Skip to content

Commit 49f25a1

Browse files
olszomalmtrojnar
olszomal
authored and
mtrojnar
committed
CRL support with new CRLfile global option (mtrojnar#28)
1 parent 98910f6 commit 49f25a1

File tree

7 files changed

+499
-137
lines changed

7 files changed

+499
-137
lines changed

‎TODO.md

-3
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
- signature extraction/removal/verificaton on MSI/CAB files
2-
- improved signature verification on PE files
32
- clean up / untangle code
43
- separate timestamping
5-
- man page
64
- remove mmap usage to increase portability
7-
- tests
85
- fix other stuff marked 'XXX'

‎osslsigncode.c

+358-96
Large diffs are not rendered by default.

‎tests/certs/makecerts.sh

+33-11
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,38 @@ TZ=GMT faketime -f '@2017-01-01 00:00:00' /bin/bash -c '
4747
2>> "makecerts.log" 1>&2'
4848
test_result $?
4949

50+
printf "\nGenerate private RSA encrypted key\n" >> "makecerts.log"
51+
$OPENSSL genrsa -des3 -out demoCA/private.key -passout pass:$password \
52+
2>> "makecerts.log" 1>&2
53+
test_result $?
54+
cat demoCA/private.key >> tmp/keyp.pem 2>> "makecerts.log"
55+
56+
printf "\nGenerate private RSA decrypted key\n" >> "makecerts.log"
57+
$OPENSSL rsa -in demoCA/private.key -passin pass:$password -out tmp/key.pem \
58+
2>> "makecerts.log" 1>&2
59+
test_result $?
60+
61+
printf "\nGenerate a certificate to revoke\n" >> "makecerts.log"
62+
$OPENSSL req -config $CONF -new -key demoCA/private.key -passin pass:$password -out demoCA/revoked.csr \
63+
-subj "/C=PL/O=osslsigncode/OU=CA/CN=revoked/emailAddress=revoked@example.com" \
64+
2>> "makecerts.log" 1>&2
65+
$OPENSSL ca -config $CONF -batch -in demoCA/revoked.csr -out demoCA/revoked.cer \
66+
2>> "makecerts.log" 1>&2
67+
$OPENSSL x509 -in demoCA/revoked.cer -out tmp/revoked.pem \
68+
2>> "makecerts.log" 1>&2
69+
70+
printf "\nRevoke above certificate\n" >> "makecerts.log"
71+
$OPENSSL ca -config $CONF -revoke demoCA/1000.pem \
72+
2>> "makecerts.log" 1>&2
73+
74+
printf "\nGenerate CRL file\n" >> "makecerts.log"
75+
TZ=GMT faketime -f '@2019-01-01 00:00:00' /bin/bash -c '
76+
script_path=$(pwd)
77+
OPENSSL=openssl
78+
CONF="${script_path}/openssltest.cnf"
79+
$OPENSSL ca -config $CONF -gencrl -crldays 8766 -out tmp/CACertCRL.pem \
80+
2>> "makecerts.log" 1>&2'
81+
5082
printf "\nGenerate CSP Cross-Certificate\n" >> "makecerts.log"
5183
$OPENSSL genrsa -out demoCA/cross.key \
5284
2>> "makecerts.log" 1>&2
@@ -59,17 +91,6 @@ $OPENSSL req -config $CONF -new -x509 -days 900 -key demoCA/cross.key -out tmp/c
5991
2>> "makecerts.log" 1>&2'
6092
test_result $?
6193

62-
printf "\nGenerate private RSA encrypted key\n" >> "makecerts.log"
63-
$OPENSSL genrsa -des3 -out demoCA/private.key -passout pass:$password \
64-
2>> "makecerts.log" 1>&2
65-
test_result $?
66-
cat demoCA/private.key >> tmp/keyp.pem 2>> "makecerts.log"
67-
68-
printf "\nGenerate private RSA decrypted key\n" >> "makecerts.log"
69-
$OPENSSL rsa -in demoCA/private.key -passin pass:$password -out tmp/key.pem \
70-
2>> "makecerts.log" 1>&2
71-
test_result $?
72-
7394
printf "\nGenerate code signing certificate\n" >> "makecerts.log"
7495
$OPENSSL req -config $CONF -new -key demoCA/private.key -passin pass:$password -out demoCA/cert.csr \
7596
-subj "/C=PL/ST=Mazovia Province/L=Warsaw/O=osslsigncode/OU=CA/CN=localhost/emailAddress=osslsigncode@example.com" \
@@ -116,6 +137,7 @@ test_result $?
116137

117138
# copy new files
118139
if [ -s tmp/CACert.pem ] && [ -s tmp/crosscert.pem ] && [ -s tmp/expired.pem ] && [ -s tmp/cert.pem ] && \
140+
[ -s tmp/CACertCRL.pem ] && [ -s tmp/revoked.pem ] && \
119141
[ -s tmp/key.pem ] && [ -s tmp/keyp.pem ] && [ -s tmp/key.der ] && \
120142
[ -s tmp/cert.der ] && [ -s tmp/cert.spc ] && [ -s tmp/cert.p12 ]
121143
then

‎tests/recipes/32_attach_signature

+2
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ if [ -s "test.exe" ]
1111
then
1212
../../osslsigncode attach-signature -sigin "sign_pe.pem" \
1313
-CAfile "${script_path}/../certs/CACert.pem" \
14+
-CRLfile "${script_path}/../certs/CACertCRL.pem" \
1415
-in "test.exe" -out "test_321.exe"
1516
verify_signature "$?" "321" "exe" "success" "@2019-09-01 12:00:00" \
1617
"sha256sum" "ASCII" "osslsigncode" "UNUSED_PATTERN"
@@ -29,6 +30,7 @@ if [ -s "sample.msi" ]
2930
then
3031
../../osslsigncode attach-signature -sigin "sign_msi.pem" \
3132
-CAfile "${script_path}/../certs/CACert.pem" \
33+
-CRLfile "${script_path}/../certs/CACertCRL.pem" \
3234
-in "sample.msi" -out "test_322.msi"
3335
verify_signature "$?" "322" "msi" "success" "@2019-09-01 12:00:00" \
3436
"sha256sum" "ASCII" "osslsigncode" "UNUSED_PATTERN"

‎tests/recipes/40_verify_leaf_hash

+6-20
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,8 @@ if [ -s "test.exe" ]
1313
-st "1556668800" \
1414
-certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.der" \
1515
-in "test.exe" -out "test_401.exe"
16-
TZ=GMT faketime -f '@2019-05-01 00:00:00' /bin/bash -c '
17-
printf "Verify time: " && date && printf "\n"
18-
script_path=$(pwd)
19-
../../osslsigncode verify -CAfile "${script_path}/../certs/CACert.pem" -in "test_401.exe" \
20-
-require-leaf-hash SHA256:$(sha256sum "${script_path}/../certs/cert.der" | cut -d" " -f1)'
21-
if test_result "$?" "$test_name"
22-
then
23-
rm -f "test_401.exe"
24-
fi
16+
verify_leaf_hash "$?" "401" "exe" "@2019-05-01 00:00:00"
17+
test_result "$?" "$test_name"
2518
else
2619
printf "Test skipped\n"
2720
fi
@@ -30,23 +23,16 @@ if [ -s "test.exe" ]
3023
# Command is not supported for non-PE/non-MSI files
3124

3225
# MSI file
33-
test_name="402. Compare the leaf certificate hash against specified SHA256 message digest for the MSI file"
26+
test_name="403. Compare the leaf certificate hash against specified SHA256 message digest for the MSI file"
3427
printf "\n%s\n" "$test_name"
3528
if [ -s "sample.msi" ]
3629
then
3730
../../osslsigncode sign -h sha256 \
3831
-st "1556668800" \
3932
-certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.der" \
40-
-in "sample.msi" -out "test_402.msi"
41-
TZ=GMT faketime -f '@2019-05-01 00:00:00' /bin/bash -c '
42-
printf "Verify time: " && date && printf "\n"
43-
script_path=$(pwd)
44-
../../osslsigncode verify -CAfile "${script_path}/../certs/CACert.pem" -in "test_402.msi" \
45-
-require-leaf-hash SHA256:$(sha256sum "${script_path}/../certs/cert.der" | cut -d" " -f1)'
46-
if test_result "$?" "$test_name"
47-
then
48-
rm -f "test_402.msi"
49-
fi
33+
-in "sample.msi" -out "test_403.msi"
34+
verify_leaf_hash "$?" "403" "msi" "@2019-05-01 00:00:00"
35+
test_result "$?" "$test_name"
5036
else
5137
printf "Test skipped\n"
5238
fi

‎tests/recipes/55_verify_revoked

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
#!/bin/sh
2+
# Verify PE/MSI file signed with the revoked cert.
3+
4+
. $(dirname $0)/../test_library
5+
6+
# PE file
7+
test_name="551. Verify PE file signed with the revoked cert"
8+
printf "\n%s\n" "$test_name"
9+
if [ -s "test.exe" ] && ! grep -q "no libcurl available" "results.log"
10+
then
11+
TZ=GMT faketime -f '@2019-05-01 00:00:00' /bin/bash -c '
12+
script_path=$(pwd)
13+
../../osslsigncode sign -h sha256 \
14+
-certs "${script_path}/../certs/revoked.pem" -key "${script_path}/../certs/key.pem" \
15+
-ts http://time.certum.pl/ \
16+
-in "test.exe" -out "test_551.exe" 2>> "results.log" 1>&2'
17+
verify_signature "$?" "551" "exe" "fail" "@2019-09-01 12:00:00" \
18+
"UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN"
19+
test_result "$?" "$test_name"
20+
else
21+
printf "Test skipped\n"
22+
fi
23+
24+
# CAB file
25+
# Command is not supported for non-PE/non-MSI files
26+
27+
# MSI file
28+
test_name="553. Verify MSI file signed with the revoked cert"
29+
printf "\n%s\n" "$test_name"
30+
if [ -s "sample.msi" ] && ! grep -q "no libcurl available" "results.log"
31+
then
32+
TZ=GMT faketime -f '@2019-05-01 00:00:00' /bin/bash -c '
33+
script_path=$(pwd)
34+
../../osslsigncode sign -h sha256 \
35+
-certs "${script_path}/../certs/revoked.pem" -key "${script_path}/../certs/key.pem" \
36+
-ts http://time.certum.pl/ \
37+
-in "sample.msi" -out "test_553.msi"'
38+
verify_signature "$?" "553" "msi" "fail" "@2019-09-01 12:00:00" \
39+
"UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN"
40+
test_result "$?" "$test_name"
41+
else
42+
printf "Test skipped\n"
43+
fi
44+
45+
exit 0

‎tests/test_library

+55-7
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,9 @@ modify_blob() {
3535
xxd -p -c 1000 "test_$1.$2" | \
3636
sed "s/$initial_blob$zero_blob/$initial_blob$modified_blob/" | \
3737
xxd -p -r > "test_$1_changed.$2"
38-
../../osslsigncode verify -CAfile "${script_path}/../certs/CACert.pem" \
38+
../../osslsigncode verify \
39+
-CAfile "${script_path}/../certs/CACert.pem" \
40+
-CRLfile "${script_path}/../certs/CACertCRL.pem" \
3941
-in "test_$1_changed.$2" 2>> "verify.log" 1>&2
4042
result=$?
4143
if [ "$result" -ne 0 ] || \
@@ -96,21 +98,25 @@ verify_signature() {
9698
# $9 modify requirement
9799

98100
local result=0
99-
101+
printf "" > "verify.log"
100102
if [ "$1" -eq 0 ]
101103
then
102104
if [ "$3" != "ex_" ]
103105
then
104106
cp "test_$2.$3" "test_tmp.tmp"
105107
TZ=GMT faketime -f "$5" /bin/bash -c '
106-
printf "Verify time: " > "verify.log" && date > "verify.log" && printf "\n" > "verify.log"
108+
printf "Verify time: " >> "verify.log" && date >> "verify.log" && printf "\n" >> "verify.log"
107109
script_path=$(pwd)
108-
../../osslsigncode verify -CAfile "${script_path}/../certs/CACert.pem" \
109-
-in "test_tmp.tmp" 2> "verify.log" 1>&2'
110+
../../osslsigncode verify \
111+
-CAfile "${script_path}/../certs/CACert.pem" \
112+
-CRLfile "${script_path}/../certs/CACertCRL.pem" \
113+
-in "test_tmp.tmp" 2>> "verify.log" 1>&2'
110114
result=$?
111115
rm -f "test_tmp.tmp"
116+
else
117+
printf "VERIFY is not supported for CAB files\n"
112118
fi
113-
if [ "$7" != "UNUSED_PATTERN" ] && [ "$8" != "UNUSED_PATTERN" ]
119+
if [ "$result" -eq 0 ] && [ "$7" != "UNUSED_PATTERN" ] && [ "$8" != "UNUSED_PATTERN" ]
114120
then
115121
search_pattern "$2" "$3" "$7" "$8" "$9"
116122
result=$?
@@ -124,17 +130,59 @@ verify_signature() {
124130
sha256sum "test_$2.$3" 2>> "sha256sum_$3.log" 1>&2
125131
fi
126132
fi
127-
if ([ "$4" = "success" ] && [ "$result" -eq 0 ]) || ([ "$4" = "fail" ] && [ "$result" -eq 1 ])
133+
if [ "$4" = "success" ] && [ "$result" -eq 0 ]
128134
then
129135
rm -f "test_$2.$3" "test_$2_signed.$3" "test_$2_modifed.$3" "test_$2_changed.$3"
130136
result=0
137+
elif [ "$4" = "fail" ] && [ "$result" -eq 1 ]
138+
then
139+
rm -f "test_$2.$3" "test_$2_signed.$3" "test_$2_modifed.$3" "test_$2_changed.$3"
140+
cat "verify.log" >> "results.log"
141+
result=0
131142
else
132143
cat "verify.log" >> "results.log"
133144
result=1
134145
fi
135146
else
136147
result=1
137148
fi
149+
return "$result"
150+
}
138151

152+
verify_leaf_hash() {
153+
# $1 sign exit code
154+
# $2 test number
155+
# $3 filename extension
156+
# $4 fake time
157+
158+
local result=0
159+
printf "" > "verify.log"
160+
if [ "$1" -eq 0 ]
161+
then
162+
if [ "$3" != "ex_" ]
163+
then
164+
cp "test_$2.$3" "test_tmp.tmp"
165+
TZ=GMT faketime -f "$4" /bin/bash -c '
166+
printf "Verify time: " >> "verify.log" && date >> "verify.log" && printf "\n" >> "verify.log"
167+
script_path=$(pwd)
168+
../../osslsigncode verify \
169+
-CAfile "${script_path}/../certs/CACert.pem" \
170+
-CRLfile "${script_path}/../certs/CACertCRL.pem" \
171+
-require-leaf-hash SHA256:$(sha256sum "${script_path}/../certs/cert.der" | cut -d" " -f1) \
172+
-in "test_tmp.tmp" 2>> "verify.log" 1>&2'
173+
result=$?
174+
rm -f "test_tmp.tmp"
175+
else
176+
printf "VERIFY is not supported for CAB files\n"
177+
fi
178+
if [ "$result" -eq 0 ]
179+
then
180+
rm -f "test_$2.$3"
181+
else
182+
cat "verify.log" >> "results.log"
183+
fi
184+
else
185+
result=1
186+
fi
139187
return "$result"
140188
}

0 commit comments

Comments
 (0)