VirtualBox

source: vbox/trunk/src/VBox/Runtime/tools/RTSignTool.cpp@ 59675

Last change on this file since 59675 was 57572, checked in by vboxsync, 9 years ago

IPRT: Started on accessing system certificate stores to get SSL roots for cURL.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 35.9 KB
Line 
1/* $Id: RTSignTool.cpp 57572 2015-08-28 01:31:29Z vboxsync $ */
2/** @file
3 * IPRT - Signing Tool.
4 */
5
6/*
7 * Copyright (C) 2006-2015 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 */
26
27
28/*******************************************************************************
29* Header Files *
30*******************************************************************************/
31#include <iprt/assert.h>
32#include <iprt/buildconfig.h>
33#include <iprt/err.h>
34#include <iprt/getopt.h>
35#include <iprt/file.h>
36#include <iprt/initterm.h>
37#include <iprt/ldr.h>
38#include <iprt/message.h>
39#include <iprt/mem.h>
40#include <iprt/path.h>
41#include <iprt/stream.h>
42#include <iprt/string.h>
43#include <iprt/crypto/x509.h>
44#include <iprt/crypto/pkcs7.h>
45#include <iprt/crypto/store.h>
46#ifdef VBOX
47# include <VBox/sup.h> /* Certificates */
48#endif
49
50
51/*******************************************************************************
52* Structures and Typedefs *
53*******************************************************************************/
54/** Help detail levels. */
55typedef enum RTSIGNTOOLHELP
56{
57 RTSIGNTOOLHELP_USAGE,
58 RTSIGNTOOLHELP_FULL
59} RTSIGNTOOLHELP;
60
61
62/*******************************************************************************
63* Internal Functions *
64*******************************************************************************/
65static RTEXITCODE HandleHelp(int cArgs, char **papszArgs);
66static RTEXITCODE HelpHelp(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel);
67static RTEXITCODE HandleVersion(int cArgs, char **papszArgs);
68
69
70
71
72/*
73 * The 'extract-exe-signer-cert' command.
74 */
75static RTEXITCODE HelpExtractExeSignerCert(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
76{
77 RTStrmPrintf(pStrm, "extract-exe-signer-cert [--ber|--cer|--der] [--exe|-e] <exe> [--output|-o] <outfile.cer>\n");
78 return RTEXITCODE_SUCCESS;
79}
80
81static RTEXITCODE HandleExtractExeSignerCert(int cArgs, char **papszArgs)
82{
83 /*
84 * Parse arguments.
85 */
86 static const RTGETOPTDEF s_aOptions[] =
87 {
88 { "--ber", 'b', RTGETOPT_REQ_NOTHING },
89 { "--cer", 'c', RTGETOPT_REQ_NOTHING },
90 { "--der", 'd', RTGETOPT_REQ_NOTHING },
91 { "--exe", 'e', RTGETOPT_REQ_STRING },
92 { "--output", 'o', RTGETOPT_REQ_STRING },
93 };
94
95 const char *pszExe = NULL;
96 const char *pszOut = NULL;
97 RTLDRARCH enmLdrArch = RTLDRARCH_WHATEVER;
98 uint32_t fCursorFlags = RTASN1CURSOR_FLAGS_DER;
99
100 RTGETOPTSTATE GetState;
101 int rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
102 AssertRCReturn(rc, RTEXITCODE_FAILURE);
103 RTGETOPTUNION ValueUnion;
104 int ch;
105 while ((ch = RTGetOpt(&GetState, &ValueUnion)))
106 {
107 switch (ch)
108 {
109 case 'e': pszExe = ValueUnion.psz; break;
110 case 'o': pszOut = ValueUnion.psz; break;
111 case 'b': fCursorFlags = 0; break;
112 case 'c': fCursorFlags = RTASN1CURSOR_FLAGS_CER; break;
113 case 'd': fCursorFlags = RTASN1CURSOR_FLAGS_DER; break;
114 case 'V': return HandleVersion(cArgs, papszArgs);
115 case 'h': return HelpExtractExeSignerCert(g_pStdOut, RTSIGNTOOLHELP_FULL);
116
117 case VINF_GETOPT_NOT_OPTION:
118 if (!pszExe)
119 pszExe = ValueUnion.psz;
120 else if (!pszOut)
121 pszOut = ValueUnion.psz;
122 else
123 return RTMsgErrorExit(RTEXITCODE_FAILURE, "Too many file arguments: %s", ValueUnion.psz);
124 break;
125
126 default:
127 return RTGetOptPrintError(ch, &ValueUnion);
128 }
129 }
130 if (!pszExe)
131 return RTMsgErrorExit(RTEXITCODE_FAILURE, "No executable given.");
132 if (!pszOut)
133 return RTMsgErrorExit(RTEXITCODE_FAILURE, "No output file given.");
134 if (RTPathExists(pszOut))
135 return RTMsgErrorExit(RTEXITCODE_FAILURE, "The output file '%s' exists.", pszOut);
136
137 /*
138 * Do it.
139 */
140
141 /* Open the executable image and query the PKCS7 info. */
142 RTLDRMOD hLdrMod;
143 rc = RTLdrOpen(pszExe, RTLDR_O_FOR_VALIDATION, enmLdrArch, &hLdrMod);
144 if (RT_FAILURE(rc))
145 return RTMsgErrorExit(RTEXITCODE_FAILURE, "Error opening executable image '%s': %Rrc", pszExe, rc);
146
147 RTEXITCODE rcExit = RTEXITCODE_FAILURE;
148#ifdef DEBUG
149 size_t cbBuf = 64;
150#else
151 size_t cbBuf = _512K;
152#endif
153 void *pvBuf = RTMemAlloc(cbBuf);
154 size_t cbRet = 0;
155 rc = RTLdrQueryPropEx(hLdrMod, RTLDRPROP_PKCS7_SIGNED_DATA, NULL /*pvBits*/, pvBuf, cbBuf, &cbRet);
156 if (rc == VERR_BUFFER_OVERFLOW && cbRet < _4M && cbRet > 0)
157 {
158 RTMemFree(pvBuf);
159 cbBuf = cbRet;
160 pvBuf = RTMemAlloc(cbBuf);
161 rc = RTLdrQueryPropEx(hLdrMod, RTLDRPROP_PKCS7_SIGNED_DATA, NULL /*pvBits*/, pvBuf, cbBuf, &cbRet);
162 }
163 if (RT_SUCCESS(rc))
164 {
165 static RTERRINFOSTATIC s_StaticErrInfo;
166 RTErrInfoInitStatic(&s_StaticErrInfo);
167
168 /*
169 * Decode the output.
170 */
171 RTASN1CURSORPRIMARY PrimaryCursor;
172 RTAsn1CursorInitPrimary(&PrimaryCursor, pvBuf, (uint32_t)cbRet, &s_StaticErrInfo.Core,
173 &g_RTAsn1DefaultAllocator, fCursorFlags, "exe");
174 RTCRPKCS7CONTENTINFO Pkcs7Ci;
175 rc = RTCrPkcs7ContentInfo_DecodeAsn1(&PrimaryCursor.Cursor, 0, &Pkcs7Ci, "pkcs7");
176 if (RT_SUCCESS(rc))
177 {
178 if (RTCrPkcs7ContentInfo_IsSignedData(&Pkcs7Ci))
179 {
180 PCRTCRPKCS7SIGNEDDATA pSd = Pkcs7Ci.u.pSignedData;
181 if (pSd->SignerInfos.cItems == 1)
182 {
183 PCRTCRPKCS7ISSUERANDSERIALNUMBER pISN = &pSd->SignerInfos.paItems[0].IssuerAndSerialNumber;
184 PCRTCRX509CERTIFICATE pCert;
185 pCert = RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(&pSd->Certificates,
186 &pISN->Name, &pISN->SerialNumber);
187 if (pCert)
188 {
189 /*
190 * Write it out.
191 */
192 RTFILE hFile;
193 rc = RTFileOpen(&hFile, pszOut, RTFILE_O_WRITE | RTFILE_O_DENY_WRITE | RTFILE_O_CREATE);
194 if (RT_SUCCESS(rc))
195 {
196 uint32_t cbCert = pCert->SeqCore.Asn1Core.cbHdr + pCert->SeqCore.Asn1Core.cb;
197 rc = RTFileWrite(hFile, pCert->SeqCore.Asn1Core.uData.pu8 - pCert->SeqCore.Asn1Core.cbHdr,
198 cbCert, NULL);
199 if (RT_SUCCESS(rc))
200 {
201 rc = RTFileClose(hFile);
202 if (RT_SUCCESS(rc))
203 {
204 hFile = NIL_RTFILE;
205 rcExit = RTEXITCODE_SUCCESS;
206 RTMsgInfo("Successfully wrote %u bytes to '%s'", cbCert, pszOut);
207 }
208 else
209 RTMsgError("RTFileClose failed: %Rrc", rc);
210 }
211 else
212 RTMsgError("RTFileWrite failed: %Rrc", rc);
213 RTFileClose(hFile);
214 }
215 else
216 RTMsgError("Error opening '%s': %Rrc", pszOut, rc);
217 }
218 else
219 RTMsgError("Certificate not found.");
220 }
221 else
222 RTMsgError("SignerInfo count: %u", pSd->SignerInfos.cItems);
223 }
224 else
225 RTMsgError("No PKCS7 content: ContentType=%s", Pkcs7Ci.ContentType.szObjId);
226 RTAsn1VtDelete(&Pkcs7Ci.SeqCore.Asn1Core);
227 }
228 else
229 RTMsgError("RTPkcs7ContentInfoDecodeAsn1 failed: %Rrc - %s", rc, s_StaticErrInfo.szMsg);
230 }
231 else
232 RTMsgError("RTLDRPROP_PKCS7_SIGNED_DATA failed on '%s': %Rrc", pszExe, rc);
233 RTMemFree(pvBuf);
234 rc = RTLdrClose(hLdrMod);
235 if (RT_FAILURE(rc))
236 rcExit = RTMsgErrorExit(RTEXITCODE_FAILURE, "RTLdrClose failed: %Rrc\n", rc);
237 return rcExit;
238}
239
240#ifndef IPRT_IN_BUILD_TOOL
241
242/*
243 * The 'verify-exe' command.
244 */
245static RTEXITCODE HelpVerifyExe(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
246{
247 RTStrmPrintf(pStrm,
248 "verify-exe [--verbose|--quiet] [--kernel] [--root <root-cert.der>] [--additional <supp-cert.der>]\n"
249 " [--type <win|osx>] <exe1> [exe2 [..]]\n");
250 return RTEXITCODE_SUCCESS;
251}
252
253typedef struct VERIFYEXESTATE
254{
255 RTCRSTORE hRootStore;
256 RTCRSTORE hKernelRootStore;
257 RTCRSTORE hAdditionalStore;
258 bool fKernel;
259 int cVerbose;
260 enum { kSignType_Windows, kSignType_OSX } enmSignType;
261 uint64_t uTimestamp;
262 RTLDRARCH enmLdrArch;
263} VERIFYEXESTATE;
264
265#ifdef VBOX
266/** Certificate store load set.
267 * Declared outside HandleVerifyExe because of braindead gcc visibility crap. */
268struct STSTORESET
269{
270 RTCRSTORE hStore;
271 PCSUPTAENTRY paTAs;
272 unsigned cTAs;
273};
274#endif
275
276/**
277 * @callback_method_impl{FNRTCRPKCS7VERIFYCERTCALLBACK,
278 * Standard code signing. Use this for Microsoft SPC.}
279 */
280static DECLCALLBACK(int) VerifyExecCertVerifyCallback(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths, uint32_t fFlags,
281 void *pvUser, PRTERRINFO pErrInfo)
282{
283 VERIFYEXESTATE *pState = (VERIFYEXESTATE *)pvUser;
284 uint32_t cPaths = hCertPaths != NIL_RTCRX509CERTPATHS ? RTCrX509CertPathsGetPathCount(hCertPaths) : 0;
285
286 /*
287 * Dump all the paths.
288 */
289 if (pState->cVerbose > 0)
290 {
291 for (uint32_t iPath = 0; iPath < cPaths; iPath++)
292 {
293 RTPrintf("---\n");
294 RTCrX509CertPathsDumpOne(hCertPaths, iPath, pState->cVerbose, RTStrmDumpPrintfV, g_pStdOut);
295 *pErrInfo->pszMsg = '\0';
296 }
297 RTPrintf("---\n");
298 }
299
300 /*
301 * Test signing certificates normally doesn't have all the necessary
302 * features required below. So, treat them as special cases.
303 */
304 if ( hCertPaths == NIL_RTCRX509CERTPATHS
305 && RTCrX509Name_Compare(&pCert->TbsCertificate.Issuer, &pCert->TbsCertificate.Subject) == 0)
306 {
307 RTMsgInfo("Test signed.\n");
308 return VINF_SUCCESS;
309 }
310
311 if (hCertPaths == NIL_RTCRX509CERTPATHS)
312 RTMsgInfo("Signed by trusted certificate.\n");
313
314 /*
315 * Standard code signing capabilites required.
316 */
317 int rc = RTCrPkcs7VerifyCertCallbackCodeSigning(pCert, hCertPaths, fFlags, NULL, pErrInfo);
318 if ( RT_SUCCESS(rc)
319 && (fFlags & RTCRPKCS7VCC_F_SIGNED_DATA))
320 {
321 /*
322 * If kernel signing, a valid certificate path must be anchored by the
323 * microsoft kernel signing root certificate. The only alternative is
324 * test signing.
325 */
326 if (pState->fKernel && hCertPaths != NIL_RTCRX509CERTPATHS)
327 {
328 uint32_t cFound = 0;
329 uint32_t cValid = 0;
330 for (uint32_t iPath = 0; iPath < cPaths; iPath++)
331 {
332 bool fTrusted;
333 PCRTCRX509NAME pSubject;
334 PCRTCRX509SUBJECTPUBLICKEYINFO pPublicKeyInfo;
335 int rcVerify;
336 rc = RTCrX509CertPathsQueryPathInfo(hCertPaths, iPath, &fTrusted, NULL /*pcNodes*/, &pSubject, &pPublicKeyInfo,
337 NULL, NULL /*pCertCtx*/, &rcVerify);
338 AssertRCBreak(rc);
339
340 if (RT_SUCCESS(rcVerify))
341 {
342 Assert(fTrusted);
343 cValid++;
344
345 /* Search the kernel signing root store for a matching anchor. */
346 RTCRSTORECERTSEARCH Search;
347 rc = RTCrStoreCertFindBySubjectOrAltSubjectByRfc5280(pState->hKernelRootStore, pSubject, &Search);
348 AssertRCBreak(rc);
349 PCRTCRCERTCTX pCertCtx;
350 while ((pCertCtx = RTCrStoreCertSearchNext(pState->hKernelRootStore, &Search)) != NULL)
351 {
352 PCRTCRX509SUBJECTPUBLICKEYINFO pPubKeyInfo;
353 if (pCertCtx->pCert)
354 pPubKeyInfo = &pCertCtx->pCert->TbsCertificate.SubjectPublicKeyInfo;
355 else if (pCertCtx->pTaInfo)
356 pPubKeyInfo = &pCertCtx->pTaInfo->PubKey;
357 else
358 pPubKeyInfo = NULL;
359 if (RTCrX509SubjectPublicKeyInfo_Compare(pPubKeyInfo, pPublicKeyInfo) == 0)
360 cFound++;
361 RTCrCertCtxRelease(pCertCtx);
362 }
363
364 int rc2 = RTCrStoreCertSearchDestroy(pState->hKernelRootStore, &Search); AssertRC(rc2);
365 }
366 }
367 if (RT_SUCCESS(rc) && cFound == 0)
368 rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE, "Not valid kernel code signature.");
369 if (RT_SUCCESS(rc) && cValid != 2)
370 RTMsgWarning("%u valid paths, expected 2", cValid);
371 }
372 }
373
374 return rc;
375}
376
377
378/** @callback_method_impl{FNRTLDRVALIDATESIGNEDDATA} */
379static DECLCALLBACK(int) VerifyExeCallback(RTLDRMOD hLdrMod, RTLDRSIGNATURETYPE enmSignature,
380 void const *pvSignature, size_t cbSignature,
381 PRTERRINFO pErrInfo, void *pvUser)
382{
383 VERIFYEXESTATE *pState = (VERIFYEXESTATE *)pvUser;
384 switch (enmSignature)
385 {
386 case RTLDRSIGNATURETYPE_PKCS7_SIGNED_DATA:
387 {
388 PCRTCRPKCS7CONTENTINFO pContentInfo = (PCRTCRPKCS7CONTENTINFO)pvSignature;
389
390 RTTIMESPEC ValidationTime;
391 RTTimeSpecSetSeconds(&ValidationTime, pState->uTimestamp);
392
393 /*
394 * Dump the signed data if so requested.
395 */
396 if (pState->cVerbose)
397 RTAsn1Dump(&pContentInfo->SeqCore.Asn1Core, 0, 0, RTStrmDumpPrintfV, g_pStdOut);
398
399
400 /*
401 * Do the actual verification. Will have to modify this so it takes
402 * the authenticode policies into account.
403 */
404 return RTCrPkcs7VerifySignedData(pContentInfo,
405 RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY
406 | RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT
407 | RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT,
408 pState->hAdditionalStore, pState->hRootStore, &ValidationTime,
409 VerifyExecCertVerifyCallback, pState, pErrInfo);
410 }
411
412 default:
413 return RTErrInfoSetF(pErrInfo, VERR_NOT_SUPPORTED, "Unsupported signature type: %d", enmSignature);
414 }
415 return VINF_SUCCESS;
416}
417
418/** Worker for HandleVerifyExe. */
419static RTEXITCODE HandleVerifyExeWorker(VERIFYEXESTATE *pState, const char *pszFilename, PRTERRINFOSTATIC pStaticErrInfo)
420{
421 /*
422 * Open the executable image and verify it.
423 */
424 RTLDRMOD hLdrMod;
425 int rc = RTLdrOpen(pszFilename, RTLDR_O_FOR_VALIDATION, pState->enmLdrArch, &hLdrMod);
426 if (RT_FAILURE(rc))
427 return RTMsgErrorExit(RTEXITCODE_FAILURE, "Error opening executable image '%s': %Rrc", pszFilename, rc);
428
429
430 rc = RTLdrQueryProp(hLdrMod, RTLDRPROP_TIMESTAMP_SECONDS, &pState->uTimestamp, sizeof(pState->uTimestamp));
431 if (RT_SUCCESS(rc))
432 {
433 rc = RTLdrVerifySignature(hLdrMod, VerifyExeCallback, pState, RTErrInfoInitStatic(pStaticErrInfo));
434 if (RT_SUCCESS(rc))
435 RTMsgInfo("'%s' is valid.\n", pszFilename);
436 else
437 RTMsgError("RTLdrVerifySignature failed on '%s': %Rrc - %s\n", pszFilename, rc, pStaticErrInfo->szMsg);
438 }
439 else
440 RTMsgError("RTLdrQueryProp/RTLDRPROP_TIMESTAMP_SECONDS failed on '%s': %Rrc\n", pszFilename, rc);
441
442 int rc2 = RTLdrClose(hLdrMod);
443 if (RT_FAILURE(rc2))
444 return RTMsgErrorExit(RTEXITCODE_FAILURE, "RTLdrClose failed: %Rrc\n", rc2);
445 if (RT_FAILURE(rc))
446 return rc != VERR_LDRVI_NOT_SIGNED ? RTEXITCODE_FAILURE : RTEXITCODE_SKIPPED;
447
448 return RTEXITCODE_SUCCESS;
449}
450
451
452static RTEXITCODE HandleVerifyExe(int cArgs, char **papszArgs)
453{
454 RTERRINFOSTATIC StaticErrInfo;
455
456 /* Note! This code does not try to clean up the crypto stores on failure.
457 This is intentional as the code is only expected to be used in a
458 one-command-per-process environment where we do exit() upon
459 returning from this function. */
460
461 /*
462 * Parse arguments.
463 */
464 static const RTGETOPTDEF s_aOptions[] =
465 {
466 { "--kernel", 'k', RTGETOPT_REQ_NOTHING },
467 { "--root", 'r', RTGETOPT_REQ_STRING },
468 { "--additional", 'a', RTGETOPT_REQ_STRING },
469 { "--add", 'a', RTGETOPT_REQ_STRING },
470 { "--type", 't', RTGETOPT_REQ_STRING },
471 { "--verbose", 'v', RTGETOPT_REQ_NOTHING },
472 { "--quiet", 'q', RTGETOPT_REQ_NOTHING },
473 };
474
475 VERIFYEXESTATE State =
476 {
477 NIL_RTCRSTORE, NIL_RTCRSTORE, NIL_RTCRSTORE, false, false,
478 VERIFYEXESTATE::kSignType_Windows, 0, RTLDRARCH_WHATEVER
479 };
480 int rc = RTCrStoreCreateInMem(&State.hRootStore, 0);
481 if (RT_SUCCESS(rc))
482 rc = RTCrStoreCreateInMem(&State.hKernelRootStore, 0);
483 if (RT_SUCCESS(rc))
484 rc = RTCrStoreCreateInMem(&State.hAdditionalStore, 0);
485 if (RT_FAILURE(rc))
486 return RTMsgErrorExit(RTEXITCODE_FAILURE, "Error creating in-memory certificate store: %Rrc", rc);
487
488 RTGETOPTSTATE GetState;
489 rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
490 AssertRCReturn(rc, RTEXITCODE_FAILURE);
491 RTGETOPTUNION ValueUnion;
492 int ch;
493 while ((ch = RTGetOpt(&GetState, &ValueUnion)) && ch != VINF_GETOPT_NOT_OPTION)
494 {
495 switch (ch)
496 {
497 case 'r': case 'a':
498 rc = RTCrStoreCertAddFromFile(ch == 'r' ? State.hRootStore : State.hAdditionalStore,
499 RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR,
500 ValueUnion.psz, RTErrInfoInitStatic(&StaticErrInfo));
501 if (RT_FAILURE(rc))
502 return RTMsgErrorExit(RTEXITCODE_FAILURE, "Error loading certificate '%s': %Rrc - %s",
503 ValueUnion.psz, rc, StaticErrInfo.szMsg);
504 if (RTErrInfoIsSet(&StaticErrInfo.Core))
505 RTMsgWarning("Warnings loading certificate '%s': %s", ValueUnion.psz, StaticErrInfo.szMsg);
506 break;
507
508 case 't':
509 if (!strcmp(ValueUnion.psz, "win") || !strcmp(ValueUnion.psz, "windows"))
510 State.enmSignType = VERIFYEXESTATE::kSignType_Windows;
511 else if (!strcmp(ValueUnion.psz, "osx") || !strcmp(ValueUnion.psz, "apple"))
512 State.enmSignType = VERIFYEXESTATE::kSignType_OSX;
513 else
514 return RTMsgErrorExit(RTEXITCODE_SYNTAX, "Unknown signing type: '%s'", ValueUnion.psz);
515 break;
516
517 case 'k': State.fKernel = true; break;
518 case 'v': State.cVerbose++; break;
519 case 'q': State.cVerbose = 0; break;
520 case 'V': return HandleVersion(cArgs, papszArgs);
521 case 'h': return HelpVerifyExe(g_pStdOut, RTSIGNTOOLHELP_FULL);
522 default: return RTGetOptPrintError(ch, &ValueUnion);
523 }
524 }
525 if (ch != VINF_GETOPT_NOT_OPTION)
526 return RTMsgErrorExit(RTEXITCODE_FAILURE, "No executable given.");
527
528 /*
529 * Populate the certificate stores according to the signing type.
530 */
531#ifdef VBOX
532 unsigned cSets = 0;
533 struct STSTORESET aSets[6];
534#endif
535
536 switch (State.enmSignType)
537 {
538 case VERIFYEXESTATE::kSignType_Windows:
539#ifdef VBOX
540 aSets[cSets].hStore = State.hRootStore;
541 aSets[cSets].paTAs = g_aSUPTimestampTAs;
542 aSets[cSets].cTAs = g_cSUPTimestampTAs;
543 cSets++;
544 aSets[cSets].hStore = State.hRootStore;
545 aSets[cSets].paTAs = g_aSUPSpcRootTAs;
546 aSets[cSets].cTAs = g_cSUPSpcRootTAs;
547 cSets++;
548 aSets[cSets].hStore = State.hRootStore;
549 aSets[cSets].paTAs = g_aSUPNtKernelRootTAs;
550 aSets[cSets].cTAs = g_cSUPNtKernelRootTAs;
551 cSets++;
552 aSets[cSets].hStore = State.hKernelRootStore;
553 aSets[cSets].paTAs = g_aSUPNtKernelRootTAs;
554 aSets[cSets].cTAs = g_cSUPNtKernelRootTAs;
555 cSets++;
556#endif
557 break;
558
559 case VERIFYEXESTATE::kSignType_OSX:
560 return RTMsgErrorExit(RTEXITCODE_FAILURE, "Mac OS X executable signing is not implemented.");
561 }
562
563#ifdef VBOX
564 for (unsigned i = 0; i < cSets; i++)
565 for (unsigned j = 0; j < aSets[i].cTAs; j++)
566 {
567 rc = RTCrStoreCertAddEncoded(aSets[i].hStore, RTCRCERTCTX_F_ENC_TAF_DER, aSets[i].paTAs[j].pch,
568 aSets[i].paTAs[j].cb, RTErrInfoInitStatic(&StaticErrInfo));
569 if (RT_FAILURE(rc))
570 return RTMsgErrorExit(RTEXITCODE_FAILURE, "RTCrStoreCertAddEncoded failed (%u/%u): %s",
571 i, j, StaticErrInfo.szMsg);
572 }
573#endif
574
575 /*
576 * Do it.
577 */
578 RTEXITCODE rcExit;
579 for (;;)
580 {
581 rcExit = HandleVerifyExeWorker(&State, ValueUnion.psz, &StaticErrInfo);
582 if (rcExit != RTEXITCODE_SUCCESS)
583 break;
584
585 /*
586 * Next file
587 */
588 ch = RTGetOpt(&GetState, &ValueUnion);
589 if (ch == 0)
590 break;
591 if (ch != VINF_GETOPT_NOT_OPTION)
592 {
593 rcExit = RTGetOptPrintError(ch, &ValueUnion);
594 break;
595 }
596 }
597
598 /*
599 * Clean up.
600 */
601 uint32_t cRefs;
602 cRefs = RTCrStoreRelease(State.hRootStore); Assert(cRefs == 0);
603 cRefs = RTCrStoreRelease(State.hKernelRootStore); Assert(cRefs == 0);
604 cRefs = RTCrStoreRelease(State.hAdditionalStore); Assert(cRefs == 0);
605
606 return rcExit;
607}
608
609#endif /* !IPRT_IN_BUILD_TOOL */
610
611/*
612 * The 'make-tainfo' command.
613 */
614static RTEXITCODE HelpMakeTaInfo(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
615{
616 RTStrmPrintf(pStrm,
617 "make-tainfo [--verbose|--quiet] [--cert <cert.der>] [-o|--output] <tainfo.der>\n");
618 return RTEXITCODE_SUCCESS;
619}
620
621
622typedef struct MAKETAINFOSTATE
623{
624 int cVerbose;
625 const char *pszCert;
626 const char *pszOutput;
627} MAKETAINFOSTATE;
628
629
630/** @callback_method_impl{FNRTASN1ENCODEWRITER} */
631static DECLCALLBACK(int) handleMakeTaInfoWriter(const void *pvBuf, size_t cbToWrite, void *pvUser, PRTERRINFO pErrInfo)
632{
633 return RTStrmWrite((PRTSTREAM)pvUser, pvBuf, cbToWrite);
634}
635
636
637static RTEXITCODE HandleMakeTaInfo(int cArgs, char **papszArgs)
638{
639 /*
640 * Parse arguments.
641 */
642 static const RTGETOPTDEF s_aOptions[] =
643 {
644 { "--cert", 'c', RTGETOPT_REQ_STRING },
645 { "--output", 'o', RTGETOPT_REQ_STRING },
646 { "--verbose", 'v', RTGETOPT_REQ_NOTHING },
647 { "--quiet", 'q', RTGETOPT_REQ_NOTHING },
648 };
649
650 RTLDRARCH enmLdrArch = RTLDRARCH_WHATEVER;
651 MAKETAINFOSTATE State = { 0, NULL, NULL };
652
653 RTGETOPTSTATE GetState;
654 int rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST);
655 AssertRCReturn(rc, RTEXITCODE_FAILURE);
656 RTGETOPTUNION ValueUnion;
657 int ch;
658 while ((ch = RTGetOpt(&GetState, &ValueUnion)) != 0)
659 {
660 switch (ch)
661 {
662 case 'c':
663 if (State.pszCert)
664 return RTMsgErrorExit(RTEXITCODE_FAILURE, "The --cert option can only be used once.");
665 State.pszCert = ValueUnion.psz;
666 break;
667
668 case 'o':
669 case VINF_GETOPT_NOT_OPTION:
670 if (State.pszOutput)
671 return RTMsgErrorExit(RTEXITCODE_FAILURE, "Multiple output files specified.");
672 State.pszOutput = ValueUnion.psz;
673 break;
674
675 case 'v': State.cVerbose++; break;
676 case 'q': State.cVerbose = 0; break;
677 case 'V': return HandleVersion(cArgs, papszArgs);
678 case 'h': return HelpMakeTaInfo(g_pStdOut, RTSIGNTOOLHELP_FULL);
679 default: return RTGetOptPrintError(ch, &ValueUnion);
680 }
681 }
682 if (!State.pszCert)
683 return RTMsgErrorExit(RTEXITCODE_FAILURE, "No input certificate was specified.");
684 if (!State.pszOutput)
685 return RTMsgErrorExit(RTEXITCODE_FAILURE, "No output file was specified.");
686
687 /*
688 * Read the certificate.
689 */
690 RTERRINFOSTATIC StaticErrInfo;
691 RTCRX509CERTIFICATE Certificate;
692 rc = RTCrX509Certificate_ReadFromFile(&Certificate, State.pszCert, 0, &g_RTAsn1DefaultAllocator,
693 RTErrInfoInitStatic(&StaticErrInfo));
694 if (RT_FAILURE(rc))
695 return RTMsgErrorExit(RTEXITCODE_FAILURE, "Error reading certificate from %s: %Rrc - %s",
696 State.pszCert, rc, StaticErrInfo.szMsg);
697 /*
698 * Construct the trust anchor information.
699 */
700 RTCRTAFTRUSTANCHORINFO TrustAnchor;
701 rc = RTCrTafTrustAnchorInfo_Init(&TrustAnchor, &g_RTAsn1DefaultAllocator);
702 if (RT_SUCCESS(rc))
703 {
704 /* Public key. */
705 Assert(RTCrX509SubjectPublicKeyInfo_IsPresent(&TrustAnchor.PubKey));
706 RTCrX509SubjectPublicKeyInfo_Delete(&TrustAnchor.PubKey);
707 rc = RTCrX509SubjectPublicKeyInfo_Clone(&TrustAnchor.PubKey, &Certificate.TbsCertificate.SubjectPublicKeyInfo,
708 &g_RTAsn1DefaultAllocator);
709 if (RT_FAILURE(rc))
710 RTMsgError("RTCrX509SubjectPublicKeyInfo_Clone failed: %Rrc", rc);
711 RTAsn1Core_ResetImplict(RTCrX509SubjectPublicKeyInfo_GetAsn1Core(&TrustAnchor.PubKey)); /* temporary hack. */
712
713 /* Key Identifier. */
714 PCRTASN1OCTETSTRING pKeyIdentifier = NULL;
715 if (Certificate.TbsCertificate.T3.fFlags & RTCRX509TBSCERTIFICATE_F_PRESENT_SUBJECT_KEY_IDENTIFIER)
716 pKeyIdentifier = Certificate.TbsCertificate.T3.pSubjectKeyIdentifier;
717 else if ( (Certificate.TbsCertificate.T3.fFlags & RTCRX509TBSCERTIFICATE_F_PRESENT_AUTHORITY_KEY_IDENTIFIER)
718 && RTCrX509Certificate_IsSelfSigned(&Certificate)
719 && RTAsn1OctetString_IsPresent(&Certificate.TbsCertificate.T3.pAuthorityKeyIdentifier->KeyIdentifier) )
720 pKeyIdentifier = &Certificate.TbsCertificate.T3.pAuthorityKeyIdentifier->KeyIdentifier;
721 else if ( (Certificate.TbsCertificate.T3.fFlags & RTCRX509TBSCERTIFICATE_F_PRESENT_OLD_AUTHORITY_KEY_IDENTIFIER)
722 && RTCrX509Certificate_IsSelfSigned(&Certificate)
723 && RTAsn1OctetString_IsPresent(&Certificate.TbsCertificate.T3.pOldAuthorityKeyIdentifier->KeyIdentifier) )
724 pKeyIdentifier = &Certificate.TbsCertificate.T3.pOldAuthorityKeyIdentifier->KeyIdentifier;
725 if (pKeyIdentifier && pKeyIdentifier->Asn1Core.cb > 0)
726 {
727 Assert(RTAsn1OctetString_IsPresent(&TrustAnchor.KeyIdentifier));
728 RTAsn1OctetString_Delete(&TrustAnchor.KeyIdentifier);
729 rc = RTAsn1OctetString_Clone(&TrustAnchor.KeyIdentifier, pKeyIdentifier, &g_RTAsn1DefaultAllocator);
730 if (RT_FAILURE(rc))
731 RTMsgError("RTAsn1OctetString_Clone failed: %Rrc", rc);
732 RTAsn1Core_ResetImplict(RTAsn1OctetString_GetAsn1Core(&TrustAnchor.KeyIdentifier)); /* temporary hack. */
733 }
734 else
735 RTMsgWarning("No key identifier found or has zero length.");
736
737 /* Subject */
738 if (RT_SUCCESS(rc))
739 {
740 Assert(!RTCrTafCertPathControls_IsPresent(&TrustAnchor.CertPath));
741 rc = RTCrTafCertPathControls_Init(&TrustAnchor.CertPath, &g_RTAsn1DefaultAllocator);
742 if (RT_SUCCESS(rc))
743 {
744 Assert(RTCrX509Name_IsPresent(&TrustAnchor.CertPath.TaName));
745 RTCrX509Name_Delete(&TrustAnchor.CertPath.TaName);
746 rc = RTCrX509Name_Clone(&TrustAnchor.CertPath.TaName, &Certificate.TbsCertificate.Subject,
747 &g_RTAsn1DefaultAllocator);
748 if (RT_SUCCESS(rc))
749 {
750 RTAsn1Core_ResetImplict(RTCrX509Name_GetAsn1Core(&TrustAnchor.CertPath.TaName)); /* temporary hack. */
751 rc = RTCrX509Name_RecodeAsUtf8(&TrustAnchor.CertPath.TaName, &g_RTAsn1DefaultAllocator);
752 if (RT_FAILURE(rc))
753 RTMsgError("RTCrX509Name_RecodeAsUtf8 failed: %Rrc", rc);
754 }
755 else
756 RTMsgError("RTCrX509Name_Clone failed: %Rrc", rc);
757 }
758 else
759 RTMsgError("RTCrTafCertPathControls_Init failed: %Rrc", rc);
760 }
761
762 /* Check that what we've constructed makes some sense. */
763 if (RT_SUCCESS(rc))
764 {
765 rc = RTCrTafTrustAnchorInfo_CheckSanity(&TrustAnchor, 0, RTErrInfoInitStatic(&StaticErrInfo), "TAI");
766 if (RT_FAILURE(rc))
767 RTMsgError("RTCrTafTrustAnchorInfo_CheckSanity failed: %Rrc - %s", rc, StaticErrInfo.szMsg);
768 }
769
770 if (RT_SUCCESS(rc))
771 {
772 /*
773 * Encode it and write it to the output file.
774 */
775 uint32_t cbEncoded;
776 rc = RTAsn1EncodePrepare(RTCrTafTrustAnchorInfo_GetAsn1Core(&TrustAnchor), RTASN1ENCODE_F_DER, &cbEncoded,
777 RTErrInfoInitStatic(&StaticErrInfo));
778 if (RT_SUCCESS(rc))
779 {
780 if (State.cVerbose >= 1)
781 RTAsn1Dump(RTCrTafTrustAnchorInfo_GetAsn1Core(&TrustAnchor), 0, 0, RTStrmDumpPrintfV, g_pStdOut);
782
783 PRTSTREAM pStrm;
784 rc = RTStrmOpen(State.pszOutput, "wb", &pStrm);
785 if (RT_SUCCESS(rc))
786 {
787 rc = RTAsn1EncodeWrite(RTCrTafTrustAnchorInfo_GetAsn1Core(&TrustAnchor), RTASN1ENCODE_F_DER,
788 handleMakeTaInfoWriter, pStrm, RTErrInfoInitStatic(&StaticErrInfo));
789 if (RT_SUCCESS(rc))
790 {
791 rc = RTStrmClose(pStrm);
792 if (RT_SUCCESS(rc))
793 RTMsgInfo("Successfully wrote TrustedAnchorInfo to '%s'.", State.pszOutput);
794 else
795 RTMsgError("RTStrmClose failed: %Rrc", rc);
796 }
797 else
798 {
799 RTMsgError("RTAsn1EncodeWrite failed: %Rrc - %s", rc, StaticErrInfo.szMsg);
800 RTStrmClose(pStrm);
801 }
802 }
803 else
804 RTMsgError("Error opening '%s' for writing: %Rrcs", State.pszOutput, rc);
805 }
806 else
807 RTMsgError("RTAsn1EncodePrepare failed: %Rrc - %s", rc, StaticErrInfo.szMsg);
808 }
809
810 RTCrTafTrustAnchorInfo_Delete(&TrustAnchor);
811 }
812 else
813 RTMsgError("RTCrTafTrustAnchorInfo_Init failed: %Rrc", rc);
814
815 RTCrX509Certificate_Delete(&Certificate);
816 return RT_SUCCESS(rc) ? RTEXITCODE_SUCCESS : RTEXITCODE_FAILURE;
817}
818
819
820
821/*
822 * The 'version' command.
823 */
824static RTEXITCODE HelpVersion(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
825{
826 RTStrmPrintf(pStrm, "version\n");
827 return RTEXITCODE_SUCCESS;
828}
829
830static RTEXITCODE HandleVersion(int cArgs, char **papszArgs)
831{
832 RTPrintf("%s\n", RTBldCfgVersion());
833 return RTEXITCODE_SUCCESS;
834}
835
836
837
838/**
839 * Command mapping.
840 */
841static struct
842{
843 /** The command. */
844 const char *pszCmd;
845 /**
846 * Handle the command.
847 * @returns Program exit code.
848 * @param cArgs Number of arguments.
849 * @param papszArgs The argument vector, starting with the command name.
850 */
851 RTEXITCODE (*pfnHandler)(int cArgs, char **papszArgs);
852 /**
853 * Produce help.
854 * @returns RTEXITCODE_SUCCESS to simplify handling '--help' in the handler.
855 * @param pStrm Where to send help text.
856 * @param enmLevel The level of the help information.
857 */
858 RTEXITCODE (*pfnHelp)(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel);
859}
860/** Mapping commands to handler and helper functions. */
861const g_aCommands[] =
862{
863 { "extract-exe-signer-cert", HandleExtractExeSignerCert, HelpExtractExeSignerCert },
864#ifndef IPRT_IN_BUILD_TOOL
865 { "verify-exe", HandleVerifyExe, HelpVerifyExe },
866#endif
867 { "make-tainfo", HandleMakeTaInfo, HelpMakeTaInfo },
868 { "help", HandleHelp, HelpHelp },
869 { "--help", HandleHelp, NULL },
870 { "-h", HandleHelp, NULL },
871 { "version", HandleVersion, HelpVersion },
872 { "--version", HandleVersion, NULL },
873 { "-V", HandleVersion, NULL },
874};
875
876
877/*
878 * The 'help' command.
879 */
880static RTEXITCODE HelpHelp(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel)
881{
882 RTStrmPrintf(pStrm, "help [cmd-patterns]\n");
883 return RTEXITCODE_SUCCESS;
884}
885
886static RTEXITCODE HandleHelp(int cArgs, char **papszArgs)
887{
888 RTSIGNTOOLHELP enmLevel = cArgs <= 1 ? RTSIGNTOOLHELP_USAGE : RTSIGNTOOLHELP_FULL;
889 uint32_t cShowed = 0;
890 for (uint32_t iCmd = 0; iCmd < RT_ELEMENTS(g_aCommands); iCmd++)
891 {
892 if (g_aCommands[iCmd].pfnHelp)
893 {
894 bool fShow;
895 if (cArgs <= 1)
896 fShow = true;
897 else
898 {
899 for (int iArg = 1; iArg < cArgs; iArg++)
900 if (RTStrSimplePatternMultiMatch(papszArgs[iArg], RTSTR_MAX, g_aCommands[iCmd].pszCmd, RTSTR_MAX, NULL))
901 {
902 fShow = true;
903 break;
904 }
905 }
906 if (fShow)
907 {
908 g_aCommands[iCmd].pfnHelp(g_pStdOut, enmLevel);
909 cShowed++;
910 }
911 }
912 }
913 return cShowed ? RTEXITCODE_SUCCESS : RTEXITCODE_FAILURE;
914}
915
916
917
918int main(int argc, char **argv)
919{
920 int rc = RTR3InitExe(argc, &argv, 0);
921 if (RT_FAILURE(rc))
922 return RTMsgInitFailure(rc);
923
924 /*
925 * Parse global arguments.
926 */
927 int iArg = 1;
928 /* none presently. */
929
930 /*
931 * Command dispatcher.
932 */
933 if (iArg < argc)
934 {
935 const char *pszCmd = argv[iArg];
936 uint32_t i = RT_ELEMENTS(g_aCommands);
937 while (i-- > 0)
938 if (!strcmp(g_aCommands[i].pszCmd, pszCmd))
939 return g_aCommands[i].pfnHandler(argc - iArg, &argv[iArg]);
940 RTMsgError("Unknown command '%s'.", pszCmd);
941 }
942 else
943 RTMsgError("No command given. (try --help)");
944
945 return RTEXITCODE_SYNTAX;
946}
947
948
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette