MAJOR=13 MINOR=34 DEVNAME=input/mouse2 'ś/* Sign a module file using the given key. * * Copyright ÂŠ 2014-2016 Red Hat, Inc. All Rights Reserved. * Copyright ÂŠ 2015 Intel Corporation. * Copyright ÂŠ 2016 Hewlett Packard Enterprise Development LP * * Authors: David Howells * David Woodhouse * Juerg Haefliger * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public License * as published by the Free Software Foundation; either version 2.1 * of the licence, or (at your option) any later version. */ #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include /* * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API. * * Remove this if/when that API is no longer used */ #pragma GCC diagnostic ignored "-Wdeprecated-declarations" /* * Use CMS if we have openssl-1.0.0 or newer available - otherwise we have to * assume that it's not available and its header file is missing and that we * should use PKCS#7 instead. Switching to the older PKCS#7 format restricts * the options we have on specifying the X.509 certificate we want. * * Further, older versions of OpenSSL don't support manually adding signers to * the PKCS#7 message so have to accept that we get a certificate included in * the signature message. Nor do such older versions of OpenSSL support * signing with anything other than SHA1 - so we're stuck with that if such is * the case. */ #if defined(LIBRESSL_VERSION_NUMBER) || \ OPENSSL_VERSION_NUMBER < 0x10000000L || \ defined(OPENSSL_NO_CMS) #define USE_PKCS7 #endif #ifndef USE_PKCS7 #include #else #include #endif struct module_signature { uint8_t algo; /* Public-key crypto algorithm [0] */ uint8_t hash; /* Digest algorithm [0] */ uint8_t id_type; /* Key identifier type [PKEY_ID_PKCS7] */ uint8_t signer_len; /* Length of signer's name [0] */ uint8_t key_id_len; /* Length of key identifier [0] */ uint8_t __pad[3]; uint32_t sig_len; /* Length of signature data */ }; #define PKEY_ID_PKCS7 2 static char magic_number[] = "~Module signature appended~\n"; static __attribute__((noreturn)) void format(void) { fprintf(stderr, "Usage: scripts/sign-file [-dp] []\n"); fprintf(stderr, " scripts/sign-file -s []\n"); exit(2); } static void display_openssl_errors(int l) { const char *file; char buf[120]; int e, line; if (ERR_peek_error() == 0) return; fprintf(stderr, "At main.c:%d:\n", l); while ((e = ERR_get_error_line(&file, &line))) { ERR_error_string(e, buf); fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line); } } static void drain_openssl_errors(void) { const char *file; int line; if (ERR_peek_error() == 0) return; while (ERR_get_error_line(&file, &line)) {} } #define ERR(cond, fmt, ...) \ do { \ bool __cond = (cond); \ display_openssl_errors(__LINE__); \ if (__cond) { \ err(1, fmt, ## __VA_ARGS__); \ } \ } while(0) static const char *key_pass; static int pem_pw_cb(char *buf, int len, int w, void *v) { int pwlen; if (!key_pass) return -1; pwlen = strlen(key_pass); if (pwlen >= len) return -1; strcpy(buf, key_pass); /* If it's wrong, don't keep trying it. */ key_pass = NULL; return pwlen; } static EVP_PKEY *read_private_key(const char *private_key_name) { EVP_PKEY *private_key; if (!strncmp(private_key_name, "pkcs11:", 7)) { ENGINE *e; ENGINE_load_builtin_engines(); drain_openssl_errors(); e = ENGINE_by_id("pkcs11"); ERR(!e, "Load PKCS#11 ENGINE"); if (ENGINE_init(e)) drain_openssl_errors(); else ERR(1, "ENGINE_init"