nhyatt/osslsigncode
1
0
Fork 0
mirror of https://github.com/mtrojnar/osslsigncode.git synced 2025-04-05 09:08:04 -05:00
Code Issues Projects Releases Wiki Activity

user-specified signing and/or verifying time (-time option)

Browse Source
This commit is contained in:
olszomal 2022-03-28 11:32:05 +02:00 committed by Michał Trojnara
parent 82185eef18
commit 8ba94fafd9
1 changed files with 41 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
osslsigncode.c
View File

@ -227,7 +227,7 @@ typedef struct {
char *desc; char *desc;
const EVP_MD *md; const EVP_MD *md;
char *url; char *url;
time_t signing_time; time_t time;
#ifdef ENABLE_CURL #ifdef ENABLE_CURL
char *turl[MAX_TS_SERVERS]; char *turl[MAX_TS_SERVERS];
int nturl; int nturl;
@ -731,13 +731,13 @@ static int asn1_simple_hdr_len(const u_char *p, int len)
* behaviour closer to signtool.exe (which doesn't include any non-trusted * behaviour closer to signtool.exe (which doesn't include any non-trusted
* time in this case.) * time in this case.)
*/ */
static int pkcs7_add_signing_time(PKCS7_SIGNER_INFO *si, time_t signing_time) static int pkcs7_add_signing_time(PKCS7_SIGNER_INFO *si, time_t time)
{ {
if (signing_time == INVALID_TIME) /* -st option was not specified */ if (time == INVALID_TIME) /* -time option was not specified */
return 1; /* success */ return 1; /* success */
return PKCS7_add_signed_attribute(si, return PKCS7_add_signed_attribute(si,
NID_pkcs9_signingTime, V_ASN1_UTCTIME, NID_pkcs9_signingTime, V_ASN1_UTCTIME,
ASN1_TIME_adj(NULL, signing_time, 0, 0)); ASN1_TIME_adj(NULL, time, 0, 0));
} }
static void tohex(const u_char *v, char *b, int len) static void tohex(const u_char *v, char *b, int len)
@ -1183,7 +1183,7 @@ static void usage(const char *argv0, const char *cmd)
printf("%12s[ -t <timestampurl> [ -t ... ] [ -p <proxy> ] [ -noverifypeer ]\n", ""); printf("%12s[ -t <timestampurl> [ -t ... ] [ -p <proxy> ] [ -noverifypeer ]\n", "");
printf("%12s[ -ts <timestampurl> [ -ts ... ] [ -p <proxy> ] [ -noverifypeer ] ]\n", ""); printf("%12s[ -ts <timestampurl> [ -ts ... ] [ -p <proxy> ] [ -noverifypeer ] ]\n", "");
#endif /* ENABLE_CURL */ #endif /* ENABLE_CURL */
printf("%12s[ -st <unix-time> ]\n", ""); printf("%12s[ -time <unix-time> ]\n", "");
printf("%12s[ -addUnauthenticatedBlob ]\n", ""); printf("%12s[ -addUnauthenticatedBlob ]\n", "");
printf("%12s[ -nest ]\n", ""); printf("%12s[ -nest ]\n", "");
printf("%12s[ -verbose ]\n", ""); printf("%12s[ -verbose ]\n", "");
@ -1207,6 +1207,7 @@ static void usage(const char *argv0, const char *cmd)
printf("%12s[ -CRLfile <infile> ]\n", ""); printf("%12s[ -CRLfile <infile> ]\n", "");
printf("%12s[ -TSA-CAfile <infile> ]\n", ""); printf("%12s[ -TSA-CAfile <infile> ]\n", "");
printf("%12s[ -TSA-CRLfile <infile> ]\n", ""); printf("%12s[ -TSA-CRLfile <infile> ]\n", "");
printf("%12s[ -time <unix-time> ]\n", "");
printf("%12s[ -h {md5,sha1,sha2(56),sha384,sha512} ]\n", ""); printf("%12s[ -h {md5,sha1,sha2(56),sha384,sha512} ]\n", "");
printf("%12s[ -require-leaf-hash {md5,sha1,sha2(56),sha384,sha512}:XXXXXXXXXXXX... ]\n", ""); printf("%12s[ -require-leaf-hash {md5,sha1,sha2(56),sha384,sha512}:XXXXXXXXXXXX... ]\n", "");
printf("%12s[ -nest ]\n", ""); printf("%12s[ -nest ]\n", "");
@ -1226,6 +1227,7 @@ static void usage(const char *argv0, const char *cmd)
printf("%12s[ -CRLfile <infile> ]\n", ""); printf("%12s[ -CRLfile <infile> ]\n", "");
printf("%12s[ -TSA-CAfile <infile> ]\n", ""); printf("%12s[ -TSA-CAfile <infile> ]\n", "");
printf("%12s[ -TSA-CRLfile <infile> ]\n", ""); printf("%12s[ -TSA-CRLfile <infile> ]\n", "");
printf("%12s[ -time <unix-time> ]\n", "");
printf("%12s[ -require-leaf-hash {md5,sha1,sha2(56),sha384,sha512}:XXXXXXXXXXXX... ]\n", ""); printf("%12s[ -require-leaf-hash {md5,sha1,sha2(56),sha384,sha512}:XXXXXXXXXXXX... ]\n", "");
printf("%12s[ -timestamp-expiration ]\n", ""); printf("%12s[ -timestamp-expiration ]\n", "");
printf("%12s[ -verbose ]\n\n", ""); printf("%12s[ -verbose ]\n\n", "");
@ -1242,7 +1244,7 @@ static void help_for(const char *argv0, const char *cmd)
const char *cmds_sign[] = {"sign", NULL}; const char *cmds_sign[] = {"sign", NULL};
const char *cmds_verify[] = {"verify", NULL}; const char *cmds_verify[] = {"verify", NULL};
const char *cmds_ac[] = {"sign", NULL}; const char *cmds_ac[] = {"sign", NULL};
const char *cmds_add_msi_dse[] = {"sign", NULL}; const char *cmds_add_msi_dse[] = {"add", "attach-signature", "sign", NULL};
const char *cmds_addUnauthenticatedBlob[] = {"sign", "add", NULL}; const char *cmds_addUnauthenticatedBlob[] = {"sign", "add", NULL};
#ifdef PROVIDE_ASKPASS #ifdef PROVIDE_ASKPASS
const char *cmds_askpass[] = {"sign", NULL}; const char *cmds_askpass[] = {"sign", NULL};
@ -1253,7 +1255,7 @@ static void help_for(const char *argv0, const char *cmd)
const char *cmds_comm[] = {"sign", NULL}; const char *cmds_comm[] = {"sign", NULL};
const char *cmds_CRLfile[] = {"attach-signature", "verify", NULL}; const char *cmds_CRLfile[] = {"attach-signature", "verify", NULL};
const char *cmds_CRLfileTSA[] = {"attach-signature", "verify", NULL}; const char *cmds_CRLfileTSA[] = {"attach-signature", "verify", NULL};
const char *cmds_h[] = {"sign", NULL}; const char *cmds_h[] = {"add", "attach-signature", "sign", NULL};
const char *cmds_i[] = {"sign", NULL}; const char *cmds_i[] = {"sign", NULL};
const char *cmds_in[] = {"add", "attach-signature", "extract-signature", "remove-signature", "sign", "verify", NULL}; const char *cmds_in[] = {"add", "attach-signature", "extract-signature", "remove-signature", "sign", "verify", NULL};
const char *cmds_jp[] = {"sign", NULL}; const char *cmds_jp[] = {"sign", NULL};
@ -1275,9 +1277,9 @@ static void help_for(const char *argv0, const char *cmd)
const char *cmds_pkcs11module[] = {"sign", NULL}; const char *cmds_pkcs11module[] = {"sign", NULL};
const char *cmds_pkcs12[] = {"sign", NULL}; const char *cmds_pkcs12[] = {"sign", NULL};
const char *cmds_readpass[] = {"sign", NULL}; const char *cmds_readpass[] = {"sign", NULL};
const char *cmds_require_leaf_hash[] = {"verify", NULL}; const char *cmds_require_leaf_hash[] = {"attach-signature", "verify", NULL};
const char *cmds_sigin[] = {"attach-signature", NULL}; const char *cmds_sigin[] = {"attach-signature", NULL};
const char *cmds_st[] = {"sign", NULL}; const char *cmds_time[] = {"attach-signature", "sign", "verify", NULL};
const char *cmds_timestamp_expiration[] = {"verify", NULL}; const char *cmds_timestamp_expiration[] = {"verify", NULL};
#ifdef ENABLE_CURL #ifdef ENABLE_CURL
const char *cmds_t[] = {"add", "sign", NULL}; const char *cmds_t[] = {"add", "sign", NULL};
@ -1395,9 +1397,9 @@ static void help_for(const char *argv0, const char *cmd)
if (on_list(cmd, cmds_pkcs11cert)) if (on_list(cmd, cmds_pkcs11cert))
printf("%-24s= PKCS#11 URI identifies a certificate in the token\n", "-pkcs11cert"); printf("%-24s= PKCS#11 URI identifies a certificate in the token\n", "-pkcs11cert");
if (on_list(cmd, cmds_pkcs11engine)) if (on_list(cmd, cmds_pkcs11engine))
printf("%-24s= PKCS11 engine\n", "-pkcs11engine"); printf("%-24s= PKCS#11 engine\n", "-pkcs11engine");
if (on_list(cmd, cmds_pkcs11module)) if (on_list(cmd, cmds_pkcs11module))
printf("%-24s= PKCS11 module\n", "-pkcs11module"); printf("%-24s= PKCS#11 module\n", "-pkcs11module");
if (on_list(cmd, cmds_pkcs12)) if (on_list(cmd, cmds_pkcs12))
printf("%-24s= PKCS#12 container with the certificate and the private key\n", "-pkcs12"); printf("%-24s= PKCS#12 container with the certificate and the private key\n", "-pkcs12");
if (on_list(cmd, cmds_readpass)) if (on_list(cmd, cmds_readpass))
@ -1410,8 +1412,6 @@ static void help_for(const char *argv0, const char *cmd)
} }
if (on_list(cmd, cmds_sigin)) if (on_list(cmd, cmds_sigin))
printf("%-24s= a file containing the signature to be attached\n", "-sigin"); printf("%-24s= a file containing the signature to be attached\n", "-sigin");
if (on_list(cmd, cmds_st))
printf("%-24s= the unix-time to set the signing time\n", "-st");
if (on_list(cmd, cmds_timestamp_expiration)) if (on_list(cmd, cmds_timestamp_expiration))
printf("%-24s= verify a finite lifetime of the TSA private key\n", "-timestamp-expiration"); printf("%-24s= verify a finite lifetime of the TSA private key\n", "-timestamp-expiration");
#ifdef ENABLE_CURL #ifdef ENABLE_CURL
@ -1425,14 +1425,14 @@ static void help_for(const char *argv0, const char *cmd)
printf("%26sthis option cannot be used with the -t option\n", ""); printf("%26sthis option cannot be used with the -t option\n", "");
} }
#endif /* ENABLE_CURL */ #endif /* ENABLE_CURL */
if (on_list(cmd, cmds_CAfileTSA)) { if (on_list(cmd, cmds_time))
printf("%-24s= the unix-time to set the signing and/or verifying time\n", "-time");
if (on_list(cmd, cmds_CAfileTSA))
printf("%-24s= the file containing one or more Time-Stamp Authority certificates in PEM format\n", "-TSA-CAfile"); printf("%-24s= the file containing one or more Time-Stamp Authority certificates in PEM format\n", "-TSA-CAfile");
}
if (on_list(cmd, cmds_CRLfileTSA)) if (on_list(cmd, cmds_CRLfileTSA))
printf("%-24s= the file containing one or more Time-Stamp Authority CRLs in PEM format\n", "-TSA-CRLfile"); printf("%-24s= the file containing one or more Time-Stamp Authority CRLs in PEM format\n", "-TSA-CRLfile");
if (on_list(cmd, cmds_verbose)) { if (on_list(cmd, cmds_verbose))
printf("%-24s= include additional output in the log\n", "-verbose"); printf("%-24s= include additional output in the log\n", "-verbose");
}
usage(argv0, cmd); usage(argv0, cmd);
} }
@ -2601,7 +2601,7 @@ static int append_nested_signature(STACK_OF(X509_ATTRIBUTE) **unauth_attr, u_cha
* pkcs7_set_nested_signature adds the p7nest signature to p7 * pkcs7_set_nested_signature adds the p7nest signature to p7
* as a nested signature (SPC_NESTED_SIGNATURE). * as a nested signature (SPC_NESTED_SIGNATURE).
*/ */
static int pkcs7_set_nested_signature(PKCS7 *p7, PKCS7 *p7nest, time_t signing_time) static int pkcs7_set_nested_signature(PKCS7 *p7, PKCS7 *p7nest, time_t time)
{ {
u_char *p = NULL; u_char *p = NULL;
int len = 0; int len = 0;
@ -2619,7 +2619,7 @@ static int pkcs7_set_nested_signature(PKCS7 *p7, PKCS7 *p7nest, time_t signing_t
i2d_PKCS7(p7nest, &p); i2d_PKCS7(p7nest, &p);
p -= len; p -= len;
pkcs7_add_signing_time(si, signing_time); pkcs7_add_signing_time(si, time);
if (!append_nested_signature(&(si->unauth_attr), p, len)) { if (!append_nested_signature(&(si->unauth_attr), p, len)) {
OPENSSL_free(p); OPENSSL_free(p);
return 0; /* FAILED */ return 0; /* FAILED */
@ -2756,7 +2756,6 @@ static int verify_timestamp(SIGNATURE *signature, GLOBAL_OPTIONS *options)
printf("TSA's CRL distribution point: %s\n", url); printf("TSA's CRL distribution point: %s\n", url);
OPENSSL_free(url); OPENSSL_free(url);
} }
printf("\n");
/* verify a Certificate Revocation List */ /* verify a Certificate Revocation List */
crls = signature->p7->d.sign->crl; crls = signature->p7->d.sign->crl;
@ -2808,10 +2807,22 @@ static int verify_authenticode(SIGNATURE *signature, GLOBAL_OPTIONS *options, X5
X509_STORE_free(store); X509_STORE_free(store);
goto out; goto out;
} }
if (signature->time != INVALID_TIME && !set_store_time(store, signature->time)) { if (options->time != INVALID_TIME) {
printf("Failed to set store time\n"); printf("Signature verification time: ");
X509_STORE_free(store); print_time_t(options->time);
goto out; if (!set_store_time(store, options->time)) {
printf("Failed to set verifying time\n");
X509_STORE_free(store);
goto out;
}
} else if (signature->time != INVALID_TIME) {
printf("Signature verification time: ");
print_time_t(signature->time);
if (!set_store_time(store, signature->time)) {
printf("Failed to set signature time\n");
X509_STORE_free(store);
goto out;
}
} }
/* verify a PKCS#7 signedData structure */ /* verify a PKCS#7 signedData structure */
@ -4473,7 +4484,7 @@ static PKCS7 *create_new_signature(file_type_t type,
return NULL; /* FAILED */ return NULL; /* FAILED */
} }
} }
pkcs7_add_signing_time(si, options->signing_time); pkcs7_add_signing_time(si, options->time);
if (type == FILE_TYPE_CAT) { if (type == FILE_TYPE_CAT) {
PKCS7_add_signed_attribute(si, NID_pkcs9_contentType, PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
V_ASN1_OBJECT, OBJ_txt2obj(MS_CTL_OBJID, 1)); V_ASN1_OBJECT, OBJ_txt2obj(MS_CTL_OBJID, 1));
@ -4567,7 +4578,7 @@ static int append_signature(PKCS7 *sig, PKCS7 *cursig, file_type_t type,
printf("Internal error: No 'cursig' was extracted\n"); printf("Internal error: No 'cursig' was extracted\n");
return 1; /* FAILED */ return 1; /* FAILED */
} }
if (pkcs7_set_nested_signature(cursig, sig, options->signing_time) == 0) { if (pkcs7_set_nested_signature(cursig, sig, options->time) == 0) {
printf("Unable to append the nested signature to the current signature\n"); printf("Unable to append the nested signature to the current signature\n");
return 1; /* FAILED */ return 1; /* FAILED */
} }
@ -5612,7 +5623,7 @@ static int main_configure(int argc, char **argv, cmd_type_t *cmd, GLOBAL_OPTIONS
argc--; argc--;
} }
options->md = EVP_sha256(); options->md = EVP_sha256();
options->signing_time = INVALID_TIME; options->time = INVALID_TIME;
options->jp = -1; options->jp = -1;
if (*cmd == CMD_HELP) { if (*cmd == CMD_HELP) {
@ -5753,12 +5764,13 @@ static int main_configure(int argc, char **argv, cmd_type_t *cmd, GLOBAL_OPTIONS
return 0; /* FAILED */ return 0; /* FAILED */
} }
options->url = *(++argv); options->url = *(++argv);
} else if ((*cmd == CMD_SIGN) && !strcmp(*argv, "-st")) { } else if ((*cmd == CMD_ATTACH || *cmd == CMD_SIGN || *cmd == CMD_VERIFY)
&& (!strcmp(*argv, "-time") || !strcmp(*argv, "-st"))) {
if (--argc < 1) { if (--argc < 1) {
usage(argv0, "all"); usage(argv0, "all");
return 0; /* FAILED */ return 0; /* FAILED */
} }
options->signing_time = (time_t)strtoul(*(++argv), NULL, 10); options->time = (time_t)strtoul(*(++argv), NULL, 10);
#ifdef ENABLE_CURL #ifdef ENABLE_CURL
} else if ((*cmd == CMD_SIGN || *cmd == CMD_ADD) && !strcmp(*argv, "-t")) { } else if ((*cmd == CMD_SIGN || *cmd == CMD_ADD) && !strcmp(*argv, "-t")) {
if (--argc < 1) { if (--argc < 1) {