1 files changed, 406 insertions, 92 deletions
diff --git a/scripts/sign-file b/scripts/sign-file
index e58e34e50ac5..87ca59d36e7e 100644..100755
--- a/scripts/sign-file
+++ b/scripts/sign-file
@@ -1,115 +1,429 @@
-#!/bin/sh
+#!/usr/bin/perl -w
 #
 # Sign a module file using the given key.
 #
-# Format: sign-file <key> <x509> <src-file> <dst-file>
+# Format:
-#
+#
+#       ./scripts/sign-file [-v] <key> <x509> <module> [<dest>]
-scripts=`dirname $0`
+#
+#
-CONFIG_MODULE_SIG_SHA512=y
+use strict;
-if [ -r .config ]
+use FileHandle;
-then
+use IPC::Open2;
-    . ./.config
-fi
+my $verbose = 0;
+if ($#ARGV >= 0 && $ARGV[0] eq "-v") {
-key="$1"
+    $verbose = 1;
-x509="$2"
+    shift;
-src="$3"
+}
-dst="$4"
+die "Format: ./scripts/sign-file [-v] <key> <x509> <module> [<dest>]\n"
-if [ ! -r "$key" ]
+    if ($#ARGV != 2 && $#ARGV != 3);
-then
-    echo "Can't read private key" >&2
+my $private_key = $ARGV[0];
-    exit 2
+my $x509 = $ARGV[1];
-fi
+my $module = $ARGV[2];
+my $dest = ($#ARGV == 3) ? $ARGV[3] : $ARGV[2] . "~";
-if [ ! -r "$x509" ]
-then
+die "Can't read private key\n" unless (-r $private_key);
-    echo "Can't read X.509 certificate" >&2
+die "Can't read X.509 certificate\n" unless (-r $x509);
-    exit 2
+die "Can't read module\n" unless (-r $module);
-fi
-if [ ! -r "$x509.signer" ]
+#
-then
+# Read the kernel configuration
-    echo "Can't read Signer name" >&2
+#
-    exit 2;
+my %config = (
-fi
+    CONFIG_MODULE_SIG_SHA512 => 1
-if [ ! -r "$x509.keyid" ]
+    );
-then
-    echo "Can't read Key identifier" >&2
+if (-r ".config") {
-    exit 2;
+    open(FD, "<.config") || die ".config";
-fi
+    while (<FD>) {
+        if ($_ =~ /^(CONFIG_.*)=[ym]/) {
+            $config{$1} = 1;
+        }
+    }
+    close(FD);
+}
+#
+# Function to read the contents of a file into a variable.
+#
+sub read_file($)
+{
+    my ($file) = @_;
+    my $contents;
+    my $len;
+    open(FD, "<$file") || die $file;
+    binmode FD;
+    my @st = stat(FD);
+    die $file if (!@st);
+    $len = read(FD, $contents, $st[7]) || die $file;
+    close(FD) || die $file;
+    die "$file: Wanted length ", $st[7], ", got ", $len, "\n"
+        if ($len != $st[7]);
+    return $contents;
+}
+###############################################################################
+#
+# First of all, we have to parse the X.509 certificate to find certain details
+# about it.
+#
+# We read the DER-encoded X509 certificate and parse it to extract the Subject
+# name and Subject Key Identifier.  Theis provides the data we need to build
+# the certificate identifier.
+#
+# The signer's name part of the identifier is fabricated from the commonName,
+# the organizationName or the emailAddress components of the X.509 subject
+# name.
+#
+# The subject key ID is used to select which of that signer's certificates
+# we're intending to use to sign the module.
+#
+###############################################################################
+my $x509_certificate = read_file($x509);
+my $UNIV = 0 << 6;
+my $APPL = 1 << 6;
+my $CONT = 2 << 6;
+my $PRIV = 3 << 6;
+my $CONS = 0x20;
+my $BOOLEAN     = 0x01;
+my $INTEGER     = 0x02;
+my $BIT_STRING  = 0x03;
+my $OCTET_STRING = 0x04;
+my $NULL        = 0x05;
+my $OBJ_ID      = 0x06;
+my $UTF8String  = 0x0c;
+my $SEQUENCE    = 0x10;
+my $SET         = 0x11;
+my $UTCTime     = 0x17;
+my $GeneralizedTime = 0x18;
+my %OIDs = (
+    pack("CCC", 85, 4, 3)       => "commonName",
+    pack("CCC", 85, 4, 6)       => "countryName",
+    pack("CCC", 85, 4, 10)      => "organizationName",
+    pack("CCC", 85, 4, 11)      => "organizationUnitName",
+    pack("CCCCCCCCC", 42, 134, 72, 134, 247, 13, 1, 1, 1) => "rsaEncryption",
+    pack("CCCCCCCCC", 42, 134, 72, 134, 247, 13, 1, 1, 5) => "sha1WithRSAEncryption",
+    pack("CCCCCCCCC", 42, 134, 72, 134, 247, 13, 1, 9, 1) => "emailAddress",
+    pack("CCC", 85, 29, 35)     => "authorityKeyIdentifier",
+    pack("CCC", 85, 29, 14)     => "subjectKeyIdentifier",
+    pack("CCC", 85, 29, 19)     => "basicConstraints"
+);
+###############################################################################
+#
+# Extract an ASN.1 element from a string and return information about it.
+#
+###############################################################################
+sub asn1_extract($$@)
+{
+    my ($cursor, $expected_tag, $optional) = @_;
+    return [ -1 ]
+        if ($cursor->[1] == 0 && $optional);
+    die $x509, ": ", $cursor->[0], ": ASN.1 data underrun (elem ", $cursor->[1], ")\n"
+        if ($cursor->[1] < 2);
+    my ($tag, $len) = unpack("CC", substr(${$cursor->[2]}, $cursor->[0], 2));
+    if ($expected_tag != -1 && $tag != $expected_tag) {
+        return [ -1 ]
+            if ($optional);
+        die $x509, ": ", $cursor->[0], ": ASN.1 unexpected tag (", $tag,
+        " not ", $expected_tag, ")\n";
+    }
+    $cursor->[0] += 2;
+    $cursor->[1] -= 2;
+    die $x509, ": ", $cursor->[0], ": ASN.1 long tag\n"
+        if (($tag & 0x1f) == 0x1f);
+    die $x509, ": ", $cursor->[0], ": ASN.1 indefinite length\n"
+        if ($len == 0x80);
+    if ($len > 0x80) {
+        my $l = $len - 0x80;
+        die $x509, ": ", $cursor->[0], ": ASN.1 data underrun (len len $l)\n"
+            if ($cursor->[1] < $l);
+        if ($l == 0x1) {
+            $len = unpack("C", substr(${$cursor->[2]}, $cursor->[0], 1));
+        } elsif ($l = 0x2) {
+            $len = unpack("n", substr(${$cursor->[2]}, $cursor->[0], 2));
+        } elsif ($l = 0x3) {
+            $len = unpack("C", substr(${$cursor->[2]}, $cursor->[0], 1)) << 16;
+            $len = unpack("n", substr(${$cursor->[2]}, $cursor->[0] + 1, 2));
+        } elsif ($l = 0x4) {
+            $len = unpack("N", substr(${$cursor->[2]}, $cursor->[0], 4));
+        } else {
+            die $x509, ": ", $cursor->[0], ": ASN.1 element too long (", $l, ")\n";
+        }
+        $cursor->[0] += $l;
+        $cursor->[1] -= $l;
+    }
+    die $x509, ": ", $cursor->[0], ": ASN.1 data underrun (", $len, ")\n"
+        if ($cursor->[1] < $len);
+    my $ret = [ $tag, [ $cursor->[0], $len, $cursor->[2] ] ];
+    $cursor->[0] += $len;
+    $cursor->[1] -= $len;
+    return $ret;
+}
+###############################################################################
+#
+# Retrieve the data referred to by a cursor
+#
+###############################################################################
+sub asn1_retrieve($)
+{
+    my ($cursor) = @_;
+    my ($offset, $len, $data) = @$cursor;
+    return substr($$data, $offset, $len);
+}
+###############################################################################
+#
+# Roughly parse the X.509 certificate
+#
+###############################################################################
+my $cursor = [ 0, length($x509_certificate), \$x509_certificate ];
+my $cert = asn1_extract($cursor, $UNIV | $CONS | $SEQUENCE);
+my $tbs = asn1_extract($cert->[1], $UNIV | $CONS | $SEQUENCE);
+my $version = asn1_extract($tbs->[1], $CONT | $CONS | 0, 1);
+my $serial_number = asn1_extract($tbs->[1], $UNIV | $INTEGER);
+my $sig_type = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
+my $issuer = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
+my $validity = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
+my $subject = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
+my $key = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
+my $issuer_uid = asn1_extract($tbs->[1], $CONT | $CONS | 1, 1);
+my $subject_uid = asn1_extract($tbs->[1], $CONT | $CONS | 2, 1);
+my $extension_list = asn1_extract($tbs->[1], $CONT | $CONS | 3, 1);
+my $subject_key_id = ();
+my $authority_key_id = ();
+#
+# Parse the extension list
+#
+if ($extension_list->[0] != -1) {
+    my $extensions = asn1_extract($extension_list->[1], $UNIV | $CONS | $SEQUENCE);
+    while ($extensions->[1]->[1] > 0) {
+        my $ext = asn1_extract($extensions->[1], $UNIV | $CONS | $SEQUENCE);
+        my $x_oid = asn1_extract($ext->[1], $UNIV | $OBJ_ID);
+        my $x_crit = asn1_extract($ext->[1], $UNIV | $BOOLEAN, 1);
+        my $x_val = asn1_extract($ext->[1], $UNIV | $OCTET_STRING);
+        my $raw_oid = asn1_retrieve($x_oid->[1]);
+        next if (!exists($OIDs{$raw_oid}));
+        my $x_type = $OIDs{$raw_oid};
+        my $raw_value = asn1_retrieve($x_val->[1]);
+        if ($x_type eq "subjectKeyIdentifier") {
+            my $vcursor = [ 0, length($raw_value), \$raw_value ];
+            $subject_key_id = asn1_extract($vcursor, $UNIV | $OCTET_STRING);
+        }
+    }
+}
+###############################################################################
+#
+# Determine what we're going to use as the signer's name.  In order of
+# preference, take one of: commonName, organizationName or emailAddress.
+#
+###############################################################################
+my $org = "";
+my $cn = "";
+my $email = "";
+while ($subject->[1]->[1] > 0) {
+    my $rdn = asn1_extract($subject->[1], $UNIV | $CONS | $SET);
+    my $attr = asn1_extract($rdn->[1], $UNIV | $CONS | $SEQUENCE);
+    my $n_oid = asn1_extract($attr->[1], $UNIV | $OBJ_ID);
+    my $n_val = asn1_extract($attr->[1], -1);
+    my $raw_oid = asn1_retrieve($n_oid->[1]);
+    next if (!exists($OIDs{$raw_oid}));
+    my $n_type = $OIDs{$raw_oid};
+    my $raw_value = asn1_retrieve($n_val->[1]);
+    if ($n_type eq "organizationName") {
+        $org = $raw_value;
+    } elsif ($n_type eq "commonName") {
+        $cn = $raw_value;
+    } elsif ($n_type eq "emailAddress") {
+        $email = $raw_value;
+    }
+}
+my $signers_name = $email;
+if ($org && $cn) {
+    # Don't use the organizationName if the commonName repeats it
+    if (length($org) <= length($cn) &&
+        substr($cn, 0, length($org)) eq $org) {
+        $signers_name = $cn;
+        goto got_id_name;
+    }
+    # Or a signifcant chunk of it
+    if (length($org) >= 7 &&
+        length($cn) >= 7 &&
+        substr($cn, 0, 7) eq substr($org, 0, 7)) {
+        $signers_name = $cn;
+        goto got_id_name;
+    }
+    $signers_name = $org . ": " . $cn;
+} elsif ($org) {
+    $signers_name = $org;
+} elsif ($cn) {
+    $signers_name = $cn;
+}
+got_id_name:
+die $x509, ": ", "X.509: Couldn't find the Subject Key Identifier extension\n"
+    if (!$subject_key_id);
+my $key_identifier = asn1_retrieve($subject_key_id->[1]);
+###############################################################################
+#
+# Create and attach the module signature
+#
+###############################################################################
 #
 # Signature parameters
 #
-algo=1          # Public-key crypto algorithm: RSA
+my $algo = 1;           # Public-key crypto algorithm: RSA
-hash=           # Digest algorithm
+my $hash = 0;           # Digest algorithm
-id_type=1       # Identifier type: X.509
+my $id_type = 1;        # Identifier type: X.509
 #
 # Digest the data
 #
-dgst=
+my ($dgst, $prologue) = ();
-if [ "$CONFIG_MODULE_SIG_SHA1" = "y" ]
+if (exists $config{"CONFIG_MODULE_SIG_SHA1"}) {
-then
+    $prologue = pack("C*",
-    prologue="0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A, 0x05, 0x00, 0x04, 0x14"
+                     0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
-    dgst=-sha1
+                     0x2B, 0x0E, 0x03, 0x02, 0x1A,
-    hash=2
+                     0x05, 0x00, 0x04, 0x14);
-elif [ "$CONFIG_MODULE_SIG_SHA224" = "y" ]
+    $dgst = "-sha1";
-then
+    $hash = 2;
-    prologue="0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, 0x05, 0x00, 0x04, 0x1C"
+} elsif (exists $config{"CONFIG_MODULE_SIG_SHA224"}) {
-    dgst=-sha224
+    $prologue = pack("C*",
-    hash=7
+                     0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
-elif [ "$CONFIG_MODULE_SIG_SHA256" = "y" ]
+                     0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
-then
+                     0x05, 0x00, 0x04, 0x1C);
-    prologue="0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20"
+    $dgst = "-sha224";
-    dgst=-sha256
+    $hash = 7;
-    hash=4
+} elsif (exists $config{"CONFIG_MODULE_SIG_SHA256"}) {
-elif [ "$CONFIG_MODULE_SIG_SHA384" = "y" ]
+    $prologue = pack("C*",
-then
+                     0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
-    prologue="0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30"
+                     0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
-    dgst=-sha384
+                     0x05, 0x00, 0x04, 0x20);
-    hash=5
+    $dgst = "-sha256";
-elif [ "$CONFIG_MODULE_SIG_SHA512" = "y" ]
+    $hash = 4;
-then
+} elsif (exists $config{"CONFIG_MODULE_SIG_SHA384"}) {
-    prologue="0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40"
+    $prologue = pack("C*",
-    dgst=-sha512
+                     0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
-    hash=6
+                     0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
-else
+                     0x05, 0x00, 0x04, 0x30);
-    echo "$0: Can't determine hash algorithm" >&2
+    $dgst = "-sha384";
-    exit 2
+    $hash = 5;
-fi
+} elsif (exists $config{"CONFIG_MODULE_SIG_SHA512"}) {
+    $prologue = pack("C*",
-(
+                     0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
-perl -e "binmode STDOUT; print pack(\"C*\", $prologue)" || exit $?
+                     0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
-openssl dgst $dgst -binary $src || exit $?
+                     0x05, 0x00, 0x04, 0x40);
-) >$src.dig || exit $?
+    $dgst = "-sha512";
+    $hash = 6;
+} else {
+    die "Can't determine hash algorithm";
+}
+#
+# Generate the digest and read from openssl's stdout
+#
+my $digest;
+$digest = readpipe("openssl dgst $dgst -binary $module") || die "openssl dgst";
 #
 # Generate the binary signature, which will be just the integer that comprises
 # the signature with no metadata attached.
 #
-openssl rsautl -sign -inkey $key -keyform PEM -in $src.dig -out $src.sig || exit $?
+my $pid;
-signerlen=`stat -c %s $x509.signer`
+$pid = open2(*read_from, *write_to,
-keyidlen=`stat -c %s $x509.keyid`
+             "openssl rsautl -sign -inkey $private_key -keyform PEM") ||
-siglen=`stat -c %s $src.sig`
+    die "openssl rsautl";
+binmode write_to;
+print write_to $prologue . $digest || die "pipe to openssl rsautl";
+close(write_to) || die "pipe to openssl rsautl";
+binmode read_from;
+my $signature;
+read(read_from, $signature, 4096) || die "pipe from openssl rsautl";
+close(read_from) || die "pipe from openssl rsautl";
+$signature = pack("n", length($signature)) . $signature,
+waitpid($pid, 0) || die;
+die "openssl rsautl died: $?" if ($? >> 8);
 #
 # Build the signed binary
 #
-(
+my $unsigned_module = read_file($module);
-    cat $src || exit $?
-    echo '~Module signature appended~' || exit $?
+my $magic_number = "~Module signature appended~\n";
-    cat $x509.signer $x509.keyid || exit $?
+my $info = pack("CCCCCxxxN",
+                $algo, $hash, $id_type,
+                length($signers_name),
+                length($key_identifier),
+                length($signature));
-    # Preface each signature integer with a 2-byte BE length
+if ($verbose) {
-    perl -e "binmode STDOUT; print pack(\"n\", $siglen)" || exit $?
+    print "Size of unsigned module: ", length($unsigned_module), "\n";
-    cat $src.sig || exit $?
+    print "Size of signer's name  : ", length($signers_name), "\n";
+    print "Size of key identifier : ", length($key_identifier), "\n";
+    print "Size of signature      : ", length($signature), "\n";
+    print "Size of informaton     : ", length($info), "\n";
+    print "Size of magic number   : ", length($magic_number), "\n";
+    print "Signer's name          : '", $signers_name, "'\n";
+    print "Digest                 : $dgst\n";
+}
-    # Generate the information block
+open(FD, ">$dest") || die $dest;
-    perl -e "binmode STDOUT; print pack(\"CCCCCxxxN\", $algo, $hash, $id_type, $signerlen, $keyidlen, $siglen + 2)" || exit $?
+binmode FD;
-) >$dst~ || exit $?
+print FD
+    $unsigned_module,
+    $signers_name,
+    $key_identifier,
+    $signature,
+    $info,
+    $magic_number
+    ;
+close FD || die $dest;
-# Permit in-place signing
+if ($#ARGV != 3) {
-mv $dst~ $dst || exit $?
+    rename($dest, $module) || die $module;
+}

diff --git a/scripts/sign-file b/scripts/sign-file index e58e34e50ac5..87ca59d36e7e 100644..100755 --- a/scripts/sign-file +++ b/scripts/sign-file
@@ -1,115 +1,429 @@
1	#!/bin/sh	1	#!/usr/bin/perl -w
2	#	2	#
3	# Sign a module file using the given key.	3	# Sign a module file using the given key.
4	#	4	#
5	# Format: sign-file <key> <x509> <src-file> <dst-file>	5	# Format:
6	#	6	#
7		7	# ./scripts/sign-file [-v] <key> <x509> <module> [<dest>]
8	scripts=`dirname $0`	8	#
9		9	#
10	CONFIG_MODULE_SIG_SHA512=y	10	use strict;
11	if [ -r .config ]	11	use FileHandle;
12	then	12	use IPC::Open2;
13	. ./.config	13
14	fi	14	my $verbose = 0;
15		15	if ($#ARGV >= 0 && $ARGV[0] eq "-v") {
16	key="$1"	16	$verbose = 1;
17	x509="$2"	17	shift;
18	src="$3"	18	}
19	dst="$4"	19
20		20	die "Format: ./scripts/sign-file [-v] <key> <x509> <module> [<dest>]\n"
21	if [ ! -r "$key" ]	21	if ($#ARGV != 2 && $#ARGV != 3);
22	then	22
23	echo "Can't read private key" >&2	23	my $private_key = $ARGV[0];
24	exit 2	24	my $x509 = $ARGV[1];
25	fi	25	my $module = $ARGV[2];
26		26	my $dest = ($#ARGV == 3) ? $ARGV[3] : $ARGV[2] . "~";
27	if [ ! -r "$x509" ]	27
28	then	28	die "Can't read private key\n" unless (-r $private_key);
29	echo "Can't read X.509 certificate" >&2	29	die "Can't read X.509 certificate\n" unless (-r $x509);
30	exit 2	30	die "Can't read module\n" unless (-r $module);
31	fi	31
32	if [ ! -r "$x509.signer" ]	32	#
33	then	33	# Read the kernel configuration
34	echo "Can't read Signer name" >&2	34	#
35	exit 2;	35	my %config = (
36	fi	36	CONFIG_MODULE_SIG_SHA512 => 1
37	if [ ! -r "$x509.keyid" ]	37	);
38	then	38
39	echo "Can't read Key identifier" >&2	39	if (-r ".config") {
40	exit 2;	40	open(FD, "<.config") \|\| die ".config";
41	fi	41	while (<FD>) {
		42	if ($_ =~ /^(CONFIG_.*)=[ym]/) {
		43	$config{$1} = 1;
		44	}
		45	}
		46	close(FD);
		47	}
		48
		49	#
		50	# Function to read the contents of a file into a variable.
		51	#
		52	sub read_file($)
		53	{
		54	my ($file) = @_;
		55	my $contents;
		56	my $len;
		57
		58	open(FD, "<$file") \|\| die $file;
		59	binmode FD;
		60	my @st = stat(FD);
		61	die $file if (!@st);
		62	$len = read(FD, $contents, $st[7]) \|\| die $file;
		63	close(FD) \|\| die $file;
		64	die "$file: Wanted length ", $st[7], ", got ", $len, "\n"
		65	if ($len != $st[7]);
		66	return $contents;
		67	}
		68
		69	###############################################################################
		70	#
		71	# First of all, we have to parse the X.509 certificate to find certain details
		72	# about it.
		73	#
		74	# We read the DER-encoded X509 certificate and parse it to extract the Subject
		75	# name and Subject Key Identifier. Theis provides the data we need to build
		76	# the certificate identifier.
		77	#
		78	# The signer's name part of the identifier is fabricated from the commonName,
		79	# the organizationName or the emailAddress components of the X.509 subject
		80	# name.
		81	#
		82	# The subject key ID is used to select which of that signer's certificates
		83	# we're intending to use to sign the module.
		84	#
		85	###############################################################################
		86	my $x509_certificate = read_file($x509);
		87
		88	my $UNIV = 0 << 6;
		89	my $APPL = 1 << 6;
		90	my $CONT = 2 << 6;
		91	my $PRIV = 3 << 6;
		92
		93	my $CONS = 0x20;
		94
		95	my $BOOLEAN = 0x01;
		96	my $INTEGER = 0x02;
		97	my $BIT_STRING = 0x03;
		98	my $OCTET_STRING = 0x04;
		99	my $NULL = 0x05;
		100	my $OBJ_ID = 0x06;
		101	my $UTF8String = 0x0c;
		102	my $SEQUENCE = 0x10;
		103	my $SET = 0x11;
		104	my $UTCTime = 0x17;
		105	my $GeneralizedTime = 0x18;
		106
		107	my %OIDs = (
		108	pack("CCC", 85, 4, 3) => "commonName",
		109	pack("CCC", 85, 4, 6) => "countryName",
		110	pack("CCC", 85, 4, 10) => "organizationName",
		111	pack("CCC", 85, 4, 11) => "organizationUnitName",
		112	pack("CCCCCCCCC", 42, 134, 72, 134, 247, 13, 1, 1, 1) => "rsaEncryption",
		113	pack("CCCCCCCCC", 42, 134, 72, 134, 247, 13, 1, 1, 5) => "sha1WithRSAEncryption",
		114	pack("CCCCCCCCC", 42, 134, 72, 134, 247, 13, 1, 9, 1) => "emailAddress",
		115	pack("CCC", 85, 29, 35) => "authorityKeyIdentifier",
		116	pack("CCC", 85, 29, 14) => "subjectKeyIdentifier",
		117	pack("CCC", 85, 29, 19) => "basicConstraints"
		118	);
		119
		120	###############################################################################
		121	#
		122	# Extract an ASN.1 element from a string and return information about it.
		123	#
		124	###############################################################################
		125	sub asn1_extract($$@)
		126	{
		127	my ($cursor, $expected_tag, $optional) = @_;
		128
		129	return [ -1 ]
		130	if ($cursor->[1] == 0 && $optional);
		131
		132	die $x509, ": ", $cursor->[0], ": ASN.1 data underrun (elem ", $cursor->[1], ")\n"
		133	if ($cursor->[1] < 2);
		134
		135	my ($tag, $len) = unpack("CC", substr(${$cursor->[2]}, $cursor->[0], 2));
		136
		137	if ($expected_tag != -1 && $tag != $expected_tag) {
		138	return [ -1 ]
		139	if ($optional);
		140	die $x509, ": ", $cursor->[0], ": ASN.1 unexpected tag (", $tag,
		141	" not ", $expected_tag, ")\n";
		142	}
		143
		144	$cursor->[0] += 2;
		145	$cursor->[1] -= 2;
		146
		147	die $x509, ": ", $cursor->[0], ": ASN.1 long tag\n"
		148	if (($tag & 0x1f) == 0x1f);
		149	die $x509, ": ", $cursor->[0], ": ASN.1 indefinite length\n"
		150	if ($len == 0x80);
		151
		152	if ($len > 0x80) {
		153	my $l = $len - 0x80;
		154	die $x509, ": ", $cursor->[0], ": ASN.1 data underrun (len len $l)\n"
		155	if ($cursor->[1] < $l);
		156
		157	if ($l == 0x1) {
		158	$len = unpack("C", substr(${$cursor->[2]}, $cursor->[0], 1));
		159	} elsif ($l = 0x2) {
		160	$len = unpack("n", substr(${$cursor->[2]}, $cursor->[0], 2));
		161	} elsif ($l = 0x3) {
		162	$len = unpack("C", substr(${$cursor->[2]}, $cursor->[0], 1)) << 16;
		163	$len = unpack("n", substr(${$cursor->[2]}, $cursor->[0] + 1, 2));
		164	} elsif ($l = 0x4) {
		165	$len = unpack("N", substr(${$cursor->[2]}, $cursor->[0], 4));
		166	} else {
		167	die $x509, ": ", $cursor->[0], ": ASN.1 element too long (", $l, ")\n";
		168	}
		169
		170	$cursor->[0] += $l;
		171	$cursor->[1] -= $l;
		172	}
		173
		174	die $x509, ": ", $cursor->[0], ": ASN.1 data underrun (", $len, ")\n"
		175	if ($cursor->[1] < $len);
		176
		177	my $ret = [ $tag, [ $cursor->[0], $len, $cursor->[2] ] ];
		178	$cursor->[0] += $len;
		179	$cursor->[1] -= $len;
		180
		181	return $ret;
		182	}
		183
		184	###############################################################################
		185	#
		186	# Retrieve the data referred to by a cursor
		187	#
		188	###############################################################################
		189	sub asn1_retrieve($)
		190	{
		191	my ($cursor) = @_;
		192	my ($offset, $len, $data) = @$cursor;
		193	return substr($$data, $offset, $len);
		194	}
		195
		196	###############################################################################
		197	#
		198	# Roughly parse the X.509 certificate
		199	#
		200	###############################################################################
		201	my $cursor = [ 0, length($x509_certificate), \$x509_certificate ];
		202
		203	my $cert = asn1_extract($cursor, $UNIV \| $CONS \| $SEQUENCE);
		204	my $tbs = asn1_extract($cert->[1], $UNIV \| $CONS \| $SEQUENCE);
		205	my $version = asn1_extract($tbs->[1], $CONT \| $CONS \| 0, 1);
		206	my $serial_number = asn1_extract($tbs->[1], $UNIV \| $INTEGER);
		207	my $sig_type = asn1_extract($tbs->[1], $UNIV \| $CONS \| $SEQUENCE);
		208	my $issuer = asn1_extract($tbs->[1], $UNIV \| $CONS \| $SEQUENCE);
		209	my $validity = asn1_extract($tbs->[1], $UNIV \| $CONS \| $SEQUENCE);
		210	my $subject = asn1_extract($tbs->[1], $UNIV \| $CONS \| $SEQUENCE);
		211	my $key = asn1_extract($tbs->[1], $UNIV \| $CONS \| $SEQUENCE);
		212	my $issuer_uid = asn1_extract($tbs->[1], $CONT \| $CONS \| 1, 1);
		213	my $subject_uid = asn1_extract($tbs->[1], $CONT \| $CONS \| 2, 1);
		214	my $extension_list = asn1_extract($tbs->[1], $CONT \| $CONS \| 3, 1);
		215
		216	my $subject_key_id = ();
		217	my $authority_key_id = ();
		218
		219	#
		220	# Parse the extension list
		221	#
		222	if ($extension_list->[0] != -1) {
		223	my $extensions = asn1_extract($extension_list->[1], $UNIV \| $CONS \| $SEQUENCE);
		224
		225	while ($extensions->[1]->[1] > 0) {
		226	my $ext = asn1_extract($extensions->[1], $UNIV \| $CONS \| $SEQUENCE);
		227	my $x_oid = asn1_extract($ext->[1], $UNIV \| $OBJ_ID);
		228	my $x_crit = asn1_extract($ext->[1], $UNIV \| $BOOLEAN, 1);
		229	my $x_val = asn1_extract($ext->[1], $UNIV \| $OCTET_STRING);
		230
		231	my $raw_oid = asn1_retrieve($x_oid->[1]);
		232	next if (!exists($OIDs{$raw_oid}));
		233	my $x_type = $OIDs{$raw_oid};
		234
		235	my $raw_value = asn1_retrieve($x_val->[1]);
		236
		237	if ($x_type eq "subjectKeyIdentifier") {
		238	my $vcursor = [ 0, length($raw_value), \$raw_value ];
		239
		240	$subject_key_id = asn1_extract($vcursor, $UNIV \| $OCTET_STRING);
		241	}
		242	}
		243	}
		244
		245	###############################################################################
		246	#
		247	# Determine what we're going to use as the signer's name. In order of
		248	# preference, take one of: commonName, organizationName or emailAddress.
		249	#
		250	###############################################################################
		251	my $org = "";
		252	my $cn = "";
		253	my $email = "";
		254
		255	while ($subject->[1]->[1] > 0) {
		256	my $rdn = asn1_extract($subject->[1], $UNIV \| $CONS \| $SET);
		257	my $attr = asn1_extract($rdn->[1], $UNIV \| $CONS \| $SEQUENCE);
		258	my $n_oid = asn1_extract($attr->[1], $UNIV \| $OBJ_ID);
		259	my $n_val = asn1_extract($attr->[1], -1);
		260
		261	my $raw_oid = asn1_retrieve($n_oid->[1]);
		262	next if (!exists($OIDs{$raw_oid}));
		263	my $n_type = $OIDs{$raw_oid};
		264
		265	my $raw_value = asn1_retrieve($n_val->[1]);
		266
		267	if ($n_type eq "organizationName") {
		268	$org = $raw_value;
		269	} elsif ($n_type eq "commonName") {
		270	$cn = $raw_value;
		271	} elsif ($n_type eq "emailAddress") {
		272	$email = $raw_value;
		273	}
		274	}
		275
		276	my $signers_name = $email;
		277
		278	if ($org && $cn) {
		279	# Don't use the organizationName if the commonName repeats it
		280	if (length($org) <= length($cn) &&
		281	substr($cn, 0, length($org)) eq $org) {
		282	$signers_name = $cn;
		283	goto got_id_name;
		284	}
		285
		286	# Or a signifcant chunk of it
		287	if (length($org) >= 7 &&
		288	length($cn) >= 7 &&
		289	substr($cn, 0, 7) eq substr($org, 0, 7)) {
		290	$signers_name = $cn;
		291	goto got_id_name;
		292	}
		293
		294	$signers_name = $org . ": " . $cn;
		295	} elsif ($org) {
		296	$signers_name = $org;
		297	} elsif ($cn) {
		298	$signers_name = $cn;
		299	}
		300
		301	got_id_name:
		302
		303	die $x509, ": ", "X.509: Couldn't find the Subject Key Identifier extension\n"
		304	if (!$subject_key_id);
		305
		306	my $key_identifier = asn1_retrieve($subject_key_id->[1]);
		307
		308	###############################################################################
		309	#
		310	# Create and attach the module signature
		311	#
		312	###############################################################################
42		313
43	#	314	#
44	# Signature parameters	315	# Signature parameters
45	#	316	#
46	algo=1 # Public-key crypto algorithm: RSA	317	my $algo = 1; # Public-key crypto algorithm: RSA
47	hash= # Digest algorithm	318	my $hash = 0; # Digest algorithm
48	id_type=1 # Identifier type: X.509	319	my $id_type = 1; # Identifier type: X.509
49		320
50	#	321	#
51	# Digest the data	322	# Digest the data
52	#	323	#
53	dgst=	324	my ($dgst, $prologue) = ();
54	if [ "$CONFIG_MODULE_SIG_SHA1" = "y" ]	325	if (exists $config{"CONFIG_MODULE_SIG_SHA1"}) {
55	then	326	$prologue = pack("C*",
56	prologue="0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A, 0x05, 0x00, 0x04, 0x14"	327	0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
57	dgst=-sha1	328	0x2B, 0x0E, 0x03, 0x02, 0x1A,
58	hash=2	329	0x05, 0x00, 0x04, 0x14);
59	elif [ "$CONFIG_MODULE_SIG_SHA224" = "y" ]	330	$dgst = "-sha1";
60	then	331	$hash = 2;
61	prologue="0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, 0x05, 0x00, 0x04, 0x1C"	332	} elsif (exists $config{"CONFIG_MODULE_SIG_SHA224"}) {
62	dgst=-sha224	333	$prologue = pack("C*",
63	hash=7	334	0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
64	elif [ "$CONFIG_MODULE_SIG_SHA256" = "y" ]	335	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
65	then	336	0x05, 0x00, 0x04, 0x1C);
66	prologue="0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20"	337	$dgst = "-sha224";
67	dgst=-sha256	338	$hash = 7;
68	hash=4	339	} elsif (exists $config{"CONFIG_MODULE_SIG_SHA256"}) {
69	elif [ "$CONFIG_MODULE_SIG_SHA384" = "y" ]	340	$prologue = pack("C*",
70	then	341	0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
71	prologue="0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30"	342	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
72	dgst=-sha384	343	0x05, 0x00, 0x04, 0x20);
73	hash=5	344	$dgst = "-sha256";
74	elif [ "$CONFIG_MODULE_SIG_SHA512" = "y" ]	345	$hash = 4;
75	then	346	} elsif (exists $config{"CONFIG_MODULE_SIG_SHA384"}) {
76	prologue="0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40"	347	$prologue = pack("C*",
77	dgst=-sha512	348	0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
78	hash=6	349	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
79	else	350	0x05, 0x00, 0x04, 0x30);
80	echo "$0: Can't determine hash algorithm" >&2	351	$dgst = "-sha384";
81	exit 2	352	$hash = 5;
82	fi	353	} elsif (exists $config{"CONFIG_MODULE_SIG_SHA512"}) {
83		354	$prologue = pack("C*",
84	(	355	0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
85	perl -e "binmode STDOUT; print pack(\"C*\", $prologue)" \|\| exit $?	356	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
86	openssl dgst $dgst -binary $src \|\| exit $?	357	0x05, 0x00, 0x04, 0x40);
87	) >$src.dig \|\| exit $?	358	$dgst = "-sha512";
		359	$hash = 6;
		360	} else {
		361	die "Can't determine hash algorithm";
		362	}
		363
		364	#
		365	# Generate the digest and read from openssl's stdout
		366	#
		367	my $digest;
		368	$digest = readpipe("openssl dgst $dgst -binary $module") \|\| die "openssl dgst";
88		369
89	#	370	#
90	# Generate the binary signature, which will be just the integer that comprises	371	# Generate the binary signature, which will be just the integer that comprises
91	# the signature with no metadata attached.	372	# the signature with no metadata attached.
92	#	373	#
93	openssl rsautl -sign -inkey $key -keyform PEM -in $src.dig -out $src.sig \|\| exit $?	374	my $pid;
94	signerlen=`stat -c %s $x509.signer`	375	$pid = open2(read_from, write_to,
95	keyidlen=`stat -c %s $x509.keyid`	376	"openssl rsautl -sign -inkey $private_key -keyform PEM") \|\|
96	siglen=`stat -c %s $src.sig`	377	die "openssl rsautl";
		378	binmode write_to;
		379	print write_to $prologue . $digest \|\| die "pipe to openssl rsautl";
		380	close(write_to) \|\| die "pipe to openssl rsautl";
		381
		382	binmode read_from;
		383	my $signature;
		384	read(read_from, $signature, 4096) \|\| die "pipe from openssl rsautl";
		385	close(read_from) \|\| die "pipe from openssl rsautl";
		386	$signature = pack("n", length($signature)) . $signature,
		387
		388	waitpid($pid, 0) \|\| die;
		389	die "openssl rsautl died: $?" if ($? >> 8);
97		390
98	#	391	#
99	# Build the signed binary	392	# Build the signed binary
100	#	393	#
101	(	394	my $unsigned_module = read_file($module);
102	cat $src \|\| exit $?	395
103	echo '~Module signature appended~' \|\| exit $?	396	my $magic_number = "~Module signature appended~\n";
104	cat $x509.signer $x509.keyid \|\| exit $?	397
		398	my $info = pack("CCCCCxxxN",
		399	$algo, $hash, $id_type,
		400	length($signers_name),
		401	length($key_identifier),
		402	length($signature));
105		403
106	# Preface each signature integer with a 2-byte BE length	404	if ($verbose) {
107	perl -e "binmode STDOUT; print pack(\"n\", $siglen)" \|\| exit $?	405	print "Size of unsigned module: ", length($unsigned_module), "\n";
108	cat $src.sig \|\| exit $?	406	print "Size of signer's name : ", length($signers_name), "\n";
		407	print "Size of key identifier : ", length($key_identifier), "\n";
		408	print "Size of signature : ", length($signature), "\n";
		409	print "Size of informaton : ", length($info), "\n";
		410	print "Size of magic number : ", length($magic_number), "\n";
		411	print "Signer's name : '", $signers_name, "'\n";
		412	print "Digest : $dgst\n";
		413	}
109		414
110	# Generate the information block	415	open(FD, ">$dest") \|\| die $dest;
111	perl -e "binmode STDOUT; print pack(\"CCCCCxxxN\", $algo, $hash, $id_type, $signerlen, $keyidlen, $siglen + 2)" \|\| exit $?	416	binmode FD;
112	) >$dst~ \|\| exit $?	417	print FD
		418	$unsigned_module,
		419	$signers_name,
		420	$key_identifier,
		421	$signature,
		422	$info,
		423	$magic_number
		424	;
		425	close FD \|\| die $dest;
113		426
114	# Permit in-place signing	427	if ($#ARGV != 3) {
115	mv $dst~ $dst \|\| exit $?	428	rename($dest, $module) \|\| die $module;
		429	}