path: root/runtime/lib_ksils12.h

/* lib_ksils12.h - rsyslog's KSI-LS12 support library
 *
 * Copyright 2013-2017 Adiscon GmbH and Guardtime, Inc.
 *
 * This file is part of rsyslog.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *       http://www.apache.org/licenses/LICENSE-2.0
 *       -or-
 *       see COPYING.ASL20 in the source distribution
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#ifndef INCLUDED_KSILS12_H
#define INCLUDED_KSILS12_H
#include <ksi/ksi.h>

#include "lib_ksi_queue.h"

#define MAX_ROOTS 64

/* Flags and record types for TLV handling */
#define RSGT_FLAG_NONCRIT 0x20
#define RSGT_FLAG_FORWARD 0x40
#define RSGT_TYPE_MASK 0x1f
#define RSGT_FLAG_TLV16 0x80

/* check return state of operation and abort, if non-OK */
#define CHKr(code) if((r = code) != 0) goto done

/* check the return value of a ksi api call and log a message in case of error */
#define CHECK_KSI_API(code, context, msg) if((res = code) != 0) do { \
	reportKSIAPIErr(context, NULL, msg, res); \
	goto cleanup; \
	} while (0)


typedef enum LOGSIG_SyncMode_en {
	/** The block hashes and ksi signatures in one file */
	LOGSIG_ASYNCHRONOUS = 0x00,
	/** The block hashes and ksi signatures split into separate files */
	LOGSIG_SYNCHRONOUS = 0x01
} LOGSIG_SyncMode;

enum {
	/* Signer state assigned before the signer thread is initialized. State remains
	 * until thread initialization begins. In case of system failure to create new
	 * thread state remains the same.
	 */
	SIGNER_IDLE = 0x01,

	/* Signer state assigned while signer thread initialization is in progress.
	 */
	SIGNER_INIT = 0x02,

	/* Signer state assigned when signer thread is initialized and ready to work.
	 */
	SIGNER_STARTED = 0x04,

	/* Thread state assigned when signer thread is being closed (signer thread returns).
	 */
	SIGNER_STOPPED = 0x08
};

/* Max number of roots inside the forest. This permits blocks of up to
 * 2^MAX_ROOTS records. We assume that 64 is sufficient for all use
 * cases ;) [and 64 is not really a waste of memory, so we do not even
 * try to work with reallocs and such...]
 */

typedef struct rsksictx_s *rsksictx;
typedef struct ksifile_s *ksifile;
typedef struct ksierrctx_s ksierrctx_t;


/* context for gt calls. This primarily serves as a container for the
 * config settings. The actual file-specific data is kept in ksifile.
 */
struct rsksictx_s {
	KSI_CTX *ksi_ctx;	/* libksi's context object */
	KSI_DataHasher *hasher;
	KSI_HashAlgorithm hashAlg;
	KSI_HashAlgorithm hmacAlg;
	uint8_t bKeepRecordHashes;
	uint8_t bKeepTreeHashes;
	uint64_t confInterval;
	time_t tConfRequested;
	uint64_t blockLevelLimit;
	uint32_t blockTimeLimit;
	uint32_t blockSigTimeout;
	uint32_t effectiveBlockLevelLimit; /* level limit adjusted by gateway settings */
	uint32_t threadSleepms;
	uint8_t syncMode;
	uid_t	fileUID;	/* IDs for creation */
	uid_t	dirUID;
	gid_t	fileGID;
	gid_t	dirGID;
	int fCreateMode; /* mode to use when creating files */
	int fDirCreateMode; /* mode to use when creating files */
	char* aggregatorUri;
	char* aggregatorId;
	char* aggregatorKey;
	char* aggregatorEndpoints[KSI_CTX_HA_MAX_SUBSERVICES];
	int aggregatorEndpointCount;
	char* random_source;
	pthread_mutex_t module_lock;
	pthread_t signer_thread;
	ProtectedQueue *signer_queue;
#if KSI_SDK_VER_MAJOR == 3 && KSI_SDK_VER_MINOR < 22
	size_t roundCount;	/* Count of signing requests in round. */
	uint8_t bRoundLock;		/* A lock for async. signer. */
#endif
	int signer_state;
	uint8_t disabled;	/* permits to disable the plugin --> set to 1 */

	ksifile *ksi;		/* List of signature files for keeping track of block timeouts. */
	size_t ksiCapacity;
	size_t ksiCount;

	char *debugFileName;
	int debugLevel;
	FILE *debugFile;
	uint64_t max_requests;
	void (*errFunc)(void *, unsigned char*);
	void (*logFunc)(void *, unsigned char*);
	void *usrptr; /* for error function */
};

/* this describes a file, as far as librsksi is concerned */
struct ksifile_s {
	/* the following data items are mirrored from rsksictx to
	 * increase cache hit ratio (they are frequently accesed).
	 */
	KSI_HashAlgorithm hashAlg;
	uint8_t bKeepRecordHashes;
	uint8_t bKeepTreeHashes;
	uint64_t blockSizeLimit;
	uint32_t blockTimeLimit;
	/* end mirrored properties */
	uint8_t disabled; /* permits to disable this file --> set to 1 */
	uint8_t *IV; /* initial value for blinding masks */
	unsigned char lastLeaf[KSI_MAX_IMPRINT_LEN]; /* last leaf hash (maybe of previous block)
							--> preserve on term */
	unsigned char *blockfilename;
	unsigned char *ksifilename;
	unsigned char *statefilename;
	uint64_t nRecords;  /* current number of records in current block */
	uint64_t bInBlk;    /* are we currently inside a blk --> need to finish on close */
	time_t blockStarted;
	int8_t nRoots;
	/* algo engineering: roots structure is split into two arrays
	 * in order to improve cache hits.
	 */
	KSI_DataHash *roots[MAX_ROOTS];
	/* data members for the associated TLV file */
	FILE *blockFile;
	FILE *sigFile;	/* Note that this may only be closed by signer thread or when signer thread has terminated. */
	rsksictx ctx;
};

/* the following defines the ksistate file record. Currently, this record
 * is fixed, we may change that over time.
 */
struct rsksistatefile {
	char hdr[9];	/* must be "KSISTAT10" */
	uint8_t hashID;
	uint8_t lenHash;
	/* after that, the hash value is contained within the file */
};

/* error states */
#define RSGTE_SUCCESS 0 /* Success state */
#define RSGTE_IO 1 	/* any kind of io error */
#define RSGTE_FMT 2	/* data fromat error */
#define RSGTE_INVLTYP 3	/* invalid TLV type record (unexcpected at this point) */
#define RSGTE_OOM 4	/* ran out of memory */
#define RSGTE_LEN 5	/* error related to length records */
#define RSGTE_SIG_EXTEND 6/* error extending signature */
#define RSGTE_INVLD_RECCNT 7/* mismatch between actual records and records
				given in block-sig record */
#define RSGTE_INVLHDR 8/* invalid file header */
#define RSGTE_EOF 9 	/* specific EOF */
#define RSGTE_MISS_REC_HASH 10 /* record hash missing when expected */
#define RSGTE_MISS_TREE_HASH 11 /* tree hash missing when expected */
#define RSGTE_INVLD_REC_HASH 12 /* invalid record hash (failed verification) */
#define RSGTE_INVLD_TREE_HASH 13 /* invalid tree hash (failed verification) */
#define RSGTE_INVLD_REC_HASHID 14 /* invalid record hash ID (failed verification) */
#define RSGTE_INVLD_TREE_HASHID 15 /* invalid tree hash ID (failed verification) */
#define RSGTE_MISS_BLOCKSIG 16 /* block signature record missing when expected */
#define RSGTE_INVLD_SIGNATURE 17 /* Signature is invalid (KSI_Signature_verifyDataHash)*/
#define RSGTE_TS_CREATEHASH 18 /* error creating HASH (KSI_DataHash_create) */
#define RSGTE_TS_DERENCODE 19 /* error DER-Encoding a timestamp */
#define RSGTE_HASH_CREATE 20 /* error creating a hash */
#define RSGTE_END_OF_SIG 21 /* unexpected end of signature - more log line exist */
#define RSGTE_END_OF_LOG 22 /* unexpected end of log file - more signatures exist */
#define RSGTE_EXTRACT_HASH 23 /* error extracting hashes for record */
#define RSGTE_CONFIG_ERROR 24 /* Configuration error */
#define RSGTE_NETWORK_ERROR 25 /* Network error */
#define RSGTE_MISS_KSISIG 26 /* KSI signature missing */
#define RSGTE_INTERNAL 27 /* Internal error */

#define getIVLenKSI(bh) (hashOutputLengthOctetsKSI((bh)->hashID))
#define rsksiSetBlockLevelLimit(ctx, limit) ((ctx)->blockLevelLimit = (ctx)->effectiveBlockLevelLimit = limit)
#define rsksiSetBlockTimeLimit(ctx, limit) ((ctx)->blockTimeLimit = limit)
#define rsksiSetBlockSigTimeout(ctx, val) ((ctx)->blockSigTimeout = val)
#define rsksiSetConfInterval(ctx, val) ((ctx)->confInterval = val)
#define rsksiSetKeepRecordHashes(ctx, val) ((ctx)->bKeepRecordHashes = val)
#define rsksiSetKeepTreeHashes(ctx, val) ((ctx)->bKeepTreeHashes = val)
#define rsksiSetFileFormat(ctx, val) ((ctx)->fileFormat = val)
#define rsksiSetSyncMode(ctx, val) ((ctx)->syncMode = val)
#define rsksiSetRandomSource(ctx, val) ((ctx)->random_source = strdup(val))
#define rsksiSetFileUID(ctx, val) ((ctx)->fileUID = val)	/* IDs for creation */
#define rsksiSetDirUID(ctx, val) ((ctx)->dirUID = val)
#define rsksiSetFileGID(ctx, val) ((ctx)->fileGID= val)
#define rsksiSetDirGID(ctx, val) ((ctx)->dirGID = val)
#define rsksiSetCreateMode(ctx, val) ((ctx)->fCreateMode= val)
#define rsksiSetDirCreateMode(ctx, val) ((ctx)->fDirCreateMode = val)
#define rsksiSetDebugLevel(ctx, val) ((ctx)->debugLevel = val)


int rsksiSetDebugFile(rsksictx ctx, char *val);
int rsksiSetAggregator(rsksictx ctx, char *uri, char *loginid, char *key);
int rsksiSetHashFunction(rsksictx ctx, char *algName);
int rsksiSetHmacFunction(rsksictx ctx, char *algName);
int rsksiInitModule(rsksictx ctx);
rsksictx rsksiCtxNew(void);
void rsksisetErrFunc(rsksictx ctx, void (*func)(void*, unsigned char *), void *usrptr);
void rsksisetLogFunc(rsksictx ctx, void (*func)(void*, unsigned char *), void *usrptr);
void reportKSIAPIErr(rsksictx ctx, ksifile ksi, const char *apiname, int ecode);
ksifile rsksiCtxOpenFile(rsksictx ctx, unsigned char *logfn);
int rsksifileDestruct(ksifile ksi);
void rsksiCtxDel(rsksictx ctx);
void sigblkInitKSI(ksifile ksi);
int sigblkAddRecordKSI(ksifile ksi, const unsigned char *rec, const size_t len);
int sigblkAddLeaf(ksifile ksi, const unsigned char *rec, const size_t len, bool metadata);
unsigned sigblkCalcLevel(unsigned leaves);
int sigblkFinishKSI(ksifile ksi);
int sigblkAddMetadata(ksifile ksi, const char *key, const char *value);
int sigblkCreateMask(ksifile ksi, KSI_DataHash **m);
int sigblkCreateHash(ksifile ksi, KSI_DataHash **r, const unsigned char *rec, const size_t len);
int sigblkHashTwoNodes(ksifile ksi, KSI_DataHash **node, KSI_DataHash *m, KSI_DataHash *r, uint8_t level);

#endif  /* #ifndef INCLUDED_KSILS12_H */