RTSignTool.cpp revision 26670dbc1e09e6dd974b9d55a35bb17834e8125e
/* $Id$ */
/** @file
* IPRT - Signing Tool.
*/
/*
* Copyright (C) 2006-2014 Oracle Corporation
*
* This file is part of VirtualBox Open Source Edition (OSE), as
* available from http://www.virtualbox.org. This file is free software;
* General Public License (GPL) as published by the Free Software
* Foundation, in version 2 as it comes in the "COPYING" file of the
* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
*
* The contents of this file may alternatively be used under the terms
* of the Common Development and Distribution License Version 1.0
* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
* VirtualBox OSE distribution, in which case the provisions of the
* CDDL are applicable instead of those of the GPL.
*
* You may elect to license modified versions of this file under the
* terms and conditions of either the GPL or the CDDL or both.
*/
/*******************************************************************************
* Header Files *
*******************************************************************************/
#include <iprt/buildconfig.h>
#include <iprt/initterm.h>
#ifdef VBOX
#endif
/*******************************************************************************
* Structures and Typedefs *
*******************************************************************************/
/** Help detail levels. */
typedef enum RTSIGNTOOLHELP
{
/*******************************************************************************
* Internal Functions *
*******************************************************************************/
/*
* The 'extract-exe-signer-cert' command.
*/
{
RTStrmPrintf(pStrm, "extract-exe-signer-cert [--ber|--cer|--der] [--exe|-e] <exe> [--output|-o] <outfile.cer>\n");
return RTEXITCODE_SUCCESS;
}
{
/*
* Parse arguments.
*/
static const RTGETOPTDEF s_aOptions[] =
{
};
int rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
int ch;
{
switch (ch)
{
case 'b': fCursorFlags = 0; break;
case VINF_GETOPT_NOT_OPTION:
if (!pszExe)
else if (!pszOut)
else
break;
default:
}
}
if (!pszExe)
if (!pszOut)
if (RTPathExists(pszOut))
/*
* Do it.
*/
/* Open the executable image and query the PKCS7 info. */
if (RT_FAILURE(rc))
#ifdef DEBUG
#else
#endif
{
}
if (RT_SUCCESS(rc))
{
static RTERRINFOSTATIC s_StaticErrInfo;
/*
* Decode the output.
*/
if (RT_SUCCESS(rc))
{
{
{
if (pCert)
{
/*
* Write it out.
*/
if (RT_SUCCESS(rc))
{
if (RT_SUCCESS(rc))
{
if (RT_SUCCESS(rc))
{
hFile = NIL_RTFILE;
}
else
}
else
}
else
}
else
RTMsgError("Certificate not found.");
}
else
}
else
}
else
}
else
if (RT_FAILURE(rc))
return rcExit;
}
#ifndef IPRT_IN_BUILD_TOOL
/*
* The 'verify-exe' command.
*/
{
"verify-exe [--verbose|--quiet] [--kernel] [--root <root-cert.der>] [--additional <supp-cert.der>]\n"
" [--type <win|osx>] <exe1> [exe2 [..]]\n");
return RTEXITCODE_SUCCESS;
}
typedef struct VERIFYEXESTATE
{
bool fKernel;
int cVerbose;
#ifdef VBOX
/** Certificate store load set.
* Declared outside HandleVerifyExe because of braindead gcc visibility crap. */
struct STSTORESET
{
unsigned cTAs;
};
#endif
/**
* @callback_method_impl{RTCRPKCS7VERIFYCERTCALLBACK,
* Standard code signing. Use this for Microsoft SPC.}
*/
static DECLCALLBACK(int) VerifyExecCertVerifyCallback(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths,
{
uint32_t cPaths = hCertPaths != NIL_RTCRX509CERTPATHS ? RTCrX509CertPathsGetPathCount(hCertPaths) : 0;
/*
* Dump all the paths.
*/
{
{
RTPrintf("---\n");
}
RTPrintf("---\n");
}
/*
* Test signing certificates normally doesn't have all the necessary
* features required below. So, treat them as special cases.
*/
if ( hCertPaths == NIL_RTCRX509CERTPATHS
{
RTMsgInfo("Test signed.\n");
return VINF_SUCCESS;
}
if (hCertPaths == NIL_RTCRX509CERTPATHS)
RTMsgInfo("Signed by trusted certificate.\n");
/*
* Standard code signing capabilites required.
*/
if (RT_SUCCESS(rc))
{
/*
* If kernel signing, a valid certificate path must be anchored by the
* microsoft kernel signing root certificate. The only alternative is
* test signing.
*/
{
{
bool fTrusted;
int rcVerify;
rc = RTCrX509CertPathsQueryPathInfo(hCertPaths, iPath, &fTrusted, NULL /*pcNodes*/, &pSubject, &pPublicKeyInfo,
if (RT_SUCCESS(rcVerify))
{
cValid++;
/* Search the kernel signing root store for a matching anchor. */
{
pPublicKeyInfo) == 0)
cFound++;
}
}
}
}
}
return rc;
}
/** @callback_method_impl{FNRTLDRVALIDATESIGNEDDATA} */
{
switch (enmSignature)
{
{
/*
* Dump the signed data if so requested.
*/
/*
* Do the actual verification. Will have to modify this so it takes
* the authenticode policies into account.
*/
return RTCrPkcs7VerifySignedData(pContentInfo, 0, pState->hAdditionalStore, pState->hRootStore, &ValidationTime,
}
default:
}
return VINF_SUCCESS;
}
{
/* Note! This code does not try to clean up the crypto stores on failure.
This is intentional as the code is only expected to be used in a
one-command-per-process environment where we do exit() upon
returning from this function. */
/*
* Parse arguments.
*/
static const RTGETOPTDEF s_aOptions[] =
{
};
VERIFYEXESTATE State = { NIL_RTCRSTORE, NIL_RTCRSTORE, NIL_RTCRSTORE, false, false, VERIFYEXESTATE::kSignType_Windows };
if (RT_SUCCESS(rc))
if (RT_SUCCESS(rc))
if (RT_FAILURE(rc))
rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
int ch;
{
switch (ch)
{
case 'r': case 'a':
rc = RTCrStoreCertAddFromFile(ch == 'r' ? State.hRootStore : State.hAdditionalStore, 0, ValueUnion.psz,
if (RT_FAILURE(rc))
break;
case 't':
else
break;
}
}
if (ch != VINF_GETOPT_NOT_OPTION)
/*
* Populate the certificate stores according to the signing type.
*/
#ifdef VBOX
unsigned cSets = 0;
#endif
switch (State.enmSignType)
{
case VERIFYEXESTATE::kSignType_Windows:
#ifdef VBOX
cSets++;
cSets++;
cSets++;
cSets++;
#endif
break;
case VERIFYEXESTATE::kSignType_OSX:
}
#ifdef VBOX
for (unsigned i = 0; i < cSets; i++)
{
if (RT_FAILURE(rc))
i, j, StaticErrInfo.szMsg);
}
#endif
/*
* Do it.
*/
for (;;)
{
/*
* Open the executable image and verify it.
*/
if (RT_FAILURE(rc))
return RTMsgErrorExit(RTEXITCODE_FAILURE, "Error opening executable image '%s': %Rrc", ValueUnion.psz, rc);
rc = RTLdrQueryProp(hLdrMod, RTLDRPROP_TIMESTAMP_SECONDS, &State.uTimestamp, sizeof(State.uTimestamp));
if (RT_SUCCESS(rc))
{
if (RT_SUCCESS(rc))
else
RTMsgError("RTLdrVerifySignature failed on '%s': %Rrc - %s\n", ValueUnion.psz, rc, StaticErrInfo.szMsg);
}
else
RTMsgError("RTLdrQueryProp/RTLDRPROP_TIMESTAMP_SECONDS failed on '%s': %Rrc\n", ValueUnion.psz, rc);
if (RT_FAILURE(rc2))
if (RT_FAILURE(rc))
/*
* Next file
*/
if (ch == 0)
return RTEXITCODE_SUCCESS;
if (ch != VINF_GETOPT_NOT_OPTION)
}
}
#endif /* !IPRT_IN_BUILD_TOOL */
/*
* The 'make-tainfo' command.
*/
{
"make-tainfo [--verbose|--quiet] [--cert <cert.der>] [-o|--output] <tainfo.der>\n");
return RTEXITCODE_SUCCESS;
}
typedef struct MAKETAINFOSTATE
{
int cVerbose;
const char *pszCert;
const char *pszOutput;
/** @callback_method_impl{FNRTASN1ENCODEWRITER} */
static DECLCALLBACK(int) handleMakeTaInfoWriter(const void *pvBuf, size_t cbToWrite, void *pvUser, PRTERRINFO pErrInfo)
{
}
{
/*
* Parse arguments.
*/
static const RTGETOPTDEF s_aOptions[] =
{
};
int rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
int ch;
{
switch (ch)
{
case 'c':
break;
case 'o':
case VINF_GETOPT_NOT_OPTION:
break;
}
}
/*
* Read the certificate.
*/
if (RT_FAILURE(rc))
/*
* Construct the trust anchor information.
*/
if (RT_SUCCESS(rc))
{
/* Public key. */
rc = RTCrX509SubjectPublicKeyInfo_Clone(&TrustAnchor.PubKey, &Certificate.TbsCertificate.SubjectPublicKeyInfo,
if (RT_FAILURE(rc))
RTAsn1Core_ResetImplict(RTCrX509SubjectPublicKeyInfo_GetAsn1Core(&TrustAnchor.PubKey)); /* temporary hack. */
/* Key Identifier. */
else if ( (Certificate.TbsCertificate.T3.fFlags & RTCRX509TBSCERTIFICATE_F_PRESENT_AUTHORITY_KEY_IDENTIFIER)
&& RTAsn1OctetString_IsPresent(&Certificate.TbsCertificate.T3.pAuthorityKeyIdentifier->KeyIdentifier) )
else if ( (Certificate.TbsCertificate.T3.fFlags & RTCRX509TBSCERTIFICATE_F_PRESENT_OLD_AUTHORITY_KEY_IDENTIFIER)
&& RTAsn1OctetString_IsPresent(&Certificate.TbsCertificate.T3.pOldAuthorityKeyIdentifier->KeyIdentifier) )
{
rc = RTAsn1OctetString_Clone(&TrustAnchor.KeyIdentifier, pKeyIdentifier, &g_RTAsn1DefaultAllocator);
if (RT_FAILURE(rc))
RTAsn1Core_ResetImplict(RTAsn1OctetString_GetAsn1Core(&TrustAnchor.KeyIdentifier)); /* temporary hack. */
}
else
RTMsgWarning("No key identifier found or has zero length.");
/* Subject */
if (RT_SUCCESS(rc))
{
if (RT_SUCCESS(rc))
{
if (RT_SUCCESS(rc))
{
RTAsn1Core_ResetImplict(RTCrX509Name_GetAsn1Core(&TrustAnchor.CertPath.TaName)); /* temporary hack. */
if (RT_FAILURE(rc))
}
else
}
else
}
/* Check that what we've constructed makes some sense. */
if (RT_SUCCESS(rc))
{
rc = RTCrTafTrustAnchorInfo_CheckSanity(&TrustAnchor, 0, RTErrInfoInitStatic(&StaticErrInfo), "TAI");
if (RT_FAILURE(rc))
}
if (RT_SUCCESS(rc))
{
/*
* Encode it and write it to the output file.
*/
rc = RTAsn1EncodePrepare(RTCrTafTrustAnchorInfo_GetAsn1Core(&TrustAnchor), RTASN1ENCODE_F_DER, &cbEncoded,
if (RT_SUCCESS(rc))
{
if (RT_SUCCESS(rc))
{
if (RT_SUCCESS(rc))
{
if (RT_SUCCESS(rc))
else
RTMsgError("RTStrmClose failed: %Rrc");
}
else
{
}
}
else
}
else
}
}
else
}
/*
* The 'version' command.
*/
{
return RTEXITCODE_SUCCESS;
}
{
return RTEXITCODE_SUCCESS;
}
/**
* Command mapping.
*/
static struct
{
/** The command. */
const char *pszCmd;
/**
* Handle the command.
* @returns Program exit code.
* @param cArgs Number of arguments.
* @param papszArgs The argument vector, starting with the command name.
*/
/**
* Produce help.
* @returns RTEXITCODE_SUCCESS to simplify handling '--help' in the handler.
* @param pStrm Where to send help text.
* @param enmLevel The level of the help information.
*/
}
/** Mapping commands to handler and helper functions. */
const g_aCommands[] =
{
#ifndef IPRT_IN_BUILD_TOOL
#endif
};
/*
* The 'help' command.
*/
{
return RTEXITCODE_SUCCESS;
}
{
{
{
bool fShow;
if (cArgs <= 1)
fShow = true;
else
{
if (RTStrSimplePatternMultiMatch(papszArgs[iArg], RTSTR_MAX, g_aCommands[iCmd].pszCmd, RTSTR_MAX, NULL))
{
fShow = true;
break;
}
}
if (fShow)
{
cShowed++;
}
}
}
}
{
if (RT_FAILURE(rc))
return RTMsgInitFailure(rc);
/*
* Parse global arguments.
*/
int iArg = 1;
/* none presently. */
/*
* Command dispatcher.
*/
{
while (i-- > 0)
}
else
RTMsgError("No command given. (try --help)");
return RTEXITCODE_SYNTAX;
}