sync SignatureValidator, pkcs12 with private

[model]
[binary_type]
[customer]
[issue#]
[problem]
[cause]
[solution]
[team]
[request]
[horizontal_expansion]

Change-Id: Idda961a999a78ed831c2dde8a30187de2f396d7d
Signed-off-by: jc815.lee <jc815.lee@samsung.com>

diff --git a/vcore/src/vcore/SignatureValidator.cpp b/vcore/src/vcore/SignatureValidator.cpp
old mode 100644 (file)
new mode 100755 (executable)
index 5a80021..dafd53e
--- a/vcore/src/vcore/SignatureValidator.cpp
+++ b/vcore/src/vcore/SignatureValidator.cpp
@@ -39,6 +39,9 @@ const std::string TOKEN_ROLE_DISTRIBUTOR_URI =
     "http://www.w3.org/ns/widgets-digsig#role-distributor";
 const std::string TOKEN_PROFILE_URI =
     "http://www.w3.org/ns/widgets-digsig#profile";
+
+const char* TIZEN_STORE_CN = "Tizen Store";
+
 } // namespace anonymouse
 
 namespace ValidationCore {
@@ -47,7 +50,8 @@ class SignatureValidator::ImplSignatureValidator {
 public:
     virtual SignatureValidator::Result check(
         SignatureData &data,
-        const std::string &widgetContentPath) = 0;
+        const std::string &widgetContentPath,
+        AppInstallPath appInstallPath = TIZEN_STORE) = 0;
 
     virtual SignatureValidator::Result checkList(
         SignatureData &data,
@@ -119,7 +123,8 @@ class ImplTizenSignatureValidator : public SignatureValidator::ImplSignatureVali
 {
   public:
     SignatureValidator::Result check(SignatureData &data,
-            const std::string &widgetContentPath);
+            const std::string &widgetContentPath,
+            SignatureValidator::AppInstallPath appInstallPath = SignatureValidator::TIZEN_STORE);
 
     SignatureValidator::Result checkList(SignatureData &data,
             const std::string &widgetContentPath,
@@ -137,7 +142,8 @@ class ImplTizenSignatureValidator : public SignatureValidator::ImplSignatureVali
 
 SignatureValidator::Result ImplTizenSignatureValidator::check(
         SignatureData &data,
-        const std::string &widgetContentPath)
+        const std::string &widgetContentPath,
+        SignatureValidator::AppInstallPath appInstallPath)
 {
     bool disregard = false;
 
@@ -227,6 +233,35 @@ SignatureValidator::Result ImplTizenSignatureValidator::check(
     data.setStorageType(storeIdSet);
     data.setSortedCertificateList(sortedCertificateList);
 
+    if (data.getSignatureNumber() == 1 && appInstallPath != SignatureValidator::TIZEN_STORE)
+    {
+       CertificatePtr endCert = data.getEndEntityCertificatePtr();
+       DPL::String subjectD = endCert->getOneLine(Certificate::FIELD_SUBJECT);
+       std::string subject = DPL::ToUTF8String(subjectD);
+       LogDebug("endCert subject : " << subject);
+
+       char* subString = (char*)subject.c_str();
+       char* findCN = NULL;
+       findCN = strstr(subString, "/CN=");
+       if(findCN == NULL)
+       {
+           LogDebug("### Signature is invalid. CN does not exist.");
+           fprintf(stderr, "### Signature is invalid. CN does not exist.\n");
+           return SignatureValidator::SIGNATURE_INVALID;
+        }
+
+       findCN += strlen("/CN=");
+       int cmp = -1;
+      cmp = strncmp(findCN, TIZEN_STORE_CN, strlen(TIZEN_STORE_CN));
+
+      if(cmp == 0)
+      {
+        LogDebug("### Signature is invalid. End Issure is Tizen Store.");
+        fprintf(stderr, "### Signature is invalid. End Issure is Tizen Store.\n");
+        return SignatureValidator::SIGNATURE_INVALID;
+      }
+     }
+
     // We add only Root CA certificate because WAC ensure that the rest
     // of certificates are present in signature files ;-)
     XmlSec::XmlSecContext context;
@@ -572,7 +607,8 @@ class ImplWacSignatureValidator : public SignatureValidator::ImplSignatureValida
 {
   public:
     SignatureValidator::Result check(SignatureData &data,
-            const std::string &widgetContentPath);
+            const std::string &widgetContentPath,
+            SignatureValidator::AppInstallPath appInstallPath);
 
     SignatureValidator::Result checkList(SignatureData &data,
             const std::string &widgetContentPath,
@@ -601,7 +637,8 @@ SignatureValidator::Result ImplWacSignatureValidator::checkList(
 
 SignatureValidator::Result ImplWacSignatureValidator::check(
     SignatureData &data,
-    const std::string &widgetContentPath)
+    const std::string &widgetContentPath,
+    SignatureValidator::AppInstallPath appInstallPath)
 {
     bool disregard = false;
 
@@ -823,9 +860,10 @@ SignatureValidator::~SignatureValidator() {
 
 SignatureValidator::Result SignatureValidator::check(
     SignatureData &data,
-    const std::string &widgetContentPath)
+    const std::string &widgetContentPath,
+    AppInstallPath appInstallPath)
 {
-    return m_impl->check(data, widgetContentPath);
+    return m_impl->check(data, widgetContentPath, appInstallPath);
 }
 
 SignatureValidator::Result SignatureValidator::checkList(

diff --git a/vcore/src/vcore/SignatureValidator.h b/vcore/src/vcore/SignatureValidator.h
old mode 100644 (file)
new mode 100755 (executable)
index 931de76..05d62ef
--- a/vcore/src/vcore/SignatureValidator.h
+++ b/vcore/src/vcore/SignatureValidator.h
@@ -49,6 +49,12 @@ public:
         SIGNATURE_REVOKED
     };
 
+    enum AppInstallPath
+    {
+        TIZEN_STORE,
+        OTHER_PATH
+    };
+
     explicit SignatureValidator(
         AppType appType,
         bool ocspEnable,
@@ -59,7 +65,8 @@ public:
 
     Result check(
         SignatureData &data,
-        const std::string &widgetContentPath);
+        const std::string &widgetContentPath,
+        AppInstallPath appInstallPath = TIZEN_STORE);
 
     Result checkList(
         SignatureData &data,

diff --git a/vcore/src/vcore/pkcs12.c b/vcore/src/vcore/pkcs12.c
index ef95212..15823c9 100755 (executable)
--- a/vcore/src/vcore/pkcs12.c
+++ b/vcore/src/vcore/pkcs12.c
@@ -20,6 +20,7 @@
  * @brief       PKCS#12 container manipulation routines.
  */
 #define _GNU_SOURCE
+#define  _CERT_SVC_VERIFY_PKCS12
 
 #include "pkcs12.h"
 #include <cert-svc/cerror.h>
@@ -47,7 +48,7 @@
 static const char  CERTSVC_PKCS12_STORAGE_KEY_PKEY[]  = "pkey";
 static const char  CERTSVC_PKCS12_STORAGE_KEY_CERTS[] = "certs";
 static const gchar CERTSVC_PKCS12_STORAGE_SEPARATOR  = ';';
-static const char* CERTSVC_PKCS12_UNIX_GROUP = NULL;
+static const char  CERTSVC_PKCS12_UNIX_GROUP[] = "secure-storage::pkcs12";
 
 static gboolean keyfile_check(const char *pathname) {
   int result;
@@ -216,10 +217,216 @@ int c_certsvc_pkcs12_import(const char *path, const char *password, const gchar
   }
   result = PKCS12_parse(container, password, &key, &cert, &certv);
   PKCS12_free(container);
-  if(result == 0) {
-    result = CERTSVC_FAIL;
-    goto free_keyfile;
-  }
+       if (result == 0)
+       {
+               result = CERTSVC_FAIL;
+               goto free_keyfile;
+       }
+
+#define _CERT_SVC_VERIFY_PKCS12
+#ifdef _CERT_SVC_VERIFY_PKCS12
+
+       if (certv == NULL)
+       {
+               char* pSubject = NULL;
+               char* pIssuerName = NULL;
+               int isSelfSigned = 0;
+
+               pSubject = X509_NAME_oneline(cert->cert_info->subject, NULL, 0);
+               if (!pSubject)
+               {
+                       LOGD("Failed to get subject name");
+                       result = CERTSVC_FAIL;
+                       goto free_keyfile;
+               }
+
+               pIssuerName = X509_NAME_oneline(cert->cert_info->issuer, NULL, 0);
+               if (!pIssuerName)
+               {
+                       LOGD("Failed to get issuer name");
+                       free(pSubject);
+                       result = CERTSVC_FAIL;
+                       goto free_keyfile;
+               }
+
+               if (strcmp((const char*)pSubject, (const char*)pIssuerName) == 0)
+               {
+                       //self signed..
+                       isSelfSigned = 1;
+
+                       EVP_PKEY* pKey = X509_get_pubkey(cert);
+                       if (!pKey)
+                       {
+                               LOGD("Failed to get public key");
+                               result = CERTSVC_FAIL;
+                               free(pSubject);
+                               free(pIssuerName);
+                               goto free_keyfile;
+                       }
+
+                       if (X509_verify(cert, pKey) <= 0)
+                       {
+                               LOGD("P12 verification failed");
+                               result = CERTSVC_FAIL;
+                               EVP_PKEY_free(pKey);
+                               free(pSubject);
+                               free(pIssuerName);
+                               goto free_keyfile;
+                       }
+                       LOGD("P12 verification Success");
+                       EVP_PKEY_free(pKey);
+               }
+               else
+               {
+                       isSelfSigned = 0;
+                       int res = 0;
+                       X509_STORE_CTX *cert_ctx = NULL;
+                       X509_STORE *cert_store = NULL;
+
+                       cert_store = X509_STORE_new();
+                       if (!cert_store)
+                       {
+                               LOGD("Memory allocation failed");
+                               free(pSubject);
+                               free(pIssuerName);
+                               result = CERTSVC_FAIL;
+                               goto free_keyfile;
+                       }
+
+                       res = X509_STORE_load_locations(cert_store, NULL, "/opt/etc/ssl/certs/");
+                       if (res != 1)
+                       {
+                               LOGD("P12 load certificate store failed");
+                               free(pSubject);
+                               free(pIssuerName);
+                               X509_STORE_free(cert_store);
+                               result = CERTSVC_FAIL;
+                               goto free_keyfile;
+                       }
+
+                       res = X509_STORE_set_default_paths(cert_store);
+                       if (res != 1)
+                       {
+                               LOGD("P12 load certificate store path failed");
+                               free(pSubject);
+                               free(pIssuerName);
+                               X509_STORE_free(cert_store);
+                               result = CERTSVC_FAIL;
+                               goto free_keyfile;
+                       }
+
+                       // initialize store and store context
+                       cert_ctx = X509_STORE_CTX_new();
+                       if (cert_ctx == NULL)
+                       {
+                               LOGD("Memory allocation failed");
+                               free(pSubject);
+                               free(pIssuerName);
+                               X509_STORE_free(cert_store);
+                               result = CERTSVC_FAIL;
+                               goto free_keyfile;
+                       }
+
+                       // construct store context
+                       if (!X509_STORE_CTX_init(cert_ctx, cert_store, cert, NULL))
+                       {
+                               LOGD("Memory allocation failed");
+                               free(pSubject);
+                               free(pIssuerName);
+                               X509_STORE_free(cert_store);
+                               X509_STORE_CTX_free(cert_ctx);
+                               result = CERTSVC_FAIL;
+                               goto free_keyfile;
+                       }
+
+                       res = X509_verify_cert(cert_ctx);
+                       if (res != 1)
+                       {
+                               LOGD("P12 verification failed");
+                               free(pSubject);
+                               free(pIssuerName);
+                               X509_STORE_free(cert_store);
+                               X509_STORE_CTX_free(cert_ctx);
+                               result = CERTSVC_FAIL;
+                               goto free_keyfile;
+                       }
+                       X509_STORE_free(cert_store);
+                       X509_STORE_CTX_free(cert_ctx);
+                       LOGD("P12 verification Success");
+               }
+               free(pSubject);
+               free(pIssuerName);
+       }
+       else if (certv != NULL)
+       {
+               // Cert Chain
+               int res = 0;
+               X509_STORE_CTX *cert_ctx = NULL;
+               X509_STORE *cert_store = NULL;
+
+               cert_store = X509_STORE_new();
+               if (!cert_store)
+               {
+                       LOGD("Memory allocation failed");
+                       result = CERTSVC_FAIL;
+                       goto free_keyfile;
+               }
+
+               res = X509_STORE_load_locations(cert_store, NULL, "/opt/share/cert-svc/certs/ssl/");
+               if (res != 1)
+               {
+                       LOGD("P12 load certificate store failed");
+                       result = CERTSVC_FAIL;
+                       X509_STORE_free(cert_store);
+                       goto free_keyfile;
+               }
+
+               res = X509_STORE_set_default_paths(cert_store);
+               if (res != 1)
+               {
+                       LOGD("P12 load certificate path failed");
+                       result = CERTSVC_FAIL;
+                       X509_STORE_free(cert_store);
+                       goto free_keyfile;
+               }
+
+               // initialize store and store context
+               cert_ctx = X509_STORE_CTX_new();
+               if (cert_ctx == NULL)
+               {
+                       LOGD("Memory allocation failed");
+                       result = CERTSVC_FAIL;
+                       X509_STORE_free(cert_store);
+                       goto free_keyfile;
+               }
+
+               // construct store context
+               if (!X509_STORE_CTX_init(cert_ctx, cert_store, cert, NULL))
+               {
+                       LOGD("Memory allocation failed");
+                       result = CERTSVC_FAIL;
+                       X509_STORE_free(cert_store);
+                       X509_STORE_CTX_free(cert_ctx);
+                       goto free_keyfile;
+               }
+
+               X509_STORE_CTX_trusted_stack(cert_ctx, certv);
+
+               res = X509_verify_cert(cert_ctx);
+               if (res != 1)
+               {
+                       LOGD("P12 verification failed");
+                       result = CERTSVC_FAIL;
+                       X509_STORE_free(cert_store);
+                       X509_STORE_CTX_free(cert_ctx);
+                       goto free_keyfile;
+               }
+
+               LOGD("P12 verification Success");
+               X509_STORE_free(cert_store);
+               X509_STORE_CTX_free(cert_ctx);
+       }
+#endif //_CERT_SVC_VERIFY_PKCS12
   nicerts = certv ? sk_X509_num(certv) : 0;
   cvaluev = (gchar **)calloc(1 + nicerts, sizeof(gchar *));
   n = 0;