13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/* $Id$ */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** @file
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * IPRT - Crypto - Microsoft SPC / Authenticode, Sanity Checkers.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/*
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Copyright (C) 2006-2014 Oracle Corporation
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync *
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * This file is part of VirtualBox Open Source Edition (OSE), as
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * available from http://www.virtualbox.org. This file is free software;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * you can redistribute it and/or modify it under the terms of the GNU
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * General Public License (GPL) as published by the Free Software
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Foundation, in version 2 as it comes in the "COPYING" file of the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync *
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * The contents of this file may alternatively be used under the terms
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * of the Common Development and Distribution License Version 1.0
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * VirtualBox OSE distribution, in which case the provisions of the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * CDDL are applicable instead of those of the GPL.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync *
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * You may elect to license modified versions of this file under the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * terms and conditions of either the GPL or the CDDL or both.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/*******************************************************************************
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync* Header Files *
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync*******************************************************************************/
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include "internal/iprt.h"
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include <iprt/crypto/spc.h>
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include <iprt/assert.h>
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include <iprt/err.h>
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include <iprt/uuid.h>
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include "spc-internal.h"
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsyncRTDECL(int) RTCrSpcIndirectDataContent_CheckSanityEx(PCRTCRSPCINDIRECTDATACONTENT pIndData,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync PCRTCRPKCS7SIGNEDDATA pSignedData,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync uint32_t fFlags,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync PRTERRINFO pErrInfo)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync{
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /*
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Match up the digest algorithms (page 8, v1.0).
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (pSignedData->SignerInfos.cItems != 1)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_NOT_EXACTLY_ONE_SIGNER_INFOS,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent expects SignedData to have exactly one SignerInfos entries, found: %u",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pSignedData->SignerInfos.cItems);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (pSignedData->DigestAlgorithms.cItems != 1)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_NOT_EXACTLY_ONE_DIGEST_ALGO,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent expects SignedData to have exactly one DigestAlgorithms entries, found: %u",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pSignedData->DigestAlgorithms.cItems);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (RTCrX509AlgorithmIdentifier_Compare(&pIndData->DigestInfo.DigestAlgorithm, /** @todo not entirely sure about this check... */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync &pSignedData->SignerInfos.paItems[0].DigestAlgorithm) != 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_SIGNED_IND_DATA_DIGEST_ALGO_MISMATCH,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent DigestInfo and SignerInfos algorithms mismatch: %s vs %s",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pIndData->DigestInfo.DigestAlgorithm.Algorithm.szObjId,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pSignedData->SignerInfos.paItems[0].DigestAlgorithm.Algorithm.szObjId);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (RTCrX509AlgorithmIdentifier_Compare(&pIndData->DigestInfo.DigestAlgorithm,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync &pSignedData->DigestAlgorithms.paItems[0]) != 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_IND_DATA_DIGEST_ALGO_NOT_IN_DIGEST_ALGOS,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent DigestInfo and SignedData.DigestAlgorithms[0] mismatch: %s vs %s",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pIndData->DigestInfo.DigestAlgorithm.Algorithm.szObjId,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pSignedData->DigestAlgorithms.paItems[0].Algorithm.szObjId);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (fFlags & RTCRSPCINDIRECTDATACONTENT_SANITY_F_ONLY_KNOWN_HASH)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (RTCrX509AlgorithmIdentifier_QueryDigestType(&pIndData->DigestInfo.DigestAlgorithm) == RTDIGESTTYPE_INVALID)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_UNKNOWN_DIGEST_ALGO,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent DigestAlgortihm is not known: %s",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pIndData->DigestInfo.DigestAlgorithm.Algorithm.szObjId);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync }
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync uint32_t cbDigest = RTCrX509AlgorithmIdentifier_QueryDigestSize(&pIndData->DigestInfo.DigestAlgorithm);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if ( pIndData->DigestInfo.Digest.Asn1Core.cb != cbDigest
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync && (cbDigest != UINT32_MAX || (fFlags & RTCRSPCINDIRECTDATACONTENT_SANITY_F_ONLY_KNOWN_HASH)))
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_IND_DATA_DIGEST_SIZE_MISMATCH,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent Digest size mismatch with algorithm: %u, expected %u (%s)",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pIndData->DigestInfo.Digest.Asn1Core.cb, cbDigest,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pIndData->DigestInfo.DigestAlgorithm.Algorithm.szObjId);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /*
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Data.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (fFlags & RTCRSPCINDIRECTDATACONTENT_SANITY_F_PE_IMAGE)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if ( pIndData->Data.enmType != RTCRSPCAAOVTYPE_PE_IMAGE_DATA
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync || RTAsn1ObjId_CompareWithString(&pIndData->Data.Type, RTCRSPCPEIMAGEDATA_OID) != 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_EXPECTED_PE_IMAGE_DATA,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent.Data.Type is %s, expected %s (SpcPeImageData) [enmType=%d]",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pIndData->Data.Type.szObjId, RTCRSPCPEIMAGEDATA_OID, pIndData->Data.enmType);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if ( pIndData->Data.uValue.pPeImage
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync || !RTCrSpcPeImageData_IsPresent(pIndData->Data.uValue.pPeImage) )
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSet(pErrInfo, VERR_CR_SPC_PEIMAGE_DATA_NOT_PRESENT,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent.Data.uValue/PEImage is missing");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if ( pIndData->Data.uValue.pPeImage->T0.File.enmChoice == RTCRSPCLINKCHOICE_MONIKER
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync && RTCrSpcSerializedObject_IsPresent(pIndData->Data.uValue.pPeImage->T0.File.u.pMoniker) )
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync PCRTCRSPCSERIALIZEDOBJECT pObj = pIndData->Data.uValue.pPeImage->T0.File.u.pMoniker;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (pObj->Uuid.Asn1Core.cb != sizeof(RTUUID))
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_BAD_MONIKER_UUID,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent...MonikerT1.Uuid incorrect size: %u, expected %u.",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pObj->Uuid.Asn1Core.cb, sizeof(RTUUID));
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (RTUuidCompareStr(pObj->Uuid.Asn1Core.uData.pUuid, RTCRSPCSERIALIZEDOBJECT_UUID_STR) != 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_UNKNOWN_MONIKER_UUID,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent...MonikerT1.Uuid mismatch: %RTuuid, expected %s.",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pObj->Uuid.Asn1Core.uData.pUuid, RTCRSPCSERIALIZEDOBJECT_UUID_STR);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (pObj->enmType != RTCRSPCSERIALIZEDOBJECTTYPE_ATTRIBUTES)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_BAD_MONIKER_CHOICE,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent...pMoniker->enmType=%d, expected %d.",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pObj->enmType, RTCRSPCSERIALIZEDOBJECTTYPE_ATTRIBUTES);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (!pObj->u.pData)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSet(pErrInfo, VERR_CR_SPC_MONIKER_BAD_DATA,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent...pMoniker->pData is NULL.");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
72ae3c29eeae4b10f2b363d6fd090cf1e9bdd145vboxsync uint32_t cPageHashTabs = 0;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync for (uint32_t i = 0; i < pObj->u.pData->cItems; i++)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync PCRTCRSPCSERIALIZEDOBJECTATTRIBUTE pAttr = &pObj->u.pData->paItems[i];
72ae3c29eeae4b10f2b363d6fd090cf1e9bdd145vboxsync if ( RTAsn1ObjId_CompareWithString(&pAttr->Type, RTCRSPC_PE_IMAGE_HASHES_V1_OID) == 0
72ae3c29eeae4b10f2b363d6fd090cf1e9bdd145vboxsync || RTAsn1ObjId_CompareWithString(&pAttr->Type, RTCRSPC_PE_IMAGE_HASHES_V2_OID) == 0 )
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
72ae3c29eeae4b10f2b363d6fd090cf1e9bdd145vboxsync cPageHashTabs++;
72ae3c29eeae4b10f2b363d6fd090cf1e9bdd145vboxsync AssertPtr(pAttr->u.pPageHashes->pData);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync }
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync else
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_PEIMAGE_UNKNOWN_ATTRIBUTE,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent...MonikerT1 unknown attribute %u: %s.",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync i, pAttr->Type.szObjId);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync }
72ae3c29eeae4b10f2b363d6fd090cf1e9bdd145vboxsync if (cPageHashTabs > 0)
72ae3c29eeae4b10f2b363d6fd090cf1e9bdd145vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_PEIMAGE_MULTIPLE_HASH_TABS,
72ae3c29eeae4b10f2b363d6fd090cf1e9bdd145vboxsync "SpcIndirectDataContent...MonikerT1 multiple page hash attributes (%u).", cPageHashTabs);
72ae3c29eeae4b10f2b363d6fd090cf1e9bdd145vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync }
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync else if ( pIndData->Data.uValue.pPeImage->T0.File.enmChoice == RTCRSPCLINKCHOICE_FILE
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync && RTCrSpcString_IsPresent(&pIndData->Data.uValue.pPeImage->T0.File.u.pT2->File) )
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /* Could check for "<<<Obsolete>>>" here, but it's really irrelevant. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync }
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync else if ( pIndData->Data.uValue.pPeImage->T0.File.enmChoice == RTCRSPCLINKCHOICE_URL
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync && RTAsn1String_IsPresent(pIndData->Data.uValue.pPeImage->T0.File.u.pUrl) )
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSet(pErrInfo, VERR_CR_SPC_PEIMAGE_URL_UNEXPECTED,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent.Data.uValue.pPeImage->File is an URL, expected object Moniker or File.");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync else
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSet(pErrInfo, VERR_CR_SPC_PEIMAGE_NO_CONTENT,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SpcIndirectDataContent.Data.uValue.pPeImage->File has no content");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync }
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return VINF_SUCCESS;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync}
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/*
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Generate the standard core code.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include <iprt/asn1-generator-sanity.h>
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync