1 /* Sign a module file using the given key.
3 * Copyright (C) 2014 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
19 #include <arpa/inet.h>
20 #include <openssl/bio.h>
21 #include <openssl/evp.h>
22 #include <openssl/pem.h>
23 #include <openssl/pkcs7.h>
24 #include <openssl/err.h>
26 struct module_signature
{
27 uint8_t algo
; /* Public-key crypto algorithm [0] */
28 uint8_t hash
; /* Digest algorithm [0] */
29 uint8_t id_type
; /* Key identifier type [PKEY_ID_PKCS7] */
30 uint8_t signer_len
; /* Length of signer's name [0] */
31 uint8_t key_id_len
; /* Length of key identifier [0] */
33 uint32_t sig_len
; /* Length of signature data */
36 #define PKEY_ID_PKCS7 2
38 static char magic_number
[] = "~Module signature appended~\n";
40 static __attribute__((noreturn
))
44 "Usage: scripts/sign-file [-dp] <hash algo> <key> <x509> <module> [<dest>]\n");
48 static void display_openssl_errors(int l
)
54 if (ERR_peek_error() == 0)
56 fprintf(stderr
, "At main.c:%d:\n", l
);
58 while ((e
= ERR_get_error_line(&file
, &line
))) {
59 ERR_error_string(e
, buf
);
60 fprintf(stderr
, "- SSL %s: %s:%d\n", buf
, file
, line
);
64 static void drain_openssl_errors(void)
69 if (ERR_peek_error() == 0)
71 while (ERR_get_error_line(&file
, &line
)) {}
74 #define ERR(cond, fmt, ...) \
76 bool __cond = (cond); \
77 display_openssl_errors(__LINE__); \
79 err(1, fmt, ## __VA_ARGS__); \
83 int main(int argc
, char **argv
)
85 struct module_signature sig_info
= { .id_type
= PKEY_ID_PKCS7
};
86 char *hash_algo
= NULL
;
87 char *private_key_name
, *x509_name
, *module_name
, *dest_name
;
88 bool save_pkcs7
= false, replace_orig
;
89 bool sign_only
= false;
90 unsigned char buf
[4096];
91 unsigned long module_size
, pkcs7_size
;
92 const EVP_MD
*digest_algo
;
93 EVP_PKEY
*private_key
;
96 BIO
*b
, *bd
= NULL
, *bm
;
99 ERR_load_crypto_strings();
103 opt
= getopt(argc
, argv
, "dp");
105 case 'p': save_pkcs7
= true; break;
106 case 'd': sign_only
= true; save_pkcs7
= true; break;
114 if (argc
< 4 || argc
> 5)
118 private_key_name
= argv
[1];
120 module_name
= argv
[3];
123 replace_orig
= false;
125 ERR(asprintf(&dest_name
, "%s.~signed~", module_name
) < 0,
130 /* Read the private key and the X.509 cert the PKCS#7 message
133 b
= BIO_new_file(private_key_name
, "rb");
134 ERR(!b
, "%s", private_key_name
);
135 private_key
= PEM_read_bio_PrivateKey(b
, NULL
, NULL
, NULL
);
138 b
= BIO_new_file(x509_name
, "rb");
139 ERR(!b
, "%s", x509_name
);
140 x509
= d2i_X509_bio(b
, NULL
); /* Binary encoded X.509 */
143 x509
= PEM_read_bio_X509(b
, NULL
, NULL
, NULL
); /* PEM encoded X.509 */
145 drain_openssl_errors();
148 ERR(!x509
, "%s", x509_name
);
150 /* Open the destination file now so that we can shovel the module data
151 * across as we read it.
154 bd
= BIO_new_file(dest_name
, "wb");
155 ERR(!bd
, "%s", dest_name
);
158 /* Digest the module data. */
159 OpenSSL_add_all_digests();
160 display_openssl_errors(__LINE__
);
161 digest_algo
= EVP_get_digestbyname(hash_algo
);
162 ERR(!digest_algo
, "EVP_get_digestbyname");
164 bm
= BIO_new_file(module_name
, "rb");
165 ERR(!bm
, "%s", module_name
);
167 /* Load the PKCS#7 message from the digest buffer. */
168 pkcs7
= PKCS7_sign(NULL
, NULL
, NULL
, NULL
,
169 PKCS7_NOCERTS
| PKCS7_PARTIAL
| PKCS7_BINARY
| PKCS7_DETACHED
| PKCS7_STREAM
);
170 ERR(!pkcs7
, "PKCS7_sign");
172 ERR(!PKCS7_sign_add_signer(pkcs7
, x509
, private_key
, digest_algo
, PKCS7_NOCERTS
| PKCS7_BINARY
),
173 "PKCS7_sign_add_signer");
174 ERR(PKCS7_final(pkcs7
, bm
, PKCS7_NOCERTS
| PKCS7_BINARY
) < 0,
180 ERR(asprintf(&pkcs7_name
, "%s.pkcs7", module_name
) < 0, "asprintf");
181 b
= BIO_new_file(pkcs7_name
, "wb");
182 ERR(!b
, "%s", pkcs7_name
);
183 ERR(i2d_PKCS7_bio_stream(b
, pkcs7
, NULL
, 0) < 0, "%s", pkcs7_name
);
190 /* Append the marker and the PKCS#7 message to the destination file */
191 ERR(BIO_reset(bm
) < 0, "%s", module_name
);
192 while ((n
= BIO_read(bm
, buf
, sizeof(buf
))),
194 ERR(BIO_write(bd
, buf
, n
) < 0, "%s", dest_name
);
196 ERR(n
< 0, "%s", module_name
);
197 module_size
= BIO_number_written(bd
);
199 ERR(i2d_PKCS7_bio_stream(bd
, pkcs7
, NULL
, 0) < 0, "%s", dest_name
);
200 pkcs7_size
= BIO_number_written(bd
) - module_size
;
201 sig_info
.sig_len
= htonl(pkcs7_size
);
202 ERR(BIO_write(bd
, &sig_info
, sizeof(sig_info
)) < 0, "%s", dest_name
);
203 ERR(BIO_write(bd
, magic_number
, sizeof(magic_number
) - 1) < 0, "%s", dest_name
);
205 ERR(BIO_free(bd
) < 0, "%s", dest_name
);
207 /* Finally, if we're signing in place, replace the original. */
209 ERR(rename(dest_name
, module_name
) < 0, "%s", dest_name
);