Mercurial > trustbridge

annotate common/binverify.c @ 1143:cc7a5c12a429 runafterinstall

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Runafterinstall has been merged into master
author Andre Heinecke <andre.heinecke@intevation.de>
date Thu, 18 Sep 2014 10:30:27 +0200
parents 698b6a9bd75e
children edbf5e5e88f4
rev   line source
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
1 /* Copyright (C) 2014 by Bundesamt für Sicherheit in der Informationstechnik
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
2 * Software engineering by Intevation GmbH
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
3 *
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
4 * This file is Free Software under the GNU GPL (v>=2)
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
5 * and comes with ABSOLUTELY NO WARRANTY!
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
6 * See LICENSE.txt for details.
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
7 */
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
8
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
9 #include "binverify.h"
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
10
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
11 #include "strhelp.h"
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
12 #include "logging.h"
629
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
13 #ifdef RELEASE_BUILD
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
14 #include "pubkey-release.h"
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
15 #else
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
16 #include "pubkey-test.h"
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
17 #endif
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
18
586
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
19 bin_verify_result
905
698b6a9bd75e Fix coding style for C code
Andre Heinecke <andre.heinecke@intevation.de>
parents: 774
diff changeset
20 verify_binary(const char *filename, size_t name_len)
698b6a9bd75e Fix coding style for C code
Andre Heinecke <andre.heinecke@intevation.de>
parents: 774
diff changeset
21 {
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
22 if (!filename || !name_len)
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
23 return VerifyUnknownError;
586
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
24 #ifdef WIN32
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
25 return verify_binary_win(filename, name_len);
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
26 #else
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
27 return verify_binary_linux(filename, name_len);
586
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
28 #endif
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
29 }
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
30
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
31 #ifdef WIN32
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
32
629
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
33 #include <polarssl/x509_crt.h>
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
34
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
35 #include <windows.h>
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
36 #include <wincrypt.h>
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
37 #include <wintrust.h>
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
38 #include <stdio.h>
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
39
629
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
40
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
41 /** @brief Check if the certificate @a pCCertContext is pinned
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
42 *
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
43 * Compares the certificate's binary data (public key and attributes)
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
44 * with each other to validate that the certificate pCCertContext has
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
45 * exactly the same data as the builtin public certificate.
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
46 *
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
47 * @param[in] pCCertContext pointer to the certificate to check
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
48 *
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
49 * @returns true if the certificate matches, false otherwise.
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
50 */
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
51 static bool
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
52 check_certificate (PCCERT_CONTEXT pCCertContext)
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
53 {
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
54 x509_crt codesign_cert;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
55 int ret = 0;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
56 DWORD dwI = 0;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
57 bool retval = false;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
58
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
59 if (pCCertContext == NULL)
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
60 {
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
61 ERRORPRINTF ("Invalid call to check_certificate");
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
62 return false;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
63 }
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
64
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
65 x509_crt_init(&codesign_cert);
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
66
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
67 /* Parse the pinned certificate */
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
68 ret = x509_crt_parse(&codesign_cert,
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
69 public_key_codesign_pem,
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
70 public_key_codesign_pem_size);
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
71 if (ret != 0)
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
72 {
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
73 ERRORPRINTF ("x509_crt_parse failed with -0x%04x\n\n", -ret);
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
74 goto done;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
75 }
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
76
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
77 if (codesign_cert.raw.len != pCCertContext->cbCertEncoded ||
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
78 codesign_cert.raw.len <= 0)
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
79 {
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
80 ERRORPRINTF ("Certificate size mismatch");
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
81 goto done;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
82 }
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
83
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
84 /* Check that the certificate is exactly the same as the pinned one */
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
85 for (dwI = 0; dwI < pCCertContext->cbCertEncoded; dwI++)
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
86 {
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
87 if (pCCertContext->pbCertEncoded[dwI] != codesign_cert.raw.p[dwI])
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
88 {
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
89 ERRORPRINTF ("Certificate content mismatch");
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
90 goto done;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
91 }
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
92 }
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
93
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
94 retval = true;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
95
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
96 done:
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
97 x509_crt_free(&codesign_cert);
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
98 return retval;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
99 }
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
100
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
101 bin_verify_result
905
698b6a9bd75e Fix coding style for C code
Andre Heinecke <andre.heinecke@intevation.de>
parents: 774
diff changeset
102 verify_binary_win(const char *filename, size_t name_len)
698b6a9bd75e Fix coding style for C code
Andre Heinecke <andre.heinecke@intevation.de>
parents: 774
diff changeset
103 {
586
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
104 bin_verify_result retval = VerifyUnknownError;
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
105 WCHAR *filenameW = NULL;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
106 BOOL result = FALSE;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
107 DWORD dwEncoding = 0,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
108 dwContentType = 0,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
109 dwFormatType = 0,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
110 dwSignerInfoSize = 0;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
111 HCERTSTORE hStore = NULL;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
112 HCRYPTMSG hMsg = NULL;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
113 PCERT_INFO pSignerCert = NULL;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
114 PCCERT_CONTEXT pSignerCertContext = NULL;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
115
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
116 if (!filename || name_len > MAX_PATH || strlen(filename) != name_len)
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
117 {
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
118 ERRORPRINTF ("Invalid parameters\n");
586
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
119 return VerifyUnknownError;
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
120 }
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
121
591
26a18e3c3db4 Cleanups and coding style.
Andre Heinecke <aheinecke@intevation.de>
parents: 590
diff changeset
122 filenameW = utf8_to_wchar(filename, name_len);
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
123
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
124 result = CryptQueryObject (CERT_QUERY_OBJECT_FILE,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
125 filenameW,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
126 CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
127 CERT_QUERY_FORMAT_FLAG_BINARY,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
128 0,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
129 &dwEncoding,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
130 &dwContentType,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
131 &dwFormatType,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
132 &hStore,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
133 &hMsg,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
134 NULL);
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
135
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
136 if (!result || !hMsg)
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
137 {
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
138 PRINTLASTERROR ("Failed to query crypto object");
586
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
139 retval = VerifyReadFailed;
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
140 goto done;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
141 }
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
142
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
143 /* Get the cert info so that we can look up the signer in the store later */
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
144 if (CryptMsgGetParam(hMsg,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
145 CMSG_SIGNER_CERT_INFO_PARAM,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
146 0,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
147 NULL,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
148 &dwSignerInfoSize) && dwSignerInfoSize > 0)
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
149 {
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
150 pSignerCert = xmalloc (dwSignerInfoSize);
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
151 }
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
152 else
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
153 {
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
154 ERRORPRINTF ("Failed to get signer cert size.");
586
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
155 retval = VerifyUnknownError;
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
156 goto done;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
157 }
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
158
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
159 if (!(CryptMsgGetParam(hMsg,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
160 CMSG_SIGNER_CERT_INFO_PARAM,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
161 0,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
162 pSignerCert,
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
163 &dwSignerInfoSize)))
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
164 {
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
165 ERRORPRINTF ("Failed to get signer cert.");
586
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
166 retval = VerifyUnknownError;
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
167 goto done;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
168 }
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
169
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
170 pSignerCertContext = CertGetSubjectCertificateFromStore(
905
698b6a9bd75e Fix coding style for C code
Andre Heinecke <andre.heinecke@intevation.de>
parents: 774
diff changeset
171 hStore,
698b6a9bd75e Fix coding style for C code
Andre Heinecke <andre.heinecke@intevation.de>
parents: 774
diff changeset
172 PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
698b6a9bd75e Fix coding style for C code
Andre Heinecke <andre.heinecke@intevation.de>
parents: 774
diff changeset
173 pSignerCert);
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
174
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
175 if (!pSignerCertContext)
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
176 {
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
177 ERRORPRINTF ("Failed to find signer cert in store.");
586
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
178 retval = VerifyUnknownError;
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
179 goto done;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
180 }
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
181
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
182 /* Verify that the signature is actually valid */
629
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
183 if(!CryptMsgControl(hMsg,
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
184 0,
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
185 CMSG_CTRL_VERIFY_SIGNATURE,
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
186 pSignerCertContext->pCertInfo))
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
187 {
629
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
188 ERRORPRINTF ("The signature is invalid. \n");
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
189 retval = VerifyInvalidSignature;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
190 syslog_error_printf ("Software update embedded signature is invalid.");
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
191 goto done;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
192 }
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
193
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
194 if(check_certificate(pSignerCertContext))
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
195 {
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
196 DEBUGPRINTF ("Valid signature with pinned certificate.");
586
ecfd77751daf Disambiguate enumerator values and add portable wrapper.
Andre Heinecke <aheinecke@intevation.de>
parents: 579
diff changeset
197 retval = VerifyValid;
629
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
198 goto done;
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
199 }
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
200 else
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
201 {
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
202 ERRORPRINTF ("Certificate mismatch. \n");
637
be30d50bc4f0 Add remaining tests to check binverify functionality
Andre Heinecke <andre.heinecke@intevation.de>
parents: 629
diff changeset
203 retval = VerifyInvalidCertificate;
629
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
204 syslog_error_printf ("Software update embedded signature "
facb13c578f1 Add certificate pinning to verify_binary_win
Andre Heinecke <andre.heinecke@intevation.de>
parents: 591
diff changeset
205 "created with wrong certificate.");
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
206 goto done;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
207 }
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
208
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
209 done:
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
210 xfree(filenameW);
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
211 xfree(pSignerCert);
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
212
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
213 if(pSignerCertContext)
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
214 {
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
215 CertFreeCertificateContext(pSignerCertContext);
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
216 }
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
217 if (hStore)
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
218 {
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
219 CertCloseStore(hStore, 0);
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
220 }
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
221 if (hMsg)
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
222 {
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
223 CryptMsgClose(hMsg);
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
224 }
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
225 return retval;
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
226 }
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
227 #else /* WIN32 */
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
228
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
229 #include "listutil.h"
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
230
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
231 #pragma GCC diagnostic ignored "-Wconversion"
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
232 /* Polarssl mh.h contains a conversion which gcc warns about */
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
233 #include <polarssl/pk.h>
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
234 #include <polarssl/base64.h>
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
235 #include <polarssl/sha256.h>
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
236 #include <polarssl/error.h>
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
237 #include <polarssl/x509_crt.h>
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
238 #pragma GCC diagnostic pop
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
239
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
240 bin_verify_result
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
241 verify_binary_linux(const char *filename, size_t name_len)
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
242 {
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
243 int ret = -1;
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
244 const size_t sig_b64_size = TRUSTBRIDGE_RSA_KEY_SIZE / 8 * 4 / 3;
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
245 char *data = NULL,
905
698b6a9bd75e Fix coding style for C code
Andre Heinecke <andre.heinecke@intevation.de>
parents: 774
diff changeset
246 signature_b64[sig_b64_size + 1];
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
247 size_t data_size = 0,
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
248 sig_size = TRUSTBRIDGE_RSA_KEY_SIZE / 8;
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
249 unsigned char signature[sig_size],
905
698b6a9bd75e Fix coding style for C code
Andre Heinecke <andre.heinecke@intevation.de>
parents: 774
diff changeset
250 hash[32];
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
251
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
252 bin_verify_result retval = VerifyUnknownError;
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
253 x509_crt codesign_cert;
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
254
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
255 if (strnlen(filename, name_len + 1) != name_len || name_len == 0)
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
256 {
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
257 ERRORPRINTF ("Invalid call to verify_binary_linux\n");
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
258 return VerifyUnknownError;
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
259 }
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
260
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
261 ret = read_file(filename, &data, &data_size, MAX_VALID_BIN_SIZE);
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
262
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
263 if (ret != 0)
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
264 {
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
265 ERRORPRINTF ("Read file failed with error: %i\n", ret);
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
266 return VerifyReadFailed;
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
267 }
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
268
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
269 /* Fetch the signature from the end of data */
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
270 if (data_size < sig_b64_size + 5)
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
271 {
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
272 ERRORPRINTF ("File to small to contain a signature.\n");
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
273 retval = VerifyInvalidSignature;
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
274 goto done;
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
275 }
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
276
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
277 if (data[data_size - sig_b64_size - 2] != ':' ||
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
278 data[data_size - sig_b64_size - 3] != 'S' ||
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
279 data[data_size - sig_b64_size - 4] != '\n'||
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
280 data[data_size - sig_b64_size - 5] != '\r')
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
281 {
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
282 ERRORPRINTF ("Failed to find valid signature line.\n");
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
283 retval = VerifyInvalidSignature;
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
284 goto done;
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
285 }
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
286
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
287 strncpy(signature_b64, data + (data_size - sig_b64_size - 1), sig_b64_size);
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
288 signature_b64[sig_b64_size] = '\0';
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
289
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
290 ret = base64_decode(signature, &sig_size,
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
291 (unsigned char *)signature_b64, sig_b64_size);
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
292
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
293 if (ret != 0 || sig_size != TRUSTBRIDGE_RSA_KEY_SIZE / 8)
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
294 {
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
295 ERRORPRINTF ("Base 64 decode failed with error: %i\n", ret);
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
296 goto done;
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
297 }
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
298
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
299 /* Hash is calculated over the data without the signature at the end. */
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
300 sha256((unsigned char *)data, data_size - sig_b64_size - 5, hash, 0);
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
301
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
302 x509_crt_init(&codesign_cert);
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
303
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
304 /* Parse the pinned certificate */
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
305 ret = x509_crt_parse(&codesign_cert,
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
306 public_key_codesign_pem,
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
307 public_key_codesign_pem_size);
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
308 if (ret != 0)
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
309 {
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
310 char errbuf[1020];
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
311 polarssl_strerror(ret, errbuf, 1020);
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
312 errbuf[1019] = '\0'; /* Just to be sure */
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
313 ERRORPRINTF ("x509_crt_parse failed with -0x%04x\n%s\n", -ret, errbuf);
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
314 x509_crt_free(&codesign_cert);
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
315 return VerifyUnknownError;
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
316 }
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
317
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
318 ret = pk_verify(&codesign_cert.pk, POLARSSL_MD_SHA256, hash, 0,
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
319 signature, sig_size);
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
320
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
321 if (ret != 0)
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
322 {
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
323 char errbuf[1020];
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
324 polarssl_strerror(ret, errbuf, 1020);
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
325 errbuf[1019] = '\0'; /* Just to be sure */
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
326 ERRORPRINTF ("pk_verify failed with -0x%04x\n %s\n", -ret, errbuf);
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
327 x509_crt_free(&codesign_cert);
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
328 retval = VerifyInvalidSignature;
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
329 goto done;
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
330 }
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
331 x509_crt_free(&codesign_cert);
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
332
774
44fa5de02b52 (issue43) Finalize and verify binary verification for linux.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 771
diff changeset
333 retval = VerifyValid;
771
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
334
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
335 done:
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
336 xfree (data);
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
337 return retval;
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
338 }
2798f1869eee (issue43) Add first draft of signature verification for GNU/Linux
Andre Heinecke <andre.heinecke@intevation.de>
parents: 637
diff changeset
339
579
f4ce4eef3b38 Implement PKCS#7 embedded signature verfification for windows
Andre Heinecke <aheinecke@intevation.de>
parents:
diff changeset
340 #endif /* WIN32 */
http://wald.intevation.org/projects/trustbridge/