| Message ID | 20240104190558.3674008-7-zohar@linux.ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Address non concurrency-safe libimaevm global variables | expand |
On 1/4/24 14:05, Mimi Zohar wrote: > Replace calling init_public_keys() with the imaevm_init_public_keys() > version. Similarly replace verify_hash() with the imaevm_verify_hash() > version. > > Update the static function verify_evm() definition to include a > "public_keys" parameter. > > Free the local public keys list. > > Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> > --- > src/evmctl.c | 20 +++++++++++++++----- > 1 file changed, 15 insertions(+), 5 deletions(-) > > diff --git a/src/evmctl.c b/src/evmctl.c > index 5d84a41a0762..29c4d1dc1f0d 100644 > --- a/src/evmctl.c > +++ b/src/evmctl.c > @@ -905,7 +905,7 @@ static int cmd_sign_evm(struct command *cmd) > return do_cmd(cmd, sign_evm_path); > } > > -static int verify_evm(const char *file) > +static int verify_evm(struct public_key_entry *public_keys, const char *file) > { > unsigned char hash[MAX_DIGEST_SIZE]; > unsigned char sig[MAX_SIGNATURE_SIZE]; > @@ -945,11 +945,13 @@ static int verify_evm(const char *file) > return mdlen; > assert(mdlen <= sizeof(hash)); > > - return verify_hash(file, hash, mdlen, sig, len); > + return imaevm_verify_hash(public_keys, file, imaevm_params.hash_algo, > + hash, mdlen, sig, len); > } > > static int cmd_verify_evm(struct command *cmd) > { > + struct public_key_entry *public_keys = NULL; > char *file = g_argv[optind++]; > int err; > > @@ -961,14 +963,22 @@ static int cmd_verify_evm(struct command *cmd) > > if (imaevm_params.x509) { > if (imaevm_params.keyfile) /* Support multiple public keys */ > - init_public_keys(imaevm_params.keyfile); > + err = imaevm_init_public_keys(imaevm_params.keyfile, > + &public_keys); > else /* assume read pubkey from x509 cert */ > - init_public_keys("/etc/keys/x509_evm.der"); > + err = imaevm_init_public_keys("/etc/keys/x509_evm.der", > + &public_keys); > + if (err < 0) { > + log_info("Failed loading public keys"); > + return err; > + } > } > > - err = verify_evm(file); > + err = verify_evm(public_keys, file); > if (!err && imaevm_params.verbose >= LOG_INFO) > log_info("%s: verification is OK\n", file); > + > + imaevm_free_public_keys(public_keys); > return err; > } >
diff --git a/src/evmctl.c b/src/evmctl.c index 5d84a41a0762..29c4d1dc1f0d 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -905,7 +905,7 @@ static int cmd_sign_evm(struct command *cmd) return do_cmd(cmd, sign_evm_path); } -static int verify_evm(const char *file) +static int verify_evm(struct public_key_entry *public_keys, const char *file) { unsigned char hash[MAX_DIGEST_SIZE]; unsigned char sig[MAX_SIGNATURE_SIZE]; @@ -945,11 +945,13 @@ static int verify_evm(const char *file) return mdlen; assert(mdlen <= sizeof(hash)); - return verify_hash(file, hash, mdlen, sig, len); + return imaevm_verify_hash(public_keys, file, imaevm_params.hash_algo, + hash, mdlen, sig, len); } static int cmd_verify_evm(struct command *cmd) { + struct public_key_entry *public_keys = NULL; char *file = g_argv[optind++]; int err; @@ -961,14 +963,22 @@ static int cmd_verify_evm(struct command *cmd) if (imaevm_params.x509) { if (imaevm_params.keyfile) /* Support multiple public keys */ - init_public_keys(imaevm_params.keyfile); + err = imaevm_init_public_keys(imaevm_params.keyfile, + &public_keys); else /* assume read pubkey from x509 cert */ - init_public_keys("/etc/keys/x509_evm.der"); + err = imaevm_init_public_keys("/etc/keys/x509_evm.der", + &public_keys); + if (err < 0) { + log_info("Failed loading public keys"); + return err; + } } - err = verify_evm(file); + err = verify_evm(public_keys, file); if (!err && imaevm_params.verbose >= LOG_INFO) log_info("%s: verification is OK\n", file); + + imaevm_free_public_keys(public_keys); return err; }
Replace calling init_public_keys() with the imaevm_init_public_keys() version. Similarly replace verify_hash() with the imaevm_verify_hash() version. Update the static function verify_evm() definition to include a "public_keys" parameter. Free the local public keys list. Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> --- src/evmctl.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)