gmh5225
2 years ago
parent
6a7d856339
commit
55e042f47c
@ -0,0 +1,101 @@
|
|||||||
|
AccessModifierOffset: -4
|
||||||
|
AlignAfterOpenBracket: AlwaysBreak
|
||||||
|
AlignConsecutiveAssignments: false
|
||||||
|
AlignConsecutiveDeclarations: false
|
||||||
|
AlignEscapedNewlines: DontAlign
|
||||||
|
AlignOperands: true
|
||||||
|
AllowAllParametersOfDeclarationOnNextLine: false
|
||||||
|
AllowShortBlocksOnASingleLine: false
|
||||||
|
AllowShortCaseLabelsOnASingleLine: false
|
||||||
|
AllowShortFunctionsOnASingleLine: Inline
|
||||||
|
AllowShortIfStatementsOnASingleLine: false
|
||||||
|
AllowShortLoopsOnASingleLine: false
|
||||||
|
AlwaysBreakAfterReturnType: TopLevel
|
||||||
|
AlwaysBreakBeforeMultilineStrings: false
|
||||||
|
AlwaysBreakTemplateDeclarations: true
|
||||||
|
BinPackArguments: false
|
||||||
|
BinPackParameters: false
|
||||||
|
BraceWrapping:
|
||||||
|
AfterClass: true
|
||||||
|
AfterControlStatement: true
|
||||||
|
AfterEnum: true
|
||||||
|
AfterFunction: true
|
||||||
|
AfterNamespace: false
|
||||||
|
AfterStruct: true
|
||||||
|
AfterUnion: true
|
||||||
|
AfterExternBlock: false
|
||||||
|
BeforeCatch: true
|
||||||
|
BeforeElse: true
|
||||||
|
BreakBeforeBraces: Custom
|
||||||
|
BreakBeforeBinaryOperators: None
|
||||||
|
BreakBeforeTernaryOperators: true
|
||||||
|
BreakConstructorInitializers: AfterColon
|
||||||
|
BreakStringLiterals: false
|
||||||
|
ColumnLimit: 120
|
||||||
|
CommentPragmas: '^begin_wpp|^end_wpp|^FUNC |^USESUFFIX |^USESUFFIX '
|
||||||
|
ConstructorInitializerAllOnOneLineOrOnePerLine: true
|
||||||
|
ConstructorInitializerIndentWidth: 4
|
||||||
|
ContinuationIndentWidth: 4
|
||||||
|
Cpp11BracedListStyle: true
|
||||||
|
DerivePointerAlignment: false
|
||||||
|
ExperimentalAutoDetectBinPacking: false
|
||||||
|
IndentCaseLabels: false
|
||||||
|
IndentPPDirectives: AfterHash
|
||||||
|
IndentWidth: 4
|
||||||
|
KeepEmptyLinesAtTheStartOfBlocks: false
|
||||||
|
Language: Cpp
|
||||||
|
MacroBlockBegin: '^BEGIN_MODULE$|^BEGIN_TEST_CLASS$|^BEGIN_TEST_METHOD$'
|
||||||
|
MacroBlockEnd: '^END_MODULE$|^END_TEST_CLASS$|^END_TEST_METHOD$'
|
||||||
|
MaxEmptyLinesToKeep: 1
|
||||||
|
NamespaceIndentation: None
|
||||||
|
PointerAlignment: Right
|
||||||
|
ReflowComments: true
|
||||||
|
SortIncludes: false
|
||||||
|
SpaceAfterCStyleCast: false
|
||||||
|
SpaceBeforeAssignmentOperators: true
|
||||||
|
SpaceBeforeCtorInitializerColon: true
|
||||||
|
SpaceBeforeCtorInitializerColon: true
|
||||||
|
SpaceBeforeParens: ControlStatements
|
||||||
|
SpaceBeforeRangeBasedForLoopColon: true
|
||||||
|
SpaceInEmptyParentheses: false
|
||||||
|
SpacesInAngles: false
|
||||||
|
SpacesInCStyleCastParentheses: false
|
||||||
|
SpacesInParentheses: false
|
||||||
|
SpacesInSquareBrackets: false
|
||||||
|
Standard: Cpp11
|
||||||
|
StatementMacros: [
|
||||||
|
'EXTERN_C',
|
||||||
|
'PAGED',
|
||||||
|
'PAGEDX',
|
||||||
|
'NONPAGED',
|
||||||
|
'PNPCODE',
|
||||||
|
'INITCODE',
|
||||||
|
'_At_',
|
||||||
|
'_When_',
|
||||||
|
'_Success_',
|
||||||
|
'_Check_return_',
|
||||||
|
'_Must_inspect_result_',
|
||||||
|
'_IRQL_requires_',
|
||||||
|
'_IRQL_requires_max_',
|
||||||
|
'_IRQL_requires_min_',
|
||||||
|
'_IRQL_saves_',
|
||||||
|
'_IRQL_restores_',
|
||||||
|
'_IRQL_saves_global_',
|
||||||
|
'_IRQL_restores_global_',
|
||||||
|
'_IRQL_raises_',
|
||||||
|
'_IRQL_lowers_',
|
||||||
|
'_Acquires_lock_',
|
||||||
|
'_Releases_lock_',
|
||||||
|
'_Acquires_exclusive_lock_',
|
||||||
|
'_Releases_exclusive_lock_',
|
||||||
|
'_Acquires_shared_lock_',
|
||||||
|
'_Releases_shared_lock_',
|
||||||
|
'_Requires_lock_held_',
|
||||||
|
'_Use_decl_annotations_',
|
||||||
|
'_Guarded_by_',
|
||||||
|
'__drv_preferredFunction',
|
||||||
|
'__drv_allocatesMem',
|
||||||
|
'__drv_freesMem',
|
||||||
|
]
|
||||||
|
TabWidth: '4'
|
||||||
|
UseTab: Never
|
||||||
@ -0,0 +1,101 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup>
|
||||||
|
<Filter Include="rewrite">
|
||||||
|
<UniqueIdentifier>{dfa2a449-d195-41f6-9061-1cddd0d53459}</UniqueIdentifier>
|
||||||
|
</Filter>
|
||||||
|
<Filter Include="linux">
|
||||||
|
<UniqueIdentifier>{ff838198-8354-4f87-9c88-5d00dd0ae098}</UniqueIdentifier>
|
||||||
|
</Filter>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="rewrite\Lib.SoulExtraction.rewrite.c">
|
||||||
|
<Filter>rewrite</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="linux\mscode_parser.c">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="linux\oid_registry.c">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="linux\pkcs7_parser.c">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="linux\public_key.c">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="linux\signature.c">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="linux\system_keyring.c">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="linux\verify_pefile.c">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="linux\x509_cert_parser.c">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="linux\x509_public_key.c">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="linux\asn1_decoder.c">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="linux\asymmetric_type.c">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="Lib.SoulExtraction.cpp" />
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="rewrite\Lib.SoulExtraction.rewrite.h">
|
||||||
|
<Filter>rewrite</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\errno-base.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\key.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\oid_registry.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\pe.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\pkcs7.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\pkcs7_parser.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\public_key.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\verify_pefile.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\x509_parser.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\asn1.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\asn1_ber_bytecode.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\asn1_decoder.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\asymmetric-type.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\config.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="linux\errno.h">
|
||||||
|
<Filter>linux</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="Lib.SoulExtraction.h" />
|
||||||
|
</ItemGroup>
|
||||||
|
</Project>
|
||||||
@ -0,0 +1,579 @@
|
|||||||
|
#include <stdlib.h>
|
||||||
|
|
||||||
|
#include "Lib.SoulExtraction.h"
|
||||||
|
extern "C" {
|
||||||
|
#include "linux\verify_pefile.h"
|
||||||
|
}
|
||||||
|
|
||||||
|
__forceinline size_t
|
||||||
|
_strlen_a(const char *s)
|
||||||
|
{
|
||||||
|
char *s0 = (char *)s;
|
||||||
|
|
||||||
|
if (s == 0)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
while (*s != 0)
|
||||||
|
s++;
|
||||||
|
|
||||||
|
return (s - s0);
|
||||||
|
}
|
||||||
|
|
||||||
|
__forceinline size_t
|
||||||
|
_strlen_w(const wchar_t *s)
|
||||||
|
{
|
||||||
|
wchar_t *s0 = (wchar_t *)s;
|
||||||
|
|
||||||
|
if (s == 0)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
while (*s != 0)
|
||||||
|
s++;
|
||||||
|
|
||||||
|
return (s - s0);
|
||||||
|
}
|
||||||
|
|
||||||
|
__forceinline size_t
|
||||||
|
ultostr_a(unsigned long x, char *s)
|
||||||
|
{
|
||||||
|
unsigned long t = x;
|
||||||
|
size_t i, r = 1;
|
||||||
|
|
||||||
|
while (t >= 10)
|
||||||
|
{
|
||||||
|
t /= 10;
|
||||||
|
r++;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (s == 0)
|
||||||
|
return r;
|
||||||
|
|
||||||
|
for (i = r; i != 0; i--)
|
||||||
|
{
|
||||||
|
s[i - 1] = (char)(x % 10) + '0';
|
||||||
|
x /= 10;
|
||||||
|
}
|
||||||
|
|
||||||
|
s[r] = (char)0;
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
__forceinline char *
|
||||||
|
_strcat_a(char *dest, const char *src)
|
||||||
|
{
|
||||||
|
if ((dest == 0) || (src == 0))
|
||||||
|
return dest;
|
||||||
|
|
||||||
|
while (*dest != 0)
|
||||||
|
dest++;
|
||||||
|
|
||||||
|
while (*src != 0)
|
||||||
|
{
|
||||||
|
*dest = *src;
|
||||||
|
dest++;
|
||||||
|
src++;
|
||||||
|
}
|
||||||
|
|
||||||
|
*dest = 0;
|
||||||
|
return dest;
|
||||||
|
}
|
||||||
|
|
||||||
|
__forceinline int
|
||||||
|
_isdigit_w(wchar_t x)
|
||||||
|
{
|
||||||
|
return ((x >= L'0') && (x <= L'9'));
|
||||||
|
}
|
||||||
|
|
||||||
|
__forceinline unsigned long long
|
||||||
|
strtou64_a(char *s)
|
||||||
|
{
|
||||||
|
unsigned long long a = 0;
|
||||||
|
char c;
|
||||||
|
|
||||||
|
if (s == 0)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
while (*s != 0)
|
||||||
|
{
|
||||||
|
c = *s;
|
||||||
|
if (_isdigit_w(c))
|
||||||
|
a = (a * 10) + (c - '0');
|
||||||
|
else
|
||||||
|
break;
|
||||||
|
s++;
|
||||||
|
}
|
||||||
|
return a;
|
||||||
|
}
|
||||||
|
|
||||||
|
namespace LibSoulExtraction {
|
||||||
|
|
||||||
|
#define SIGN_NOT_3RDPARTY_TAG (19) // Non-third-party tag is 19. May not be correct
|
||||||
|
#define SIGN_MAIN_SIG_AKID_SIZE (24) // The size of the main signature is usually 24. It may not be right
|
||||||
|
|
||||||
|
static bool
|
||||||
|
IsUTF8(char *Buffer, unsigned long Size, bool ExcludeAscii /*= true*/)
|
||||||
|
{
|
||||||
|
bool b_utf8 = true;
|
||||||
|
bool b_ascii = true;
|
||||||
|
|
||||||
|
unsigned char *start = (unsigned char *)Buffer;
|
||||||
|
unsigned char *end = (unsigned char *)Buffer + Size;
|
||||||
|
|
||||||
|
while (start < end)
|
||||||
|
{
|
||||||
|
if ((*start & 0x80) != 0)
|
||||||
|
{
|
||||||
|
b_ascii = false;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (*start < 0x80)
|
||||||
|
{
|
||||||
|
start += 1;
|
||||||
|
}
|
||||||
|
else if (*start < (0xC0))
|
||||||
|
{
|
||||||
|
b_utf8 = false;
|
||||||
|
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
else if (*start < (0xE0))
|
||||||
|
{
|
||||||
|
if (start >= end - 1)
|
||||||
|
{
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ((start[1] & (0xC0)) != 0x80)
|
||||||
|
{
|
||||||
|
b_utf8 = false;
|
||||||
|
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
start += 2;
|
||||||
|
}
|
||||||
|
else if (*start < (0xF0))
|
||||||
|
{
|
||||||
|
if (start >= end - 2)
|
||||||
|
{
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ((start[1] & (0xC0)) != 0x80 || (start[2] & (0xC0)) != 0x80)
|
||||||
|
{
|
||||||
|
b_utf8 = false;
|
||||||
|
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
start += 3;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
b_utf8 = false;
|
||||||
|
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (ExcludeAscii)
|
||||||
|
{
|
||||||
|
if (b_ascii)
|
||||||
|
{
|
||||||
|
b_utf8 = false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return b_utf8;
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned long long
|
||||||
|
MakeTime(unsigned long Year, unsigned long Mon, unsigned long Day, unsigned long Hour, unsigned long Min)
|
||||||
|
{
|
||||||
|
char c_year[5];
|
||||||
|
char c_mon[5];
|
||||||
|
char c_day[5];
|
||||||
|
char c_hour[5];
|
||||||
|
char c_min[5];
|
||||||
|
|
||||||
|
char c_all[20];
|
||||||
|
|
||||||
|
RtlSecureZeroMemory(c_year, sizeof(c_year));
|
||||||
|
RtlSecureZeroMemory(c_mon, sizeof(c_mon));
|
||||||
|
RtlSecureZeroMemory(c_day, sizeof(c_day));
|
||||||
|
RtlSecureZeroMemory(c_hour, sizeof(c_hour));
|
||||||
|
RtlSecureZeroMemory(c_min, sizeof(c_min));
|
||||||
|
RtlSecureZeroMemory(c_all, sizeof(c_all));
|
||||||
|
|
||||||
|
ultostr_a(Year, c_year);
|
||||||
|
ultostr_a(Mon, c_mon);
|
||||||
|
ultostr_a(Day, c_day);
|
||||||
|
ultostr_a(Hour, c_hour);
|
||||||
|
ultostr_a(Min, c_min);
|
||||||
|
|
||||||
|
if (c_mon[1] == 0)
|
||||||
|
{
|
||||||
|
c_mon[1] = c_mon[0];
|
||||||
|
c_mon[0] = '0';
|
||||||
|
}
|
||||||
|
|
||||||
|
if (c_day[1] == 0)
|
||||||
|
{
|
||||||
|
c_day[1] = c_day[0];
|
||||||
|
c_day[0] = '0';
|
||||||
|
}
|
||||||
|
|
||||||
|
if (c_hour[1] == 0)
|
||||||
|
{
|
||||||
|
c_hour[1] = c_hour[0];
|
||||||
|
c_hour[0] = '0';
|
||||||
|
}
|
||||||
|
|
||||||
|
if (c_min[1] == 0)
|
||||||
|
{
|
||||||
|
c_min[1] = c_min[0];
|
||||||
|
c_min[0] = '0';
|
||||||
|
}
|
||||||
|
|
||||||
|
_strcat_a(c_all, c_year);
|
||||||
|
_strcat_a(c_all, c_mon);
|
||||||
|
_strcat_a(c_all, c_day);
|
||||||
|
_strcat_a(c_all, c_hour);
|
||||||
|
_strcat_a(c_all, c_min);
|
||||||
|
|
||||||
|
return strtou64_a(c_all);
|
||||||
|
}
|
||||||
|
|
||||||
|
static NTSTATUS
|
||||||
|
UTF8ToUnicodeN(PWSTR uni_dest, ULONG uni_bytes_max, PULONG uni_bytes_written, PCCH utf8_src, ULONG utf8_bytes)
|
||||||
|
{
|
||||||
|
NTSTATUS status;
|
||||||
|
ULONG i, j;
|
||||||
|
ULONG written;
|
||||||
|
ULONG ch;
|
||||||
|
ULONG utf8_trail_bytes;
|
||||||
|
WCHAR utf16_ch[3];
|
||||||
|
ULONG utf16_ch_len;
|
||||||
|
|
||||||
|
if (!utf8_src)
|
||||||
|
return STATUS_INVALID_PARAMETER_4;
|
||||||
|
if (!uni_bytes_written)
|
||||||
|
return STATUS_INVALID_PARAMETER;
|
||||||
|
|
||||||
|
written = 0;
|
||||||
|
status = STATUS_SUCCESS;
|
||||||
|
|
||||||
|
for (i = 0; i < utf8_bytes; i++)
|
||||||
|
{
|
||||||
|
/* read UTF-8 lead byte */
|
||||||
|
ch = (unsigned char)utf8_src[i];
|
||||||
|
utf8_trail_bytes = 0;
|
||||||
|
if (ch >= 0xf5)
|
||||||
|
{
|
||||||
|
ch = 0xfffd;
|
||||||
|
status = STATUS_SOME_NOT_MAPPED;
|
||||||
|
}
|
||||||
|
else if (ch >= 0xf0)
|
||||||
|
{
|
||||||
|
ch &= 0x07;
|
||||||
|
utf8_trail_bytes = 3;
|
||||||
|
}
|
||||||
|
else if (ch >= 0xe0)
|
||||||
|
{
|
||||||
|
ch &= 0x0f;
|
||||||
|
utf8_trail_bytes = 2;
|
||||||
|
}
|
||||||
|
else if (ch >= 0xc2)
|
||||||
|
{
|
||||||
|
ch &= 0x1f;
|
||||||
|
utf8_trail_bytes = 1;
|
||||||
|
}
|
||||||
|
else if (ch >= 0x80)
|
||||||
|
{
|
||||||
|
/* overlong or trail byte */
|
||||||
|
ch = 0xfffd;
|
||||||
|
status = STATUS_SOME_NOT_MAPPED;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* read UTF-8 trail bytes */
|
||||||
|
if (i + utf8_trail_bytes < utf8_bytes)
|
||||||
|
{
|
||||||
|
for (j = 0; j < utf8_trail_bytes; j++)
|
||||||
|
{
|
||||||
|
if ((utf8_src[i + 1] & 0xc0) == 0x80)
|
||||||
|
{
|
||||||
|
ch <<= 6;
|
||||||
|
ch |= utf8_src[i + 1] & 0x3f;
|
||||||
|
i++;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
ch = 0xfffd;
|
||||||
|
utf8_trail_bytes = 0;
|
||||||
|
status = STATUS_SOME_NOT_MAPPED;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
ch = 0xfffd;
|
||||||
|
utf8_trail_bytes = 0;
|
||||||
|
status = STATUS_SOME_NOT_MAPPED;
|
||||||
|
i = utf8_bytes;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* encode ch as UTF-16 */
|
||||||
|
if ((ch > 0x10ffff) || (ch >= 0xd800 && ch <= 0xdfff) || (utf8_trail_bytes == 2 && ch < 0x00800) ||
|
||||||
|
(utf8_trail_bytes == 3 && ch < 0x10000))
|
||||||
|
{
|
||||||
|
/* invalid codepoint or overlong encoding */
|
||||||
|
utf16_ch[0] = 0xfffd;
|
||||||
|
utf16_ch[1] = 0xfffd;
|
||||||
|
utf16_ch[2] = 0xfffd;
|
||||||
|
utf16_ch_len = utf8_trail_bytes;
|
||||||
|
status = STATUS_SOME_NOT_MAPPED;
|
||||||
|
}
|
||||||
|
else if (ch >= 0x10000)
|
||||||
|
{
|
||||||
|
/* surrogate pair */
|
||||||
|
ch -= 0x010000;
|
||||||
|
utf16_ch[0] = 0xd800 + (ch >> 10 & 0x3ff);
|
||||||
|
utf16_ch[1] = 0xdc00 + (ch >> 0 & 0x3ff);
|
||||||
|
utf16_ch_len = 2;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
/* single unit */
|
||||||
|
utf16_ch[0] = (WCHAR)ch;
|
||||||
|
utf16_ch_len = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!uni_dest)
|
||||||
|
{
|
||||||
|
written += utf16_ch_len;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
|
||||||
|
for (j = 0; j < utf16_ch_len; j++)
|
||||||
|
{
|
||||||
|
if (uni_bytes_max >= sizeof(WCHAR))
|
||||||
|
{
|
||||||
|
*uni_dest++ = utf16_ch[j];
|
||||||
|
uni_bytes_max -= sizeof(WCHAR);
|
||||||
|
written++;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
uni_bytes_max = 0;
|
||||||
|
status = STATUS_BUFFER_TOO_SMALL;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
*uni_bytes_written = written * sizeof(WCHAR);
|
||||||
|
return status;
|
||||||
|
}
|
||||||
|
|
||||||
|
static bool
|
||||||
|
IsMainCert(
|
||||||
|
/*IN*/ struct pkcs7_message *Pkcs7,
|
||||||
|
/*OUT*/ struct x509_certificate **MainCert)
|
||||||
|
{
|
||||||
|
if (!Pkcs7 || !MainCert)
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
bool b_ismain = false;
|
||||||
|
|
||||||
|
// Up to 10 cycles, let's say up to 10 certificates
|
||||||
|
|
||||||
|
auto cert = Pkcs7->certs;
|
||||||
|
for (int i = 0; i < 10; ++i)
|
||||||
|
{
|
||||||
|
if (cert && MmIsAddressValid(cert))
|
||||||
|
{
|
||||||
|
auto subject_tag = cert->subject_tag;
|
||||||
|
if (subject_tag != SIGN_NOT_3RDPARTY_TAG)
|
||||||
|
{
|
||||||
|
b_ismain = true;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
cert = cert->next;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (b_ismain)
|
||||||
|
{
|
||||||
|
if (cert->subject && MmIsAddressValid(cert->subject))
|
||||||
|
{
|
||||||
|
*MainCert = cert;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
b_ismain = false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
// Get the maximum length of the X509 fingerprint ID is generally the main signature (the regular look out, may
|
||||||
|
// not be allowed)
|
||||||
|
|
||||||
|
cert = Pkcs7->certs;
|
||||||
|
|
||||||
|
struct x509_certificate *find_cert = NULL;
|
||||||
|
unsigned short max_idlen = 0;
|
||||||
|
for (int i = 0; i < 10; ++i)
|
||||||
|
{
|
||||||
|
if (cert && MmIsAddressValid(cert))
|
||||||
|
{
|
||||||
|
auto idlen = cert->id->len;
|
||||||
|
if (idlen > max_idlen)
|
||||||
|
{
|
||||||
|
max_idlen = idlen;
|
||||||
|
find_cert = cert;
|
||||||
|
}
|
||||||
|
cert = cert->next;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (find_cert && MmIsAddressValid(find_cert))
|
||||||
|
{
|
||||||
|
auto raw_akid_size = find_cert->raw_akid_size;
|
||||||
|
if (raw_akid_size == SIGN_MAIN_SIG_AKID_SIZE)
|
||||||
|
{
|
||||||
|
if (find_cert->subject && MmIsAddressValid(find_cert->subject))
|
||||||
|
{
|
||||||
|
*MainCert = find_cert;
|
||||||
|
b_ismain = true;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return b_ismain;
|
||||||
|
}
|
||||||
|
|
||||||
|
bool
|
||||||
|
GetMainCertInfo(
|
||||||
|
/*IN*/ void *PeBuf,
|
||||||
|
/*IN*/ unsigned long PeBufLen,
|
||||||
|
/*OUT*/ char *CertName,
|
||||||
|
/*IN*/ unsigned long CertNameMaxSize,
|
||||||
|
/*OUT OPTIONAL*/ unsigned long long *ValidFromTime,
|
||||||
|
/*OUT OPTIONAL*/ unsigned long long *ValidToTime)
|
||||||
|
{
|
||||||
|
if (!PeBuf || !CertName || !PeBufLen || !CertNameMaxSize)
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!MmIsAddressValid(PeBuf))
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
struct pefile_context ctx;
|
||||||
|
int ret;
|
||||||
|
|
||||||
|
RtlSecureZeroMemory(&ctx, sizeof(ctx));
|
||||||
|
|
||||||
|
ret = pefile_parse_binary(PeBuf, PeBufLen, &ctx);
|
||||||
|
if (ret < 0)
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = pefile_strip_sig_wrapper(PeBuf, &ctx);
|
||||||
|
if (ret < 0)
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!ctx.sig_offset)
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
if (!ctx.sig_len)
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
auto pstart = (PUCHAR)PeBuf + ctx.sig_offset;
|
||||||
|
if (!MmIsAddressValid(pstart))
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
auto pkcs7 = pkcs7_parse_message(pstart, ctx.sig_len);
|
||||||
|
if (!(pkcs7 && MmIsAddressValid(pkcs7)))
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
struct x509_certificate *main_cert = NULL;
|
||||||
|
auto bret = IsMainCert(pkcs7, &main_cert);
|
||||||
|
do
|
||||||
|
{
|
||||||
|
if (!(bret && main_cert))
|
||||||
|
{
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
auto subject = main_cert->subject;
|
||||||
|
auto subject_len = (unsigned long)strlen(subject);
|
||||||
|
if (IsUTF8(subject, subject_len, true))
|
||||||
|
{
|
||||||
|
wchar_t utf16[_MAX_PATH + sizeof(wchar_t)];
|
||||||
|
|
||||||
|
RtlSecureZeroMemory(utf16, _MAX_PATH + sizeof(wchar_t));
|
||||||
|
auto ns = UTF8ToUTF16(subject, subject_len, utf16, _MAX_PATH);
|
||||||
|
if (NT_SUCCESS(ns))
|
||||||
|
{
|
||||||
|
char ascii[_MAX_PATH + sizeof(char)];
|
||||||
|
auto utf16_len = (unsigned long)_strlen_w(utf16);
|
||||||
|
|
||||||
|
RtlSecureZeroMemory(ascii, _MAX_PATH + sizeof(char));
|
||||||
|
|
||||||
|
ns = UTF16ToAscii(utf16, utf16_len, ascii, _MAX_PATH);
|
||||||
|
if (NT_SUCCESS(ns))
|
||||||
|
{
|
||||||
|
auto ascii_len = (unsigned long)_strlen_a(ascii);
|
||||||
|
memcpy(CertName, ascii, min(ascii_len, CertNameMaxSize));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
memcpy(CertName, subject, min(subject_len, CertNameMaxSize));
|
||||||
|
}
|
||||||
|
|
||||||
|
if (ValidFromTime)
|
||||||
|
{
|
||||||
|
*ValidFromTime = MakeTime(
|
||||||
|
main_cert->valid_from_year,
|
||||||
|
main_cert->valid_from_mon,
|
||||||
|
main_cert->valid_from_day,
|
||||||
|
main_cert->valid_from_hour,
|
||||||
|
main_cert->valid_from_min);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (ValidToTime)
|
||||||
|
{
|
||||||
|
*ValidToTime = MakeTime(
|
||||||
|
main_cert->valid_to_year,
|
||||||
|
main_cert->valid_to_mon,
|
||||||
|
main_cert->valid_to_day,
|
||||||
|
main_cert->valid_to_hour,
|
||||||
|
main_cert->valid_to_min);
|
||||||
|
}
|
||||||
|
|
||||||
|
} while (0);
|
||||||
|
|
||||||
|
pkcs7_free_message(pkcs7);
|
||||||
|
|
||||||
|
return bret;
|
||||||
|
}
|
||||||
|
|
||||||
|
} // namespace LibSoulExtraction
|
||||||
@ -0,0 +1,14 @@
|
|||||||
|
#pragma once
|
||||||
|
|
||||||
|
namespace LibSoulExtraction {
|
||||||
|
|
||||||
|
bool
|
||||||
|
GetMainCertInfo(
|
||||||
|
/*IN*/ void *PeBuf,
|
||||||
|
/*IN*/ unsigned long PeBufLen,
|
||||||
|
/*OUT*/ char *CertName,
|
||||||
|
/*IN*/ unsigned long CertNameMaxSize,
|
||||||
|
/*OUT OPTIONAL*/ unsigned long long *ValidFromTime,
|
||||||
|
/*OUT OPTIONAL*/ unsigned long long *ValidToTime);
|
||||||
|
|
||||||
|
}
|
||||||
@ -0,0 +1,71 @@
|
|||||||
|
/* ASN.1 BER/DER/CER encoding definitions
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or
|
||||||
|
* modify it under the terms of the GNU General Public Licence
|
||||||
|
* as published by the Free Software Foundation; either version
|
||||||
|
* 2 of the Licence, or (at your option) any later version.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifndef _LINUX_ASN1_H
|
||||||
|
#define _LINUX_ASN1_H
|
||||||
|
|
||||||
|
/* Class */
|
||||||
|
enum asn1_class
|
||||||
|
{
|
||||||
|
ASN1_UNIV = 0, /* Universal */
|
||||||
|
ASN1_APPL = 1, /* Application */
|
||||||
|
ASN1_CONT = 2, /* Context */
|
||||||
|
ASN1_PRIV = 3 /* Private */
|
||||||
|
};
|
||||||
|
#define ASN1_CLASS_BITS 0xc0
|
||||||
|
|
||||||
|
enum asn1_method
|
||||||
|
{
|
||||||
|
ASN1_PRIM = 0, /* Primitive */
|
||||||
|
ASN1_CONS = 1 /* Constructed */
|
||||||
|
};
|
||||||
|
#define ASN1_CONS_BIT 0x20
|
||||||
|
|
||||||
|
/* Tag */
|
||||||
|
enum asn1_tag
|
||||||
|
{
|
||||||
|
ASN1_EOC = 0, /* End Of Contents or N/A */
|
||||||
|
ASN1_BOOL = 1, /* Boolean */
|
||||||
|
ASN1_INT = 2, /* Integer */
|
||||||
|
ASN1_BTS = 3, /* Bit String */
|
||||||
|
ASN1_OTS = 4, /* Octet String */
|
||||||
|
ASN1_NULL = 5, /* Null */
|
||||||
|
ASN1_OID = 6, /* Object Identifier */
|
||||||
|
ASN1_ODE = 7, /* Object Description */
|
||||||
|
ASN1_EXT = 8, /* External */
|
||||||
|
ASN1_REAL = 9, /* Real float */
|
||||||
|
ASN1_ENUM = 10, /* Enumerated */
|
||||||
|
ASN1_EPDV = 11, /* Embedded PDV */
|
||||||
|
ASN1_UTF8STR = 12, /* UTF8 String */
|
||||||
|
ASN1_RELOID = 13, /* Relative OID */
|
||||||
|
/* 14 - Reserved */
|
||||||
|
/* 15 - Reserved */
|
||||||
|
ASN1_SEQ = 16, /* Sequence and Sequence of */
|
||||||
|
ASN1_SET = 17, /* Set and Set of */
|
||||||
|
ASN1_NUMSTR = 18, /* Numerical String */
|
||||||
|
ASN1_PRNSTR = 19, /* Printable String */
|
||||||
|
ASN1_TEXSTR = 20, /* T61 String / Teletext String */
|
||||||
|
ASN1_VIDSTR = 21, /* Videotex String */
|
||||||
|
ASN1_IA5STR = 22, /* IA5 String */
|
||||||
|
ASN1_UNITIM = 23, /* Universal Time */
|
||||||
|
ASN1_GENTIM = 24, /* General Time */
|
||||||
|
ASN1_GRASTR = 25, /* Graphic String */
|
||||||
|
ASN1_VISSTR = 26, /* Visible String */
|
||||||
|
ASN1_GENSTR = 27, /* General String */
|
||||||
|
ASN1_UNISTR = 28, /* Universal String */
|
||||||
|
ASN1_CHRSTR = 29, /* Character String */
|
||||||
|
ASN1_BMPSTR = 30, /* BMP String */
|
||||||
|
ASN1_LONG_TAG = 31 /* Long form tag */
|
||||||
|
};
|
||||||
|
|
||||||
|
#define ASN1_INDEFINITE_LENGTH 0x80
|
||||||
|
|
||||||
|
#endif /* _LINUX_ASN1_H */
|
||||||
@ -0,0 +1,99 @@
|
|||||||
|
/* ASN.1 BER/DER/CER parsing state machine internal definitions
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or
|
||||||
|
* modify it under the terms of the GNU General Public Licence
|
||||||
|
* as published by the Free Software Foundation; either version
|
||||||
|
* 2 of the Licence, or (at your option) any later version.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifndef _LINUX_ASN1_BER_BYTECODE_H
|
||||||
|
#define _LINUX_ASN1_BER_BYTECODE_H
|
||||||
|
|
||||||
|
//#ifdef __KERNEL__
|
||||||
|
//#include <linux/types.h>
|
||||||
|
//#endif
|
||||||
|
//#include <linux/asn1.h>
|
||||||
|
|
||||||
|
#include <fltKernel.h>
|
||||||
|
|
||||||
|
typedef int (*asn1_action_t)(
|
||||||
|
void *context,
|
||||||
|
size_t hdrlen, /* In case of ANY type */
|
||||||
|
unsigned char tag, /* In case of ANY type */
|
||||||
|
const void *value,
|
||||||
|
size_t vlen);
|
||||||
|
|
||||||
|
struct asn1_decoder
|
||||||
|
{
|
||||||
|
const unsigned char *machine;
|
||||||
|
size_t machlen;
|
||||||
|
const asn1_action_t *actions;
|
||||||
|
};
|
||||||
|
|
||||||
|
enum asn1_opcode
|
||||||
|
{
|
||||||
|
/* The tag-matching ops come first and the odd-numbered slots
|
||||||
|
* are for OR_SKIP ops.
|
||||||
|
*/
|
||||||
|
#define ASN1_OP_MATCH__SKIP 0x01
|
||||||
|
#define ASN1_OP_MATCH__ACT 0x02
|
||||||
|
#define ASN1_OP_MATCH__JUMP 0x04
|
||||||
|
#define ASN1_OP_MATCH__ANY 0x08
|
||||||
|
#define ASN1_OP_MATCH__COND 0x10
|
||||||
|
|
||||||
|
ASN1_OP_MATCH = 0x00,
|
||||||
|
ASN1_OP_MATCH_OR_SKIP = 0x01,
|
||||||
|
ASN1_OP_MATCH_ACT = 0x02,
|
||||||
|
ASN1_OP_MATCH_ACT_OR_SKIP = 0x03,
|
||||||
|
ASN1_OP_MATCH_JUMP = 0x04,
|
||||||
|
ASN1_OP_MATCH_JUMP_OR_SKIP = 0x05,
|
||||||
|
ASN1_OP_MATCH_ANY = 0x08,
|
||||||
|
ASN1_OP_MATCH_ANY_OR_SKIP = 0x09,
|
||||||
|
ASN1_OP_MATCH_ANY_ACT = 0x0a,
|
||||||
|
ASN1_OP_MATCH_ANY_ACT_OR_SKIP = 0x0b,
|
||||||
|
/* Everything before here matches unconditionally */
|
||||||
|
|
||||||
|
ASN1_OP_COND_MATCH_OR_SKIP = 0x11,
|
||||||
|
ASN1_OP_COND_MATCH_ACT_OR_SKIP = 0x13,
|
||||||
|
ASN1_OP_COND_MATCH_JUMP_OR_SKIP = 0x15,
|
||||||
|
ASN1_OP_COND_MATCH_ANY = 0x18,
|
||||||
|
ASN1_OP_COND_MATCH_ANY_OR_SKIP = 0x19,
|
||||||
|
ASN1_OP_COND_MATCH_ANY_ACT = 0x1a,
|
||||||
|
ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP = 0x1b,
|
||||||
|
|
||||||
|
/* Everything before here will want a tag from the data */
|
||||||
|
#define ASN1_OP__MATCHES_TAG ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP
|
||||||
|
|
||||||
|
/* These are here to help fill up space */
|
||||||
|
ASN1_OP_COND_FAIL = 0x1c,
|
||||||
|
ASN1_OP_COMPLETE = 0x1d,
|
||||||
|
ASN1_OP_ACT = 0x1e,
|
||||||
|
ASN1_OP_MAYBE_ACT = 0x1f,
|
||||||
|
|
||||||
|
/* The following eight have bit 0 -> SET, 1 -> OF, 2 -> ACT */
|
||||||
|
ASN1_OP_END_SEQ = 0x20,
|
||||||
|
ASN1_OP_END_SET = 0x21,
|
||||||
|
ASN1_OP_END_SEQ_OF = 0x22,
|
||||||
|
ASN1_OP_END_SET_OF = 0x23,
|
||||||
|
ASN1_OP_END_SEQ_ACT = 0x24,
|
||||||
|
ASN1_OP_END_SET_ACT = 0x25,
|
||||||
|
ASN1_OP_END_SEQ_OF_ACT = 0x26,
|
||||||
|
ASN1_OP_END_SET_OF_ACT = 0x27,
|
||||||
|
#define ASN1_OP_END__SET 0x01
|
||||||
|
#define ASN1_OP_END__OF 0x02
|
||||||
|
#define ASN1_OP_END__ACT 0x04
|
||||||
|
|
||||||
|
ASN1_OP_RETURN = 0x28,
|
||||||
|
|
||||||
|
ASN1_OP__NR
|
||||||
|
};
|
||||||
|
|
||||||
|
#define _tag(CLASS, CP, TAG) ((ASN1_##CLASS << 6) | (ASN1_##CP << 5) | ASN1_##TAG)
|
||||||
|
#define _tagn(CLASS, CP, TAG) ((ASN1_##CLASS << 6) | (ASN1_##CP << 5) | TAG)
|
||||||
|
#define _jump_target(N) (N)
|
||||||
|
#define _action(N) (N)
|
||||||
|
|
||||||
|
#endif /* _LINUX_ASN1_BER_BYTECODE_H */
|
||||||
@ -0,0 +1,600 @@
|
|||||||
|
/* Decoder for ASN.1 BER/DER/CER encoded bytestream
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or
|
||||||
|
* modify it under the terms of the GNU General Public Licence
|
||||||
|
* as published by the Free Software Foundation; either version
|
||||||
|
* 2 of the Licence, or (at your option) any later version.
|
||||||
|
*/
|
||||||
|
|
||||||
|
//#include <linux/export.h>
|
||||||
|
//#include <linux/kernel.h>
|
||||||
|
//#include <linux/errno.h>
|
||||||
|
//#include <linux/module.h>
|
||||||
|
//#include <linux/asn1_decoder.h>
|
||||||
|
//#include <linux/asn1_ber_bytecode.h>
|
||||||
|
|
||||||
|
#include "errno.h"
|
||||||
|
#include "asn1_ber_bytecode.h"
|
||||||
|
#include "asn1.h"
|
||||||
|
|
||||||
|
//
|
||||||
|
// macro
|
||||||
|
//
|
||||||
|
|
||||||
|
//#define pr_debug DbgPrint
|
||||||
|
//#define pr_devel DbgPrint
|
||||||
|
//#define pr_err DbgPrint
|
||||||
|
|
||||||
|
#define pr_debug
|
||||||
|
#define pr_devel
|
||||||
|
#define pr_err
|
||||||
|
|
||||||
|
#define GFP_ATOMIC /*(__GFP_HIGH|__GFP_ATOMIC|__GFP_KSWAPD_RECLAIM)*/ 1
|
||||||
|
#define GFP_KERNEL /*(__GFP_RECLAIM | __GFP_IO | __GFP_FS)*/ 2
|
||||||
|
#define GFP_KERNEL_ACCOUNT /*(GFP_KERNEL | __GFP_ACCOUNT)*/ 3
|
||||||
|
#define GFP_NOWAIT /*(__GFP_KSWAPD_RECLAIM)*/ 4
|
||||||
|
#define GFP_NOIO /*(__GFP_RECLAIM)*/ 5
|
||||||
|
#define GFP_NOFS /*(__GFP_RECLAIM | __GFP_IO)*/ 6
|
||||||
|
#define GFP_USER /*(__GFP_RECLAIM | __GFP_IO | __GFP_FS | __GFP_HARDWALL)*/ 7
|
||||||
|
#define GFP_DMA /*__GFP_DMA*/ 8
|
||||||
|
#define GFP_DMA32 /*__GFP_DMA32*/ 9
|
||||||
|
#define GFP_HIGHUSER /*(GFP_USER | __GFP_HIGHMEM)*/ 10
|
||||||
|
#define GFP_HIGHUSER_MOVABLE /*(GFP_HIGHUSER | __GFP_MOVABLE)*/ 11
|
||||||
|
#define GFP_TRANSHUGE_LIGHT 12
|
||||||
|
#define GFP_TRANSHUGE /*(GFP_TRANSHUGE_LIGHT | __GFP_DIRECT_RECLAIM)*/ 13
|
||||||
|
|
||||||
|
#define unlikely(a) (a)
|
||||||
|
|
||||||
|
static const unsigned char asn1_op_lengths[ASN1_OP__NR] = {
|
||||||
|
/* OPC TAG JMP ACT */
|
||||||
|
[ASN1_OP_MATCH] = 1 + 1,
|
||||||
|
[ASN1_OP_MATCH_OR_SKIP] = 1 + 1,
|
||||||
|
[ASN1_OP_MATCH_ACT] = 1 + 1 + 1,
|
||||||
|
[ASN1_OP_MATCH_ACT_OR_SKIP] = 1 + 1 + 1,
|
||||||
|
[ASN1_OP_MATCH_JUMP] = 1 + 1 + 1,
|
||||||
|
[ASN1_OP_MATCH_JUMP_OR_SKIP] = 1 + 1 + 1,
|
||||||
|
[ASN1_OP_MATCH_ANY] = 1,
|
||||||
|
[ASN1_OP_MATCH_ANY_OR_SKIP] = 1,
|
||||||
|
[ASN1_OP_MATCH_ANY_ACT] = 1 + 1,
|
||||||
|
[ASN1_OP_MATCH_ANY_ACT_OR_SKIP] = 1 + 1,
|
||||||
|
[ASN1_OP_COND_MATCH_OR_SKIP] = 1 + 1,
|
||||||
|
[ASN1_OP_COND_MATCH_ACT_OR_SKIP] = 1 + 1 + 1,
|
||||||
|
[ASN1_OP_COND_MATCH_JUMP_OR_SKIP] = 1 + 1 + 1,
|
||||||
|
[ASN1_OP_COND_MATCH_ANY] = 1,
|
||||||
|
[ASN1_OP_COND_MATCH_ANY_OR_SKIP] = 1,
|
||||||
|
[ASN1_OP_COND_MATCH_ANY_ACT] = 1 + 1,
|
||||||
|
[ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP] = 1 + 1,
|
||||||
|
[ASN1_OP_COND_FAIL] = 1,
|
||||||
|
[ASN1_OP_COMPLETE] = 1,
|
||||||
|
[ASN1_OP_ACT] = 1 + 1,
|
||||||
|
[ASN1_OP_MAYBE_ACT] = 1 + 1,
|
||||||
|
[ASN1_OP_RETURN] = 1,
|
||||||
|
[ASN1_OP_END_SEQ] = 1,
|
||||||
|
[ASN1_OP_END_SEQ_OF] = 1 + 1,
|
||||||
|
[ASN1_OP_END_SET] = 1,
|
||||||
|
[ASN1_OP_END_SET_OF] = 1 + 1,
|
||||||
|
[ASN1_OP_END_SEQ_ACT] = 1 + 1,
|
||||||
|
[ASN1_OP_END_SEQ_OF_ACT] = 1 + 1 + 1,
|
||||||
|
[ASN1_OP_END_SET_ACT] = 1 + 1,
|
||||||
|
[ASN1_OP_END_SET_OF_ACT] = 1 + 1 + 1,
|
||||||
|
};
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Find the length of an indefinite length object
|
||||||
|
* @data: The data buffer
|
||||||
|
* @datalen: The end of the innermost containing element in the buffer
|
||||||
|
* @_dp: The data parse cursor (updated before returning)
|
||||||
|
* @_len: Where to return the size of the element.
|
||||||
|
* @_errmsg: Where to return a pointer to an error message on error
|
||||||
|
*/
|
||||||
|
static int
|
||||||
|
asn1_find_indefinite_length(const unsigned char *data, size_t datalen, size_t *_dp, size_t *_len, const char **_errmsg)
|
||||||
|
{
|
||||||
|
unsigned char tag, tmp;
|
||||||
|
size_t dp = *_dp, len, n;
|
||||||
|
int indef_level = 1;
|
||||||
|
|
||||||
|
next_tag:
|
||||||
|
if (unlikely(datalen - dp < 2))
|
||||||
|
{
|
||||||
|
if (datalen == dp)
|
||||||
|
goto missing_eoc;
|
||||||
|
goto data_overrun_error;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Extract a tag from the data */
|
||||||
|
tag = data[dp++];
|
||||||
|
if (tag == ASN1_EOC)
|
||||||
|
{
|
||||||
|
/* It appears to be an EOC. */
|
||||||
|
if (data[dp++] != 0)
|
||||||
|
goto invalid_eoc;
|
||||||
|
if (--indef_level <= 0)
|
||||||
|
{
|
||||||
|
*_len = dp - *_dp;
|
||||||
|
*_dp = dp;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
goto next_tag;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (unlikely((tag & 0x1f) == ASN1_LONG_TAG))
|
||||||
|
{
|
||||||
|
do
|
||||||
|
{
|
||||||
|
if (unlikely(datalen - dp < 2))
|
||||||
|
goto data_overrun_error;
|
||||||
|
tmp = data[dp++];
|
||||||
|
} while (tmp & 0x80);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Extract the length */
|
||||||
|
len = data[dp++];
|
||||||
|
if (len <= 0x7f)
|
||||||
|
goto check_length;
|
||||||
|
|
||||||
|
if (unlikely(len == ASN1_INDEFINITE_LENGTH))
|
||||||
|
{
|
||||||
|
/* Indefinite length */
|
||||||
|
if (unlikely((tag & ASN1_CONS_BIT) == ASN1_PRIM << 5))
|
||||||
|
goto indefinite_len_primitive;
|
||||||
|
indef_level++;
|
||||||
|
goto next_tag;
|
||||||
|
}
|
||||||
|
|
||||||
|
n = len - 0x80;
|
||||||
|
if (unlikely(n > sizeof(len) - 1))
|
||||||
|
goto length_too_long;
|
||||||
|
if (unlikely(n > datalen - dp))
|
||||||
|
goto data_overrun_error;
|
||||||
|
len = 0;
|
||||||
|
for (; n > 0; n--)
|
||||||
|
{
|
||||||
|
len <<= 8;
|
||||||
|
len |= data[dp++];
|
||||||
|
}
|
||||||
|
check_length:
|
||||||
|
if (len > datalen - dp)
|
||||||
|
goto data_overrun_error;
|
||||||
|
dp += len;
|
||||||
|
goto next_tag;
|
||||||
|
|
||||||
|
length_too_long:
|
||||||
|
/**_errmsg = "Unsupported length";*/
|
||||||
|
*_errmsg = "UI";
|
||||||
|
goto error;
|
||||||
|
indefinite_len_primitive:
|
||||||
|
/**_errmsg = "Indefinite len primitive not permitted";*/
|
||||||
|
*_errmsg = "ILPNP";
|
||||||
|
goto error;
|
||||||
|
invalid_eoc:
|
||||||
|
/**_errmsg = "Invalid length EOC";*/
|
||||||
|
*_errmsg = "ILE";
|
||||||
|
goto error;
|
||||||
|
data_overrun_error:
|
||||||
|
/**_errmsg = "Data overrun error";*/
|
||||||
|
*_errmsg = "DOE";
|
||||||
|
goto error;
|
||||||
|
missing_eoc:
|
||||||
|
/**_errmsg = "Missing EOC in indefinite len cons";*/
|
||||||
|
*_errmsg = "MEIILC";
|
||||||
|
error:
|
||||||
|
*_dp = dp;
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* asn1_ber_decoder - Decoder BER/DER/CER ASN.1 according to pattern
|
||||||
|
* @decoder: The decoder definition (produced by asn1_compiler)
|
||||||
|
* @context: The caller's context (to be passed to the action functions)
|
||||||
|
* @data: The encoded data
|
||||||
|
* @datalen: The size of the encoded data
|
||||||
|
*
|
||||||
|
* Decode BER/DER/CER encoded ASN.1 data according to a bytecode pattern
|
||||||
|
* produced by asn1_compiler. Action functions are called on marked tags to
|
||||||
|
* allow the caller to retrieve significant data.
|
||||||
|
*
|
||||||
|
* LIMITATIONS:
|
||||||
|
*
|
||||||
|
* To keep down the amount of stack used by this function, the following limits
|
||||||
|
* have been imposed:
|
||||||
|
*
|
||||||
|
* (1) This won't handle datalen > 65535 without increasing the size of the
|
||||||
|
* cons stack elements and length_too_long checking.
|
||||||
|
*
|
||||||
|
* (2) The stack of constructed types is 10 deep. If the depth of non-leaf
|
||||||
|
* constructed types exceeds this, the decode will fail.
|
||||||
|
*
|
||||||
|
* (3) The SET type (not the SET OF type) isn't really supported as tracking
|
||||||
|
* what members of the set have been seen is a pain.
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
asn1_ber_decoder(const struct asn1_decoder *decoder, void *context, const unsigned char *data, size_t datalen)
|
||||||
|
{
|
||||||
|
const unsigned char *machine = decoder->machine;
|
||||||
|
const asn1_action_t *actions = decoder->actions;
|
||||||
|
size_t machlen = decoder->machlen;
|
||||||
|
enum asn1_opcode op;
|
||||||
|
unsigned char tag = 0, csp = 0, jsp = 0, optag = 0, hdr = 0;
|
||||||
|
const char *errmsg;
|
||||||
|
size_t pc = 0, dp = 0, tdp = 0, len = 0;
|
||||||
|
int ret;
|
||||||
|
|
||||||
|
unsigned char flags = 0;
|
||||||
|
#define FLAG_INDEFINITE_LENGTH 0x01
|
||||||
|
#define FLAG_MATCHED 0x02
|
||||||
|
#define FLAG_LAST_MATCHED 0x04 /* Last tag matched */
|
||||||
|
#define FLAG_CONS \
|
||||||
|
0x20 /* Corresponds to CONS bit in the opcode tag \
|
||||||
|
* - ie. whether or not we are going to parse \
|
||||||
|
* a compound type. \
|
||||||
|
*/
|
||||||
|
|
||||||
|
#define NR_CONS_STACK 10
|
||||||
|
unsigned short cons_dp_stack[NR_CONS_STACK];
|
||||||
|
unsigned short cons_datalen_stack[NR_CONS_STACK];
|
||||||
|
unsigned char cons_hdrlen_stack[NR_CONS_STACK];
|
||||||
|
#define NR_JUMP_STACK 10
|
||||||
|
unsigned char jump_stack[NR_JUMP_STACK];
|
||||||
|
|
||||||
|
if (datalen > 65535)
|
||||||
|
return -EMSGSIZE;
|
||||||
|
|
||||||
|
next_op:
|
||||||
|
/*pr_debug("next_op: pc=\e[32m%zu\e[m/%zu dp=\e[33m%zu\e[m/%zu C=%d J=%d\n",
|
||||||
|
pc, machlen, dp, datalen, csp, jsp);*/
|
||||||
|
if (unlikely(pc >= machlen))
|
||||||
|
goto machine_overrun_error;
|
||||||
|
op = machine[pc];
|
||||||
|
if (unlikely(pc + asn1_op_lengths[op] > machlen))
|
||||||
|
goto machine_overrun_error;
|
||||||
|
|
||||||
|
/* If this command is meant to match a tag, then do that before
|
||||||
|
* evaluating the command.
|
||||||
|
*/
|
||||||
|
if (op <= ASN1_OP__MATCHES_TAG)
|
||||||
|
{
|
||||||
|
unsigned char tmp;
|
||||||
|
|
||||||
|
/* Skip conditional matches if possible */
|
||||||
|
if ((op & ASN1_OP_MATCH__COND && flags & FLAG_MATCHED) || (op & ASN1_OP_MATCH__SKIP && dp == datalen))
|
||||||
|
{
|
||||||
|
flags &= ~FLAG_LAST_MATCHED;
|
||||||
|
pc += asn1_op_lengths[op];
|
||||||
|
goto next_op;
|
||||||
|
}
|
||||||
|
|
||||||
|
flags = 0;
|
||||||
|
hdr = 2;
|
||||||
|
|
||||||
|
/* Extract a tag from the data */
|
||||||
|
if (unlikely(datalen - dp < 2))
|
||||||
|
goto data_overrun_error;
|
||||||
|
tag = data[dp++];
|
||||||
|
if (unlikely((tag & 0x1f) == ASN1_LONG_TAG))
|
||||||
|
goto long_tag_not_supported;
|
||||||
|
|
||||||
|
if (op & ASN1_OP_MATCH__ANY)
|
||||||
|
{
|
||||||
|
pr_debug("- any %02x\n", tag);
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
/* Extract the tag from the machine
|
||||||
|
* - Either CONS or PRIM are permitted in the data if
|
||||||
|
* CONS is not set in the op stream, otherwise CONS
|
||||||
|
* is mandatory.
|
||||||
|
*/
|
||||||
|
optag = machine[pc + 1];
|
||||||
|
flags |= optag & FLAG_CONS;
|
||||||
|
|
||||||
|
/* Determine whether the tag matched */
|
||||||
|
tmp = optag ^ tag;
|
||||||
|
tmp &= ~(optag & ASN1_CONS_BIT);
|
||||||
|
pr_debug("- match? %02x %02x %02x\n", tag, optag, tmp);
|
||||||
|
if (tmp != 0)
|
||||||
|
{
|
||||||
|
/* All odd-numbered tags are MATCH_OR_SKIP. */
|
||||||
|
if (op & ASN1_OP_MATCH__SKIP)
|
||||||
|
{
|
||||||
|
pc += asn1_op_lengths[op];
|
||||||
|
dp--;
|
||||||
|
goto next_op;
|
||||||
|
}
|
||||||
|
goto tag_mismatch;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
flags |= FLAG_MATCHED;
|
||||||
|
|
||||||
|
len = data[dp++];
|
||||||
|
if (len > 0x7f)
|
||||||
|
{
|
||||||
|
if (unlikely(len == ASN1_INDEFINITE_LENGTH))
|
||||||
|
{
|
||||||
|
/* Indefinite length */
|
||||||
|
if (unlikely(!(tag & ASN1_CONS_BIT)))
|
||||||
|
goto indefinite_len_primitive;
|
||||||
|
flags |= FLAG_INDEFINITE_LENGTH;
|
||||||
|
if (unlikely(2 > datalen - dp))
|
||||||
|
goto data_overrun_error;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
unsigned char n = (unsigned char)len - 0x80;
|
||||||
|
if (unlikely(n > 2))
|
||||||
|
goto length_too_long;
|
||||||
|
if (unlikely(n > datalen - dp))
|
||||||
|
goto data_overrun_error;
|
||||||
|
hdr += n;
|
||||||
|
for (len = 0; n > 0; n--)
|
||||||
|
{
|
||||||
|
len <<= 8;
|
||||||
|
len |= data[dp++];
|
||||||
|
}
|
||||||
|
if (unlikely(len > datalen - dp))
|
||||||
|
goto data_overrun_error;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
if (unlikely(len > datalen - dp))
|
||||||
|
goto data_overrun_error;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (flags & FLAG_CONS)
|
||||||
|
{
|
||||||
|
/* For expected compound forms, we stack the positions
|
||||||
|
* of the start and end of the data.
|
||||||
|
*/
|
||||||
|
if (unlikely(csp >= NR_CONS_STACK))
|
||||||
|
goto cons_stack_overflow;
|
||||||
|
cons_dp_stack[csp] = dp;
|
||||||
|
cons_hdrlen_stack[csp] = hdr;
|
||||||
|
if (!(flags & FLAG_INDEFINITE_LENGTH))
|
||||||
|
{
|
||||||
|
cons_datalen_stack[csp] = datalen;
|
||||||
|
datalen = dp + len;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
cons_datalen_stack[csp] = 0;
|
||||||
|
}
|
||||||
|
csp++;
|
||||||
|
}
|
||||||
|
|
||||||
|
pr_debug("- TAG: %02x %u %d %s\n", tag, len, flags & FLAG_CONS ? " CONS" : "");
|
||||||
|
tdp = dp;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Decide how to handle the operation */
|
||||||
|
switch (op)
|
||||||
|
{
|
||||||
|
case ASN1_OP_MATCH:
|
||||||
|
case ASN1_OP_MATCH_OR_SKIP:
|
||||||
|
case ASN1_OP_MATCH_ACT:
|
||||||
|
case ASN1_OP_MATCH_ACT_OR_SKIP:
|
||||||
|
case ASN1_OP_MATCH_ANY:
|
||||||
|
case ASN1_OP_MATCH_ANY_OR_SKIP:
|
||||||
|
case ASN1_OP_MATCH_ANY_ACT:
|
||||||
|
case ASN1_OP_MATCH_ANY_ACT_OR_SKIP:
|
||||||
|
case ASN1_OP_COND_MATCH_OR_SKIP:
|
||||||
|
case ASN1_OP_COND_MATCH_ACT_OR_SKIP:
|
||||||
|
case ASN1_OP_COND_MATCH_ANY:
|
||||||
|
case ASN1_OP_COND_MATCH_ANY_OR_SKIP:
|
||||||
|
case ASN1_OP_COND_MATCH_ANY_ACT:
|
||||||
|
case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP:
|
||||||
|
|
||||||
|
if (!(flags & FLAG_CONS))
|
||||||
|
{
|
||||||
|
if (flags & FLAG_INDEFINITE_LENGTH)
|
||||||
|
{
|
||||||
|
size_t tmp = dp;
|
||||||
|
|
||||||
|
ret = asn1_find_indefinite_length(data, datalen, &tmp, &len, &errmsg);
|
||||||
|
if (ret < 0)
|
||||||
|
goto error;
|
||||||
|
}
|
||||||
|
pr_debug("- LEAF: %zu\n", len);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (op & ASN1_OP_MATCH__ACT)
|
||||||
|
{
|
||||||
|
unsigned char act;
|
||||||
|
|
||||||
|
if (op & ASN1_OP_MATCH__ANY)
|
||||||
|
act = machine[pc + 1];
|
||||||
|
else
|
||||||
|
act = machine[pc + 2];
|
||||||
|
ret = actions[act](context, hdr, tag, data + dp, len);
|
||||||
|
if (ret < 0)
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!(flags & FLAG_CONS))
|
||||||
|
dp += len;
|
||||||
|
pc += asn1_op_lengths[op];
|
||||||
|
goto next_op;
|
||||||
|
|
||||||
|
case ASN1_OP_MATCH_JUMP:
|
||||||
|
case ASN1_OP_MATCH_JUMP_OR_SKIP:
|
||||||
|
case ASN1_OP_COND_MATCH_JUMP_OR_SKIP:
|
||||||
|
pr_debug("- MATCH_JUMP\n");
|
||||||
|
if (unlikely(jsp == NR_JUMP_STACK))
|
||||||
|
goto jump_stack_overflow;
|
||||||
|
jump_stack[jsp++] = pc + asn1_op_lengths[op];
|
||||||
|
pc = machine[pc + 2];
|
||||||
|
goto next_op;
|
||||||
|
|
||||||
|
case ASN1_OP_COND_FAIL:
|
||||||
|
if (unlikely(!(flags & FLAG_MATCHED)))
|
||||||
|
goto tag_mismatch;
|
||||||
|
pc += asn1_op_lengths[op];
|
||||||
|
goto next_op;
|
||||||
|
|
||||||
|
case ASN1_OP_COMPLETE:
|
||||||
|
if (unlikely(jsp != 0 || csp != 0))
|
||||||
|
{
|
||||||
|
pr_err("ASN.1 decoder error: Stacks not empty at completion (%u, %u)\n", jsp, csp);
|
||||||
|
return -EBADMSG;
|
||||||
|
}
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
case ASN1_OP_END_SET:
|
||||||
|
case ASN1_OP_END_SET_ACT:
|
||||||
|
if (unlikely(!(flags & FLAG_MATCHED)))
|
||||||
|
goto tag_mismatch;
|
||||||
|
case ASN1_OP_END_SEQ:
|
||||||
|
case ASN1_OP_END_SET_OF:
|
||||||
|
case ASN1_OP_END_SEQ_OF:
|
||||||
|
case ASN1_OP_END_SEQ_ACT:
|
||||||
|
case ASN1_OP_END_SET_OF_ACT:
|
||||||
|
case ASN1_OP_END_SEQ_OF_ACT:
|
||||||
|
if (unlikely(csp <= 0))
|
||||||
|
goto cons_stack_underflow;
|
||||||
|
csp--;
|
||||||
|
tdp = cons_dp_stack[csp];
|
||||||
|
hdr = cons_hdrlen_stack[csp];
|
||||||
|
len = datalen;
|
||||||
|
datalen = cons_datalen_stack[csp];
|
||||||
|
pr_debug("- end cons t=%zu dp=%zu l=%zu/%zu\n", tdp, dp, len, datalen);
|
||||||
|
if (datalen == 0)
|
||||||
|
{
|
||||||
|
/* Indefinite length - check for the EOC. */
|
||||||
|
datalen = len;
|
||||||
|
if (unlikely(datalen - dp < 2))
|
||||||
|
goto data_overrun_error;
|
||||||
|
if (data[dp++] != 0)
|
||||||
|
{
|
||||||
|
if (op & ASN1_OP_END__OF)
|
||||||
|
{
|
||||||
|
dp--;
|
||||||
|
csp++;
|
||||||
|
pc = machine[pc + 1];
|
||||||
|
pr_debug("- continue\n");
|
||||||
|
goto next_op;
|
||||||
|
}
|
||||||
|
goto missing_eoc;
|
||||||
|
}
|
||||||
|
if (data[dp++] != 0)
|
||||||
|
goto invalid_eoc;
|
||||||
|
len = dp - tdp - 2;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
if (dp < len && (op & ASN1_OP_END__OF))
|
||||||
|
{
|
||||||
|
datalen = len;
|
||||||
|
csp++;
|
||||||
|
pc = machine[pc + 1];
|
||||||
|
pr_debug("- continue\n");
|
||||||
|
goto next_op;
|
||||||
|
}
|
||||||
|
if (dp != len)
|
||||||
|
goto cons_length_error;
|
||||||
|
len -= tdp;
|
||||||
|
pr_debug("- cons len l=%zu d=%zu\n", len, dp - tdp);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (op & ASN1_OP_END__ACT)
|
||||||
|
{
|
||||||
|
unsigned char act;
|
||||||
|
if (op & ASN1_OP_END__OF)
|
||||||
|
act = machine[pc + 2];
|
||||||
|
else
|
||||||
|
act = machine[pc + 1];
|
||||||
|
ret = actions[act](context, hdr, 0, data + tdp, len);
|
||||||
|
if (ret < 0)
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
pc += asn1_op_lengths[op];
|
||||||
|
goto next_op;
|
||||||
|
|
||||||
|
case ASN1_OP_MAYBE_ACT:
|
||||||
|
if (!(flags & FLAG_LAST_MATCHED))
|
||||||
|
{
|
||||||
|
pc += asn1_op_lengths[op];
|
||||||
|
goto next_op;
|
||||||
|
}
|
||||||
|
case ASN1_OP_ACT:
|
||||||
|
ret = actions[machine[pc + 1]](context, hdr, tag, data + tdp, len);
|
||||||
|
if (ret < 0)
|
||||||
|
return ret;
|
||||||
|
pc += asn1_op_lengths[op];
|
||||||
|
goto next_op;
|
||||||
|
|
||||||
|
case ASN1_OP_RETURN:
|
||||||
|
if (unlikely(jsp <= 0))
|
||||||
|
goto jump_stack_underflow;
|
||||||
|
pc = jump_stack[--jsp];
|
||||||
|
flags |= FLAG_MATCHED | FLAG_LAST_MATCHED;
|
||||||
|
goto next_op;
|
||||||
|
|
||||||
|
default:
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Shouldn't reach here */
|
||||||
|
pr_err("ASN.1 decoder error: Found reserved opcode (%u) pc=%zu\n", op, pc);
|
||||||
|
return -EBADMSG;
|
||||||
|
|
||||||
|
data_overrun_error:
|
||||||
|
/*errmsg = "Data overrun error";*/
|
||||||
|
errmsg = "DOE";
|
||||||
|
goto error;
|
||||||
|
machine_overrun_error:
|
||||||
|
/*errmsg = "Machine overrun error";*/
|
||||||
|
errmsg = "MOE";
|
||||||
|
goto error;
|
||||||
|
jump_stack_underflow:
|
||||||
|
/*errmsg = "Jump stack underflow";*/
|
||||||
|
errmsg = "JSU";
|
||||||
|
goto error;
|
||||||
|
jump_stack_overflow:
|
||||||
|
/*errmsg = "Jump stack overflow";*/
|
||||||
|
errmsg = "JSO";
|
||||||
|
goto error;
|
||||||
|
cons_stack_underflow:
|
||||||
|
/*errmsg = "Cons stack underflow";*/
|
||||||
|
errmsg = "CSU";
|
||||||
|
goto error;
|
||||||
|
cons_stack_overflow:
|
||||||
|
/*errmsg = "Cons stack overflow";*/
|
||||||
|
errmsg = "CSO";
|
||||||
|
goto error;
|
||||||
|
cons_length_error:
|
||||||
|
/*errmsg = "Cons length error";*/
|
||||||
|
errmsg = "CLE";
|
||||||
|
goto error;
|
||||||
|
missing_eoc:
|
||||||
|
/*errmsg = "Missing EOC in indefinite len cons";*/
|
||||||
|
errmsg = "MEIILC";
|
||||||
|
goto error;
|
||||||
|
invalid_eoc:
|
||||||
|
/*errmsg = "Invalid length EOC";*/
|
||||||
|
errmsg = "ILE";
|
||||||
|
goto error;
|
||||||
|
length_too_long:
|
||||||
|
/*errmsg = "Unsupported length";*/
|
||||||
|
errmsg = "UL";
|
||||||
|
goto error;
|
||||||
|
indefinite_len_primitive:
|
||||||
|
/*errmsg = "Indefinite len primitive not permitted";*/
|
||||||
|
errmsg = "ILPNP";
|
||||||
|
goto error;
|
||||||
|
tag_mismatch:
|
||||||
|
/*errmsg = "Unexpected tag";*/
|
||||||
|
errmsg = "UT";
|
||||||
|
goto error;
|
||||||
|
long_tag_not_supported:
|
||||||
|
/*errmsg = "Long tag not supported";*/
|
||||||
|
errmsg = "LTNS";
|
||||||
|
error:
|
||||||
|
pr_debug("\nASN1: %s [m=%zu d=%zu ot=%02x t=%02x l=%zu]\n", errmsg, pc, dp, optag, tag, len);
|
||||||
|
return -EBADMSG;
|
||||||
|
}
|
||||||
|
// EXPORT_SYMBOL_GPL(asn1_ber_decoder);
|
||||||
|
|
||||||
|
// MODULE_LICENSE("GPL");
|
||||||
@ -0,0 +1,24 @@
|
|||||||
|
/* ASN.1 decoder
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or
|
||||||
|
* modify it under the terms of the GNU General Public Licence
|
||||||
|
* as published by the Free Software Foundation; either version
|
||||||
|
* 2 of the Licence, or (at your option) any later version.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifndef _LINUX_ASN1_DECODER_H
|
||||||
|
#define _LINUX_ASN1_DECODER_H
|
||||||
|
|
||||||
|
//#include <linux/asn1.h>
|
||||||
|
|
||||||
|
#include "asn1_ber_bytecode.h"
|
||||||
|
|
||||||
|
// struct asn1_decoder;
|
||||||
|
|
||||||
|
extern int
|
||||||
|
asn1_ber_decoder(const struct asn1_decoder *decoder, void *context, const unsigned char *data, size_t datalen);
|
||||||
|
|
||||||
|
#endif /* _LINUX_ASN1_DECODER_H */
|
||||||
@ -0,0 +1,91 @@
|
|||||||
|
/* Asymmetric Public-key cryptography key type interface
|
||||||
|
*
|
||||||
|
* See Documentation/security/asymmetric-keys.txt
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or
|
||||||
|
* modify it under the terms of the GNU General Public Licence
|
||||||
|
* as published by the Free Software Foundation; either version
|
||||||
|
* 2 of the Licence, or (at your option) any later version.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifndef _KEYS_ASYMMETRIC_TYPE_H
|
||||||
|
#define _KEYS_ASYMMETRIC_TYPE_H
|
||||||
|
|
||||||
|
//#include <linux/key-type.h>
|
||||||
|
//#include <linux/verification.h>
|
||||||
|
|
||||||
|
#include <fltKernel.h>
|
||||||
|
|
||||||
|
// extern struct key_type key_type_asymmetric;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* The key payload is four words. The asymmetric-type key uses them as
|
||||||
|
* follows:
|
||||||
|
*/
|
||||||
|
enum asymmetric_payload_bits
|
||||||
|
{
|
||||||
|
asym_crypto, /* The data representing the key */
|
||||||
|
asym_subtype, /* Pointer to an asymmetric_key_subtype struct */
|
||||||
|
asym_key_ids, /* Pointer to an asymmetric_key_ids struct */
|
||||||
|
asym_auth /* The key's authorisation (signature, parent key ID) */
|
||||||
|
};
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Identifiers for an asymmetric key ID. We have three ways of looking up a
|
||||||
|
* key derived from an X.509 certificate:
|
||||||
|
*
|
||||||
|
* (1) Serial Number & Issuer. Non-optional. This is the only valid way to
|
||||||
|
* map a PKCS#7 signature to an X.509 certificate.
|
||||||
|
*
|
||||||
|
* (2) Issuer & Subject Unique IDs. Optional. These were the original way to
|
||||||
|
* match X.509 certificates, but have fallen into disuse in favour of (3).
|
||||||
|
*
|
||||||
|
* (3) Auth & Subject Key Identifiers. Optional. SKIDs are only provided on
|
||||||
|
* CA keys that are intended to sign other keys, so don't appear in end
|
||||||
|
* user certificates unless forced.
|
||||||
|
*
|
||||||
|
* We could also support an PGP key identifier, which is just a SHA1 sum of the
|
||||||
|
* public key and certain parameters, but since we don't support PGP keys at
|
||||||
|
* the moment, we shall ignore those.
|
||||||
|
*
|
||||||
|
* What we actually do is provide a place where binary identifiers can be
|
||||||
|
* stashed and then compare against them when checking for an id match.
|
||||||
|
*/
|
||||||
|
struct asymmetric_key_id
|
||||||
|
{
|
||||||
|
unsigned short len;
|
||||||
|
unsigned char data[1];
|
||||||
|
};
|
||||||
|
|
||||||
|
struct asymmetric_key_ids
|
||||||
|
{
|
||||||
|
void *id[2];
|
||||||
|
};
|
||||||
|
|
||||||
|
extern unsigned char
|
||||||
|
asymmetric_key_id_same(const struct asymmetric_key_id *kid1, const struct asymmetric_key_id *kid2);
|
||||||
|
|
||||||
|
// extern bool asymmetric_key_id_partial(const struct asymmetric_key_id *kid1,
|
||||||
|
// const struct asymmetric_key_id *kid2);
|
||||||
|
|
||||||
|
extern struct asymmetric_key_id *
|
||||||
|
asymmetric_key_generate_id(const void *val_1, size_t len_1, const void *val_2, size_t len_2);
|
||||||
|
// static inline
|
||||||
|
// const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
|
||||||
|
//{
|
||||||
|
// return key->payload.data[asym_key_ids];
|
||||||
|
// }
|
||||||
|
|
||||||
|
// extern struct key *find_asymmetric_key(struct key *keyring,
|
||||||
|
// const struct asymmetric_key_id *id_0,
|
||||||
|
// const struct asymmetric_key_id *id_1,
|
||||||
|
// bool partial);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* The payload is at the discretion of the subtype.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#endif /* _KEYS_ASYMMETRIC_TYPE_H */
|
||||||
@ -0,0 +1,635 @@
|
|||||||
|
/* Asymmetric public-key cryptography key type
|
||||||
|
*
|
||||||
|
* See Documentation/security/asymmetric-keys.txt
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or
|
||||||
|
* modify it under the terms of the GNU General Public Licence
|
||||||
|
* as published by the Free Software Foundation; either version
|
||||||
|
* 2 of the Licence, or (at your option) any later version.
|
||||||
|
*/
|
||||||
|
//#include <keys/asymmetric-subtype.h>
|
||||||
|
//#include <keys/asymmetric-parser.h>
|
||||||
|
//#include <crypto/public_key.h>
|
||||||
|
//#include <linux/seq_file.h>
|
||||||
|
//#include <linux/module.h>
|
||||||
|
//#include <linux/slab.h>
|
||||||
|
//#include <linux/ctype.h>
|
||||||
|
//#include <keys/system_keyring.h>
|
||||||
|
//#include "asymmetric_keys.h"
|
||||||
|
//
|
||||||
|
// MODULE_LICENSE("GPL");
|
||||||
|
|
||||||
|
#include "asymmetric-type.h"
|
||||||
|
#include "errno.h"
|
||||||
|
|
||||||
|
#include "../rewrite/Lib.SoulExtraction.rewrite.h"
|
||||||
|
|
||||||
|
#include "config.h"
|
||||||
|
|
||||||
|
#define GFP_ATOMIC /*(__GFP_HIGH|__GFP_ATOMIC|__GFP_KSWAPD_RECLAIM)*/ 1
|
||||||
|
#define GFP_KERNEL /*(__GFP_RECLAIM | __GFP_IO | __GFP_FS)*/ 2
|
||||||
|
#define GFP_KERNEL_ACCOUNT /*(GFP_KERNEL | __GFP_ACCOUNT)*/ 3
|
||||||
|
#define GFP_NOWAIT /*(__GFP_KSWAPD_RECLAIM)*/ 4
|
||||||
|
#define GFP_NOIO /*(__GFP_RECLAIM)*/ 5
|
||||||
|
#define GFP_NOFS /*(__GFP_RECLAIM | __GFP_IO)*/ 6
|
||||||
|
#define GFP_USER /*(__GFP_RECLAIM | __GFP_IO | __GFP_FS | __GFP_HARDWALL)*/ 7
|
||||||
|
#define GFP_DMA /*__GFP_DMA*/ 8
|
||||||
|
#define GFP_DMA32 /*__GFP_DMA32*/ 9
|
||||||
|
#define GFP_HIGHUSER /*(GFP_USER | __GFP_HIGHMEM)*/ 10
|
||||||
|
#define GFP_HIGHUSER_MOVABLE /*(GFP_HIGHUSER | __GFP_MOVABLE)*/ 11
|
||||||
|
#define GFP_TRANSHUGE_LIGHT 12
|
||||||
|
#define GFP_TRANSHUGE /*(GFP_TRANSHUGE_LIGHT | __GFP_DIRECT_RECLAIM)*/ 13
|
||||||
|
|
||||||
|
#define ERR_PTR(err) ((void *)((long)(err)))
|
||||||
|
#define PTR_ERR(ptr) ((long)(ptr))
|
||||||
|
#define IS_ERR(ptr) ((unsigned long)(ptr) > (unsigned long)(-1000))
|
||||||
|
|
||||||
|
// const char *const key_being_used_for[NR__KEY_BEING_USED_FOR] = {
|
||||||
|
// [VERIFYING_MODULE_SIGNATURE] = "mod sig",
|
||||||
|
// [VERIFYING_FIRMWARE_SIGNATURE] = "firmware sig",
|
||||||
|
// [VERIFYING_KEXEC_PE_SIGNATURE] = "kexec PE sig",
|
||||||
|
// [VERIFYING_KEY_SIGNATURE] = "key sig",
|
||||||
|
// [VERIFYING_KEY_SELF_SIGNATURE] = "key self sig",
|
||||||
|
// [VERIFYING_UNSPECIFIED_SIGNATURE] = "unspec sig",
|
||||||
|
// };
|
||||||
|
// EXPORT_SYMBOL_GPL(key_being_used_for);
|
||||||
|
//
|
||||||
|
// static LIST_HEAD(asymmetric_key_parsers);
|
||||||
|
// static DECLARE_RWSEM(asymmetric_key_parsers_sem);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* find_asymmetric_key - Find a key by ID.
|
||||||
|
* @keyring: The keys to search.
|
||||||
|
* @id_0: The first ID to look for or NULL.
|
||||||
|
* @id_1: The second ID to look for or NULL.
|
||||||
|
* @partial: Use partial match if true, exact if false.
|
||||||
|
*
|
||||||
|
* Find a key in the given keyring by identifier. The preferred identifier is
|
||||||
|
* the id_0 and the fallback identifier is the id_1. If both are given, the
|
||||||
|
* lookup is by the former, but the latter must also match.
|
||||||
|
*/
|
||||||
|
// struct key *find_asymmetric_key(struct key *keyring,
|
||||||
|
// const struct asymmetric_key_id *id_0,
|
||||||
|
// const struct asymmetric_key_id *id_1,
|
||||||
|
// bool partial)
|
||||||
|
//{
|
||||||
|
// struct key *key;
|
||||||
|
// key_ref_t ref;
|
||||||
|
// const char *lookup;
|
||||||
|
// char *req, *p;
|
||||||
|
// int len;
|
||||||
|
//
|
||||||
|
// BUG_ON(!id_0 && !id_1);
|
||||||
|
//
|
||||||
|
// if (id_0) {
|
||||||
|
// lookup = id_0->data;
|
||||||
|
// len = id_0->len;
|
||||||
|
// } else {
|
||||||
|
// lookup = id_1->data;
|
||||||
|
// len = id_1->len;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// /* Construct an identifier "id:<keyid>". */
|
||||||
|
// p = req = kmalloc(2 + 1 + len * 2 + 1, GFP_KERNEL);
|
||||||
|
// if (!req)
|
||||||
|
// return ERR_PTR(-ENOMEM);
|
||||||
|
//
|
||||||
|
// if (partial) {
|
||||||
|
// *p++ = 'i';
|
||||||
|
// *p++ = 'd';
|
||||||
|
// } else {
|
||||||
|
// *p++ = 'e';
|
||||||
|
// *p++ = 'x';
|
||||||
|
// }
|
||||||
|
// *p++ = ':';
|
||||||
|
// p = bin2hex(p, lookup, len);
|
||||||
|
// *p = 0;
|
||||||
|
//
|
||||||
|
// pr_debug("Look up: \"%s\"\n", req);
|
||||||
|
//
|
||||||
|
// ref = keyring_search(make_key_ref(keyring, 1),
|
||||||
|
// &key_type_asymmetric, req);
|
||||||
|
// if (IS_ERR(ref))
|
||||||
|
// pr_debug("Request for key '%s' err %ld\n", req, PTR_ERR(ref));
|
||||||
|
// kfree(req);
|
||||||
|
//
|
||||||
|
// if (IS_ERR(ref)) {
|
||||||
|
// switch (PTR_ERR(ref)) {
|
||||||
|
// /* Hide some search errors */
|
||||||
|
// case -EACCES:
|
||||||
|
// case -ENOTDIR:
|
||||||
|
// case -EAGAIN:
|
||||||
|
// return ERR_PTR(-ENOKEY);
|
||||||
|
// default:
|
||||||
|
// return ERR_CAST(ref);
|
||||||
|
// }
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// key = key_ref_to_ptr(ref);
|
||||||
|
// if (id_0 && id_1) {
|
||||||
|
// const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
|
||||||
|
//
|
||||||
|
// if (!kids->id[1]) {
|
||||||
|
// pr_debug("First ID matches, but second is missing\n");
|
||||||
|
// goto reject;
|
||||||
|
// }
|
||||||
|
// if (!asymmetric_key_id_same(id_1, kids->id[1])) {
|
||||||
|
// pr_debug("First ID matches, but second does not\n");
|
||||||
|
// goto reject;
|
||||||
|
// }
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// pr_devel("<==%s() = 0 [%x]\n", __func__, key_serial(key));
|
||||||
|
// return key;
|
||||||
|
//
|
||||||
|
// reject:
|
||||||
|
// key_put(key);
|
||||||
|
// return ERR_PTR(-EKEYREJECTED);
|
||||||
|
// }
|
||||||
|
// EXPORT_SYMBOL_GPL(find_asymmetric_key);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* asymmetric_key_generate_id: Construct an asymmetric key ID
|
||||||
|
* @val_1: First binary blob
|
||||||
|
* @len_1: Length of first binary blob
|
||||||
|
* @val_2: Second binary blob
|
||||||
|
* @len_2: Length of second binary blob
|
||||||
|
*
|
||||||
|
* Construct an asymmetric key ID from a pair of binary blobs.
|
||||||
|
*/
|
||||||
|
struct asymmetric_key_id *
|
||||||
|
asymmetric_key_generate_id(const void *val_1, size_t len_1, const void *val_2, size_t len_2)
|
||||||
|
{
|
||||||
|
struct asymmetric_key_id *kid;
|
||||||
|
|
||||||
|
kid = kmalloc(sizeof(struct asymmetric_key_id) + len_1 + len_2, GFP_KERNEL);
|
||||||
|
if (!kid)
|
||||||
|
return ERR_PTR(-ENOMEM);
|
||||||
|
kid->len = len_1 + len_2;
|
||||||
|
memcpy(kid->data, val_1, len_1);
|
||||||
|
memcpy(kid->data + len_1, val_2, len_2);
|
||||||
|
return kid;
|
||||||
|
}
|
||||||
|
// EXPORT_SYMBOL_GPL(asymmetric_key_generate_id);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* asymmetric_key_id_same - Return true if two asymmetric keys IDs are the same.
|
||||||
|
* @kid_1, @kid_2: The key IDs to compare
|
||||||
|
*/
|
||||||
|
unsigned char
|
||||||
|
asymmetric_key_id_same(const struct asymmetric_key_id *kid1, const struct asymmetric_key_id *kid2)
|
||||||
|
{
|
||||||
|
if (!kid1 || !kid2)
|
||||||
|
return FALSE;
|
||||||
|
if (kid1->len != kid2->len)
|
||||||
|
return FALSE;
|
||||||
|
return memcmp(kid1->data, kid2->data, kid1->len) == 0;
|
||||||
|
}
|
||||||
|
// EXPORT_SYMBOL_GPL(asymmetric_key_id_same);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* asymmetric_key_id_partial - Return true if two asymmetric keys IDs
|
||||||
|
* partially match
|
||||||
|
* @kid_1, @kid_2: The key IDs to compare
|
||||||
|
*/
|
||||||
|
// bool asymmetric_key_id_partial(const struct asymmetric_key_id *kid1,
|
||||||
|
// const struct asymmetric_key_id *kid2)
|
||||||
|
//{
|
||||||
|
// if (!kid1 || !kid2)
|
||||||
|
// return false;
|
||||||
|
// if (kid1->len < kid2->len)
|
||||||
|
// return false;
|
||||||
|
// return memcmp(kid1->data + (kid1->len - kid2->len),
|
||||||
|
// kid2->data, kid2->len) == 0;
|
||||||
|
// }
|
||||||
|
// EXPORT_SYMBOL_GPL(asymmetric_key_id_partial);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* asymmetric_match_key_ids - Search asymmetric key IDs
|
||||||
|
* @kids: The list of key IDs to check
|
||||||
|
* @match_id: The key ID we're looking for
|
||||||
|
* @match: The match function to use
|
||||||
|
*/
|
||||||
|
// static bool asymmetric_match_key_ids(
|
||||||
|
// const struct asymmetric_key_ids *kids,
|
||||||
|
// const struct asymmetric_key_id *match_id,
|
||||||
|
// bool (*match)(const struct asymmetric_key_id *kid1,
|
||||||
|
// const struct asymmetric_key_id *kid2))
|
||||||
|
//{
|
||||||
|
// int i;
|
||||||
|
//
|
||||||
|
// if (!kids || !match_id)
|
||||||
|
// return false;
|
||||||
|
// for (i = 0; i < ARRAY_SIZE(kids->id); i++)
|
||||||
|
// if (match(kids->id[i], match_id))
|
||||||
|
// return true;
|
||||||
|
// return false;
|
||||||
|
// }
|
||||||
|
|
||||||
|
/* helper function can be called directly with pre-allocated memory */
|
||||||
|
// inline int __asymmetric_key_hex_to_key_id(const char *id,
|
||||||
|
// struct asymmetric_key_id *match_id,
|
||||||
|
// size_t hexlen)
|
||||||
|
//{
|
||||||
|
// match_id->len = hexlen;
|
||||||
|
// return hex2bin(match_id->data, id, hexlen);
|
||||||
|
// }
|
||||||
|
|
||||||
|
/**
|
||||||
|
* asymmetric_key_hex_to_key_id - Convert a hex string into a key ID.
|
||||||
|
* @id: The ID as a hex string.
|
||||||
|
*/
|
||||||
|
// struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
|
||||||
|
//{
|
||||||
|
// struct asymmetric_key_id *match_id;
|
||||||
|
// size_t asciihexlen;
|
||||||
|
// int ret;
|
||||||
|
//
|
||||||
|
// if (!*id)
|
||||||
|
// return ERR_PTR(-EINVAL);
|
||||||
|
// asciihexlen = strlen(id);
|
||||||
|
// if (asciihexlen & 1)
|
||||||
|
// return ERR_PTR(-EINVAL);
|
||||||
|
//
|
||||||
|
// match_id = kmalloc(sizeof(struct asymmetric_key_id) + asciihexlen / 2,
|
||||||
|
// GFP_KERNEL);
|
||||||
|
// if (!match_id)
|
||||||
|
// return ERR_PTR(-ENOMEM);
|
||||||
|
// ret = __asymmetric_key_hex_to_key_id(id, match_id, asciihexlen / 2);
|
||||||
|
// if (ret < 0) {
|
||||||
|
// kfree(match_id);
|
||||||
|
// return ERR_PTR(-EINVAL);
|
||||||
|
// }
|
||||||
|
// return match_id;
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Match asymmetric keys by an exact match on an ID.
|
||||||
|
*/
|
||||||
|
// static bool asymmetric_key_cmp(const struct key *key,
|
||||||
|
// const struct key_match_data *match_data)
|
||||||
|
//{
|
||||||
|
// const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
|
||||||
|
// const struct asymmetric_key_id *match_id = match_data->preparsed;
|
||||||
|
//
|
||||||
|
// return asymmetric_match_key_ids(kids, match_id,
|
||||||
|
// asymmetric_key_id_same);
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Match asymmetric keys by a partial match on an IDs.
|
||||||
|
*/
|
||||||
|
// static bool asymmetric_key_cmp_partial(const struct key *key,
|
||||||
|
// const struct key_match_data *match_data)
|
||||||
|
//{
|
||||||
|
// const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
|
||||||
|
// const struct asymmetric_key_id *match_id = match_data->preparsed;
|
||||||
|
//
|
||||||
|
// return asymmetric_match_key_ids(kids, match_id,
|
||||||
|
// asymmetric_key_id_partial);
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Preparse the match criterion. If we don't set lookup_type and cmp,
|
||||||
|
* the default will be an exact match on the key description.
|
||||||
|
*
|
||||||
|
* There are some specifiers for matching key IDs rather than by the key
|
||||||
|
* description:
|
||||||
|
*
|
||||||
|
* "id:<id>" - find a key by partial match on any available ID
|
||||||
|
* "ex:<id>" - find a key by exact match on any available ID
|
||||||
|
*
|
||||||
|
* These have to be searched by iteration rather than by direct lookup because
|
||||||
|
* the key is hashed according to its description.
|
||||||
|
*/
|
||||||
|
// static int asymmetric_key_match_preparse(struct key_match_data *match_data)
|
||||||
|
//{
|
||||||
|
// struct asymmetric_key_id *match_id;
|
||||||
|
// const char *spec = match_data->raw_data;
|
||||||
|
// const char *id;
|
||||||
|
// bool (*cmp)(const struct key *, const struct key_match_data *) =
|
||||||
|
// asymmetric_key_cmp;
|
||||||
|
//
|
||||||
|
// if (!spec || !*spec)
|
||||||
|
// return -EINVAL;
|
||||||
|
// if (spec[0] == 'i' &&
|
||||||
|
// spec[1] == 'd' &&
|
||||||
|
// spec[2] == ':') {
|
||||||
|
// id = spec + 3;
|
||||||
|
// cmp = asymmetric_key_cmp_partial;
|
||||||
|
// } else if (spec[0] == 'e' &&
|
||||||
|
// spec[1] == 'x' &&
|
||||||
|
// spec[2] == ':') {
|
||||||
|
// id = spec + 3;
|
||||||
|
// } else {
|
||||||
|
// goto default_match;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// match_id = asymmetric_key_hex_to_key_id(id);
|
||||||
|
// if (IS_ERR(match_id))
|
||||||
|
// return PTR_ERR(match_id);
|
||||||
|
//
|
||||||
|
// match_data->preparsed = match_id;
|
||||||
|
// match_data->cmp = cmp;
|
||||||
|
// match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
|
||||||
|
// return 0;
|
||||||
|
//
|
||||||
|
// default_match:
|
||||||
|
// return 0;
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Free the preparsed the match criterion.
|
||||||
|
*/
|
||||||
|
// static void asymmetric_key_match_free(struct key_match_data *match_data)
|
||||||
|
//{
|
||||||
|
// kfree(match_data->preparsed);
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Describe the asymmetric key
|
||||||
|
*/
|
||||||
|
// static void asymmetric_key_describe(const struct key *key, struct seq_file *m)
|
||||||
|
//{
|
||||||
|
// const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
|
||||||
|
// const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
|
||||||
|
// const struct asymmetric_key_id *kid;
|
||||||
|
// const unsigned char *p;
|
||||||
|
// int n;
|
||||||
|
//
|
||||||
|
// seq_puts(m, key->description);
|
||||||
|
//
|
||||||
|
// if (subtype) {
|
||||||
|
// seq_puts(m, ": ");
|
||||||
|
// subtype->describe(key, m);
|
||||||
|
//
|
||||||
|
// if (kids && kids->id[1]) {
|
||||||
|
// kid = kids->id[1];
|
||||||
|
// seq_putc(m, ' ');
|
||||||
|
// n = kid->len;
|
||||||
|
// p = kid->data;
|
||||||
|
// if (n > 4) {
|
||||||
|
// p += n - 4;
|
||||||
|
// n = 4;
|
||||||
|
// }
|
||||||
|
// seq_printf(m, "%p", n, p);
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// seq_puts(m, " [");
|
||||||
|
// /* put something here to indicate the key's capabilities */
|
||||||
|
// seq_putc(m, ']');
|
||||||
|
// }
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Preparse a asymmetric payload to get format the contents appropriately for the
|
||||||
|
* internal payload to cut down on the number of scans of the data performed.
|
||||||
|
*
|
||||||
|
* We also generate a proposed description from the contents of the key that
|
||||||
|
* can be used to name the key if the user doesn't want to provide one.
|
||||||
|
*/
|
||||||
|
// static int asymmetric_key_preparse(struct key_preparsed_payload *prep)
|
||||||
|
//{
|
||||||
|
// struct asymmetric_key_parser *parser;
|
||||||
|
// int ret;
|
||||||
|
//
|
||||||
|
// pr_devel("==>%s()\n", __func__);
|
||||||
|
//
|
||||||
|
// if (prep->datalen == 0)
|
||||||
|
// return -EINVAL;
|
||||||
|
//
|
||||||
|
// down_read(&asymmetric_key_parsers_sem);
|
||||||
|
//
|
||||||
|
// ret = -EBADMSG;
|
||||||
|
// list_for_each_entry(parser, &asymmetric_key_parsers, link) {
|
||||||
|
// pr_debug("Trying parser '%s'\n", parser->name);
|
||||||
|
//
|
||||||
|
// ret = parser->parse(prep);
|
||||||
|
// if (ret != -EBADMSG) {
|
||||||
|
// pr_debug("Parser recognised the format (ret %d)\n",
|
||||||
|
// ret);
|
||||||
|
// break;
|
||||||
|
// }
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// up_read(&asymmetric_key_parsers_sem);
|
||||||
|
// pr_devel("<==%s() = %d\n", __func__, ret);
|
||||||
|
// return ret;
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Clean up the key ID list
|
||||||
|
*/
|
||||||
|
// static void asymmetric_key_free_kids(struct asymmetric_key_ids *kids)
|
||||||
|
//{
|
||||||
|
// int i;
|
||||||
|
//
|
||||||
|
// if (kids) {
|
||||||
|
// for (i = 0; i < ARRAY_SIZE(kids->id); i++)
|
||||||
|
// kfree(kids->id[i]);
|
||||||
|
// kfree(kids);
|
||||||
|
// }
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Clean up the preparse data
|
||||||
|
*/
|
||||||
|
// static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
|
||||||
|
//{
|
||||||
|
// struct asymmetric_key_subtype *subtype = prep->payload.data[asym_subtype];
|
||||||
|
// struct asymmetric_key_ids *kids = prep->payload.data[asym_key_ids];
|
||||||
|
//
|
||||||
|
// pr_devel("==>%s()\n", __func__);
|
||||||
|
//
|
||||||
|
// if (subtype) {
|
||||||
|
// subtype->destroy(prep->payload.data[asym_crypto],
|
||||||
|
// prep->payload.data[asym_auth]);
|
||||||
|
// module_put(subtype->owner);
|
||||||
|
// }
|
||||||
|
// asymmetric_key_free_kids(kids);
|
||||||
|
// kfree(prep->description);
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* dispose of the data dangling from the corpse of a asymmetric key
|
||||||
|
*/
|
||||||
|
// static void asymmetric_key_destroy(struct key *key)
|
||||||
|
//{
|
||||||
|
// struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
|
||||||
|
// struct asymmetric_key_ids *kids = key->payload.data[asym_key_ids];
|
||||||
|
// void *data = key->payload.data[asym_crypto];
|
||||||
|
// void *auth = key->payload.data[asym_auth];
|
||||||
|
//
|
||||||
|
// key->payload.data[asym_crypto] = NULL;
|
||||||
|
// key->payload.data[asym_subtype] = NULL;
|
||||||
|
// key->payload.data[asym_key_ids] = NULL;
|
||||||
|
// key->payload.data[asym_auth] = NULL;
|
||||||
|
//
|
||||||
|
// if (subtype) {
|
||||||
|
// subtype->destroy(data, auth);
|
||||||
|
// module_put(subtype->owner);
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// asymmetric_key_free_kids(kids);
|
||||||
|
// }
|
||||||
|
|
||||||
|
// static struct key_restriction *asymmetric_restriction_alloc(
|
||||||
|
// key_restrict_link_func_t check,
|
||||||
|
// struct key *key)
|
||||||
|
//{
|
||||||
|
// struct key_restriction *keyres =
|
||||||
|
// kzalloc(sizeof(struct key_restriction), GFP_KERNEL);
|
||||||
|
//
|
||||||
|
// if (!keyres)
|
||||||
|
// return ERR_PTR(-ENOMEM);
|
||||||
|
//
|
||||||
|
// keyres->check = check;
|
||||||
|
// keyres->key = key;
|
||||||
|
// keyres->keytype = &key_type_asymmetric;
|
||||||
|
//
|
||||||
|
// return keyres;
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* look up keyring restrict functions for asymmetric keys
|
||||||
|
*/
|
||||||
|
// static struct key_restriction *asymmetric_lookup_restriction(
|
||||||
|
// const char *restriction)
|
||||||
|
//{
|
||||||
|
// char *restrict_method;
|
||||||
|
// char *parse_buf;
|
||||||
|
// char *next;
|
||||||
|
// struct key_restriction *ret = ERR_PTR(-EINVAL);
|
||||||
|
//
|
||||||
|
// if (strcmp("builtin_trusted", restriction) == 0)
|
||||||
|
// return asymmetric_restriction_alloc(
|
||||||
|
// restrict_link_by_builtin_trusted, NULL);
|
||||||
|
//
|
||||||
|
// if (strcmp("builtin_and_secondary_trusted", restriction) == 0)
|
||||||
|
// return asymmetric_restriction_alloc(
|
||||||
|
// restrict_link_by_builtin_and_secondary_trusted, NULL);
|
||||||
|
//
|
||||||
|
// parse_buf = kstrndup(restriction, PAGE_SIZE, GFP_KERNEL);
|
||||||
|
// if (!parse_buf)
|
||||||
|
// return ERR_PTR(-ENOMEM);
|
||||||
|
//
|
||||||
|
// next = parse_buf;
|
||||||
|
// restrict_method = strsep(&next, ":");
|
||||||
|
//
|
||||||
|
// if ((strcmp(restrict_method, "key_or_keyring") == 0) && next) {
|
||||||
|
// char *key_text;
|
||||||
|
// key_serial_t serial;
|
||||||
|
// struct key *key;
|
||||||
|
// key_restrict_link_func_t link_fn =
|
||||||
|
// restrict_link_by_key_or_keyring;
|
||||||
|
// bool allow_null_key = false;
|
||||||
|
//
|
||||||
|
// key_text = strsep(&next, ":");
|
||||||
|
//
|
||||||
|
// if (next) {
|
||||||
|
// if (strcmp(next, "chain") != 0)
|
||||||
|
// goto out;
|
||||||
|
//
|
||||||
|
// link_fn = restrict_link_by_key_or_keyring_chain;
|
||||||
|
// allow_null_key = true;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// if (kstrtos32(key_text, 0, &serial) < 0)
|
||||||
|
// goto out;
|
||||||
|
//
|
||||||
|
// if ((serial == 0) && allow_null_key) {
|
||||||
|
// key = NULL;
|
||||||
|
// } else {
|
||||||
|
// key = key_lookup(serial);
|
||||||
|
// if (IS_ERR(key)) {
|
||||||
|
// ret = ERR_CAST(key);
|
||||||
|
// goto out;
|
||||||
|
// }
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// ret = asymmetric_restriction_alloc(link_fn, key);
|
||||||
|
// if (IS_ERR(ret))
|
||||||
|
// key_put(key);
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// out:
|
||||||
|
// kfree(parse_buf);
|
||||||
|
// return ret;
|
||||||
|
// }
|
||||||
|
|
||||||
|
// struct key_type key_type_asymmetric = {
|
||||||
|
// .name = "asymmetric",
|
||||||
|
// .preparse = asymmetric_key_preparse,
|
||||||
|
// .free_preparse = asymmetric_key_free_preparse,
|
||||||
|
// .instantiate = generic_key_instantiate,
|
||||||
|
// .match_preparse = asymmetric_key_match_preparse,
|
||||||
|
// .match_free = asymmetric_key_match_free,
|
||||||
|
// .destroy = asymmetric_key_destroy,
|
||||||
|
// .describe = asymmetric_key_describe,
|
||||||
|
// .lookup_restriction = asymmetric_lookup_restriction,
|
||||||
|
// };
|
||||||
|
// EXPORT_SYMBOL_GPL(key_type_asymmetric);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* register_asymmetric_key_parser - Register a asymmetric key blob parser
|
||||||
|
* @parser: The parser to register
|
||||||
|
*/
|
||||||
|
// int register_asymmetric_key_parser(struct asymmetric_key_parser *parser)
|
||||||
|
//{
|
||||||
|
// struct asymmetric_key_parser *cursor;
|
||||||
|
// int ret;
|
||||||
|
//
|
||||||
|
// down_write(&asymmetric_key_parsers_sem);
|
||||||
|
//
|
||||||
|
// list_for_each_entry(cursor, &asymmetric_key_parsers, link) {
|
||||||
|
// if (strcmp(cursor->name, parser->name) == 0) {
|
||||||
|
// pr_err("Asymmetric key parser '%s' already registered\n",
|
||||||
|
// parser->name);
|
||||||
|
// ret = -EEXIST;
|
||||||
|
// goto out;
|
||||||
|
// }
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// list_add_tail(&parser->link, &asymmetric_key_parsers);
|
||||||
|
//
|
||||||
|
// pr_notice("Asymmetric key parser '%s' registered\n", parser->name);
|
||||||
|
// ret = 0;
|
||||||
|
//
|
||||||
|
// out:
|
||||||
|
// up_write(&asymmetric_key_parsers_sem);
|
||||||
|
// return ret;
|
||||||
|
// }
|
||||||
|
// EXPORT_SYMBOL_GPL(register_asymmetric_key_parser);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* unregister_asymmetric_key_parser - Unregister a asymmetric key blob parser
|
||||||
|
* @parser: The parser to unregister
|
||||||
|
*/
|
||||||
|
// void unregister_asymmetric_key_parser(struct asymmetric_key_parser *parser)
|
||||||
|
//{
|
||||||
|
// down_write(&asymmetric_key_parsers_sem);
|
||||||
|
// list_del(&parser->link);
|
||||||
|
// up_write(&asymmetric_key_parsers_sem);
|
||||||
|
//
|
||||||
|
// pr_notice("Asymmetric key parser '%s' unregistered\n", parser->name);
|
||||||
|
// }
|
||||||
|
// EXPORT_SYMBOL_GPL(unregister_asymmetric_key_parser);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Module stuff
|
||||||
|
*/
|
||||||
|
// static int __init asymmetric_key_init(void)
|
||||||
|
//{
|
||||||
|
// return register_key_type(&key_type_asymmetric);
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// static void __exit asymmetric_key_cleanup(void)
|
||||||
|
//{
|
||||||
|
// unregister_key_type(&key_type_asymmetric);
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// module_init(asymmetric_key_init);
|
||||||
|
// module_exit(asymmetric_key_cleanup);
|
||||||
@ -0,0 +1,21 @@
|
|||||||
|
#pragma once
|
||||||
|
|
||||||
|
//#define usedbg
|
||||||
|
|
||||||
|
#ifdef usedbg
|
||||||
|
|
||||||
|
# define pr_debug DbgPrint
|
||||||
|
# define pr_devel DbgPrint
|
||||||
|
# define pr_err DbgPrint
|
||||||
|
# define pr_warn DbgPrint
|
||||||
|
# define printk DbgPrint
|
||||||
|
|
||||||
|
#else
|
||||||
|
|
||||||
|
# define pr_debug
|
||||||
|
# define pr_devel
|
||||||
|
# define pr_err
|
||||||
|
# define pr_warn
|
||||||
|
# define printk
|
||||||
|
|
||||||
|
#endif // usedbg
|
||||||
@ -0,0 +1,40 @@
|
|||||||
|
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
|
||||||
|
#ifndef _ASM_GENERIC_ERRNO_BASE_H
|
||||||
|
#define _ASM_GENERIC_ERRNO_BASE_H
|
||||||
|
|
||||||
|
#define EPERM 1 /* Operation not permitted */
|
||||||
|
#define ENOENT 2 /* No such file or directory */
|
||||||
|
#define ESRCH 3 /* No such process */
|
||||||
|
#define EINTR 4 /* Interrupted system call */
|
||||||
|
#define EIO 5 /* I/O error */
|
||||||
|
#define ENXIO 6 /* No such device or address */
|
||||||
|
#define E2BIG 7 /* Argument list too long */
|
||||||
|
#define ENOEXEC 8 /* Exec format error */
|
||||||
|
#define EBADF 9 /* Bad file number */
|
||||||
|
#define ECHILD 10 /* No child processes */
|
||||||
|
#define EAGAIN 11 /* Try again */
|
||||||
|
#define ENOMEM 12 /* Out of memory */
|
||||||
|
#define EACCES 13 /* Permission denied */
|
||||||
|
#define EFAULT 14 /* Bad address */
|
||||||
|
#define ENOTBLK 15 /* Block device required */
|
||||||
|
#define EBUSY 16 /* Device or resource busy */
|
||||||
|
#define EEXIST 17 /* File exists */
|
||||||
|
#define EXDEV 18 /* Cross-device link */
|
||||||
|
#define ENODEV 19 /* No such device */
|
||||||
|
#define ENOTDIR 20 /* Not a directory */
|
||||||
|
#define EISDIR 21 /* Is a directory */
|
||||||
|
#define EINVAL 22 /* Invalid argument */
|
||||||
|
#define ENFILE 23 /* File table overflow */
|
||||||
|
#define EMFILE 24 /* Too many open files */
|
||||||
|
#define ENOTTY 25 /* Not a typewriter */
|
||||||
|
#define ETXTBSY 26 /* Text file busy */
|
||||||
|
#define EFBIG 27 /* File too large */
|
||||||
|
#define ENOSPC 28 /* No space left on device */
|
||||||
|
#define ESPIPE 29 /* Illegal seek */
|
||||||
|
#define EROFS 30 /* Read-only file system */
|
||||||
|
#define EMLINK 31 /* Too many links */
|
||||||
|
#define EPIPE 32 /* Broken pipe */
|
||||||
|
#define EDOM 33 /* Math argument out of domain of func */
|
||||||
|
#define ERANGE 34 /* Math result not representable */
|
||||||
|
|
||||||
|
#endif
|
||||||
@ -0,0 +1,157 @@
|
|||||||
|
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
|
||||||
|
#ifndef _ALPHA_ERRNO_H
|
||||||
|
#define _ALPHA_ERRNO_H
|
||||||
|
|
||||||
|
#include "errno-base.h"
|
||||||
|
|
||||||
|
#undef EAGAIN /* 11 in errno-base.h */
|
||||||
|
|
||||||
|
#define EDEADLK 11 /* Resource deadlock would occur */
|
||||||
|
|
||||||
|
#define EAGAIN 35 /* Try again */
|
||||||
|
#define EWOULDBLOCK EAGAIN /* Operation would block */
|
||||||
|
#define EINPROGRESS 36 /* Operation now in progress */
|
||||||
|
#define EALREADY 37 /* Operation already in progress */
|
||||||
|
#define ENOTSOCK 38 /* Socket operation on non-socket */
|
||||||
|
#define EDESTADDRREQ 39 /* Destination address required */
|
||||||
|
#define EMSGSIZE 40 /* Message too long */
|
||||||
|
#define EPROTOTYPE 41 /* Protocol wrong type for socket */
|
||||||
|
#define ENOPROTOOPT 42 /* Protocol not available */
|
||||||
|
#define EPROTONOSUPPORT 43 /* Protocol not supported */
|
||||||
|
#define ESOCKTNOSUPPORT 44 /* Socket type not supported */
|
||||||
|
#define EOPNOTSUPP 45 /* Operation not supported on transport endpoint */
|
||||||
|
#define EPFNOSUPPORT 46 /* Protocol family not supported */
|
||||||
|
#define EAFNOSUPPORT 47 /* Address family not supported by protocol */
|
||||||
|
#define EADDRINUSE 48 /* Address already in use */
|
||||||
|
#define EADDRNOTAVAIL 49 /* Cannot assign requested address */
|
||||||
|
#define ENETDOWN 50 /* Network is down */
|
||||||
|
#define ENETUNREACH 51 /* Network is unreachable */
|
||||||
|
#define ENETRESET 52 /* Network dropped connection because of reset */
|
||||||
|
#define ECONNABORTED 53 /* Software caused connection abort */
|
||||||
|
#define ECONNRESET 54 /* Connection reset by peer */
|
||||||
|
#define ENOBUFS 55 /* No buffer space available */
|
||||||
|
#define EISCONN 56 /* Transport endpoint is already connected */
|
||||||
|
#define ENOTCONN 57 /* Transport endpoint is not connected */
|
||||||
|
#define ESHUTDOWN 58 /* Cannot send after transport endpoint shutdown */
|
||||||
|
#define ETOOMANYREFS 59 /* Too many references: cannot splice */
|
||||||
|
#define ETIMEDOUT 60 /* Connection timed out */
|
||||||
|
#define ECONNREFUSED 61 /* Connection refused */
|
||||||
|
#define ELOOP 62 /* Too many symbolic links encountered */
|
||||||
|
#define ENAMETOOLONG 63 /* File name too long */
|
||||||
|
#define EHOSTDOWN 64 /* Host is down */
|
||||||
|
#define EHOSTUNREACH 65 /* No route to host */
|
||||||
|
#define ENOTEMPTY 66 /* Directory not empty */
|
||||||
|
|
||||||
|
#define EUSERS 68 /* Too many users */
|
||||||
|
#define EDQUOT 69 /* Quota exceeded */
|
||||||
|
#define ESTALE 70 /* Stale file handle */
|
||||||
|
#define EREMOTE 71 /* Object is remote */
|
||||||
|
|
||||||
|
#define ENOLCK 77 /* No record locks available */
|
||||||
|
#define ENOSYS 78 /* Function not implemented */
|
||||||
|
|
||||||
|
#define ENOMSG 80 /* No message of desired type */
|
||||||
|
#define EIDRM 81 /* Identifier removed */
|
||||||
|
#define ENOSR 82 /* Out of streams resources */
|
||||||
|
#define ETIME 83 /* Timer expired */
|
||||||
|
#define EBADMSG 84 /* Not a data message */
|
||||||
|
#define EPROTO 85 /* Protocol error */
|
||||||
|
#define ENODATA 86 /* No data available */
|
||||||
|
#define ENOSTR 87 /* Device not a stream */
|
||||||
|
|
||||||
|
#define ENOPKG 92 /* Package not installed */
|
||||||
|
|
||||||
|
#define EILSEQ 116 /* Illegal byte sequence */
|
||||||
|
|
||||||
|
/* The following are just random noise.. */
|
||||||
|
#define ECHRNG 88 /* Channel number out of range */
|
||||||
|
#define EL2NSYNC 89 /* Level 2 not synchronized */
|
||||||
|
#define EL3HLT 90 /* Level 3 halted */
|
||||||
|
#define EL3RST 91 /* Level 3 reset */
|
||||||
|
|
||||||
|
#define ELNRNG 93 /* Link number out of range */
|
||||||
|
#define EUNATCH 94 /* Protocol driver not attached */
|
||||||
|
#define ENOCSI 95 /* No CSI structure available */
|
||||||
|
#define EL2HLT 96 /* Level 2 halted */
|
||||||
|
#define EBADE 97 /* Invalid exchange */
|
||||||
|
#define EBADR 98 /* Invalid request descriptor */
|
||||||
|
#define EXFULL 99 /* Exchange full */
|
||||||
|
#define ENOANO 100 /* No anode */
|
||||||
|
#define EBADRQC 101 /* Invalid request code */
|
||||||
|
#define EBADSLT 102 /* Invalid slot */
|
||||||
|
|
||||||
|
#define EDEADLOCK EDEADLK
|
||||||
|
|
||||||
|
#define EBFONT 104 /* Bad font file format */
|
||||||
|
#define ENONET 105 /* Machine is not on the network */
|
||||||
|
#define ENOLINK 106 /* Link has been severed */
|
||||||
|
#define EADV 107 /* Advertise error */
|
||||||
|
#define ESRMNT 108 /* Srmount error */
|
||||||
|
#define ECOMM 109 /* Communication error on send */
|
||||||
|
#define EMULTIHOP 110 /* Multihop attempted */
|
||||||
|
#define EDOTDOT 111 /* RFS specific error */
|
||||||
|
#define EOVERFLOW 112 /* Value too large for defined data type */
|
||||||
|
#define ENOTUNIQ 113 /* Name not unique on network */
|
||||||
|
#define EBADFD 114 /* File descriptor in bad state */
|
||||||
|
#define EREMCHG 115 /* Remote address changed */
|
||||||
|
|
||||||
|
#define EUCLEAN 117 /* Structure needs cleaning */
|
||||||
|
#define ENOTNAM 118 /* Not a XENIX named type file */
|
||||||
|
#define ENAVAIL 119 /* No XENIX semaphores available */
|
||||||
|
#define EISNAM 120 /* Is a named type file */
|
||||||
|
#define EREMOTEIO 121 /* Remote I/O error */
|
||||||
|
|
||||||
|
#define ELIBACC 122 /* Can not access a needed shared library */
|
||||||
|
#define ELIBBAD 123 /* Accessing a corrupted shared library */
|
||||||
|
#define ELIBSCN 124 /* .lib section in a.out corrupted */
|
||||||
|
#define ELIBMAX 125 /* Attempting to link in too many shared libraries */
|
||||||
|
#define ELIBEXEC 126 /* Cannot exec a shared library directly */
|
||||||
|
#define ERESTART 127 /* Interrupted system call should be restarted */
|
||||||
|
#define ESTRPIPE 128 /* Streams pipe error */
|
||||||
|
|
||||||
|
#define ENOMEDIUM 129 /* No medium found */
|
||||||
|
#define EMEDIUMTYPE 130 /* Wrong medium type */
|
||||||
|
#define ECANCELED 131 /* Operation Cancelled */
|
||||||
|
#define ENOKEY 132 /* Required key not available */
|
||||||
|
#define EKEYEXPIRED 133 /* Key has expired */
|
||||||
|
#define EKEYREVOKED 134 /* Key has been revoked */
|
||||||
|
#define EKEYREJECTED 135 /* Key was rejected by service */
|
||||||
|
|
||||||
|
/* for robust mutexes */
|
||||||
|
#define EOWNERDEAD 136 /* Owner died */
|
||||||
|
#define ENOTRECOVERABLE 137 /* State not recoverable */
|
||||||
|
|
||||||
|
#define ERFKILL 138 /* Operation not possible due to RF-kill */
|
||||||
|
|
||||||
|
#define EHWPOISON 139 /* Memory page has hardware error */
|
||||||
|
|
||||||
|
//×·¼ÓµÄ
|
||||||
|
|
||||||
|
/*
|
||||||
|
* These should never be seen by user programs. To return one of ERESTART*
|
||||||
|
* codes, signal_pending() MUST be set. Note that ptrace can observe these
|
||||||
|
* at syscall exit tracing, but they will never be left for the debugged user
|
||||||
|
* process to see.
|
||||||
|
*/
|
||||||
|
#define ERESTARTSYS 512
|
||||||
|
#define ERESTARTNOINTR 513
|
||||||
|
#define ERESTARTNOHAND 514 /* restart if no handler.. */
|
||||||
|
#define ENOIOCTLCMD 515 /* No ioctl command */
|
||||||
|
#define ERESTART_RESTARTBLOCK 516 /* restart by calling sys_restart_syscall */
|
||||||
|
#define EPROBE_DEFER 517 /* Driver requests probe retry */
|
||||||
|
#define EOPENSTALE 518 /* open found a stale dentry */
|
||||||
|
#define ENOPARAM 519 /* Parameter not supported */
|
||||||
|
|
||||||
|
/* Defined for the NFSv3 protocol */
|
||||||
|
#define EBADHANDLE 521 /* Illegal NFS file handle */
|
||||||
|
#define ENOTSYNC 522 /* Update synchronization mismatch */
|
||||||
|
#define EBADCOOKIE 523 /* Cookie is stale */
|
||||||
|
#define ENOTSUPP 524 /* Operation is not supported */
|
||||||
|
#define ETOOSMALL 525 /* Buffer or request is too small */
|
||||||
|
#define ESERVERFAULT 526 /* An untranslatable error occurred */
|
||||||
|
#define EBADTYPE 527 /* Type not supported by server */
|
||||||
|
#define EJUKEBOX 528 /* Request initiated, but will not complete before timeout */
|
||||||
|
#define EIOCBQUEUED 529 /* iocb queued, will get completion event */
|
||||||
|
#define ERECALLCONFLICT 530 /* conflict with recalled state */
|
||||||
|
|
||||||
|
#endif
|
||||||
@ -0,0 +1,448 @@
|
|||||||
|
///* Authentication token and access key management
|
||||||
|
// *
|
||||||
|
// * Copyright (C) 2004, 2007 Red Hat, Inc. All Rights Reserved.
|
||||||
|
// * Written by David Howells (dhowells@redhat.com)
|
||||||
|
// *
|
||||||
|
// * This program is free software; you can redistribute it and/or
|
||||||
|
// * modify it under the terms of the GNU General Public License
|
||||||
|
// * as published by the Free Software Foundation; either version
|
||||||
|
// * 2 of the License, or (at your option) any later version.
|
||||||
|
// *
|
||||||
|
// *
|
||||||
|
// * See Documentation/security/keys/core.rst for information on keys/keyrings.
|
||||||
|
// */
|
||||||
|
//
|
||||||
|
//#pragma once
|
||||||
|
//
|
||||||
|
// //#ifndef _LINUX_KEY_H
|
||||||
|
////#define _LINUX_KEY_H
|
||||||
|
//
|
||||||
|
////#include <linux/types.h>
|
||||||
|
////#include <linux/list.h>
|
||||||
|
////#include <linux/rbtree.h>
|
||||||
|
////#include <linux/rcupdate.h>
|
||||||
|
////#include <linux/sysctl.h>
|
||||||
|
////#include <linux/rwsem.h>
|
||||||
|
////#include <linux/atomic.h>
|
||||||
|
////#include <linux/assoc_array.h>
|
||||||
|
////#include <linux/refcount.h>
|
||||||
|
////#include <linux/time64.h>
|
||||||
|
//
|
||||||
|
//
|
||||||
|
////#ifdef __KERNEL__
|
||||||
|
////#include <linux/uidgid.h>
|
||||||
|
//
|
||||||
|
//#include <fltKernel.h>
|
||||||
|
//
|
||||||
|
//#include <stdint.h>
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//
|
||||||
|
////
|
||||||
|
//// macro
|
||||||
|
////
|
||||||
|
//
|
||||||
|
//#define CONFIG_KEYS
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//
|
||||||
|
///* key handle serial number */
|
||||||
|
// typedef int32_t key_serial_t;
|
||||||
|
//
|
||||||
|
///* key handle permissions mask */
|
||||||
|
// typedef uint32_t key_perm_t;
|
||||||
|
//
|
||||||
|
// struct key;
|
||||||
|
//
|
||||||
|
//#ifdef CONFIG_KEYS
|
||||||
|
//
|
||||||
|
//#undef KEY_DEBUGGING
|
||||||
|
//
|
||||||
|
//#define KEY_POS_VIEW 0x01000000 /* possessor can view a key's attributes */
|
||||||
|
//#define KEY_POS_READ 0x02000000 /* possessor can read key payload / view keyring */
|
||||||
|
//#define KEY_POS_WRITE 0x04000000 /* possessor can update key payload / add link to keyring */
|
||||||
|
//#define KEY_POS_SEARCH 0x08000000 /* possessor can find a key in search / search a keyring */
|
||||||
|
//#define KEY_POS_LINK 0x10000000 /* possessor can create a link to a key/keyring */
|
||||||
|
//#define KEY_POS_SETATTR 0x20000000 /* possessor can set key attributes */
|
||||||
|
//#define KEY_POS_ALL 0x3f000000
|
||||||
|
//
|
||||||
|
//#define KEY_USR_VIEW 0x00010000 /* user permissions... */
|
||||||
|
//#define KEY_USR_READ 0x00020000
|
||||||
|
//#define KEY_USR_WRITE 0x00040000
|
||||||
|
//#define KEY_USR_SEARCH 0x00080000
|
||||||
|
//#define KEY_USR_LINK 0x00100000
|
||||||
|
//#define KEY_USR_SETATTR 0x00200000
|
||||||
|
//#define KEY_USR_ALL 0x003f0000
|
||||||
|
//
|
||||||
|
//#define KEY_GRP_VIEW 0x00000100 /* group permissions... */
|
||||||
|
//#define KEY_GRP_READ 0x00000200
|
||||||
|
//#define KEY_GRP_WRITE 0x00000400
|
||||||
|
//#define KEY_GRP_SEARCH 0x00000800
|
||||||
|
//#define KEY_GRP_LINK 0x00001000
|
||||||
|
//#define KEY_GRP_SETATTR 0x00002000
|
||||||
|
//#define KEY_GRP_ALL 0x00003f00
|
||||||
|
//
|
||||||
|
//#define KEY_OTH_VIEW 0x00000001 /* third party permissions... */
|
||||||
|
//#define KEY_OTH_READ 0x00000002
|
||||||
|
//#define KEY_OTH_WRITE 0x00000004
|
||||||
|
//#define KEY_OTH_SEARCH 0x00000008
|
||||||
|
//#define KEY_OTH_LINK 0x00000010
|
||||||
|
//#define KEY_OTH_SETATTR 0x00000020
|
||||||
|
//#define KEY_OTH_ALL 0x0000003f
|
||||||
|
//
|
||||||
|
//#define KEY_PERM_UNDEF 0xffffffff
|
||||||
|
//
|
||||||
|
// struct seq_file;
|
||||||
|
// struct user_struct;
|
||||||
|
// struct signal_struct;
|
||||||
|
// struct cred;
|
||||||
|
//
|
||||||
|
// struct key_type;
|
||||||
|
// struct key_owner;
|
||||||
|
// struct keyring_list;
|
||||||
|
// struct keyring_name;
|
||||||
|
//
|
||||||
|
// struct keyring_index_key {
|
||||||
|
// struct key_type *type;
|
||||||
|
// const char *description;
|
||||||
|
// size_t desc_len;
|
||||||
|
// };
|
||||||
|
//
|
||||||
|
// union key_payload {
|
||||||
|
// void __rcu *rcu_data0;
|
||||||
|
// void *data[4];
|
||||||
|
// };
|
||||||
|
//
|
||||||
|
///*****************************************************************************/
|
||||||
|
///*
|
||||||
|
// * key reference with possession attribute handling
|
||||||
|
// *
|
||||||
|
// * NOTE! key_ref_t is a typedef'd pointer to a type that is not actually
|
||||||
|
// * defined. This is because we abuse the bottom bit of the reference to carry a
|
||||||
|
// * flag to indicate whether the calling process possesses that key in one of
|
||||||
|
// * its keyrings.
|
||||||
|
// *
|
||||||
|
// * the key_ref_t has been made a separate type so that the compiler can reject
|
||||||
|
// * attempts to dereference it without proper conversion.
|
||||||
|
// *
|
||||||
|
// * the three functions are used to assemble and disassemble references
|
||||||
|
// */
|
||||||
|
// typedef struct __key_reference_with_attributes *key_ref_t;
|
||||||
|
//
|
||||||
|
// static inline key_ref_t make_key_ref(const struct key *key,
|
||||||
|
// bool possession)
|
||||||
|
//{
|
||||||
|
// return (key_ref_t) ((unsigned long) key | possession);
|
||||||
|
//}
|
||||||
|
//
|
||||||
|
// static inline struct key *key_ref_to_ptr(const key_ref_t key_ref)
|
||||||
|
//{
|
||||||
|
// return (struct key *) ((unsigned long) key_ref & ~1UL);
|
||||||
|
//}
|
||||||
|
//
|
||||||
|
// static inline bool is_key_possessed(const key_ref_t key_ref)
|
||||||
|
//{
|
||||||
|
// return (unsigned long) key_ref & 1UL;
|
||||||
|
//}
|
||||||
|
//
|
||||||
|
// typedef int (*key_restrict_link_func_t)(struct key *dest_keyring,
|
||||||
|
// const struct key_type *type,
|
||||||
|
// const union key_payload *payload,
|
||||||
|
// struct key *restriction_key);
|
||||||
|
//
|
||||||
|
// struct key_restriction {
|
||||||
|
// key_restrict_link_func_t check;
|
||||||
|
// struct key *key;
|
||||||
|
// struct key_type *keytype;
|
||||||
|
//};
|
||||||
|
//
|
||||||
|
// enum key_state {
|
||||||
|
// KEY_IS_UNINSTANTIATED,
|
||||||
|
// KEY_IS_POSITIVE, /* Positively instantiated */
|
||||||
|
//};
|
||||||
|
//
|
||||||
|
///*****************************************************************************/
|
||||||
|
///*
|
||||||
|
// * authentication token / access credential / keyring
|
||||||
|
// * - types of key include:
|
||||||
|
// * - keyrings
|
||||||
|
// * - disk encryption IDs
|
||||||
|
// * - Kerberos TGTs and tickets
|
||||||
|
// */
|
||||||
|
// struct key {
|
||||||
|
// refcount_t usage; /* number of references */
|
||||||
|
// key_serial_t serial; /* key serial number */
|
||||||
|
// union {
|
||||||
|
// struct list_head graveyard_link;
|
||||||
|
// struct rb_node serial_node;
|
||||||
|
// };
|
||||||
|
// struct rw_semaphore sem; /* change vs change sem */
|
||||||
|
// struct key_user *user; /* owner of this key */
|
||||||
|
// void *security; /* security data for this key */
|
||||||
|
// union {
|
||||||
|
// time64_t expiry; /* time at which key expires (or 0) */
|
||||||
|
// time64_t revoked_at; /* time at which key was revoked */
|
||||||
|
// };
|
||||||
|
// time64_t last_used_at; /* last time used for LRU keyring discard */
|
||||||
|
// kuid_t uid;
|
||||||
|
// kgid_t gid;
|
||||||
|
// key_perm_t perm; /* access permissions */
|
||||||
|
// unsigned short quotalen; /* length added to quota */
|
||||||
|
// unsigned short datalen; /* payload data length
|
||||||
|
// * - may not match RCU dereferenced payload
|
||||||
|
// * - payload should contain own length
|
||||||
|
// */
|
||||||
|
// short state; /* Key state (+) or rejection error (-) */
|
||||||
|
//
|
||||||
|
//#ifdef KEY_DEBUGGING
|
||||||
|
// unsigned magic;
|
||||||
|
//#define KEY_DEBUG_MAGIC 0x18273645u
|
||||||
|
//#endif
|
||||||
|
//
|
||||||
|
// unsigned long flags; /* status flags (change with bitops) */
|
||||||
|
//#define KEY_FLAG_DEAD 0 /* set if key type has been deleted */
|
||||||
|
//#define KEY_FLAG_REVOKED 1 /* set if key had been revoked */
|
||||||
|
//#define KEY_FLAG_IN_QUOTA 2 /* set if key consumes quota */
|
||||||
|
//#define KEY_FLAG_USER_CONSTRUCT 3 /* set if key is being constructed in userspace */
|
||||||
|
//#define KEY_FLAG_ROOT_CAN_CLEAR 4 /* set if key can be cleared by root without permission */
|
||||||
|
//#define KEY_FLAG_INVALIDATED 5 /* set if key has been invalidated */
|
||||||
|
//#define KEY_FLAG_BUILTIN 6 /* set if key is built in to the kernel */
|
||||||
|
//#define KEY_FLAG_ROOT_CAN_INVAL 7 /* set if key can be invalidated by root without permission */
|
||||||
|
//#define KEY_FLAG_KEEP 8 /* set if key should not be removed */
|
||||||
|
//#define KEY_FLAG_UID_KEYRING 9 /* set if key is a user or user session keyring */
|
||||||
|
//
|
||||||
|
// /* the key type and key description string
|
||||||
|
// * - the desc is used to match a key against search criteria
|
||||||
|
// * - it should be a printable string
|
||||||
|
// * - eg: for krb5 AFS, this might be "afs@REDHAT.COM"
|
||||||
|
// */
|
||||||
|
// union {
|
||||||
|
// struct keyring_index_key index_key;
|
||||||
|
// struct {
|
||||||
|
// struct key_type *type; /* type of key */
|
||||||
|
// char *description;
|
||||||
|
// };
|
||||||
|
// };
|
||||||
|
//
|
||||||
|
// /* key data
|
||||||
|
// * - this is used to hold the data actually used in cryptography or
|
||||||
|
// * whatever
|
||||||
|
// */
|
||||||
|
// union {
|
||||||
|
// union key_payload payload;
|
||||||
|
// struct {
|
||||||
|
// /* Keyring bits */
|
||||||
|
// struct list_head name_link;
|
||||||
|
// struct assoc_array keys;
|
||||||
|
// };
|
||||||
|
// };
|
||||||
|
//
|
||||||
|
// /* This is set on a keyring to restrict the addition of a link to a key
|
||||||
|
// * to it. If this structure isn't provided then it is assumed that the
|
||||||
|
// * keyring is open to any addition. It is ignored for non-keyring
|
||||||
|
// * keys. Only set this value using keyring_restrict(), keyring_alloc(),
|
||||||
|
// * or key_alloc().
|
||||||
|
// *
|
||||||
|
// * This is intended for use with rings of trusted keys whereby addition
|
||||||
|
// * to the keyring needs to be controlled. KEY_ALLOC_BYPASS_RESTRICTION
|
||||||
|
// * overrides this, allowing the kernel to add extra keys without
|
||||||
|
// * restriction.
|
||||||
|
// */
|
||||||
|
// struct key_restriction *restrict_link;
|
||||||
|
//};
|
||||||
|
//
|
||||||
|
// extern struct key *key_alloc(struct key_type *type,
|
||||||
|
// const char *desc,
|
||||||
|
// kuid_t uid, kgid_t gid,
|
||||||
|
// const struct cred *cred,
|
||||||
|
// key_perm_t perm,
|
||||||
|
// unsigned long flags,
|
||||||
|
// struct key_restriction *restrict_link);
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//#define KEY_ALLOC_IN_QUOTA 0x0000 /* add to quota, reject if would overrun */
|
||||||
|
//#define KEY_ALLOC_QUOTA_OVERRUN 0x0001 /* add to quota, permit even if overrun */
|
||||||
|
//#define KEY_ALLOC_NOT_IN_QUOTA 0x0002 /* not in quota */
|
||||||
|
//#define KEY_ALLOC_BUILT_IN 0x0004 /* Key is built into kernel */
|
||||||
|
//#define KEY_ALLOC_BYPASS_RESTRICTION 0x0008 /* Override the check on restricted keyrings */
|
||||||
|
//#define KEY_ALLOC_UID_KEYRING 0x0010 /* allocating a user or user session keyring */
|
||||||
|
//
|
||||||
|
// extern void key_revoke(struct key *key);
|
||||||
|
// extern void key_invalidate(struct key *key);
|
||||||
|
// extern void key_put(struct key *key);
|
||||||
|
//
|
||||||
|
// static inline struct key *__key_get(struct key *key)
|
||||||
|
//{
|
||||||
|
// refcount_inc(&key->usage);
|
||||||
|
// return key;
|
||||||
|
//}
|
||||||
|
//
|
||||||
|
// static inline struct key *key_get(struct key *key)
|
||||||
|
//{
|
||||||
|
// return key ? __key_get(key) : key;
|
||||||
|
//}
|
||||||
|
//
|
||||||
|
// static inline void key_ref_put(key_ref_t key_ref)
|
||||||
|
//{
|
||||||
|
// key_put(key_ref_to_ptr(key_ref));
|
||||||
|
//}
|
||||||
|
//
|
||||||
|
// extern struct key *request_key(struct key_type *type,
|
||||||
|
// const char *description,
|
||||||
|
// const char *callout_info);
|
||||||
|
//
|
||||||
|
// extern struct key *request_key_with_auxdata(struct key_type *type,
|
||||||
|
// const char *description,
|
||||||
|
// const void *callout_info,
|
||||||
|
// size_t callout_len,
|
||||||
|
// void *aux);
|
||||||
|
//
|
||||||
|
// extern struct key *request_key_async(struct key_type *type,
|
||||||
|
// const char *description,
|
||||||
|
// const void *callout_info,
|
||||||
|
// size_t callout_len);
|
||||||
|
//
|
||||||
|
// extern struct key *request_key_async_with_auxdata(struct key_type *type,
|
||||||
|
// const char *description,
|
||||||
|
// const void *callout_info,
|
||||||
|
// size_t callout_len,
|
||||||
|
// void *aux);
|
||||||
|
//
|
||||||
|
// extern int wait_for_key_construction(struct key *key, bool intr);
|
||||||
|
//
|
||||||
|
// extern int key_validate(const struct key *key);
|
||||||
|
//
|
||||||
|
// extern key_ref_t key_create_or_update(key_ref_t keyring,
|
||||||
|
// const char *type,
|
||||||
|
// const char *description,
|
||||||
|
// const void *payload,
|
||||||
|
// size_t plen,
|
||||||
|
// key_perm_t perm,
|
||||||
|
// unsigned long flags);
|
||||||
|
//
|
||||||
|
// extern int key_update(key_ref_t key,
|
||||||
|
// const void *payload,
|
||||||
|
// size_t plen);
|
||||||
|
//
|
||||||
|
// extern int key_link(struct key *keyring,
|
||||||
|
// struct key *key);
|
||||||
|
//
|
||||||
|
// extern int key_unlink(struct key *keyring,
|
||||||
|
// struct key *key);
|
||||||
|
//
|
||||||
|
// extern struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
|
||||||
|
// const struct cred *cred,
|
||||||
|
// key_perm_t perm,
|
||||||
|
// unsigned long flags,
|
||||||
|
// struct key_restriction *restrict_link,
|
||||||
|
// struct key *dest);
|
||||||
|
//
|
||||||
|
// extern int restrict_link_reject(struct key *keyring,
|
||||||
|
// const struct key_type *type,
|
||||||
|
// const union key_payload *payload,
|
||||||
|
// struct key *restriction_key);
|
||||||
|
//
|
||||||
|
// extern int keyring_clear(struct key *keyring);
|
||||||
|
//
|
||||||
|
// extern key_ref_t keyring_search(key_ref_t keyring,
|
||||||
|
// struct key_type *type,
|
||||||
|
// const char *description);
|
||||||
|
//
|
||||||
|
// extern int keyring_add_key(struct key *keyring,
|
||||||
|
// struct key *key);
|
||||||
|
//
|
||||||
|
// extern int keyring_restrict(key_ref_t keyring, const char *type,
|
||||||
|
// const char *restriction);
|
||||||
|
//
|
||||||
|
// extern struct key *key_lookup(key_serial_t id);
|
||||||
|
//
|
||||||
|
// static inline key_serial_t key_serial(const struct key *key)
|
||||||
|
//{
|
||||||
|
// return key ? key->serial : 0;
|
||||||
|
//}
|
||||||
|
//
|
||||||
|
// extern void key_set_timeout(struct key *, unsigned);
|
||||||
|
//
|
||||||
|
// extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags,
|
||||||
|
// key_perm_t perm);
|
||||||
|
//
|
||||||
|
///*
|
||||||
|
// * The permissions required on a key that we're looking up.
|
||||||
|
// */
|
||||||
|
//#define KEY_NEED_VIEW 0x01 /* Require permission to view attributes */
|
||||||
|
//#define KEY_NEED_READ 0x02 /* Require permission to read content */
|
||||||
|
//#define KEY_NEED_WRITE 0x04 /* Require permission to update / modify */
|
||||||
|
//#define KEY_NEED_SEARCH 0x08 /* Require permission to search (keyring) or find (key) */
|
||||||
|
//#define KEY_NEED_LINK 0x10 /* Require permission to link */
|
||||||
|
//#define KEY_NEED_SETATTR 0x20 /* Require permission to change attributes */
|
||||||
|
//#define KEY_NEED_ALL 0x3f /* All the above permissions */
|
||||||
|
//
|
||||||
|
////static inline short key_read_state(const struct key *key)
|
||||||
|
////{
|
||||||
|
//// /* Barrier versus mark_key_instantiated(). */
|
||||||
|
//// return smp_load_acquire(&key->state);
|
||||||
|
////}
|
||||||
|
//
|
||||||
|
///**
|
||||||
|
// * key_is_positive - Determine if a key has been positively instantiated
|
||||||
|
// * @key: The key to check.
|
||||||
|
// *
|
||||||
|
// * Return true if the specified key has been positively instantiated, false
|
||||||
|
// * otherwise.
|
||||||
|
// */
|
||||||
|
// static inline bool key_is_positive(const struct key *key)
|
||||||
|
//{
|
||||||
|
// return key_read_state(key) == KEY_IS_POSITIVE;
|
||||||
|
//}
|
||||||
|
//
|
||||||
|
// static inline bool key_is_negative(const struct key *key)
|
||||||
|
//{
|
||||||
|
// return key_read_state(key) < 0;
|
||||||
|
//}
|
||||||
|
//
|
||||||
|
//#define dereference_key_rcu(KEY) \
|
||||||
|
// (rcu_dereference((KEY)->payload.rcu_data0))
|
||||||
|
//
|
||||||
|
//#define dereference_key_locked(KEY) \
|
||||||
|
// (rcu_dereference_protected((KEY)->payload.rcu_data0, \
|
||||||
|
// rwsem_is_locked(&((struct key *)(KEY))->sem)))
|
||||||
|
//
|
||||||
|
// #define rcu_assign_keypointer(KEY, PAYLOAD) \
|
||||||
|
//do { \
|
||||||
|
// rcu_assign_pointer((KEY)->payload.rcu_data0, (PAYLOAD)); \
|
||||||
|
//} while (0)
|
||||||
|
//
|
||||||
|
//#ifdef CONFIG_SYSCTL
|
||||||
|
// extern struct ctl_table key_sysctls[];
|
||||||
|
//#endif
|
||||||
|
///*
|
||||||
|
// * the userspace interface
|
||||||
|
// */
|
||||||
|
// extern int install_thread_keyring_to_cred(struct cred *cred);
|
||||||
|
// extern void key_fsuid_changed(struct task_struct *tsk);
|
||||||
|
// extern void key_fsgid_changed(struct task_struct *tsk);
|
||||||
|
// extern void key_init(void);
|
||||||
|
//
|
||||||
|
//#else /* CONFIG_KEYS */
|
||||||
|
//
|
||||||
|
//#define key_validate(k) 0
|
||||||
|
//#define key_serial(k) 0
|
||||||
|
//#define key_get(k) ({ NULL; })
|
||||||
|
//#define key_revoke(k) do { } while(0)
|
||||||
|
//#define key_invalidate(k) do { } while(0)
|
||||||
|
//#define key_put(k) do { } while(0)
|
||||||
|
//#define key_ref_put(k) do { } while(0)
|
||||||
|
//#define make_key_ref(k, p) NULL
|
||||||
|
//#define key_ref_to_ptr(k) NULL
|
||||||
|
//#define is_key_possessed(k) 0
|
||||||
|
//#define key_fsuid_changed(t) do { } while(0)
|
||||||
|
//#define key_fsgid_changed(t) do { } while(0)
|
||||||
|
//#define key_init() do { } while(0)
|
||||||
|
//
|
||||||
|
//#endif /* CONFIG_KEYS */
|
||||||
|
////#endif /* __KERNEL__ */
|
||||||
|
////#endif /* _LINUX_KEY_H */
|
||||||
@ -0,0 +1,296 @@
|
|||||||
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
||||||
|
/* Parse a Microsoft Individual Code Signing blob
|
||||||
|
*
|
||||||
|
* Copyright (C) 2014 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*/
|
||||||
|
|
||||||
|
//#define pr_fmt(fmt) "MSCODE: "fmt
|
||||||
|
//#include <linux/kernel.h>
|
||||||
|
//#include <linux/slab.h>
|
||||||
|
//#include <linux/err.h>
|
||||||
|
//#include <linux/oid_registry.h>
|
||||||
|
//#include <crypto/pkcs7.h>
|
||||||
|
//#include "verify_pefile.h"
|
||||||
|
//#include "mscode.asn1.h"
|
||||||
|
|
||||||
|
#include "verify_pefile.h"
|
||||||
|
#include "pkcs7.h"
|
||||||
|
#include "asn1.h"
|
||||||
|
#include "asn1_ber_bytecode.h"
|
||||||
|
#include "asn1_decoder.h"
|
||||||
|
#include "errno.h"
|
||||||
|
#include "oid_registry.h"
|
||||||
|
|
||||||
|
#include "../rewrite/Lib.SoulExtraction.rewrite.h"
|
||||||
|
|
||||||
|
#define pr_debug
|
||||||
|
#define pr_devel
|
||||||
|
#define pr_warn
|
||||||
|
#define pr_err
|
||||||
|
#define printk
|
||||||
|
|
||||||
|
#define GFP_ATOMIC /*(__GFP_HIGH|__GFP_ATOMIC|__GFP_KSWAPD_RECLAIM)*/ 1
|
||||||
|
#define GFP_KERNEL /*(__GFP_RECLAIM | __GFP_IO | __GFP_FS)*/ 2
|
||||||
|
#define GFP_KERNEL_ACCOUNT /*(GFP_KERNEL | __GFP_ACCOUNT)*/ 3
|
||||||
|
#define GFP_NOWAIT /*(__GFP_KSWAPD_RECLAIM)*/ 4
|
||||||
|
#define GFP_NOIO /*(__GFP_RECLAIM)*/ 5
|
||||||
|
#define GFP_NOFS /*(__GFP_RECLAIM | __GFP_IO)*/ 6
|
||||||
|
#define GFP_USER /*(__GFP_RECLAIM | __GFP_IO | __GFP_FS | __GFP_HARDWALL)*/ 7
|
||||||
|
#define GFP_DMA /*__GFP_DMA*/ 8
|
||||||
|
#define GFP_DMA32 /*__GFP_DMA32*/ 9
|
||||||
|
#define GFP_HIGHUSER /*(GFP_USER | __GFP_HIGHMEM)*/ 10
|
||||||
|
#define GFP_HIGHUSER_MOVABLE /*(GFP_HIGHUSER | __GFP_MOVABLE)*/ 11
|
||||||
|
#define GFP_TRANSHUGE_LIGHT 12
|
||||||
|
#define GFP_TRANSHUGE /*(GFP_TRANSHUGE_LIGHT | __GFP_DIRECT_RECLAIM)*/ 13
|
||||||
|
|
||||||
|
#define ERR_PTR(err) ((void *)((long)(err)))
|
||||||
|
#define PTR_ERR(ptr) ((long)(ptr))
|
||||||
|
#define IS_ERR(ptr) ((unsigned long)(ptr) > (unsigned long)(-1000))
|
||||||
|
|
||||||
|
//
|
||||||
|
// fun decla
|
||||||
|
//
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Check the content type OID
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
mscode_note_content_type(void *context, size_t hdrlen, unsigned char tag, const void *value, size_t vlen);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Note the digest we're guaranteeing with this certificate
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
mscode_note_digest(void *context, size_t hdrlen, unsigned char tag, const void *value, size_t vlen);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Note the digest algorithm OID
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
mscode_note_digest_algo(void *context, size_t hdrlen, unsigned char tag, const void *value, size_t vlen);
|
||||||
|
|
||||||
|
//
|
||||||
|
// enum
|
||||||
|
//
|
||||||
|
|
||||||
|
enum mscode_actions
|
||||||
|
{
|
||||||
|
ACT_mscode_note_content_type = 0,
|
||||||
|
ACT_mscode_note_digest = 1,
|
||||||
|
ACT_mscode_note_digest_algo = 2,
|
||||||
|
NR__mscode_actions = 3
|
||||||
|
};
|
||||||
|
|
||||||
|
//
|
||||||
|
// global
|
||||||
|
//
|
||||||
|
|
||||||
|
static const asn1_action_t mscode_action_table[NR__mscode_actions] = {
|
||||||
|
mscode_note_content_type,
|
||||||
|
mscode_note_digest,
|
||||||
|
mscode_note_digest_algo,
|
||||||
|
};
|
||||||
|
|
||||||
|
static const unsigned char mscode_machine[] = {
|
||||||
|
// MSCode
|
||||||
|
ASN1_OP_MATCH,
|
||||||
|
_tag(UNIV, CONS, SEQ),
|
||||||
|
ASN1_OP_MATCH, // type
|
||||||
|
_tag(UNIV, CONS, SEQ),
|
||||||
|
// ContentType
|
||||||
|
ASN1_OP_MATCH_ACT,
|
||||||
|
_tag(UNIV, PRIM, OID),
|
||||||
|
_action(ACT_mscode_note_content_type),
|
||||||
|
ASN1_OP_MATCH_ANY, // parameters
|
||||||
|
ASN1_OP_END_SEQ,
|
||||||
|
ASN1_OP_MATCH, // content
|
||||||
|
_tag(UNIV, CONS, SEQ),
|
||||||
|
// DigestAlgorithmIdentifier
|
||||||
|
ASN1_OP_MATCH,
|
||||||
|
_tag(UNIV, CONS, SEQ),
|
||||||
|
ASN1_OP_MATCH_ACT, // algorithm
|
||||||
|
_tag(UNIV, PRIM, OID),
|
||||||
|
_action(ACT_mscode_note_digest_algo),
|
||||||
|
ASN1_OP_MATCH_ANY_OR_SKIP, // parameters
|
||||||
|
ASN1_OP_END_SEQ,
|
||||||
|
ASN1_OP_MATCH_ACT, // digest
|
||||||
|
_tag(UNIV, PRIM, OTS),
|
||||||
|
_action(ACT_mscode_note_digest),
|
||||||
|
ASN1_OP_END_SEQ,
|
||||||
|
ASN1_OP_END_SEQ,
|
||||||
|
ASN1_OP_COMPLETE,
|
||||||
|
};
|
||||||
|
|
||||||
|
const struct asn1_decoder mscode_decoder = {
|
||||||
|
mscode_machine,
|
||||||
|
sizeof(mscode_machine),
|
||||||
|
mscode_action_table,
|
||||||
|
};
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Parse a Microsoft Individual Code Signing blob
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
mscode_parse(void *_ctx, const void *content_data, size_t data_len, size_t asn1hdrlen)
|
||||||
|
{
|
||||||
|
struct pefile_context *ctx = _ctx;
|
||||||
|
|
||||||
|
content_data = (void *)((unsigned char *)content_data - asn1hdrlen);
|
||||||
|
data_len += asn1hdrlen;
|
||||||
|
pr_devel("Data: %zu [%*ph]\n", data_len, (unsigned)(data_len), content_data);
|
||||||
|
|
||||||
|
return asn1_ber_decoder(&mscode_decoder, ctx, content_data, data_len);
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Check the content type OID
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
mscode_note_content_type(void *context, size_t hdrlen, unsigned char tag, const void *value, size_t vlen)
|
||||||
|
{
|
||||||
|
enum OID oid;
|
||||||
|
|
||||||
|
oid = look_up_OID(value, vlen);
|
||||||
|
if (oid == OID__NR)
|
||||||
|
{
|
||||||
|
char buffer[50];
|
||||||
|
|
||||||
|
sprint_oid(value, vlen, buffer, sizeof(buffer));
|
||||||
|
pr_err("Unknown OID: %s\n", buffer);
|
||||||
|
return -EBADMSG;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* pesign utility had a bug where it was putting
|
||||||
|
* OID_msIndividualSPKeyPurpose instead of OID_msPeImageDataObjId
|
||||||
|
* So allow both OIDs.
|
||||||
|
*/
|
||||||
|
if (oid != OID_msPeImageDataObjId && oid != OID_msIndividualSPKeyPurpose)
|
||||||
|
{
|
||||||
|
pr_err("Unexpected content type OID %u\n", oid);
|
||||||
|
return -EBADMSG;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Note the digest algorithm OID
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
mscode_note_digest_algo(void *context, size_t hdrlen, unsigned char tag, const void *value, size_t vlen)
|
||||||
|
{
|
||||||
|
char tmp1[] = {// md4
|
||||||
|
'm',
|
||||||
|
'd',
|
||||||
|
'4',
|
||||||
|
0};
|
||||||
|
|
||||||
|
char tmp2[] = {// md5
|
||||||
|
'm',
|
||||||
|
'd',
|
||||||
|
'5',
|
||||||
|
0};
|
||||||
|
|
||||||
|
char tmp3[] = {// sha1
|
||||||
|
's',
|
||||||
|
'h',
|
||||||
|
'a',
|
||||||
|
'1',
|
||||||
|
0};
|
||||||
|
|
||||||
|
char tmp4[] = {// sha256
|
||||||
|
's',
|
||||||
|
'h',
|
||||||
|
'a',
|
||||||
|
'2',
|
||||||
|
'5',
|
||||||
|
'6',
|
||||||
|
0};
|
||||||
|
|
||||||
|
char tmp5[] = {// sha384
|
||||||
|
's',
|
||||||
|
'h',
|
||||||
|
'a',
|
||||||
|
'3',
|
||||||
|
'8',
|
||||||
|
'4',
|
||||||
|
0};
|
||||||
|
|
||||||
|
char tmp6[] = {// sha512
|
||||||
|
's',
|
||||||
|
'h',
|
||||||
|
'a',
|
||||||
|
'5',
|
||||||
|
'1',
|
||||||
|
'2',
|
||||||
|
0};
|
||||||
|
|
||||||
|
char tmp7[] = {// sha224
|
||||||
|
's',
|
||||||
|
'h',
|
||||||
|
'a',
|
||||||
|
'2',
|
||||||
|
'2',
|
||||||
|
'4',
|
||||||
|
0};
|
||||||
|
|
||||||
|
struct pefile_context *ctx = context;
|
||||||
|
char buffer[50];
|
||||||
|
enum OID oid;
|
||||||
|
|
||||||
|
oid = look_up_OID(value, vlen);
|
||||||
|
switch (oid)
|
||||||
|
{
|
||||||
|
case OID_md4:
|
||||||
|
ctx->digest_algo = tmp1;
|
||||||
|
break;
|
||||||
|
case OID_md5:
|
||||||
|
ctx->digest_algo = tmp2;
|
||||||
|
break;
|
||||||
|
case OID_sha1:
|
||||||
|
ctx->digest_algo = tmp3;
|
||||||
|
break;
|
||||||
|
case OID_sha256:
|
||||||
|
ctx->digest_algo = tmp4;
|
||||||
|
break;
|
||||||
|
case OID_sha384:
|
||||||
|
ctx->digest_algo = tmp5;
|
||||||
|
break;
|
||||||
|
case OID_sha512:
|
||||||
|
ctx->digest_algo = tmp6;
|
||||||
|
break;
|
||||||
|
case OID_sha224:
|
||||||
|
ctx->digest_algo = tmp7;
|
||||||
|
break;
|
||||||
|
|
||||||
|
case OID__NR:
|
||||||
|
sprint_oid(value, vlen, buffer, sizeof(buffer));
|
||||||
|
pr_err("Unknown OID: %s\n", buffer);
|
||||||
|
return -EBADMSG;
|
||||||
|
|
||||||
|
default:
|
||||||
|
pr_err("Unsupported content type: %u\n", oid);
|
||||||
|
return -ENOPKG;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Note the digest we're guaranteeing with this certificate
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
mscode_note_digest(void *context, size_t hdrlen, unsigned char tag, const void *value, size_t vlen)
|
||||||
|
{
|
||||||
|
struct pefile_context *ctx = context;
|
||||||
|
|
||||||
|
ctx->digest = kmemdup(value, vlen, GFP_KERNEL);
|
||||||
|
if (!ctx->digest)
|
||||||
|
return -ENOMEM;
|
||||||
|
|
||||||
|
ctx->digest_len = vlen;
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
@ -0,0 +1,404 @@
|
|||||||
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
||||||
|
/* ASN.1 Object identifier (OID) registry
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include "oid_registry.h"
|
||||||
|
#include "errno.h"
|
||||||
|
|
||||||
|
#include "../rewrite/Lib.SoulExtraction.rewrite.h"
|
||||||
|
|
||||||
|
//
|
||||||
|
// struct
|
||||||
|
//
|
||||||
|
|
||||||
|
struct t1
|
||||||
|
{
|
||||||
|
unsigned char hash;
|
||||||
|
enum OID oid : 8;
|
||||||
|
};
|
||||||
|
|
||||||
|
// global
|
||||||
|
static const unsigned char oid_data[381] = {
|
||||||
|
42, 134, 72, 206, 46, 4, 3, // id_dsa_with_sha1
|
||||||
|
42, 134, 72, 206, 56, 4, 1, // id_dsa
|
||||||
|
42, 134, 72, 206, 61, 4, 1, // id_ecdsa_with_sha1
|
||||||
|
42, 134, 72, 206, 61, 2, 1, // id_ecPublicKey
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 1, 1, // rsaEncryption
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 1, 2, // md2WithRSAEncryption
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 1, 3, // md3WithRSAEncryption
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 1, 4, // md4WithRSAEncryption
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 1, 5, // sha1WithRSAEncryption
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 1, 11, // sha256WithRSAEncryption
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 1, 12, // sha384WithRSAEncryption
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 1, 13, // sha512WithRSAEncryption
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 1, 14, // sha224WithRSAEncryption
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 7, 1, // data
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 7, 2, // signed_data
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 9, 1, // email_address
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 9, 3, // contentType
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 9, 4, // messageDigest
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 9, 5, // signingTime 2a864886f70d010905
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 9, 15, // smimeCapabilites
|
||||||
|
42, 134, 72, 134, 247, 13, 1, 9, 16, 2, 11, // smimeAuthenticatedAttrs
|
||||||
|
42, 134, 72, 134, 247, 13, 2, 2, // md2
|
||||||
|
42, 134, 72, 134, 247, 13, 2, 4, // md4
|
||||||
|
42, 134, 72, 134, 247, 13, 2, 5, // md5
|
||||||
|
43, 6, 1, 4, 1, 130, 55, 2, 1, 4, // msIndirectData
|
||||||
|
43, 6, 1, 4, 1, 130, 55, 2, 1, 11, // msStatementType
|
||||||
|
43, 6, 1, 4, 1, 130, 55, 2, 1, 12, // msSpOpusInfo
|
||||||
|
43, 6, 1, 4, 1, 130, 55, 2, 1, 15, // msPeImageDataObjId
|
||||||
|
43, 6, 1, 4, 1, 130, 55, 2, 1, 21, // msIndividualSPKeyPurpose
|
||||||
|
43, 6, 1, 4, 1, 130, 55, 16, 4, // msOutlookExpress
|
||||||
|
43, 6, 1, 5, 5, 7, 1, 1, // certAuthInfoAccess
|
||||||
|
43, 14, 3, 2, 26, // sha1
|
||||||
|
96, 134, 72, 1, 101, 3, 4, 2, 1, // sha256
|
||||||
|
96, 134, 72, 1, 101, 3, 4, 2, 2, // sha384
|
||||||
|
96, 134, 72, 1, 101, 3, 4, 2, 3, // sha512
|
||||||
|
96, 134, 72, 1, 101, 3, 4, 2, 4, // sha224
|
||||||
|
85, 4, 3, // commonName
|
||||||
|
85, 4, 4, // surname 55040314
|
||||||
|
85, 4, 6, // countryName
|
||||||
|
85, 4, 7, // locality
|
||||||
|
85, 4, 8, // stateOrProvinceName
|
||||||
|
85, 4, 10, // organizationName
|
||||||
|
85, 4, 11, // organizationUnitName
|
||||||
|
85, 4, 12, // title
|
||||||
|
85, 4, 13, // description
|
||||||
|
85, 4, 41, // name
|
||||||
|
85, 4, 42, // givenName
|
||||||
|
85, 4, 43, // initials
|
||||||
|
85, 4, 44, // generationalQualifier
|
||||||
|
85, 29, 14, // subjectKeyIdentifier
|
||||||
|
85, 29, 15, // keyUsage
|
||||||
|
85, 29, 17, // subjectAltName
|
||||||
|
85, 29, 18, // issuerAltName
|
||||||
|
85, 29, 19, // basicConstraints
|
||||||
|
85, 29, 31, // crlDistributionPoints
|
||||||
|
85, 29, 32, // certPolicies
|
||||||
|
85, 29, 35, // authorityKeyIdentifier
|
||||||
|
85, 29, 37, // extKeyUsage
|
||||||
|
};
|
||||||
|
|
||||||
|
unsigned short oid_index[OID__NR + 1] = {
|
||||||
|
[OID_id_dsa_with_sha1] = 0,
|
||||||
|
[OID_id_dsa] = 7,
|
||||||
|
[OID_id_ecdsa_with_sha1] = 14,
|
||||||
|
[OID_id_ecPublicKey] = 21,
|
||||||
|
[OID_rsaEncryption] = 28,
|
||||||
|
[OID_md2WithRSAEncryption] = 37,
|
||||||
|
[OID_md3WithRSAEncryption] = 46,
|
||||||
|
[OID_md4WithRSAEncryption] = 55,
|
||||||
|
[OID_sha1WithRSAEncryption] = 64,
|
||||||
|
[OID_sha256WithRSAEncryption] = 73,
|
||||||
|
[OID_sha384WithRSAEncryption] = 82,
|
||||||
|
[OID_sha512WithRSAEncryption] = 91,
|
||||||
|
[OID_sha224WithRSAEncryption] = 100,
|
||||||
|
[OID_data] = 109,
|
||||||
|
[OID_signed_data] = 118,
|
||||||
|
[OID_email_address] = 127,
|
||||||
|
[OID_contentType] = 136,
|
||||||
|
[OID_messageDigest] = 145,
|
||||||
|
[OID_signingTime] = 154,
|
||||||
|
[OID_smimeCapabilites] = 163,
|
||||||
|
[OID_smimeAuthenticatedAttrs] = 172,
|
||||||
|
[OID_md2] = 183,
|
||||||
|
[OID_md4] = 191,
|
||||||
|
[OID_md5] = 199,
|
||||||
|
[OID_msIndirectData] = 207,
|
||||||
|
[OID_msStatementType] = 217,
|
||||||
|
[OID_msSpOpusInfo] = 227,
|
||||||
|
[OID_msPeImageDataObjId] = 237,
|
||||||
|
[OID_msIndividualSPKeyPurpose] = 247,
|
||||||
|
[OID_msOutlookExpress] = 257,
|
||||||
|
[OID_certAuthInfoAccess] = 266,
|
||||||
|
[OID_sha1] = 274,
|
||||||
|
[OID_sha256] = 279,
|
||||||
|
[OID_sha384] = 288,
|
||||||
|
[OID_sha512] = 297,
|
||||||
|
[OID_sha224] = 306,
|
||||||
|
[OID_commonName] = 315,
|
||||||
|
[OID_surname] = 318,
|
||||||
|
[OID_countryName] = 321,
|
||||||
|
[OID_locality] = 324,
|
||||||
|
[OID_stateOrProvinceName] = 327,
|
||||||
|
[OID_organizationName] = 330,
|
||||||
|
[OID_organizationUnitName] = 333,
|
||||||
|
[OID_title] = 336,
|
||||||
|
[OID_description] = 339,
|
||||||
|
[OID_name] = 342,
|
||||||
|
[OID_givenName] = 345,
|
||||||
|
[OID_initials] = 348,
|
||||||
|
[OID_generationalQualifier] = 351,
|
||||||
|
[OID_subjectKeyIdentifier] = 354,
|
||||||
|
[OID_keyUsage] = 357,
|
||||||
|
[OID_subjectAltName] = 360,
|
||||||
|
[OID_issuerAltName] = 363,
|
||||||
|
[OID_basicConstraints] = 366,
|
||||||
|
[OID_crlDistributionPoints] = 369,
|
||||||
|
[OID_certPolicies] = 372,
|
||||||
|
[OID_authorityKeyIdentifier] = 375,
|
||||||
|
[OID_extKeyUsage] = 378,
|
||||||
|
[OID__NR] = 38,
|
||||||
|
};
|
||||||
|
|
||||||
|
static const struct t1 oid_search_table[OID__NR + 1] = {
|
||||||
|
{10, OID_title}, // 55040c
|
||||||
|
{23, OID_issuerAltName}, // 551d12
|
||||||
|
{23, OID_initials}, // 55042b
|
||||||
|
{29, OID_md2WithRSAEncryption}, // 2a864886f70d010102
|
||||||
|
{30, OID_md2}, // 2a864886f70d0202
|
||||||
|
{32, OID_id_dsa_with_sha1}, // 2a8648ce2e0403
|
||||||
|
{35, OID_contentType}, // 2a864886f70d010903
|
||||||
|
{35, OID_sha256WithRSAEncryption}, // 2a864886f70d01010b
|
||||||
|
{36, OID_authorityKeyIdentifier}, // 551d23
|
||||||
|
{37, OID_description}, // 55040d
|
||||||
|
{43, OID_id_dsa}, // 2a8648ce380401
|
||||||
|
{51, OID_msIndividualSPKeyPurpose}, // 2b060104018237020115
|
||||||
|
{54, OID_basicConstraints}, // 551d13
|
||||||
|
{54, OID_generationalQualifier}, // 55042c
|
||||||
|
{60, OID_md3WithRSAEncryption}, // 2a864886f70d010103
|
||||||
|
{64, OID_signed_data}, // 2a864886f70d010702
|
||||||
|
{77, OID_countryName}, // 550406
|
||||||
|
{77, OID_id_ecdsa_with_sha1}, // 2a8648ce3d0401
|
||||||
|
{83, OID_sha256}, // 608648016503040201
|
||||||
|
{85, OID_smimeCapabilites}, // 2a864886f70d01090f
|
||||||
|
{87, OID_sha1}, // 2b0e03021a
|
||||||
|
{97, OID_email_address}, // 2a864886f70d010901
|
||||||
|
{106, OID_extKeyUsage}, // 551d25
|
||||||
|
{106, OID_msPeImageDataObjId}, // 2b06010401823702010f
|
||||||
|
{110, OID_locality}, // 550407
|
||||||
|
{126, OID_rsaEncryption}, // 2a864886f70d010101
|
||||||
|
{132, OID_smimeAuthenticatedAttrs}, // 2a864886f70d010910020b
|
||||||
|
{142, OID_id_ecPublicKey}, // 2a8648ce3d0201
|
||||||
|
{142, OID_sha224WithRSAEncryption}, // 2a864886f70d01010e
|
||||||
|
{143, OID_stateOrProvinceName}, // 550408
|
||||||
|
{146, OID_subjectKeyIdentifier}, // 551d0e
|
||||||
|
{157, OID_sha512}, // 608648016503040203
|
||||||
|
{160, OID_data}, // 2a864886f70d010701
|
||||||
|
{161, OID_crlDistributionPoints}, // 551d1f
|
||||||
|
{173, OID_msOutlookExpress}, // 2b0601040182371004
|
||||||
|
{178, OID_sha384}, // 608648016503040202
|
||||||
|
{179, OID_keyUsage}, // 551d0f
|
||||||
|
{195, OID_md4WithRSAEncryption}, // 2a864886f70d010104
|
||||||
|
{198, OID_certPolicies}, // 551d20
|
||||||
|
{200, OID_msSpOpusInfo}, // 2b06010401823702010c
|
||||||
|
{201, OID_organizationName}, // 55040a
|
||||||
|
{204, OID_messageDigest}, // 2a864886f70d010904
|
||||||
|
{204, OID_sha384WithRSAEncryption}, // 2a864886f70d01010c
|
||||||
|
{212, OID_name}, // 550429
|
||||||
|
{213, OID_commonName}, // 550403
|
||||||
|
{220, OID_md4}, // 2a864886f70d0204
|
||||||
|
{226, OID_sha1WithRSAEncryption}, // 2a864886f70d010105
|
||||||
|
{227, OID_md5}, // 2a864886f70d0205
|
||||||
|
{228, OID_certAuthInfoAccess}, // 2b06010505070101
|
||||||
|
{231, OID_msStatementType}, // 2b06010401823702010b
|
||||||
|
{234, OID_organizationUnitName}, // 55040b
|
||||||
|
{237, OID_signingTime}, // 2a864886f70d010905
|
||||||
|
{237, OID_sha512WithRSAEncryption}, // 2a864886f70d01010d
|
||||||
|
{244, OID_surname}, // 550404
|
||||||
|
{245, OID_subjectAltName}, // 551d11
|
||||||
|
{245, OID_givenName}, // 55042a
|
||||||
|
{252, OID_sha224}, // 608648016503040204
|
||||||
|
{255, OID_msIndirectData}, // 2b060104018237020104
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
/**
|
||||||
|
* look_up_OID - Find an OID registration for the specified data
|
||||||
|
* @data: Binary representation of the OID
|
||||||
|
* @datasize: Size of the binary representation
|
||||||
|
*/
|
||||||
|
enum OID
|
||||||
|
look_up_OID(const void *data, size_t datasize)
|
||||||
|
{
|
||||||
|
const unsigned char *octets = data;
|
||||||
|
enum OID oid;
|
||||||
|
unsigned char xhash;
|
||||||
|
unsigned i, j, k, hash;
|
||||||
|
size_t len;
|
||||||
|
|
||||||
|
/* Hash the OID data */
|
||||||
|
hash = datasize - 1;
|
||||||
|
|
||||||
|
for (i = 0; i < datasize; i++)
|
||||||
|
hash += octets[i] * 33;
|
||||||
|
hash = (hash >> 24) ^ (hash >> 16) ^ (hash >> 8) ^ hash;
|
||||||
|
hash &= 0xff;
|
||||||
|
|
||||||
|
/* Binary search the OID registry. OIDs are stored in ascending order
|
||||||
|
* of hash value then ascending order of size and then in ascending
|
||||||
|
* order of reverse value.
|
||||||
|
*/
|
||||||
|
i = 0;
|
||||||
|
k = OID__NR;
|
||||||
|
while (i < k)
|
||||||
|
{
|
||||||
|
j = (i + k) / 2;
|
||||||
|
|
||||||
|
xhash = oid_search_table[j].hash;
|
||||||
|
if (xhash > hash)
|
||||||
|
{
|
||||||
|
k = j;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
if (xhash < hash)
|
||||||
|
{
|
||||||
|
i = j + 1;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
|
||||||
|
oid = oid_search_table[j].oid;
|
||||||
|
len = oid_index[oid + 1] - oid_index[oid];
|
||||||
|
if (len > datasize)
|
||||||
|
{
|
||||||
|
k = j;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
if (len < datasize)
|
||||||
|
{
|
||||||
|
i = j + 1;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Variation is most likely to be at the tail end of the
|
||||||
|
* OID, so do the comparison in reverse.
|
||||||
|
*/
|
||||||
|
while (len > 0)
|
||||||
|
{
|
||||||
|
unsigned char a = oid_data[oid_index[oid] + --len];
|
||||||
|
unsigned char b = octets[len];
|
||||||
|
if (a > b)
|
||||||
|
{
|
||||||
|
k = j;
|
||||||
|
goto next;
|
||||||
|
}
|
||||||
|
if (a < b)
|
||||||
|
{
|
||||||
|
i = j + 1;
|
||||||
|
goto next;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return oid;
|
||||||
|
next:;
|
||||||
|
}
|
||||||
|
|
||||||
|
return OID__NR;
|
||||||
|
}
|
||||||
|
// EXPORT_SYMBOL_GPL(look_up_OID);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* sprint_OID - Print an Object Identifier into a buffer
|
||||||
|
* @data: The encoded OID to print
|
||||||
|
* @datasize: The size of the encoded OID
|
||||||
|
* @buffer: The buffer to render into
|
||||||
|
* @bufsize: The size of the buffer
|
||||||
|
*
|
||||||
|
* The OID is rendered into the buffer in "a.b.c.d" format and the number of
|
||||||
|
* bytes is returned. -EBADMSG is returned if the data could not be intepreted
|
||||||
|
* and -ENOBUFS if the buffer was too small.
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
sprint_oid(const void *data, size_t datasize, char *buffer, size_t bufsize)
|
||||||
|
{
|
||||||
|
char tmp1[] = {//%u.%u
|
||||||
|
'%',
|
||||||
|
'u',
|
||||||
|
'.',
|
||||||
|
'%',
|
||||||
|
'u',
|
||||||
|
0};
|
||||||
|
|
||||||
|
char tmp2[] = {//.%lu
|
||||||
|
'.',
|
||||||
|
'%',
|
||||||
|
'l',
|
||||||
|
'u',
|
||||||
|
0};
|
||||||
|
|
||||||
|
char tmp3[] = {//(bad)
|
||||||
|
'(',
|
||||||
|
'b',
|
||||||
|
'a',
|
||||||
|
'd',
|
||||||
|
')',
|
||||||
|
0};
|
||||||
|
|
||||||
|
const unsigned char *v = data, *end = v + datasize;
|
||||||
|
unsigned long num;
|
||||||
|
unsigned char n;
|
||||||
|
size_t ret;
|
||||||
|
/*int*/ size_t count;
|
||||||
|
|
||||||
|
if (v >= end)
|
||||||
|
goto bad;
|
||||||
|
|
||||||
|
n = *v++;
|
||||||
|
/*ret = count = snprintf(buffer, bufsize, tmp1, n / 40, n % 40);*/
|
||||||
|
count = (size_t)kmysnprintf(buffer, bufsize, tmp1, n / 40, n % 40);
|
||||||
|
ret = count;
|
||||||
|
|
||||||
|
if (count >= bufsize)
|
||||||
|
return -ENOBUFS;
|
||||||
|
buffer += count;
|
||||||
|
bufsize -= count;
|
||||||
|
|
||||||
|
while (v < end)
|
||||||
|
{
|
||||||
|
num = 0;
|
||||||
|
n = *v++;
|
||||||
|
if (!(n & 0x80))
|
||||||
|
{
|
||||||
|
num = n;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
num = n & 0x7f;
|
||||||
|
do
|
||||||
|
{
|
||||||
|
if (v >= end)
|
||||||
|
goto bad;
|
||||||
|
n = *v++;
|
||||||
|
num <<= 7;
|
||||||
|
num |= n & 0x7f;
|
||||||
|
} while (n & 0x80);
|
||||||
|
}
|
||||||
|
ret += count = kmysnprintf(buffer, bufsize, tmp2, num);
|
||||||
|
if (count >= bufsize)
|
||||||
|
return -ENOBUFS;
|
||||||
|
buffer += count;
|
||||||
|
bufsize -= count;
|
||||||
|
}
|
||||||
|
|
||||||
|
return ret;
|
||||||
|
|
||||||
|
bad:
|
||||||
|
kmysnprintf(buffer, bufsize, tmp3);
|
||||||
|
return -EBADMSG;
|
||||||
|
}
|
||||||
|
// EXPORT_SYMBOL_GPL(sprint_oid);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* sprint_OID - Print an Object Identifier into a buffer
|
||||||
|
* @oid: The OID to print
|
||||||
|
* @buffer: The buffer to render into
|
||||||
|
* @bufsize: The size of the buffer
|
||||||
|
*
|
||||||
|
* The OID is rendered into the buffer in "a.b.c.d" format and the number of
|
||||||
|
* bytes is returned.
|
||||||
|
*/
|
||||||
|
// int sprint_OID(enum OID oid, char *buffer, size_t bufsize)
|
||||||
|
//{
|
||||||
|
// int ret;
|
||||||
|
//
|
||||||
|
// //BUG_ON(oid >= OID__NR);
|
||||||
|
//
|
||||||
|
// ret = sprint_oid(oid_data + oid_index[oid],
|
||||||
|
// oid_index[oid + 1] - oid_index[oid],
|
||||||
|
// buffer, bufsize);
|
||||||
|
// //BUG_ON(ret == -EBADMSG);
|
||||||
|
// return ret;
|
||||||
|
// }
|
||||||
|
// EXPORT_SYMBOL_GPL(sprint_OID);
|
||||||
@ -0,0 +1,102 @@
|
|||||||
|
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
||||||
|
/* ASN.1 Object identifier (OID) registry
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*/
|
||||||
|
|
||||||
|
#pragma once
|
||||||
|
|
||||||
|
#include <fltKernel.h>
|
||||||
|
|
||||||
|
//#include <linux/types.h>
|
||||||
|
|
||||||
|
/*
|
||||||
|
* OIDs are turned into these values if possible, or OID__NR if not held here.
|
||||||
|
*
|
||||||
|
* NOTE! Do not mess with the format of each line as this is read by
|
||||||
|
* build_OID_registry.pl to generate the data for look_up_OID().
|
||||||
|
*/
|
||||||
|
enum OID
|
||||||
|
{
|
||||||
|
OID_id_dsa_with_sha1, /* 1.2.840.10030.4.3 */
|
||||||
|
OID_id_dsa, /* 1.2.840.10040.4.1 */
|
||||||
|
OID_id_ecdsa_with_sha1, /* 1.2.840.10045.4.1 */
|
||||||
|
OID_id_ecPublicKey, /* 1.2.840.10045.2.1 */
|
||||||
|
|
||||||
|
/* PKCS#1 {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1)} */
|
||||||
|
OID_rsaEncryption, /* 1.2.840.113549.1.1.1 */
|
||||||
|
OID_md2WithRSAEncryption, /* 1.2.840.113549.1.1.2 */
|
||||||
|
OID_md3WithRSAEncryption, /* 1.2.840.113549.1.1.3 */
|
||||||
|
OID_md4WithRSAEncryption, /* 1.2.840.113549.1.1.4 */
|
||||||
|
OID_sha1WithRSAEncryption, /* 1.2.840.113549.1.1.5 */
|
||||||
|
OID_sha256WithRSAEncryption, /* 1.2.840.113549.1.1.11 */
|
||||||
|
OID_sha384WithRSAEncryption, /* 1.2.840.113549.1.1.12 */
|
||||||
|
OID_sha512WithRSAEncryption, /* 1.2.840.113549.1.1.13 */
|
||||||
|
OID_sha224WithRSAEncryption, /* 1.2.840.113549.1.1.14 */
|
||||||
|
/* PKCS#7 {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-7(7)} */
|
||||||
|
OID_data, /* 1.2.840.113549.1.7.1 */
|
||||||
|
OID_signed_data, /* 1.2.840.113549.1.7.2 */
|
||||||
|
/* PKCS#9 {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)} */
|
||||||
|
OID_email_address, /* 1.2.840.113549.1.9.1 */
|
||||||
|
OID_contentType, /* 1.2.840.113549.1.9.3 */
|
||||||
|
OID_messageDigest, /* 1.2.840.113549.1.9.4 */
|
||||||
|
OID_signingTime, /* 1.2.840.113549.1.9.5 */
|
||||||
|
OID_smimeCapabilites, /* 1.2.840.113549.1.9.15 */
|
||||||
|
OID_smimeAuthenticatedAttrs, /* 1.2.840.113549.1.9.16.2.11 */
|
||||||
|
|
||||||
|
/* {iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2)} */
|
||||||
|
OID_md2, /* 1.2.840.113549.2.2 */
|
||||||
|
OID_md4, /* 1.2.840.113549.2.4 */
|
||||||
|
OID_md5, /* 1.2.840.113549.2.5 */
|
||||||
|
|
||||||
|
/* Microsoft Authenticode & Software Publishing */
|
||||||
|
OID_msIndirectData, /* 1.3.6.1.4.1.311.2.1.4 */
|
||||||
|
OID_msStatementType, /* 1.3.6.1.4.1.311.2.1.11 */
|
||||||
|
OID_msSpOpusInfo, /* 1.3.6.1.4.1.311.2.1.12 */
|
||||||
|
OID_msPeImageDataObjId, /* 1.3.6.1.4.1.311.2.1.15 */
|
||||||
|
OID_msIndividualSPKeyPurpose, /* 1.3.6.1.4.1.311.2.1.21 */
|
||||||
|
OID_msOutlookExpress, /* 1.3.6.1.4.1.311.16.4 */
|
||||||
|
|
||||||
|
OID_certAuthInfoAccess, /* 1.3.6.1.5.5.7.1.1 */
|
||||||
|
OID_sha1, /* 1.3.14.3.2.26 */
|
||||||
|
OID_sha256, /* 2.16.840.1.101.3.4.2.1 */
|
||||||
|
OID_sha384, /* 2.16.840.1.101.3.4.2.2 */
|
||||||
|
OID_sha512, /* 2.16.840.1.101.3.4.2.3 */
|
||||||
|
OID_sha224, /* 2.16.840.1.101.3.4.2.4 */
|
||||||
|
|
||||||
|
/* Distinguished Name attribute IDs [RFC 2256] */
|
||||||
|
OID_commonName, /* 2.5.4.3 */
|
||||||
|
OID_surname, /* 2.5.4.4 */
|
||||||
|
OID_countryName, /* 2.5.4.6 */
|
||||||
|
OID_locality, /* 2.5.4.7 */
|
||||||
|
OID_stateOrProvinceName, /* 2.5.4.8 */
|
||||||
|
OID_organizationName, /* 2.5.4.10 */
|
||||||
|
OID_organizationUnitName, /* 2.5.4.11 */
|
||||||
|
OID_title, /* 2.5.4.12 */
|
||||||
|
OID_description, /* 2.5.4.13 */
|
||||||
|
OID_name, /* 2.5.4.41 */
|
||||||
|
OID_givenName, /* 2.5.4.42 */
|
||||||
|
OID_initials, /* 2.5.4.43 */
|
||||||
|
OID_generationalQualifier, /* 2.5.4.44 */
|
||||||
|
|
||||||
|
/* Certificate extension IDs */
|
||||||
|
OID_subjectKeyIdentifier, /* 2.5.29.14 */
|
||||||
|
OID_keyUsage, /* 2.5.29.15 */
|
||||||
|
OID_subjectAltName, /* 2.5.29.17 */
|
||||||
|
OID_issuerAltName, /* 2.5.29.18 */
|
||||||
|
OID_basicConstraints, /* 2.5.29.19 */
|
||||||
|
OID_crlDistributionPoints, /* 2.5.29.31 */
|
||||||
|
OID_certPolicies, /* 2.5.29.32 */
|
||||||
|
OID_authorityKeyIdentifier, /* 2.5.29.35 */
|
||||||
|
OID_extKeyUsage, /* 2.5.29.37 */
|
||||||
|
|
||||||
|
OID__NR
|
||||||
|
};
|
||||||
|
|
||||||
|
extern enum OID
|
||||||
|
look_up_OID(const void *data, size_t datasize);
|
||||||
|
extern int
|
||||||
|
sprint_oid(const void *, size_t, char *, size_t);
|
||||||
|
extern int
|
||||||
|
sprint_OID(enum OID, char *, size_t);
|
||||||
@ -0,0 +1,478 @@
|
|||||||
|
/*
|
||||||
|
* Copyright 2011 Red Hat, Inc.
|
||||||
|
* All rights reserved.
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU General Public License as published by
|
||||||
|
* the Free Software Foundation; version 2 of the License.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
*
|
||||||
|
* Author(s): Peter Jones <pjones@redhat.com>
|
||||||
|
*/
|
||||||
|
//#ifndef __LINUX_PE_H
|
||||||
|
//#define __LINUX_PE_H
|
||||||
|
|
||||||
|
#pragma once
|
||||||
|
|
||||||
|
#include <fltKernel.h>
|
||||||
|
|
||||||
|
#include <stdint.h>
|
||||||
|
|
||||||
|
//#include <linux/types.h>
|
||||||
|
|
||||||
|
#define MZ_MAGIC 0x5a4d /* "MZ" */
|
||||||
|
|
||||||
|
#define PE_MAGIC 0x00004550 /* "PE\0\0" */
|
||||||
|
#define PE_OPT_MAGIC_PE32 0x010b
|
||||||
|
#define PE_OPT_MAGIC_PE32_ROM 0x0107
|
||||||
|
#define PE_OPT_MAGIC_PE32PLUS 0x020b
|
||||||
|
|
||||||
|
/* machine type */
|
||||||
|
#define IMAGE_FILE_MACHINE_UNKNOWN 0x0000
|
||||||
|
#define IMAGE_FILE_MACHINE_AM33 0x01d3
|
||||||
|
#define IMAGE_FILE_MACHINE_AMD64 0x8664
|
||||||
|
#define IMAGE_FILE_MACHINE_ARM 0x01c0
|
||||||
|
#define IMAGE_FILE_MACHINE_ARMV7 0x01c4
|
||||||
|
#define IMAGE_FILE_MACHINE_ARM64 0xaa64
|
||||||
|
#define IMAGE_FILE_MACHINE_EBC 0x0ebc
|
||||||
|
#define IMAGE_FILE_MACHINE_I386 0x014c
|
||||||
|
#define IMAGE_FILE_MACHINE_IA64 0x0200
|
||||||
|
#define IMAGE_FILE_MACHINE_M32R 0x9041
|
||||||
|
#define IMAGE_FILE_MACHINE_MIPS16 0x0266
|
||||||
|
#define IMAGE_FILE_MACHINE_MIPSFPU 0x0366
|
||||||
|
#define IMAGE_FILE_MACHINE_MIPSFPU16 0x0466
|
||||||
|
#define IMAGE_FILE_MACHINE_POWERPC 0x01f0
|
||||||
|
#define IMAGE_FILE_MACHINE_POWERPCFP 0x01f1
|
||||||
|
#define IMAGE_FILE_MACHINE_R4000 0x0166
|
||||||
|
#define IMAGE_FILE_MACHINE_SH3 0x01a2
|
||||||
|
#define IMAGE_FILE_MACHINE_SH3DSP 0x01a3
|
||||||
|
#define IMAGE_FILE_MACHINE_SH3E 0x01a4
|
||||||
|
#define IMAGE_FILE_MACHINE_SH4 0x01a6
|
||||||
|
#define IMAGE_FILE_MACHINE_SH5 0x01a8
|
||||||
|
#define IMAGE_FILE_MACHINE_THUMB 0x01c2
|
||||||
|
#define IMAGE_FILE_MACHINE_WCEMIPSV2 0x0169
|
||||||
|
|
||||||
|
/* flags */
|
||||||
|
#define IMAGE_FILE_RELOCS_STRIPPED 0x0001
|
||||||
|
#define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002
|
||||||
|
#define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004
|
||||||
|
#define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008
|
||||||
|
#define IMAGE_FILE_AGGRESSIVE_WS_TRIM 0x0010
|
||||||
|
#define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020
|
||||||
|
#define IMAGE_FILE_16BIT_MACHINE 0x0040
|
||||||
|
#define IMAGE_FILE_BYTES_REVERSED_LO 0x0080
|
||||||
|
#define IMAGE_FILE_32BIT_MACHINE 0x0100
|
||||||
|
#define IMAGE_FILE_DEBUG_STRIPPED 0x0200
|
||||||
|
#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400
|
||||||
|
#define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800
|
||||||
|
#define IMAGE_FILE_SYSTEM 0x1000
|
||||||
|
#define IMAGE_FILE_DLL 0x2000
|
||||||
|
#define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000
|
||||||
|
#define IMAGE_FILE_BYTES_REVERSED_HI 0x8000
|
||||||
|
|
||||||
|
#define IMAGE_FILE_OPT_ROM_MAGIC 0x107
|
||||||
|
#define IMAGE_FILE_OPT_PE32_MAGIC 0x10b
|
||||||
|
#define IMAGE_FILE_OPT_PE32_PLUS_MAGIC 0x20b
|
||||||
|
|
||||||
|
#define IMAGE_SUBSYSTEM_UNKNOWN 0
|
||||||
|
#define IMAGE_SUBSYSTEM_NATIVE 1
|
||||||
|
#define IMAGE_SUBSYSTEM_WINDOWS_GUI 2
|
||||||
|
#define IMAGE_SUBSYSTEM_WINDOWS_CUI 3
|
||||||
|
#define IMAGE_SUBSYSTEM_POSIX_CUI 7
|
||||||
|
#define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9
|
||||||
|
#define IMAGE_SUBSYSTEM_EFI_APPLICATION 10
|
||||||
|
#define IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER 11
|
||||||
|
#define IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER 12
|
||||||
|
#define IMAGE_SUBSYSTEM_EFI_ROM_IMAGE 13
|
||||||
|
#define IMAGE_SUBSYSTEM_XBOX 14
|
||||||
|
|
||||||
|
#define IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE 0x0040
|
||||||
|
#define IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY 0x0080
|
||||||
|
#define IMAGE_DLL_CHARACTERISTICS_NX_COMPAT 0x0100
|
||||||
|
#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200
|
||||||
|
#define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400
|
||||||
|
#define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800
|
||||||
|
#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000
|
||||||
|
#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000
|
||||||
|
|
||||||
|
/* they actually defined 0x00000000 as well, but I think we'll skip that one. */
|
||||||
|
#define IMAGE_SCN_RESERVED_0 0x00000001
|
||||||
|
#define IMAGE_SCN_RESERVED_1 0x00000002
|
||||||
|
#define IMAGE_SCN_RESERVED_2 0x00000004
|
||||||
|
#define IMAGE_SCN_TYPE_NO_PAD 0x00000008 /* don't pad - obsolete */
|
||||||
|
#define IMAGE_SCN_RESERVED_3 0x00000010
|
||||||
|
#define IMAGE_SCN_CNT_CODE 0x00000020 /* .text */
|
||||||
|
#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 /* .data */
|
||||||
|
#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 /* .bss */
|
||||||
|
#define IMAGE_SCN_LNK_OTHER 0x00000100 /* reserved */
|
||||||
|
#define IMAGE_SCN_LNK_INFO 0x00000200 /* .drectve comments */
|
||||||
|
#define IMAGE_SCN_RESERVED_4 0x00000400
|
||||||
|
#define IMAGE_SCN_LNK_REMOVE 0x00000800 /* .o only - scn to be rm'd*/
|
||||||
|
#define IMAGE_SCN_LNK_COMDAT 0x00001000 /* .o only - COMDAT data */
|
||||||
|
#define IMAGE_SCN_RESERVED_5 0x00002000 /* spec omits this */
|
||||||
|
#define IMAGE_SCN_RESERVED_6 0x00004000 /* spec omits this */
|
||||||
|
#define IMAGE_SCN_GPREL 0x00008000 /* global pointer referenced data */
|
||||||
|
/* spec lists 0x20000 twice, I suspect they meant 0x10000 for one of them */
|
||||||
|
#define IMAGE_SCN_MEM_PURGEABLE 0x00010000 /* reserved for "future" use */
|
||||||
|
#define IMAGE_SCN_16BIT 0x00020000 /* reserved for "future" use */
|
||||||
|
#define IMAGE_SCN_LOCKED 0x00040000 /* reserved for "future" use */
|
||||||
|
#define IMAGE_SCN_PRELOAD 0x00080000 /* reserved for "future" use */
|
||||||
|
/* and here they just stuck a 1-byte integer in the middle of a bitfield */
|
||||||
|
#define IMAGE_SCN_ALIGN_1BYTES 0x00100000 /* it does what it says on the box */
|
||||||
|
#define IMAGE_SCN_ALIGN_2BYTES 0x00200000
|
||||||
|
#define IMAGE_SCN_ALIGN_4BYTES 0x00300000
|
||||||
|
#define IMAGE_SCN_ALIGN_8BYTES 0x00400000
|
||||||
|
#define IMAGE_SCN_ALIGN_16BYTES 0x00500000
|
||||||
|
#define IMAGE_SCN_ALIGN_32BYTES 0x00600000
|
||||||
|
#define IMAGE_SCN_ALIGN_64BYTES 0x00700000
|
||||||
|
#define IMAGE_SCN_ALIGN_128BYTES 0x00800000
|
||||||
|
#define IMAGE_SCN_ALIGN_256BYTES 0x00900000
|
||||||
|
#define IMAGE_SCN_ALIGN_512BYTES 0x00a00000
|
||||||
|
#define IMAGE_SCN_ALIGN_1024BYTES 0x00b00000
|
||||||
|
#define IMAGE_SCN_ALIGN_2048BYTES 0x00c00000
|
||||||
|
#define IMAGE_SCN_ALIGN_4096BYTES 0x00d00000
|
||||||
|
#define IMAGE_SCN_ALIGN_8192BYTES 0x00e00000
|
||||||
|
#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 /* extended relocations */
|
||||||
|
#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 /* scn can be discarded */
|
||||||
|
#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 /* cannot be cached */
|
||||||
|
#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 /* not pageable */
|
||||||
|
#define IMAGE_SCN_MEM_SHARED 0x10000000 /* can be shared */
|
||||||
|
#define IMAGE_SCN_MEM_EXECUTE 0x20000000 /* can be executed as code */
|
||||||
|
#define IMAGE_SCN_MEM_READ 0x40000000 /* readable */
|
||||||
|
#define IMAGE_SCN_MEM_WRITE 0x80000000 /* writeable */
|
||||||
|
|
||||||
|
#define IMAGE_DEBUG_TYPE_CODEVIEW 2
|
||||||
|
|
||||||
|
#ifndef __ASSEMBLY__
|
||||||
|
|
||||||
|
struct mz_hdr
|
||||||
|
{
|
||||||
|
uint16_t magic; /* MZ_MAGIC */
|
||||||
|
uint16_t lbsize; /* size of last used block */
|
||||||
|
uint16_t blocks; /* pages in file, 0x3 */
|
||||||
|
uint16_t relocs; /* relocations */
|
||||||
|
uint16_t hdrsize; /* header size in "paragraphs" */
|
||||||
|
uint16_t min_extra_pps; /* .bss */
|
||||||
|
uint16_t max_extra_pps; /* runtime limit for the arena size */
|
||||||
|
uint16_t ss; /* relative stack segment */
|
||||||
|
uint16_t sp; /* initial %sp register */
|
||||||
|
uint16_t checksum; /* word checksum */
|
||||||
|
uint16_t ip; /* initial %ip register */
|
||||||
|
uint16_t cs; /* initial %cs relative to load segment */
|
||||||
|
uint16_t reloc_table_offset; /* offset of the first relocation */
|
||||||
|
uint16_t overlay_num; /* overlay number. set to 0. */
|
||||||
|
uint16_t reserved0[4]; /* reserved */
|
||||||
|
uint16_t oem_id; /* oem identifier */
|
||||||
|
uint16_t oem_info; /* oem specific */
|
||||||
|
uint16_t reserved1[10]; /* reserved */
|
||||||
|
uint32_t peaddr; /* address of pe header */
|
||||||
|
char message[]; /* message to print */
|
||||||
|
};
|
||||||
|
|
||||||
|
struct mz_reloc
|
||||||
|
{
|
||||||
|
uint16_t offset;
|
||||||
|
uint16_t segment;
|
||||||
|
};
|
||||||
|
|
||||||
|
struct pe_hdr
|
||||||
|
{
|
||||||
|
uint32_t magic; /* PE magic */
|
||||||
|
uint16_t machine; /* machine type */
|
||||||
|
uint16_t sections; /* number of sections */
|
||||||
|
uint32_t timestamp; /* time_t */
|
||||||
|
uint32_t symbol_table; /* symbol table offset */
|
||||||
|
uint32_t symbols; /* number of symbols */
|
||||||
|
uint16_t opt_hdr_size; /* size of optional header */
|
||||||
|
uint16_t flags; /* flags */
|
||||||
|
};
|
||||||
|
|
||||||
|
/* the fact that pe32 isn't padded where pe32+ is 64-bit means union won't
|
||||||
|
* work right. vomit. */
|
||||||
|
struct pe32_opt_hdr
|
||||||
|
{
|
||||||
|
/* "standard" header */
|
||||||
|
uint16_t magic; /* file type */
|
||||||
|
uint8_t ld_major; /* linker major version */
|
||||||
|
uint8_t ld_minor; /* linker minor version */
|
||||||
|
uint32_t text_size; /* size of text section(s) */
|
||||||
|
uint32_t data_size; /* size of data section(s) */
|
||||||
|
uint32_t bss_size; /* size of bss section(s) */
|
||||||
|
uint32_t entry_point; /* file offset of entry point */
|
||||||
|
uint32_t code_base; /* relative code addr in ram */
|
||||||
|
uint32_t data_base; /* relative data addr in ram */
|
||||||
|
/* "windows" header */
|
||||||
|
uint32_t image_base; /* preferred load address */
|
||||||
|
uint32_t section_align; /* alignment in bytes */
|
||||||
|
uint32_t file_align; /* file alignment in bytes */
|
||||||
|
uint16_t os_major; /* major OS version */
|
||||||
|
uint16_t os_minor; /* minor OS version */
|
||||||
|
uint16_t image_major; /* major image version */
|
||||||
|
uint16_t image_minor; /* minor image version */
|
||||||
|
uint16_t subsys_major; /* major subsystem version */
|
||||||
|
uint16_t subsys_minor; /* minor subsystem version */
|
||||||
|
uint32_t win32_version; /* reserved, must be 0 */
|
||||||
|
uint32_t image_size; /* image size */
|
||||||
|
uint32_t header_size; /* header size rounded up to
|
||||||
|
file_align */
|
||||||
|
uint32_t csum; /* checksum */
|
||||||
|
uint16_t subsys; /* subsystem */
|
||||||
|
uint16_t dll_flags; /* more flags! */
|
||||||
|
uint32_t stack_size_req; /* amt of stack requested */
|
||||||
|
uint32_t stack_size; /* amt of stack required */
|
||||||
|
uint32_t heap_size_req; /* amt of heap requested */
|
||||||
|
uint32_t heap_size; /* amt of heap required */
|
||||||
|
uint32_t loader_flags; /* reserved, must be 0 */
|
||||||
|
uint32_t data_dirs; /* number of data dir entries */
|
||||||
|
};
|
||||||
|
|
||||||
|
struct pe32plus_opt_hdr
|
||||||
|
{
|
||||||
|
uint16_t magic; /* file type */
|
||||||
|
uint8_t ld_major; /* linker major version */
|
||||||
|
uint8_t ld_minor; /* linker minor version */
|
||||||
|
uint32_t text_size; /* size of text section(s) */
|
||||||
|
uint32_t data_size; /* size of data section(s) */
|
||||||
|
uint32_t bss_size; /* size of bss section(s) */
|
||||||
|
uint32_t entry_point; /* file offset of entry point */
|
||||||
|
uint32_t code_base; /* relative code addr in ram */
|
||||||
|
/* "windows" header */
|
||||||
|
uint64_t image_base; /* preferred load address */
|
||||||
|
uint32_t section_align; /* alignment in bytes */
|
||||||
|
uint32_t file_align; /* file alignment in bytes */
|
||||||
|
uint16_t os_major; /* major OS version */
|
||||||
|
uint16_t os_minor; /* minor OS version */
|
||||||
|
uint16_t image_major; /* major image version */
|
||||||
|
uint16_t image_minor; /* minor image version */
|
||||||
|
uint16_t subsys_major; /* major subsystem version */
|
||||||
|
uint16_t subsys_minor; /* minor subsystem version */
|
||||||
|
uint32_t win32_version; /* reserved, must be 0 */
|
||||||
|
uint32_t image_size; /* image size */
|
||||||
|
uint32_t header_size; /* header size rounded up to
|
||||||
|
file_align */
|
||||||
|
uint32_t csum; /* checksum */
|
||||||
|
uint16_t subsys; /* subsystem */
|
||||||
|
uint16_t dll_flags; /* more flags! */
|
||||||
|
uint64_t stack_size_req; /* amt of stack requested */
|
||||||
|
uint64_t stack_size; /* amt of stack required */
|
||||||
|
uint64_t heap_size_req; /* amt of heap requested */
|
||||||
|
uint64_t heap_size; /* amt of heap required */
|
||||||
|
uint32_t loader_flags; /* reserved, must be 0 */
|
||||||
|
uint32_t data_dirs; /* number of data dir entries */
|
||||||
|
};
|
||||||
|
|
||||||
|
struct data_dirent
|
||||||
|
{
|
||||||
|
uint32_t virtual_address; /* relative to load address */
|
||||||
|
uint32_t size;
|
||||||
|
};
|
||||||
|
|
||||||
|
struct data_directory
|
||||||
|
{
|
||||||
|
struct data_dirent exports; /* .edata */
|
||||||
|
struct data_dirent imports; /* .idata */
|
||||||
|
struct data_dirent resources; /* .rsrc */
|
||||||
|
struct data_dirent exceptions; /* .pdata */
|
||||||
|
struct data_dirent certs; /* certs */
|
||||||
|
struct data_dirent base_relocations; /* .reloc */
|
||||||
|
struct data_dirent debug; /* .debug */
|
||||||
|
struct data_dirent arch; /* reservered */
|
||||||
|
struct data_dirent global_ptr; /* global pointer reg. Size=0 */
|
||||||
|
struct data_dirent tls; /* .tls */
|
||||||
|
struct data_dirent load_config; /* load configuration structure */
|
||||||
|
struct data_dirent bound_imports; /* no idea */
|
||||||
|
struct data_dirent import_addrs; /* import address table */
|
||||||
|
struct data_dirent delay_imports; /* delay-load import table */
|
||||||
|
struct data_dirent clr_runtime_hdr; /* .cor (object only) */
|
||||||
|
struct data_dirent reserved;
|
||||||
|
};
|
||||||
|
|
||||||
|
struct section_header
|
||||||
|
{
|
||||||
|
char name[8]; /* name or "/12\0" string tbl offset */
|
||||||
|
uint32_t virtual_size; /* size of loaded section in ram */
|
||||||
|
uint32_t virtual_address; /* relative virtual address */
|
||||||
|
uint32_t raw_data_size; /* size of the section */
|
||||||
|
uint32_t data_addr; /* file pointer to first page of sec */
|
||||||
|
uint32_t relocs; /* file pointer to relocation entries */
|
||||||
|
uint32_t line_numbers; /* line numbers! */
|
||||||
|
uint16_t num_relocs; /* number of relocations */
|
||||||
|
uint16_t num_lin_numbers; /* srsly. */
|
||||||
|
uint32_t flags;
|
||||||
|
};
|
||||||
|
|
||||||
|
enum x64_coff_reloc_type
|
||||||
|
{
|
||||||
|
IMAGE_REL_AMD64_ABSOLUTE = 0,
|
||||||
|
IMAGE_REL_AMD64_ADDR64,
|
||||||
|
IMAGE_REL_AMD64_ADDR32,
|
||||||
|
IMAGE_REL_AMD64_ADDR32N,
|
||||||
|
IMAGE_REL_AMD64_REL32,
|
||||||
|
IMAGE_REL_AMD64_REL32_1,
|
||||||
|
IMAGE_REL_AMD64_REL32_2,
|
||||||
|
IMAGE_REL_AMD64_REL32_3,
|
||||||
|
IMAGE_REL_AMD64_REL32_4,
|
||||||
|
IMAGE_REL_AMD64_REL32_5,
|
||||||
|
IMAGE_REL_AMD64_SECTION,
|
||||||
|
IMAGE_REL_AMD64_SECREL,
|
||||||
|
IMAGE_REL_AMD64_SECREL7,
|
||||||
|
IMAGE_REL_AMD64_TOKEN,
|
||||||
|
IMAGE_REL_AMD64_SREL32,
|
||||||
|
IMAGE_REL_AMD64_PAIR,
|
||||||
|
IMAGE_REL_AMD64_SSPAN32,
|
||||||
|
};
|
||||||
|
|
||||||
|
enum arm_coff_reloc_type
|
||||||
|
{
|
||||||
|
IMAGE_REL_ARM_ABSOLUTE,
|
||||||
|
IMAGE_REL_ARM_ADDR32,
|
||||||
|
IMAGE_REL_ARM_ADDR32N,
|
||||||
|
IMAGE_REL_ARM_BRANCH2,
|
||||||
|
IMAGE_REL_ARM_BRANCH1,
|
||||||
|
IMAGE_REL_ARM_SECTION,
|
||||||
|
IMAGE_REL_ARM_SECREL,
|
||||||
|
};
|
||||||
|
|
||||||
|
enum sh_coff_reloc_type
|
||||||
|
{
|
||||||
|
IMAGE_REL_SH3_ABSOLUTE,
|
||||||
|
IMAGE_REL_SH3_DIRECT16,
|
||||||
|
IMAGE_REL_SH3_DIRECT32,
|
||||||
|
IMAGE_REL_SH3_DIRECT8,
|
||||||
|
IMAGE_REL_SH3_DIRECT8_WORD,
|
||||||
|
IMAGE_REL_SH3_DIRECT8_LONG,
|
||||||
|
IMAGE_REL_SH3_DIRECT4,
|
||||||
|
IMAGE_REL_SH3_DIRECT4_WORD,
|
||||||
|
IMAGE_REL_SH3_DIRECT4_LONG,
|
||||||
|
IMAGE_REL_SH3_PCREL8_WORD,
|
||||||
|
IMAGE_REL_SH3_PCREL8_LONG,
|
||||||
|
IMAGE_REL_SH3_PCREL12_WORD,
|
||||||
|
IMAGE_REL_SH3_STARTOF_SECTION,
|
||||||
|
IMAGE_REL_SH3_SIZEOF_SECTION,
|
||||||
|
IMAGE_REL_SH3_SECTION,
|
||||||
|
IMAGE_REL_SH3_SECREL,
|
||||||
|
IMAGE_REL_SH3_DIRECT32_NB,
|
||||||
|
IMAGE_REL_SH3_GPREL4_LONG,
|
||||||
|
IMAGE_REL_SH3_TOKEN,
|
||||||
|
IMAGE_REL_SHM_PCRELPT,
|
||||||
|
IMAGE_REL_SHM_REFLO,
|
||||||
|
IMAGE_REL_SHM_REFHALF,
|
||||||
|
IMAGE_REL_SHM_RELLO,
|
||||||
|
IMAGE_REL_SHM_RELHALF,
|
||||||
|
IMAGE_REL_SHM_PAIR,
|
||||||
|
IMAGE_REL_SHM_NOMODE,
|
||||||
|
};
|
||||||
|
|
||||||
|
enum ppc_coff_reloc_type
|
||||||
|
{
|
||||||
|
IMAGE_REL_PPC_ABSOLUTE,
|
||||||
|
IMAGE_REL_PPC_ADDR64,
|
||||||
|
IMAGE_REL_PPC_ADDR32,
|
||||||
|
IMAGE_REL_PPC_ADDR24,
|
||||||
|
IMAGE_REL_PPC_ADDR16,
|
||||||
|
IMAGE_REL_PPC_ADDR14,
|
||||||
|
IMAGE_REL_PPC_REL24,
|
||||||
|
IMAGE_REL_PPC_REL14,
|
||||||
|
IMAGE_REL_PPC_ADDR32N,
|
||||||
|
IMAGE_REL_PPC_SECREL,
|
||||||
|
IMAGE_REL_PPC_SECTION,
|
||||||
|
IMAGE_REL_PPC_SECREL16,
|
||||||
|
IMAGE_REL_PPC_REFHI,
|
||||||
|
IMAGE_REL_PPC_REFLO,
|
||||||
|
IMAGE_REL_PPC_PAIR,
|
||||||
|
IMAGE_REL_PPC_SECRELLO,
|
||||||
|
IMAGE_REL_PPC_GPREL,
|
||||||
|
IMAGE_REL_PPC_TOKEN,
|
||||||
|
};
|
||||||
|
|
||||||
|
enum x86_coff_reloc_type
|
||||||
|
{
|
||||||
|
IMAGE_REL_I386_ABSOLUTE,
|
||||||
|
IMAGE_REL_I386_DIR16,
|
||||||
|
IMAGE_REL_I386_REL16,
|
||||||
|
IMAGE_REL_I386_DIR32,
|
||||||
|
IMAGE_REL_I386_DIR32NB,
|
||||||
|
IMAGE_REL_I386_SEG12,
|
||||||
|
IMAGE_REL_I386_SECTION,
|
||||||
|
IMAGE_REL_I386_SECREL,
|
||||||
|
IMAGE_REL_I386_TOKEN,
|
||||||
|
IMAGE_REL_I386_SECREL7,
|
||||||
|
IMAGE_REL_I386_REL32,
|
||||||
|
};
|
||||||
|
|
||||||
|
enum ia64_coff_reloc_type
|
||||||
|
{
|
||||||
|
IMAGE_REL_IA64_ABSOLUTE,
|
||||||
|
IMAGE_REL_IA64_IMM14,
|
||||||
|
IMAGE_REL_IA64_IMM22,
|
||||||
|
IMAGE_REL_IA64_IMM64,
|
||||||
|
IMAGE_REL_IA64_DIR32,
|
||||||
|
IMAGE_REL_IA64_DIR64,
|
||||||
|
IMAGE_REL_IA64_PCREL21B,
|
||||||
|
IMAGE_REL_IA64_PCREL21M,
|
||||||
|
IMAGE_REL_IA64_PCREL21F,
|
||||||
|
IMAGE_REL_IA64_GPREL22,
|
||||||
|
IMAGE_REL_IA64_LTOFF22,
|
||||||
|
IMAGE_REL_IA64_SECTION,
|
||||||
|
IMAGE_REL_IA64_SECREL22,
|
||||||
|
IMAGE_REL_IA64_SECREL64I,
|
||||||
|
IMAGE_REL_IA64_SECREL32,
|
||||||
|
IMAGE_REL_IA64_DIR32NB,
|
||||||
|
IMAGE_REL_IA64_SREL14,
|
||||||
|
IMAGE_REL_IA64_SREL22,
|
||||||
|
IMAGE_REL_IA64_SREL32,
|
||||||
|
IMAGE_REL_IA64_UREL32,
|
||||||
|
IMAGE_REL_IA64_PCREL60X,
|
||||||
|
IMAGE_REL_IA64_PCREL60B,
|
||||||
|
IMAGE_REL_IA64_PCREL60F,
|
||||||
|
IMAGE_REL_IA64_PCREL60I,
|
||||||
|
IMAGE_REL_IA64_PCREL60M,
|
||||||
|
IMAGE_REL_IA64_IMMGPREL6,
|
||||||
|
IMAGE_REL_IA64_TOKEN,
|
||||||
|
IMAGE_REL_IA64_GPREL32,
|
||||||
|
IMAGE_REL_IA64_ADDEND,
|
||||||
|
};
|
||||||
|
|
||||||
|
struct coff_reloc
|
||||||
|
{
|
||||||
|
uint32_t virtual_address;
|
||||||
|
uint32_t symbol_table_index;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
enum x64_coff_reloc_type x64_type;
|
||||||
|
enum arm_coff_reloc_type arm_type;
|
||||||
|
enum sh_coff_reloc_type sh_type;
|
||||||
|
enum ppc_coff_reloc_type ppc_type;
|
||||||
|
enum x86_coff_reloc_type x86_type;
|
||||||
|
enum ia64_coff_reloc_type ia64_type;
|
||||||
|
uint16_t data;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Definitions for the contents of the certs data block
|
||||||
|
*/
|
||||||
|
# define WIN_CERT_TYPE_PKCS_SIGNED_DATA 0x0002
|
||||||
|
# define WIN_CERT_TYPE_EFI_OKCS115 0x0EF0
|
||||||
|
# define WIN_CERT_TYPE_EFI_GUID 0x0EF1
|
||||||
|
|
||||||
|
# define WIN_CERT_REVISION_1_0 0x0100
|
||||||
|
# define WIN_CERT_REVISION_2_0 0x0200
|
||||||
|
|
||||||
|
struct win_certificate
|
||||||
|
{
|
||||||
|
uint32_t length;
|
||||||
|
uint16_t revision;
|
||||||
|
uint16_t cert_type;
|
||||||
|
};
|
||||||
|
|
||||||
|
#endif /* !__ASSEMBLY__ */
|
||||||
|
|
||||||
|
//#endif /* __LINUX_PE_H */
|
||||||
@ -0,0 +1,53 @@
|
|||||||
|
/* PKCS#7 crypto data parser
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or
|
||||||
|
* modify it under the terms of the GNU General Public Licence
|
||||||
|
* as published by the Free Software Foundation; either version
|
||||||
|
* 2 of the Licence, or (at your option) any later version.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#pragma once
|
||||||
|
|
||||||
|
//#ifndef _CRYPTO_PKCS7_H
|
||||||
|
//#define _CRYPTO_PKCS7_H
|
||||||
|
|
||||||
|
//#include <linux/verification.h>
|
||||||
|
//#include <crypto/public_key.h>
|
||||||
|
|
||||||
|
#include "pkcs7_parser.h"
|
||||||
|
|
||||||
|
#include <fltKernel.h>
|
||||||
|
|
||||||
|
// struct key;
|
||||||
|
// struct pkcs7_message;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* pkcs7_parser.c
|
||||||
|
*/
|
||||||
|
extern struct pkcs7_message *
|
||||||
|
pkcs7_parse_message(const void *data, size_t datalen);
|
||||||
|
extern void
|
||||||
|
pkcs7_free_message(struct pkcs7_message *pkcs7);
|
||||||
|
|
||||||
|
extern int
|
||||||
|
pkcs7_get_content_data(const struct pkcs7_message *pkcs7, const void **_data, size_t *_datalen, size_t *_headerlen);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* pkcs7_trust.c
|
||||||
|
*/
|
||||||
|
// extern int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
|
||||||
|
// struct key *trust_keyring);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* pkcs7_verify.c
|
||||||
|
*/
|
||||||
|
// extern int pkcs7_verify(struct pkcs7_message *pkcs7,
|
||||||
|
// enum key_being_used_for usage);
|
||||||
|
//
|
||||||
|
// extern int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,
|
||||||
|
// const void *data, size_t datalen);
|
||||||
|
|
||||||
|
//#endif /* _CRYPTO_PKCS7_H */
|
||||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,81 @@
|
|||||||
|
/* PKCS#7 crypto data parser internal definitions
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or
|
||||||
|
* modify it under the terms of the GNU General Public Licence
|
||||||
|
* as published by the Free Software Foundation; either version
|
||||||
|
* 2 of the Licence, or (at your option) any later version.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#pragma once
|
||||||
|
|
||||||
|
//#include <linux/oid_registry.h>
|
||||||
|
//#include <crypto/pkcs7.h>
|
||||||
|
//#include "x509_parser.h"
|
||||||
|
|
||||||
|
#include "pkcs7.h"
|
||||||
|
#include "x509_parser.h"
|
||||||
|
#include "public_key.h"
|
||||||
|
#include "oid_registry.h"
|
||||||
|
|
||||||
|
//#define kenter(FMT, ...) \
|
||||||
|
// pr_devel("==> %s("FMT")\n", __func__, ##__VA_ARGS__)
|
||||||
|
//#define kleave(FMT, ...) \
|
||||||
|
// pr_devel("<== %s()"FMT"\n", __func__, ##__VA_ARGS__)
|
||||||
|
|
||||||
|
#define kenter
|
||||||
|
#define kleave
|
||||||
|
|
||||||
|
struct pkcs7_signed_info
|
||||||
|
{
|
||||||
|
struct pkcs7_signed_info *next;
|
||||||
|
struct x509_certificate *signer; /* Signing certificate (in msg->certs) */
|
||||||
|
unsigned index;
|
||||||
|
/*bool*/ unsigned char unsupported_crypto; /* T if not usable due to missing crypto */
|
||||||
|
/*bool*/ unsigned char blacklisted;
|
||||||
|
|
||||||
|
/* Message digest - the digest of the Content Data (or NULL) */
|
||||||
|
const void *msgdigest;
|
||||||
|
unsigned msgdigest_len;
|
||||||
|
|
||||||
|
/* Authenticated Attribute data (or NULL) */
|
||||||
|
unsigned authattrs_len;
|
||||||
|
const void *authattrs;
|
||||||
|
unsigned long aa_set;
|
||||||
|
#define sinfo_has_content_type 0
|
||||||
|
#define sinfo_has_signing_time 1
|
||||||
|
#define sinfo_has_message_digest 2
|
||||||
|
#define sinfo_has_smime_caps 3
|
||||||
|
#define sinfo_has_ms_opus_info 4
|
||||||
|
#define sinfo_has_ms_statement_type 5
|
||||||
|
/*time64_t*/ long long signing_time;
|
||||||
|
|
||||||
|
/* Message signature.
|
||||||
|
*
|
||||||
|
* This contains the generated digest of _either_ the Content Data or
|
||||||
|
* the Authenticated Attributes [RFC2315 9.3]. If the latter, one of
|
||||||
|
* the attributes contains the digest of the the Content Data within
|
||||||
|
* it.
|
||||||
|
*
|
||||||
|
* THis also contains the issuing cert serial number and issuer's name
|
||||||
|
* [PKCS#7 or CMS ver 1] or issuing cert's SKID [CMS ver 3].
|
||||||
|
*/
|
||||||
|
struct public_key_signature *sig;
|
||||||
|
};
|
||||||
|
|
||||||
|
struct pkcs7_message
|
||||||
|
{
|
||||||
|
struct x509_certificate *certs; /* Certificate list */
|
||||||
|
struct x509_certificate *crl; /* Revocation list */
|
||||||
|
struct pkcs7_signed_info *signed_infos;
|
||||||
|
/*u8*/ unsigned char version; /* Version of cert (1 -> PKCS#7 or CMS; 3 -> CMS) */
|
||||||
|
/*bool*/ unsigned char have_authattrs; /* T if have authattrs */
|
||||||
|
|
||||||
|
/* Content Data (or NULL) */
|
||||||
|
enum OID data_type; /* Type of Data */
|
||||||
|
size_t data_len; /* Length of Data */
|
||||||
|
size_t data_hdrlen; /* Length of Data ASN.1 header */
|
||||||
|
const void *data; /* Content Data (or 0) */
|
||||||
|
};
|
||||||
@ -0,0 +1,193 @@
|
|||||||
|
/* In-software asymmetric public-key crypto subtype
|
||||||
|
*
|
||||||
|
* See Documentation/crypto/asymmetric-keys.txt
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or
|
||||||
|
* modify it under the terms of the GNU General Public Licence
|
||||||
|
* as published by the Free Software Foundation; either version
|
||||||
|
* 2 of the Licence, or (at your option) any later version.
|
||||||
|
*/
|
||||||
|
|
||||||
|
//#define pr_fmt(fmt) "PKEY: "fmt
|
||||||
|
//#include <linux/module.h>
|
||||||
|
//#include <linux/export.h>
|
||||||
|
//#include <linux/kernel.h>
|
||||||
|
//#include <linux/slab.h>
|
||||||
|
//#include <linux/seq_file.h>
|
||||||
|
//#include <linux/scatterlist.h>
|
||||||
|
//#include <keys/asymmetric-subtype.h>
|
||||||
|
//#include <crypto/public_key.h>
|
||||||
|
//#include <crypto/akcipher.h>
|
||||||
|
//
|
||||||
|
// MODULE_LICENSE("GPL");
|
||||||
|
|
||||||
|
#include "public_key.h"
|
||||||
|
|
||||||
|
#include "../rewrite/Lib.SoulExtraction.rewrite.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Provide a part of a description of the key for /proc/keys.
|
||||||
|
*/
|
||||||
|
// static void public_key_describe(const struct key *asymmetric_key,
|
||||||
|
// struct seq_file *m)
|
||||||
|
//{
|
||||||
|
// struct public_key *key = asymmetric_key->payload.data[asym_crypto];
|
||||||
|
//
|
||||||
|
// if (key)
|
||||||
|
// seq_printf(m, "%s.%s", key->id_type, key->pkey_algo);
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Destroy a public key algorithm key.
|
||||||
|
*/
|
||||||
|
void
|
||||||
|
public_key_free(struct public_key *key)
|
||||||
|
{
|
||||||
|
if (key)
|
||||||
|
{
|
||||||
|
kfree(key->key);
|
||||||
|
kfree(key);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// EXPORT_SYMBOL_GPL(public_key_free);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Destroy a public key algorithm key.
|
||||||
|
*/
|
||||||
|
// static void public_key_destroy(void *payload0, void *payload3)
|
||||||
|
//{
|
||||||
|
// public_key_free(payload0);
|
||||||
|
// public_key_signature_free(payload3);
|
||||||
|
// }
|
||||||
|
|
||||||
|
// struct public_key_completion {
|
||||||
|
// struct completion completion;
|
||||||
|
// int err;
|
||||||
|
// };
|
||||||
|
//
|
||||||
|
// static void public_key_verify_done(struct crypto_async_request *req, int err)
|
||||||
|
//{
|
||||||
|
// struct public_key_completion *compl = req->data;
|
||||||
|
//
|
||||||
|
// if (err == -EINPROGRESS)
|
||||||
|
// return;
|
||||||
|
//
|
||||||
|
// compl->err = err;
|
||||||
|
// complete(&compl->completion);
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Verify a signature using a public key.
|
||||||
|
*/
|
||||||
|
// int public_key_verify_signature(const struct public_key *pkey,
|
||||||
|
// const struct public_key_signature *sig)
|
||||||
|
//{
|
||||||
|
// struct public_key_completion compl;
|
||||||
|
// struct crypto_akcipher *tfm;
|
||||||
|
// struct akcipher_request *req;
|
||||||
|
// struct scatterlist sig_sg, digest_sg;
|
||||||
|
// const char *alg_name;
|
||||||
|
// char alg_name_buf[CRYPTO_MAX_ALG_NAME];
|
||||||
|
// void *output;
|
||||||
|
// unsigned int outlen;
|
||||||
|
// int ret = -ENOMEM;
|
||||||
|
//
|
||||||
|
// pr_devel("==>%s()\n", __func__);
|
||||||
|
//
|
||||||
|
// BUG_ON(!pkey);
|
||||||
|
// BUG_ON(!sig);
|
||||||
|
// BUG_ON(!sig->s);
|
||||||
|
//
|
||||||
|
// if (!sig->digest)
|
||||||
|
// return -ENOPKG;
|
||||||
|
//
|
||||||
|
// alg_name = sig->pkey_algo;
|
||||||
|
// if (strcmp(sig->pkey_algo, "rsa") == 0) {
|
||||||
|
// /* The data wangled by the RSA algorithm is typically padded
|
||||||
|
// * and encoded in some manner, such as EMSA-PKCS1-1_5 [RFC3447
|
||||||
|
// * sec 8.2].
|
||||||
|
// */
|
||||||
|
// if (snprintf(alg_name_buf, CRYPTO_MAX_ALG_NAME,
|
||||||
|
// "pkcs1pad(rsa,%s)", sig->hash_algo
|
||||||
|
// ) >= CRYPTO_MAX_ALG_NAME)
|
||||||
|
// return -EINVAL;
|
||||||
|
// alg_name = alg_name_buf;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// tfm = crypto_alloc_akcipher(alg_name, 0, 0);
|
||||||
|
// if (IS_ERR(tfm))
|
||||||
|
// return PTR_ERR(tfm);
|
||||||
|
//
|
||||||
|
// req = akcipher_request_alloc(tfm, GFP_KERNEL);
|
||||||
|
// if (!req)
|
||||||
|
// goto error_free_tfm;
|
||||||
|
//
|
||||||
|
// ret = crypto_akcipher_set_pub_key(tfm, pkey->key, pkey->keylen);
|
||||||
|
// if (ret)
|
||||||
|
// goto error_free_req;
|
||||||
|
//
|
||||||
|
// ret = -ENOMEM;
|
||||||
|
// outlen = crypto_akcipher_maxsize(tfm);
|
||||||
|
// output = kmalloc(outlen, GFP_KERNEL);
|
||||||
|
// if (!output)
|
||||||
|
// goto error_free_req;
|
||||||
|
//
|
||||||
|
// sg_init_one(&sig_sg, sig->s, sig->s_size);
|
||||||
|
// sg_init_one(&digest_sg, output, outlen);
|
||||||
|
// akcipher_request_set_crypt(req, &sig_sg, &digest_sg, sig->s_size,
|
||||||
|
// outlen);
|
||||||
|
// init_completion(&compl.completion);
|
||||||
|
// akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
|
||||||
|
// CRYPTO_TFM_REQ_MAY_SLEEP,
|
||||||
|
// public_key_verify_done, &compl);
|
||||||
|
//
|
||||||
|
// /* Perform the verification calculation. This doesn't actually do the
|
||||||
|
// * verification, but rather calculates the hash expected by the
|
||||||
|
// * signature and returns that to us.
|
||||||
|
// */
|
||||||
|
// ret = crypto_akcipher_verify(req);
|
||||||
|
// if ((ret == -EINPROGRESS) || (ret == -EBUSY)) {
|
||||||
|
// wait_for_completion(&compl.completion);
|
||||||
|
// ret = compl.err;
|
||||||
|
// }
|
||||||
|
// if (ret < 0)
|
||||||
|
// goto out_free_output;
|
||||||
|
//
|
||||||
|
// /* Do the actual verification step. */
|
||||||
|
// if (req->dst_len != sig->digest_size ||
|
||||||
|
// memcmp(sig->digest, output, sig->digest_size) != 0)
|
||||||
|
// ret = -EKEYREJECTED;
|
||||||
|
//
|
||||||
|
// out_free_output:
|
||||||
|
// kfree(output);
|
||||||
|
// error_free_req:
|
||||||
|
// akcipher_request_free(req);
|
||||||
|
// error_free_tfm:
|
||||||
|
// crypto_free_akcipher(tfm);
|
||||||
|
// pr_devel("<==%s() = %d\n", __func__, ret);
|
||||||
|
// return ret;
|
||||||
|
// }
|
||||||
|
// EXPORT_SYMBOL_GPL(public_key_verify_signature);
|
||||||
|
//
|
||||||
|
// static int public_key_verify_signature_2(const struct key *key,
|
||||||
|
// const struct public_key_signature *sig)
|
||||||
|
//{
|
||||||
|
// const struct public_key *pk = key->payload.data[asym_crypto];
|
||||||
|
// return public_key_verify_signature(pk, sig);
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Public key algorithm asymmetric key subtype
|
||||||
|
*/
|
||||||
|
// struct asymmetric_key_subtype public_key_subtype = {
|
||||||
|
// .owner = THIS_MODULE,
|
||||||
|
// .name = "public_key",
|
||||||
|
// .name_len = sizeof("public_key") - 1,
|
||||||
|
// .describe = public_key_describe,
|
||||||
|
// .destroy = public_key_destroy,
|
||||||
|
// .verify_signature = public_key_verify_signature_2,
|
||||||
|
// };
|
||||||
|
// EXPORT_SYMBOL_GPL(public_key_subtype);
|
||||||
@ -0,0 +1,82 @@
|
|||||||
|
/* Asymmetric public-key algorithm definitions
|
||||||
|
*
|
||||||
|
* See Documentation/crypto/asymmetric-keys.txt
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or
|
||||||
|
* modify it under the terms of the GNU General Public Licence
|
||||||
|
* as published by the Free Software Foundation; either version
|
||||||
|
* 2 of the Licence, or (at your option) any later version.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifndef _LINUX_PUBLIC_KEY_H
|
||||||
|
#define _LINUX_PUBLIC_KEY_H
|
||||||
|
|
||||||
|
#include <fltKernel.h>
|
||||||
|
|
||||||
|
#include "asymmetric-type.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Cryptographic data for the public-key subtype of the asymmetric key type.
|
||||||
|
*
|
||||||
|
* Note that this may include private part of the key as well as the public
|
||||||
|
* part.
|
||||||
|
*/
|
||||||
|
struct public_key
|
||||||
|
{
|
||||||
|
void *key;
|
||||||
|
/*u32*/ unsigned long keylen;
|
||||||
|
const char *id_type;
|
||||||
|
const char *pkey_algo;
|
||||||
|
};
|
||||||
|
|
||||||
|
extern void
|
||||||
|
public_key_free(struct public_key *key);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Public key cryptography signature data
|
||||||
|
*/
|
||||||
|
struct public_key_signature
|
||||||
|
{
|
||||||
|
struct asymmetric_key_id *auth_ids[2];
|
||||||
|
/*u8*/ unsigned char *s; /* Signature */
|
||||||
|
/*u32*/ unsigned long s_size; /* Number of bytes in signature */
|
||||||
|
/*u8*/ unsigned char *digest;
|
||||||
|
/*u8*/ unsigned char digest_size; /* Number of bytes in digest */
|
||||||
|
const char *pkey_algo;
|
||||||
|
const char *hash_algo;
|
||||||
|
};
|
||||||
|
|
||||||
|
extern void
|
||||||
|
public_key_signature_free(struct public_key_signature *sig);
|
||||||
|
|
||||||
|
// extern struct asymmetric_key_subtype public_key_subtype;
|
||||||
|
|
||||||
|
// struct key;
|
||||||
|
// struct key_type;
|
||||||
|
// union key_payload;
|
||||||
|
|
||||||
|
// extern int restrict_link_by_signature(struct key *dest_keyring,
|
||||||
|
// const struct key_type *type,
|
||||||
|
// const union key_payload *payload,
|
||||||
|
// struct key *trust_keyring);
|
||||||
|
|
||||||
|
// extern int restrict_link_by_key_or_keyring(struct key *dest_keyring,
|
||||||
|
// const struct key_type *type,
|
||||||
|
// const union key_payload *payload,
|
||||||
|
// struct key *trusted);
|
||||||
|
|
||||||
|
// extern int restrict_link_by_key_or_keyring_chain(struct key *trust_keyring,
|
||||||
|
// const struct key_type *type,
|
||||||
|
// const union key_payload *payload,
|
||||||
|
// struct key *trusted);
|
||||||
|
|
||||||
|
// extern int verify_signature(const struct key *key,
|
||||||
|
// const struct public_key_signature *sig);
|
||||||
|
|
||||||
|
// int public_key_verify_signature(const struct public_key *pkey,
|
||||||
|
// const struct public_key_signature *sig);
|
||||||
|
|
||||||
|
#endif /* _LINUX_PUBLIC_KEY_H */
|
||||||
@ -0,0 +1,76 @@
|
|||||||
|
/* Signature verification with an asymmetric key
|
||||||
|
*
|
||||||
|
* See Documentation/security/asymmetric-keys.txt
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or
|
||||||
|
* modify it under the terms of the GNU General Public Licence
|
||||||
|
* as published by the Free Software Foundation; either version
|
||||||
|
* 2 of the Licence, or (at your option) any later version.
|
||||||
|
*/
|
||||||
|
|
||||||
|
//#define pr_fmt(fmt) "SIG: "fmt
|
||||||
|
//#include <keys/asymmetric-subtype.h>
|
||||||
|
//#include <linux/export.h>
|
||||||
|
//#include <linux/err.h>
|
||||||
|
//#include <linux/slab.h>
|
||||||
|
//#include <crypto/public_key.h>
|
||||||
|
//#include "asymmetric_keys.h"
|
||||||
|
|
||||||
|
#include "public_key.h"
|
||||||
|
|
||||||
|
#include "../rewrite/Lib.SoulExtraction.rewrite.h"
|
||||||
|
|
||||||
|
#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Destroy a public key signature.
|
||||||
|
*/
|
||||||
|
void
|
||||||
|
public_key_signature_free(struct public_key_signature *sig)
|
||||||
|
{
|
||||||
|
int i;
|
||||||
|
|
||||||
|
if (sig)
|
||||||
|
{
|
||||||
|
for (i = 0; i < ARRAY_SIZE(sig->auth_ids); i++)
|
||||||
|
kfree(sig->auth_ids[i]);
|
||||||
|
kfree(sig->s);
|
||||||
|
kfree(sig->digest);
|
||||||
|
kfree(sig);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// EXPORT_SYMBOL_GPL(public_key_signature_free);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* verify_signature - Initiate the use of an asymmetric key to verify a signature
|
||||||
|
* @key: The asymmetric key to verify against
|
||||||
|
* @sig: The signature to check
|
||||||
|
*
|
||||||
|
* Returns 0 if successful or else an error.
|
||||||
|
*/
|
||||||
|
// int verify_signature(const struct key *key,
|
||||||
|
// const struct public_key_signature *sig)
|
||||||
|
//{
|
||||||
|
// const struct asymmetric_key_subtype *subtype;
|
||||||
|
// int ret;
|
||||||
|
//
|
||||||
|
// pr_devel("==>%s()\n", __func__);
|
||||||
|
//
|
||||||
|
// if (key->type != &key_type_asymmetric)
|
||||||
|
// return -EINVAL;
|
||||||
|
// subtype = asymmetric_key_subtype(key);
|
||||||
|
// if (!subtype ||
|
||||||
|
// !key->payload.data[0])
|
||||||
|
// return -EINVAL;
|
||||||
|
// if (!subtype->verify_signature)
|
||||||
|
// return -ENOTSUPP;
|
||||||
|
//
|
||||||
|
// ret = subtype->verify_signature(key, sig);
|
||||||
|
//
|
||||||
|
// pr_devel("<==%s() = %d\n", __func__, ret);
|
||||||
|
// return ret;
|
||||||
|
// }
|
||||||
|
// EXPORT_SYMBOL_GPL(verify_signature);
|
||||||
@ -0,0 +1,338 @@
|
|||||||
|
//// SPDX-License-Identifier: GPL-2.0-or-later
|
||||||
|
///* System trusted keyring for trusted public keys
|
||||||
|
// *
|
||||||
|
// * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
// * Written by David Howells (dhowells@redhat.com)
|
||||||
|
// */
|
||||||
|
//
|
||||||
|
////#include <linux/export.h>
|
||||||
|
////#include <linux/kernel.h>
|
||||||
|
////#include <linux/sched.h>
|
||||||
|
////#include <linux/cred.h>
|
||||||
|
////#include <linux/err.h>
|
||||||
|
////#include <linux/slab.h>
|
||||||
|
////#include <linux/verification.h>
|
||||||
|
////#include <keys/asymmetric-type.h>
|
||||||
|
////#include <keys/system_keyring.h>
|
||||||
|
////#include <crypto/pkcs7.h>
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//#include "pkcs7.h"
|
||||||
|
//#include "errno.h"
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//#include "../rewrite/lib_vsign_rewritefunc.h"
|
||||||
|
//
|
||||||
|
//
|
||||||
|
////
|
||||||
|
//// macro
|
||||||
|
////
|
||||||
|
//
|
||||||
|
//
|
||||||
|
////laji daima
|
||||||
|
//#define pr_debug
|
||||||
|
//#define pr_devel
|
||||||
|
//#define pr_warn
|
||||||
|
//#define pr_err
|
||||||
|
//#define printk
|
||||||
|
//
|
||||||
|
//#define GFP_ATOMIC /*(__GFP_HIGH|__GFP_ATOMIC|__GFP_KSWAPD_RECLAIM)*/1
|
||||||
|
//#define GFP_KERNEL /*(__GFP_RECLAIM | __GFP_IO | __GFP_FS)*/2
|
||||||
|
//#define GFP_KERNEL_ACCOUNT /*(GFP_KERNEL | __GFP_ACCOUNT)*/3
|
||||||
|
//#define GFP_NOWAIT /*(__GFP_KSWAPD_RECLAIM)*/4
|
||||||
|
//#define GFP_NOIO /*(__GFP_RECLAIM)*/5
|
||||||
|
//#define GFP_NOFS /*(__GFP_RECLAIM | __GFP_IO)*/6
|
||||||
|
//#define GFP_USER /*(__GFP_RECLAIM | __GFP_IO | __GFP_FS | __GFP_HARDWALL)*/7
|
||||||
|
//#define GFP_DMA /*__GFP_DMA*/8
|
||||||
|
//#define GFP_DMA32 /*__GFP_DMA32*/9
|
||||||
|
//#define GFP_HIGHUSER /*(GFP_USER | __GFP_HIGHMEM)*/10
|
||||||
|
//#define GFP_HIGHUSER_MOVABLE /*(GFP_HIGHUSER | __GFP_MOVABLE)*/11
|
||||||
|
//#define GFP_TRANSHUGE_LIGHT 12
|
||||||
|
//#define GFP_TRANSHUGE /*(GFP_TRANSHUGE_LIGHT | __GFP_DIRECT_RECLAIM)*/13
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//#define ERR_PTR(err) ((void *)((long)(err)))
|
||||||
|
//#define PTR_ERR(ptr) ((long)(ptr))
|
||||||
|
//#define IS_ERR(ptr) ((unsigned long)(ptr) > (unsigned long)(-1000))
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//#define CONFIG_SECONDARY_TRUSTED_KEYRING
|
||||||
|
//#define CONFIG_INTEGRITY_PLATFORM_KEYRING
|
||||||
|
//
|
||||||
|
//#define CONFIG_SYSTEM_DATA_VERIFICATION
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//static struct key *builtin_trusted_keys;
|
||||||
|
//#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
|
||||||
|
//static struct key *secondary_trusted_keys;
|
||||||
|
//#endif
|
||||||
|
//#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
|
||||||
|
//static struct key *platform_trusted_keys;
|
||||||
|
//#endif
|
||||||
|
//
|
||||||
|
////extern __initconst const u8 system_certificate_list[];
|
||||||
|
////extern __initconst const unsigned long system_certificate_list_size;
|
||||||
|
//
|
||||||
|
//
|
||||||
|
///**
|
||||||
|
// * restrict_link_to_builtin_trusted - Restrict keyring addition by built in CA
|
||||||
|
// *
|
||||||
|
// * Restrict the addition of keys into a keyring based on the key-to-be-added
|
||||||
|
// * being vouched for by a key in the built in system keyring.
|
||||||
|
// */
|
||||||
|
//int restrict_link_by_builtin_trusted(struct key *dest_keyring,
|
||||||
|
// const struct key_type *type,
|
||||||
|
// const union key_payload *payload,
|
||||||
|
// struct key *restriction_key)
|
||||||
|
//{
|
||||||
|
// return restrict_link_by_signature(dest_keyring, type, payload,
|
||||||
|
// builtin_trusted_keys);
|
||||||
|
//}
|
||||||
|
//
|
||||||
|
//#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
|
||||||
|
///**
|
||||||
|
// * restrict_link_by_builtin_and_secondary_trusted - Restrict keyring
|
||||||
|
// * addition by both builtin and secondary keyrings
|
||||||
|
// *
|
||||||
|
// * Restrict the addition of keys into a keyring based on the key-to-be-added
|
||||||
|
// * being vouched for by a key in either the built-in or the secondary system
|
||||||
|
// * keyrings.
|
||||||
|
// */
|
||||||
|
//int restrict_link_by_builtin_and_secondary_trusted(
|
||||||
|
// struct key *dest_keyring,
|
||||||
|
// const struct key_type *type,
|
||||||
|
// const union key_payload *payload,
|
||||||
|
// struct key *restrict_key)
|
||||||
|
//{
|
||||||
|
// /* If we have a secondary trusted keyring, then that contains a link
|
||||||
|
// * through to the builtin keyring and the search will follow that link.
|
||||||
|
// */
|
||||||
|
// if (type == &key_type_keyring &&
|
||||||
|
// dest_keyring == secondary_trusted_keys &&
|
||||||
|
// payload == &builtin_trusted_keys->payload)
|
||||||
|
// /* Allow the builtin keyring to be added to the secondary */
|
||||||
|
// return 0;
|
||||||
|
//
|
||||||
|
// return restrict_link_by_signature(dest_keyring, type, payload,
|
||||||
|
// secondary_trusted_keys);
|
||||||
|
//}
|
||||||
|
//
|
||||||
|
///**
|
||||||
|
// * Allocate a struct key_restriction for the "builtin and secondary trust"
|
||||||
|
// * keyring. Only for use in system_trusted_keyring_init().
|
||||||
|
// */
|
||||||
|
//static __init struct key_restriction *get_builtin_and_secondary_restriction(void)
|
||||||
|
//{
|
||||||
|
// struct key_restriction *restriction;
|
||||||
|
//
|
||||||
|
// restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL);
|
||||||
|
//
|
||||||
|
// if (!restriction)
|
||||||
|
// panic("Can't allocate secondary trusted keyring restriction\n");
|
||||||
|
//
|
||||||
|
// restriction->check = restrict_link_by_builtin_and_secondary_trusted;
|
||||||
|
//
|
||||||
|
// return restriction;
|
||||||
|
//}
|
||||||
|
//#endif
|
||||||
|
//
|
||||||
|
///*
|
||||||
|
// * Create the trusted keyrings
|
||||||
|
// */
|
||||||
|
////static __init int system_trusted_keyring_init(void)
|
||||||
|
////{
|
||||||
|
//// pr_notice("Initialise system trusted keyrings\n");
|
||||||
|
////
|
||||||
|
//// builtin_trusted_keys =
|
||||||
|
//// keyring_alloc(".builtin_trusted_keys",
|
||||||
|
//// KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
|
||||||
|
//// ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
|
||||||
|
//// KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
|
||||||
|
//// KEY_ALLOC_NOT_IN_QUOTA,
|
||||||
|
//// NULL, NULL);
|
||||||
|
//// if (IS_ERR(builtin_trusted_keys))
|
||||||
|
//// panic("Can't allocate builtin trusted keyring\n");
|
||||||
|
////
|
||||||
|
////#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
|
||||||
|
//// secondary_trusted_keys =
|
||||||
|
//// keyring_alloc(".secondary_trusted_keys",
|
||||||
|
//// KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
|
||||||
|
//// ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
|
||||||
|
//// KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH |
|
||||||
|
//// KEY_USR_WRITE),
|
||||||
|
//// KEY_ALLOC_NOT_IN_QUOTA,
|
||||||
|
//// get_builtin_and_secondary_restriction(),
|
||||||
|
//// NULL);
|
||||||
|
//// if (IS_ERR(secondary_trusted_keys))
|
||||||
|
//// panic("Can't allocate secondary trusted keyring\n");
|
||||||
|
////
|
||||||
|
//// if (key_link(secondary_trusted_keys, builtin_trusted_keys) < 0)
|
||||||
|
//// panic("Can't link trusted keyrings\n");
|
||||||
|
////#endif
|
||||||
|
////
|
||||||
|
//// return 0;
|
||||||
|
////}
|
||||||
|
//
|
||||||
|
///*
|
||||||
|
// * Must be initialised before we try and load the keys into the keyring.
|
||||||
|
// */
|
||||||
|
////device_initcall(system_trusted_keyring_init);
|
||||||
|
////
|
||||||
|
/////*
|
||||||
|
//// * Load the compiled-in list of X.509 certificates.
|
||||||
|
//// */
|
||||||
|
////static __init int load_system_certificate_list(void)
|
||||||
|
////{
|
||||||
|
//// key_ref_t key;
|
||||||
|
//// const u8 *p, *end;
|
||||||
|
//// size_t plen;
|
||||||
|
////
|
||||||
|
//// pr_notice("Loading compiled-in X.509 certificates\n");
|
||||||
|
////
|
||||||
|
//// p = system_certificate_list;
|
||||||
|
//// end = p + system_certificate_list_size;
|
||||||
|
//// while (p < end) {
|
||||||
|
//// /* Each cert begins with an ASN.1 SEQUENCE tag and must be more
|
||||||
|
//// * than 256 bytes in size.
|
||||||
|
//// */
|
||||||
|
//// if (end - p < 4)
|
||||||
|
//// goto dodgy_cert;
|
||||||
|
//// if (p[0] != 0x30 &&
|
||||||
|
//// p[1] != 0x82)
|
||||||
|
//// goto dodgy_cert;
|
||||||
|
//// plen = (p[2] << 8) | p[3];
|
||||||
|
//// plen += 4;
|
||||||
|
//// if (plen > end - p)
|
||||||
|
//// goto dodgy_cert;
|
||||||
|
////
|
||||||
|
//// key = key_create_or_update(make_key_ref(builtin_trusted_keys, 1),
|
||||||
|
//// "asymmetric",
|
||||||
|
//// NULL,
|
||||||
|
//// p,
|
||||||
|
//// plen,
|
||||||
|
//// ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
|
||||||
|
//// KEY_USR_VIEW | KEY_USR_READ),
|
||||||
|
//// KEY_ALLOC_NOT_IN_QUOTA |
|
||||||
|
//// KEY_ALLOC_BUILT_IN |
|
||||||
|
//// KEY_ALLOC_BYPASS_RESTRICTION);
|
||||||
|
//// if (IS_ERR(key)) {
|
||||||
|
//// pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
|
||||||
|
//// PTR_ERR(key));
|
||||||
|
//// } else {
|
||||||
|
//// pr_notice("Loaded X.509 cert '%s'\n",
|
||||||
|
//// key_ref_to_ptr(key)->description);
|
||||||
|
//// key_ref_put(key);
|
||||||
|
//// }
|
||||||
|
//// p += plen;
|
||||||
|
//// }
|
||||||
|
////
|
||||||
|
//// return 0;
|
||||||
|
////
|
||||||
|
////dodgy_cert:
|
||||||
|
//// pr_err("Problem parsing in-kernel X.509 certificate list\n");
|
||||||
|
//// return 0;
|
||||||
|
////}
|
||||||
|
////late_initcall(load_system_certificate_list);
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//
|
||||||
|
//#ifdef CONFIG_SYSTEM_DATA_VERIFICATION
|
||||||
|
//
|
||||||
|
///**
|
||||||
|
// * verify_pkcs7_signature - Verify a PKCS#7-based signature on system data.
|
||||||
|
// * @data: The data to be verified (NULL if expecting internal data).
|
||||||
|
// * @len: Size of @data.
|
||||||
|
// * @raw_pkcs7: The PKCS#7 message that is the signature.
|
||||||
|
// * @pkcs7_len: The size of @raw_pkcs7.
|
||||||
|
// * @trusted_keys: Trusted keys to use (NULL for builtin trusted keys only,
|
||||||
|
// * (void *)1UL for all trusted keys).
|
||||||
|
// * @usage: The use to which the key is being put.
|
||||||
|
// * @view_content: Callback to gain access to content.
|
||||||
|
// * @ctx: Context for callback.
|
||||||
|
// */
|
||||||
|
//int verify_pkcs7_signature(const void *data, size_t len,
|
||||||
|
// const void *raw_pkcs7, size_t pkcs7_len,
|
||||||
|
// struct key *trusted_keys,
|
||||||
|
// enum key_being_used_for usage,
|
||||||
|
// int (*view_content)(void *ctx,
|
||||||
|
// const void *data, size_t len,
|
||||||
|
// size_t asn1hdrlen),
|
||||||
|
// void *ctx)
|
||||||
|
//{
|
||||||
|
// struct pkcs7_message *pkcs7;
|
||||||
|
// int ret;
|
||||||
|
//
|
||||||
|
// pkcs7 = pkcs7_parse_message(raw_pkcs7, pkcs7_len);
|
||||||
|
// if (IS_ERR(pkcs7))
|
||||||
|
// return PTR_ERR(pkcs7);
|
||||||
|
//
|
||||||
|
// /* The data should be detached - so we need to supply it. */
|
||||||
|
// if (data && pkcs7_supply_detached_data(pkcs7, data, len) < 0) {
|
||||||
|
// pr_err("PKCS#7 signature with non-detached data\n");
|
||||||
|
// ret = -EBADMSG;
|
||||||
|
// goto error;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// ret = pkcs7_verify(pkcs7, usage);
|
||||||
|
// if (ret < 0)
|
||||||
|
// goto error;
|
||||||
|
//
|
||||||
|
// if (!trusted_keys) {
|
||||||
|
// trusted_keys = builtin_trusted_keys;
|
||||||
|
// } else if (trusted_keys == VERIFY_USE_SECONDARY_KEYRING) {
|
||||||
|
//#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
|
||||||
|
// trusted_keys = secondary_trusted_keys;
|
||||||
|
//#else
|
||||||
|
// trusted_keys = builtin_trusted_keys;
|
||||||
|
//#endif
|
||||||
|
// } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) {
|
||||||
|
//#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
|
||||||
|
// trusted_keys = platform_trusted_keys;
|
||||||
|
//#else
|
||||||
|
// trusted_keys = NULL;
|
||||||
|
//#endif
|
||||||
|
// if (!trusted_keys) {
|
||||||
|
// ret = -ENOKEY;
|
||||||
|
// pr_devel("PKCS#7 platform keyring is not available\n");
|
||||||
|
// goto error;
|
||||||
|
// }
|
||||||
|
// }
|
||||||
|
// ret = pkcs7_validate_trust(pkcs7, trusted_keys);
|
||||||
|
// if (ret < 0) {
|
||||||
|
// if (ret == -ENOKEY)
|
||||||
|
// pr_devel("PKCS#7 signature not signed with a trusted key\n");
|
||||||
|
// goto error;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// if (view_content) {
|
||||||
|
// size_t asn1hdrlen;
|
||||||
|
//
|
||||||
|
// ret = pkcs7_get_content_data(pkcs7, &data, &len, &asn1hdrlen);
|
||||||
|
// if (ret < 0) {
|
||||||
|
// if (ret == -ENODATA)
|
||||||
|
// pr_devel("PKCS#7 message does not contain data\n");
|
||||||
|
// goto error;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// ret = view_content(ctx, data, len, asn1hdrlen);
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
//error:
|
||||||
|
// pkcs7_free_message(pkcs7);
|
||||||
|
// pr_devel("<==%s() = %d\n", __func__, ret);
|
||||||
|
// return ret;
|
||||||
|
//}
|
||||||
|
//
|
||||||
|
//
|
||||||
|
////EXPORT_SYMBOL_GPL(verify_pkcs7_signature);
|
||||||
|
//
|
||||||
|
//#endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
|
||||||
|
//
|
||||||
|
////#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
|
||||||
|
////void __init set_platform_trusted_keys(struct key *keyring)
|
||||||
|
////{
|
||||||
|
//// platform_trusted_keys = keyring;
|
||||||
|
////}
|
||||||
|
////#endif
|
||||||
@ -0,0 +1,575 @@
|
|||||||
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
||||||
|
/* Parse a signed PE binary
|
||||||
|
*
|
||||||
|
* Copyright (C) 2014 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*/
|
||||||
|
|
||||||
|
//#define pr_fmt(fmt) "PEFILE: "fmt
|
||||||
|
//#include <linux/module.h>
|
||||||
|
//#include <linux/kernel.h>
|
||||||
|
//#include <linux/slab.h>
|
||||||
|
//#include <linux/err.h>
|
||||||
|
//#include <linux/pe.h>
|
||||||
|
//#include <linux/asn1.h>
|
||||||
|
//#include <linux/verification.h>
|
||||||
|
//#include <crypto/hash.h>
|
||||||
|
//#include "verify_pefile.h"
|
||||||
|
|
||||||
|
#include "verify_pefile.h"
|
||||||
|
#include "errno.h"
|
||||||
|
#include "asn1.h"
|
||||||
|
|
||||||
|
#include "config.h"
|
||||||
|
|
||||||
|
#include "pe.h"
|
||||||
|
|
||||||
|
#include "../rewrite/Lib.SoulExtraction.rewrite.h"
|
||||||
|
|
||||||
|
//
|
||||||
|
// macro
|
||||||
|
//
|
||||||
|
|
||||||
|
#define GFP_ATOMIC /*(__GFP_HIGH|__GFP_ATOMIC|__GFP_KSWAPD_RECLAIM)*/ 1
|
||||||
|
#define GFP_KERNEL /*(__GFP_RECLAIM | __GFP_IO | __GFP_FS)*/ 2
|
||||||
|
#define GFP_KERNEL_ACCOUNT /*(GFP_KERNEL | __GFP_ACCOUNT)*/ 3
|
||||||
|
#define GFP_NOWAIT /*(__GFP_KSWAPD_RECLAIM)*/ 4
|
||||||
|
#define GFP_NOIO /*(__GFP_RECLAIM)*/ 5
|
||||||
|
#define GFP_NOFS /*(__GFP_RECLAIM | __GFP_IO)*/ 6
|
||||||
|
#define GFP_USER /*(__GFP_RECLAIM | __GFP_IO | __GFP_FS | __GFP_HARDWALL)*/ 7
|
||||||
|
#define GFP_DMA /*__GFP_DMA*/ 8
|
||||||
|
#define GFP_DMA32 /*__GFP_DMA32*/ 9
|
||||||
|
#define GFP_HIGHUSER /*(GFP_USER | __GFP_HIGHMEM)*/ 10
|
||||||
|
#define GFP_HIGHUSER_MOVABLE /*(GFP_HIGHUSER | __GFP_MOVABLE)*/ 11
|
||||||
|
#define GFP_TRANSHUGE_LIGHT 12
|
||||||
|
#define GFP_TRANSHUGE /*(GFP_TRANSHUGE_LIGHT | __GFP_DIRECT_RECLAIM)*/ 13
|
||||||
|
|
||||||
|
#define ERR_PTR(err) ((void *)((long)(err)))
|
||||||
|
#define PTR_ERR(ptr) ((long)(ptr))
|
||||||
|
#define IS_ERR(ptr) ((unsigned long)(ptr) > (unsigned long)(-1000))
|
||||||
|
|
||||||
|
///*
|
||||||
|
// * This looks more complex than it should be. But we need to
|
||||||
|
// * get the type for the ~ right in round_down (it needs to be
|
||||||
|
// * as wide as the result!), and we want to evaluate the macro
|
||||||
|
// * arguments just once each.
|
||||||
|
// */
|
||||||
|
//#define __round_mask(x, y) ((__typeof__(x))((y)-1))
|
||||||
|
//
|
||||||
|
///**
|
||||||
|
// * round_up - round up to next specified power of 2
|
||||||
|
// * @x: the value to round
|
||||||
|
// * @y: multiple to round up to (must be a power of 2)
|
||||||
|
// *
|
||||||
|
// * Rounds @x up to next multiple of @y (which must be a power of 2).
|
||||||
|
// * To perform arbitrary rounding up, use roundup() below.
|
||||||
|
// */
|
||||||
|
//#define round_up(x, y) ((((x)-1) | __round_mask(x, y))+1)
|
||||||
|
///**
|
||||||
|
//* round_up - round up to next specified power of 2
|
||||||
|
//* @x: the value to round
|
||||||
|
//* @y: multiple to round up to (must be a power of 2)
|
||||||
|
//*
|
||||||
|
//* Rounds @x up to next multiple of @y (which must be a power of 2).
|
||||||
|
//* To perform arbitrary rounding up, use roundup() below.
|
||||||
|
//*/
|
||||||
|
//#define round_up(x, y) ((((x)-1) | __round_mask(x, y))+1)
|
||||||
|
///**
|
||||||
|
//* round_down - round down to next specified power of 2
|
||||||
|
//* @x: the value to round
|
||||||
|
//* @y: multiple to round down to (must be a power of 2)
|
||||||
|
//*
|
||||||
|
//* Rounds @x down to next multiple of @y (which must be a power of 2).
|
||||||
|
//* To perform arbitrary rounding down, use rounddown() below.
|
||||||
|
//*/
|
||||||
|
//#define round_down(x, y) ((x) & ~__round_mask(x, y))
|
||||||
|
|
||||||
|
/* n must be power of 2 */
|
||||||
|
#define round_up(x, n) (((x) + (n)-1u) & ~((n)-1u))
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Parse a PE binary.
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
pefile_parse_binary(const void *pebuf, unsigned int pelen, struct pefile_context *ctx)
|
||||||
|
{
|
||||||
|
const struct mz_hdr *mz = pebuf;
|
||||||
|
const struct pe_hdr *pe;
|
||||||
|
const struct pe32_opt_hdr *pe32;
|
||||||
|
const struct pe32plus_opt_hdr *pe64;
|
||||||
|
const struct data_directory *ddir;
|
||||||
|
const struct data_dirent *dde;
|
||||||
|
const struct section_header *secs, *sec;
|
||||||
|
size_t cursor, datalen = pelen;
|
||||||
|
|
||||||
|
kenter("");
|
||||||
|
|
||||||
|
#define chkaddr(base, x, s) \
|
||||||
|
do \
|
||||||
|
{ \
|
||||||
|
if ((x) < base || (s) >= datalen || (x) > datalen - (s)) \
|
||||||
|
return -ELIBBAD; \
|
||||||
|
} while (0)
|
||||||
|
|
||||||
|
// chkaddr(0, 0, sizeof(*mz));
|
||||||
|
|
||||||
|
if (sizeof(*mz) >= datalen)
|
||||||
|
return -ELIBBAD;
|
||||||
|
|
||||||
|
if (mz->magic != MZ_MAGIC)
|
||||||
|
return -ELIBBAD;
|
||||||
|
cursor = sizeof(*mz);
|
||||||
|
|
||||||
|
chkaddr(cursor, mz->peaddr, sizeof(*pe));
|
||||||
|
pe = (struct pe_hdr *)((unsigned char *)pebuf + mz->peaddr);
|
||||||
|
if (pe->magic != PE_MAGIC)
|
||||||
|
return -ELIBBAD;
|
||||||
|
cursor = mz->peaddr + sizeof(*pe);
|
||||||
|
|
||||||
|
// chkaddr(0, cursor, sizeof(pe32->magic));
|
||||||
|
|
||||||
|
if ((sizeof(pe32->magic)) >= datalen || cursor > datalen - sizeof(pe32->magic))
|
||||||
|
return -ELIBBAD;
|
||||||
|
|
||||||
|
pe32 = (struct pe32_opt_hdr *)((unsigned char *)pebuf + cursor);
|
||||||
|
pe64 = (struct pe32plus_opt_hdr *)((unsigned char *)pebuf + cursor);
|
||||||
|
|
||||||
|
switch (pe32->magic)
|
||||||
|
{
|
||||||
|
case PE_OPT_MAGIC_PE32:
|
||||||
|
// chkaddr(0, cursor, sizeof(*pe32));
|
||||||
|
if ((sizeof(*pe32)) >= datalen || cursor > datalen - sizeof(*pe32))
|
||||||
|
return -ELIBBAD;
|
||||||
|
|
||||||
|
ctx->image_checksum_offset = (unsigned)((unsigned char *)&pe32->csum - (unsigned char *)pebuf);
|
||||||
|
ctx->header_size = pe32->header_size;
|
||||||
|
cursor += sizeof(*pe32);
|
||||||
|
ctx->n_data_dirents = pe32->data_dirs;
|
||||||
|
break;
|
||||||
|
|
||||||
|
case PE_OPT_MAGIC_PE32PLUS:
|
||||||
|
// chkaddr(0, cursor, sizeof(*pe64));
|
||||||
|
if ((sizeof(*pe64)) >= datalen || cursor > datalen - sizeof(*pe64))
|
||||||
|
return -ELIBBAD;
|
||||||
|
ctx->image_checksum_offset = (unsigned)((unsigned char *)&pe64->csum - (unsigned char *)pebuf);
|
||||||
|
ctx->header_size = pe64->header_size;
|
||||||
|
cursor += sizeof(*pe64);
|
||||||
|
ctx->n_data_dirents = pe64->data_dirs;
|
||||||
|
break;
|
||||||
|
|
||||||
|
default:
|
||||||
|
pr_debug("Unknown PEOPT magic = %04hx\n", pe32->magic);
|
||||||
|
return -ELIBBAD;
|
||||||
|
}
|
||||||
|
|
||||||
|
pr_debug("checksum @ %x\n", ctx->image_checksum_offset);
|
||||||
|
pr_debug("header size = %x\n", ctx->header_size);
|
||||||
|
|
||||||
|
if (cursor >= ctx->header_size || ctx->header_size >= datalen)
|
||||||
|
return -ELIBBAD;
|
||||||
|
|
||||||
|
if (ctx->n_data_dirents > (ctx->header_size - cursor) / sizeof(*dde))
|
||||||
|
return -ELIBBAD;
|
||||||
|
|
||||||
|
ddir = (struct data_directory *)((unsigned char *)pebuf + cursor);
|
||||||
|
cursor += sizeof(*dde) * ctx->n_data_dirents;
|
||||||
|
|
||||||
|
ctx->cert_dirent_offset = (unsigned)((unsigned char *)&ddir->certs - (unsigned char *)pebuf);
|
||||||
|
ctx->certs_size = ddir->certs.size;
|
||||||
|
|
||||||
|
if (!ddir->certs.virtual_address || !ddir->certs.size)
|
||||||
|
{
|
||||||
|
pr_debug("Unsigned PE binary\n");
|
||||||
|
return -EKEYREJECTED;
|
||||||
|
}
|
||||||
|
|
||||||
|
chkaddr(ctx->header_size, ddir->certs.virtual_address, ddir->certs.size);
|
||||||
|
ctx->sig_offset = ddir->certs.virtual_address;
|
||||||
|
ctx->sig_len = ddir->certs.size;
|
||||||
|
pr_debug(
|
||||||
|
"cert = %x @%x [%p]\n", ctx->sig_len, ctx->sig_offset, ctx->sig_len, (unsigned char *)pebuf + ctx->sig_offset);
|
||||||
|
|
||||||
|
ctx->n_sections = pe->sections;
|
||||||
|
if (ctx->n_sections > (ctx->header_size - cursor) / sizeof(*sec))
|
||||||
|
return -ELIBBAD;
|
||||||
|
ctx->secs = secs = (struct section_header *)((unsigned char *)pebuf + cursor);
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Check and strip the PE wrapper from around the signature and check that the
|
||||||
|
* remnant looks something like PKCS#7.
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
pefile_strip_sig_wrapper(const void *pebuf, struct pefile_context *ctx)
|
||||||
|
{
|
||||||
|
struct win_certificate wrapper;
|
||||||
|
const unsigned char *pkcs7;
|
||||||
|
unsigned len;
|
||||||
|
unsigned char pkcs7_1;
|
||||||
|
|
||||||
|
if (ctx->sig_len < sizeof(wrapper))
|
||||||
|
{
|
||||||
|
pr_debug("Signature wrapper too short\n");
|
||||||
|
return -ELIBBAD;
|
||||||
|
}
|
||||||
|
|
||||||
|
memcpy(&wrapper, (void *)((unsigned char *)pebuf + ctx->sig_offset), sizeof(wrapper));
|
||||||
|
pr_debug("sig wrapper = { %x, %x, %x }\n", wrapper.length, wrapper.revision, wrapper.cert_type);
|
||||||
|
|
||||||
|
/* Both pesign and sbsign round up the length of certificate table
|
||||||
|
* (in optional header data directories) to 8 byte alignment.
|
||||||
|
*/
|
||||||
|
if (round_up(wrapper.length, 8) != ctx->sig_len)
|
||||||
|
{
|
||||||
|
pr_debug("Signature wrapper len wrong\n");
|
||||||
|
return -ELIBBAD;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (wrapper.revision != WIN_CERT_REVISION_2_0)
|
||||||
|
{
|
||||||
|
pr_debug("Signature is not revision 2.0\n");
|
||||||
|
return -ENOTSUPP;
|
||||||
|
}
|
||||||
|
if (wrapper.cert_type != WIN_CERT_TYPE_PKCS_SIGNED_DATA)
|
||||||
|
{
|
||||||
|
pr_debug("Signature certificate type is not PKCS\n");
|
||||||
|
return -ENOTSUPP;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* It looks like the pkcs signature length in wrapper->length and the
|
||||||
|
* size obtained from the data dir entries, which lists the total size
|
||||||
|
* of certificate table, are both aligned to an octaword boundary, so
|
||||||
|
* we may have to deal with some padding.
|
||||||
|
*/
|
||||||
|
ctx->sig_len = wrapper.length;
|
||||||
|
ctx->sig_offset += sizeof(wrapper);
|
||||||
|
ctx->sig_len -= sizeof(wrapper);
|
||||||
|
if (ctx->sig_len < 4)
|
||||||
|
{
|
||||||
|
pr_debug("Signature data missing\n");
|
||||||
|
return -EKEYREJECTED;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* What's left should be a PKCS#7 cert */
|
||||||
|
pkcs7 = (unsigned char *)((unsigned char *)pebuf + ctx->sig_offset);
|
||||||
|
if (pkcs7[0] != (ASN1_CONS_BIT | ASN1_SEQ))
|
||||||
|
goto not_pkcs7;
|
||||||
|
|
||||||
|
pkcs7_1 = pkcs7[1];
|
||||||
|
if (pkcs7_1 >= 0 && pkcs7_1 <= 0x7f)
|
||||||
|
{
|
||||||
|
len = pkcs7[1] + 2;
|
||||||
|
goto check_len;
|
||||||
|
}
|
||||||
|
else if (pkcs7_1 == ASN1_INDEFINITE_LENGTH)
|
||||||
|
{
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
else if (pkcs7_1 == 0x81)
|
||||||
|
{
|
||||||
|
len = pkcs7[2] + 3;
|
||||||
|
goto check_len;
|
||||||
|
}
|
||||||
|
else if (pkcs7_1 == 0x82)
|
||||||
|
{
|
||||||
|
len = ((pkcs7[2] << 8) | pkcs7[3]) + 4;
|
||||||
|
goto check_len;
|
||||||
|
}
|
||||||
|
else if (pkcs7_1 >= 0x83 && pkcs7_1 <= 0xff)
|
||||||
|
{
|
||||||
|
return -EMSGSIZE;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
goto not_pkcs7;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*switch (pkcs7[1]) {
|
||||||
|
case 0 ... 0x7f:
|
||||||
|
len = pkcs7[1] + 2;
|
||||||
|
goto check_len;
|
||||||
|
case ASN1_INDEFINITE_LENGTH:
|
||||||
|
return 0;
|
||||||
|
case 0x81:
|
||||||
|
len = pkcs7[2] + 3;
|
||||||
|
goto check_len;
|
||||||
|
case 0x82:
|
||||||
|
len = ((pkcs7[2] << 8) | pkcs7[3]) + 4;
|
||||||
|
goto check_len;
|
||||||
|
case 0x83 ... 0xff:
|
||||||
|
return -EMSGSIZE;
|
||||||
|
default:
|
||||||
|
goto not_pkcs7;
|
||||||
|
}*/
|
||||||
|
|
||||||
|
check_len:
|
||||||
|
if (len <= ctx->sig_len)
|
||||||
|
{
|
||||||
|
/* There may be padding */
|
||||||
|
ctx->sig_len = len;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
not_pkcs7:
|
||||||
|
pr_debug("Signature data not PKCS#7\n");
|
||||||
|
return -ELIBBAD;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Compare two sections for canonicalisation.
|
||||||
|
*/
|
||||||
|
// static int pefile_compare_shdrs(const void *a, const void *b)
|
||||||
|
//{
|
||||||
|
// const struct section_header *shdra = a;
|
||||||
|
// const struct section_header *shdrb = b;
|
||||||
|
// int rc;
|
||||||
|
//
|
||||||
|
// if (shdra->data_addr > shdrb->data_addr)
|
||||||
|
// return 1;
|
||||||
|
// if (shdrb->data_addr > shdra->data_addr)
|
||||||
|
// return -1;
|
||||||
|
//
|
||||||
|
// if (shdra->virtual_address > shdrb->virtual_address)
|
||||||
|
// return 1;
|
||||||
|
// if (shdrb->virtual_address > shdra->virtual_address)
|
||||||
|
// return -1;
|
||||||
|
//
|
||||||
|
// rc = strcmp(shdra->name, shdrb->name);
|
||||||
|
// if (rc != 0)
|
||||||
|
// return rc;
|
||||||
|
//
|
||||||
|
// if (shdra->virtual_size > shdrb->virtual_size)
|
||||||
|
// return 1;
|
||||||
|
// if (shdrb->virtual_size > shdra->virtual_size)
|
||||||
|
// return -1;
|
||||||
|
//
|
||||||
|
// if (shdra->raw_data_size > shdrb->raw_data_size)
|
||||||
|
// return 1;
|
||||||
|
// if (shdrb->raw_data_size > shdra->raw_data_size)
|
||||||
|
// return -1;
|
||||||
|
//
|
||||||
|
// return 0;
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Load the contents of the PE binary into the digest, leaving out the image
|
||||||
|
* checksum and the certificate data block.
|
||||||
|
*/
|
||||||
|
// static int pefile_digest_pe_contents(const void *pebuf, unsigned int pelen,
|
||||||
|
// struct pefile_context *ctx,
|
||||||
|
// struct shash_desc *desc)
|
||||||
|
//{
|
||||||
|
// unsigned *canon, tmp, loop, i, hashed_bytes;
|
||||||
|
// int ret;
|
||||||
|
//
|
||||||
|
// /* Digest the header and data directory, but leave out the image
|
||||||
|
// * checksum and the data dirent for the signature.
|
||||||
|
// */
|
||||||
|
// ret = crypto_shash_update(desc, pebuf, ctx->image_checksum_offset);
|
||||||
|
// if (ret < 0)
|
||||||
|
// return ret;
|
||||||
|
//
|
||||||
|
// tmp = ctx->image_checksum_offset + sizeof(uint32_t);
|
||||||
|
// ret = crypto_shash_update(desc, pebuf + tmp,
|
||||||
|
// ctx->cert_dirent_offset - tmp);
|
||||||
|
// if (ret < 0)
|
||||||
|
// return ret;
|
||||||
|
//
|
||||||
|
// tmp = ctx->cert_dirent_offset + sizeof(struct data_dirent);
|
||||||
|
// ret = crypto_shash_update(desc, pebuf + tmp, ctx->header_size - tmp);
|
||||||
|
// if (ret < 0)
|
||||||
|
// return ret;
|
||||||
|
//
|
||||||
|
// canon = kcalloc(ctx->n_sections, sizeof(unsigned), GFP_KERNEL);
|
||||||
|
// if (!canon)
|
||||||
|
// return -ENOMEM;
|
||||||
|
//
|
||||||
|
// /* We have to canonicalise the section table, so we perform an
|
||||||
|
// * insertion sort.
|
||||||
|
// */
|
||||||
|
// canon[0] = 0;
|
||||||
|
// for (loop = 1; loop < ctx->n_sections; loop++) {
|
||||||
|
// for (i = 0; i < loop; i++) {
|
||||||
|
// if (pefile_compare_shdrs(&ctx->secs[canon[i]],
|
||||||
|
// &ctx->secs[loop]) > 0) {
|
||||||
|
// memmove(&canon[i + 1], &canon[i],
|
||||||
|
// (loop - i) * sizeof(canon[0]));
|
||||||
|
// break;
|
||||||
|
// }
|
||||||
|
// }
|
||||||
|
// canon[i] = loop;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// hashed_bytes = ctx->header_size;
|
||||||
|
// for (loop = 0; loop < ctx->n_sections; loop++) {
|
||||||
|
// i = canon[loop];
|
||||||
|
// if (ctx->secs[i].raw_data_size == 0)
|
||||||
|
// continue;
|
||||||
|
// ret = crypto_shash_update(desc,
|
||||||
|
// pebuf + ctx->secs[i].data_addr,
|
||||||
|
// ctx->secs[i].raw_data_size);
|
||||||
|
// if (ret < 0) {
|
||||||
|
// kfree(canon);
|
||||||
|
// return ret;
|
||||||
|
// }
|
||||||
|
// hashed_bytes += ctx->secs[i].raw_data_size;
|
||||||
|
// }
|
||||||
|
// kfree(canon);
|
||||||
|
//
|
||||||
|
// if (pelen > hashed_bytes) {
|
||||||
|
// tmp = hashed_bytes + ctx->certs_size;
|
||||||
|
// ret = crypto_shash_update(desc,
|
||||||
|
// pebuf + hashed_bytes,
|
||||||
|
// pelen - tmp);
|
||||||
|
// if (ret < 0)
|
||||||
|
// return ret;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// return 0;
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Digest the contents of the PE binary, leaving out the image checksum and the
|
||||||
|
* certificate data block.
|
||||||
|
*/
|
||||||
|
// static int pefile_digest_pe(const void *pebuf, unsigned int pelen,
|
||||||
|
// struct pefile_context *ctx)
|
||||||
|
//{
|
||||||
|
// struct crypto_shash *tfm;
|
||||||
|
// struct shash_desc *desc;
|
||||||
|
// size_t digest_size, desc_size;
|
||||||
|
// void *digest;
|
||||||
|
// int ret;
|
||||||
|
//
|
||||||
|
// kenter(",%s", ctx->digest_algo);
|
||||||
|
//
|
||||||
|
// /* Allocate the hashing algorithm we're going to need and find out how
|
||||||
|
// * big the hash operational data will be.
|
||||||
|
// */
|
||||||
|
// tfm = crypto_alloc_shash(ctx->digest_algo, 0, 0);
|
||||||
|
// if (IS_ERR(tfm))
|
||||||
|
// return (PTR_ERR(tfm) == -ENOENT) ? -ENOPKG : PTR_ERR(tfm);
|
||||||
|
//
|
||||||
|
// desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
|
||||||
|
// digest_size = crypto_shash_digestsize(tfm);
|
||||||
|
//
|
||||||
|
// if (digest_size != ctx->digest_len) {
|
||||||
|
// pr_debug("Digest size mismatch (%zx != %x)\n",
|
||||||
|
// digest_size, ctx->digest_len);
|
||||||
|
// ret = -EBADMSG;
|
||||||
|
// goto error_no_desc;
|
||||||
|
// }
|
||||||
|
// pr_debug("Digest: desc=%zu size=%zu\n", desc_size, digest_size);
|
||||||
|
//
|
||||||
|
// ret = -ENOMEM;
|
||||||
|
// desc = kzalloc(desc_size + digest_size, GFP_KERNEL);
|
||||||
|
// if (!desc)
|
||||||
|
// goto error_no_desc;
|
||||||
|
//
|
||||||
|
// desc->tfm = tfm;
|
||||||
|
// ret = crypto_shash_init(desc);
|
||||||
|
// if (ret < 0)
|
||||||
|
// goto error;
|
||||||
|
//
|
||||||
|
// ret = pefile_digest_pe_contents(pebuf, pelen, ctx, desc);
|
||||||
|
// if (ret < 0)
|
||||||
|
// goto error;
|
||||||
|
//
|
||||||
|
// digest = (void *)desc + desc_size;
|
||||||
|
// ret = crypto_shash_final(desc, digest);
|
||||||
|
// if (ret < 0)
|
||||||
|
// goto error;
|
||||||
|
//
|
||||||
|
// pr_debug("Digest calc = [%*ph]\n", ctx->digest_len, digest);
|
||||||
|
//
|
||||||
|
// /* Check that the PE file digest matches that in the MSCODE part of the
|
||||||
|
// * PKCS#7 certificate.
|
||||||
|
// */
|
||||||
|
// if (memcmp(digest, ctx->digest, ctx->digest_len) != 0) {
|
||||||
|
// pr_debug("Digest mismatch\n");
|
||||||
|
// ret = -EKEYREJECTED;
|
||||||
|
// } else {
|
||||||
|
// pr_debug("The digests match!\n");
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// error:
|
||||||
|
// kzfree(desc);
|
||||||
|
// error_no_desc:
|
||||||
|
// crypto_free_shash(tfm);
|
||||||
|
// kleave(" = %d", ret);
|
||||||
|
// return ret;
|
||||||
|
// }
|
||||||
|
|
||||||
|
/**
|
||||||
|
* verify_pefile_signature - Verify the signature on a PE binary image
|
||||||
|
* @pebuf: Buffer containing the PE binary image
|
||||||
|
* @pelen: Length of the binary image
|
||||||
|
* @trust_keys: Signing certificate(s) to use as starting points
|
||||||
|
* @usage: The use to which the key is being put.
|
||||||
|
*
|
||||||
|
* Validate that the certificate chain inside the PKCS#7 message inside the PE
|
||||||
|
* binary image intersects keys we already know and trust.
|
||||||
|
*
|
||||||
|
* Returns, in order of descending priority:
|
||||||
|
*
|
||||||
|
* (*) -ELIBBAD if the image cannot be parsed, or:
|
||||||
|
*
|
||||||
|
* (*) -EKEYREJECTED if a signature failed to match for which we have a valid
|
||||||
|
* key, or:
|
||||||
|
*
|
||||||
|
* (*) 0 if at least one signature chain intersects with the keys in the trust
|
||||||
|
* keyring, or:
|
||||||
|
*
|
||||||
|
* (*) -ENOPKG if a suitable crypto module couldn't be found for a check on a
|
||||||
|
* chain.
|
||||||
|
*
|
||||||
|
* (*) -ENOKEY if we couldn't find a match for any of the signature chains in
|
||||||
|
* the message.
|
||||||
|
*
|
||||||
|
* May also return -ENOMEM.
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
verify_pefile_signature(const void *pebuf, unsigned pelen, struct key *trusted_keys, enum key_being_used_for usage)
|
||||||
|
{
|
||||||
|
struct pefile_context ctx;
|
||||||
|
int ret;
|
||||||
|
|
||||||
|
kenter("");
|
||||||
|
|
||||||
|
memset(&ctx, 0, sizeof(ctx));
|
||||||
|
ret = pefile_parse_binary(pebuf, pelen, &ctx);
|
||||||
|
if (ret < 0)
|
||||||
|
return ret;
|
||||||
|
|
||||||
|
ret = pefile_strip_sig_wrapper(pebuf, &ctx);
|
||||||
|
if (ret < 0)
|
||||||
|
return ret;
|
||||||
|
|
||||||
|
// we dont need this (gmh said)
|
||||||
|
/*ret = verify_pkcs7_signature(NULL, 0,
|
||||||
|
pebuf + ctx.sig_offset, ctx.sig_len,
|
||||||
|
trusted_keys, usage,
|
||||||
|
mscode_parse, &ctx);
|
||||||
|
if (ret < 0)
|
||||||
|
goto error;
|
||||||
|
|
||||||
|
pr_debug("Digest: %u [%*ph]\n",
|
||||||
|
ctx.digest_len, ctx.digest_len, ctx.digest);
|
||||||
|
*/
|
||||||
|
|
||||||
|
/* Generate the digest and check against the PKCS7 certificate
|
||||||
|
* contents.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// we dont need this (gmh said)
|
||||||
|
// ret = pefile_digest_pe(pebuf, pelen, &ctx);
|
||||||
|
|
||||||
|
// error:
|
||||||
|
if (ctx.digest)
|
||||||
|
{
|
||||||
|
kzfree(ctx.digest);
|
||||||
|
}
|
||||||
|
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
@ -0,0 +1,73 @@
|
|||||||
|
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
||||||
|
/* PE Binary parser bits
|
||||||
|
*
|
||||||
|
* Copyright (C) 2014 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*/
|
||||||
|
|
||||||
|
//#include <crypto/pkcs7.h>
|
||||||
|
//#include <crypto/hash_info.h>
|
||||||
|
|
||||||
|
#pragma once
|
||||||
|
|
||||||
|
#include <fltKernel.h>
|
||||||
|
|
||||||
|
#include "pkcs7.h"
|
||||||
|
|
||||||
|
//#include "pe.h"
|
||||||
|
|
||||||
|
struct section_header_x
|
||||||
|
{
|
||||||
|
char name[8]; /* name or "/12\0" string tbl offset */
|
||||||
|
unsigned long virtual_size; /* size of loaded section in ram */
|
||||||
|
unsigned long virtual_address; /* relative virtual address */
|
||||||
|
unsigned long raw_data_size; /* size of the section */
|
||||||
|
unsigned long data_addr; /* file pointer to first page of sec */
|
||||||
|
unsigned long relocs; /* file pointer to relocation entries */
|
||||||
|
unsigned long line_numbers; /* line numbers! */
|
||||||
|
unsigned long num_relocs; /* number of relocations */
|
||||||
|
unsigned long num_lin_numbers; /* srsly. */
|
||||||
|
unsigned long flags;
|
||||||
|
};
|
||||||
|
|
||||||
|
struct pefile_context
|
||||||
|
{
|
||||||
|
unsigned header_size;
|
||||||
|
unsigned image_checksum_offset;
|
||||||
|
unsigned cert_dirent_offset;
|
||||||
|
unsigned n_data_dirents;
|
||||||
|
unsigned n_sections;
|
||||||
|
unsigned certs_size;
|
||||||
|
unsigned sig_offset;
|
||||||
|
unsigned sig_len;
|
||||||
|
const struct section_header_x *secs;
|
||||||
|
|
||||||
|
/* PKCS#7 MS Individual Code Signing content */
|
||||||
|
const void *digest; /* Digest */
|
||||||
|
unsigned digest_len; /* Digest length */
|
||||||
|
const char *digest_algo; /* Digest algorithm */
|
||||||
|
};
|
||||||
|
|
||||||
|
//#define kenter(FMT, ...) \
|
||||||
|
// pr_devel("==> %s("FMT")\n", __func__, ##__VA_ARGS__)
|
||||||
|
//#define kleave(FMT, ...) \
|
||||||
|
// pr_devel("<== %s()"FMT"\n", __func__, ##__VA_ARGS__)
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Parse a PE binary.
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
pefile_parse_binary(const void *pebuf, unsigned int pelen, struct pefile_context *ctx);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Check and strip the PE wrapper from around the signature and check that the
|
||||||
|
* remnant looks something like PKCS#7.
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
pefile_strip_sig_wrapper(const void *pebuf, struct pefile_context *ctx);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* mscode_parser.c
|
||||||
|
*/
|
||||||
|
extern int
|
||||||
|
mscode_parse(void *_ctx, const void *content_data, size_t data_len, size_t asn1hdrlen);
|
||||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,114 @@
|
|||||||
|
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
||||||
|
/* X.509 certificate parser internal definitions
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*/
|
||||||
|
|
||||||
|
#pragma once
|
||||||
|
|
||||||
|
#include "public_key.h"
|
||||||
|
|
||||||
|
struct x509_certificate
|
||||||
|
{
|
||||||
|
struct x509_certificate *next;
|
||||||
|
struct x509_certificate *signer; /* Certificate that signed this one */
|
||||||
|
struct public_key *pub; /* Public key details */
|
||||||
|
struct public_key_signature *sig; /* Signature parameters */
|
||||||
|
char *issuer; /* Name of certificate issuer */
|
||||||
|
unsigned long issuer_tag; // Fix to 4 bytes by gmh
|
||||||
|
char *subject; /* Name of certificate subject */
|
||||||
|
unsigned long subject_tag; // Fix to 4 bytes by gmh
|
||||||
|
|
||||||
|
struct asymmetric_key_id *id; /* Issuer + Serial number */
|
||||||
|
struct asymmetric_key_id *skid; /* Subject + subjectKeyId (optional) */
|
||||||
|
/*time64_t*/ long long valid_from;
|
||||||
|
unsigned long valid_from_year;
|
||||||
|
unsigned long valid_from_mon;
|
||||||
|
unsigned long valid_from_day;
|
||||||
|
unsigned long valid_from_hour;
|
||||||
|
unsigned long valid_from_min;
|
||||||
|
|
||||||
|
/*time64_t*/ long long valid_to;
|
||||||
|
unsigned long valid_to_year;
|
||||||
|
unsigned long valid_to_mon;
|
||||||
|
unsigned long valid_to_day;
|
||||||
|
unsigned long valid_to_hour;
|
||||||
|
unsigned long valid_to_min;
|
||||||
|
|
||||||
|
/*time64_t*/ long long sign_time;
|
||||||
|
unsigned long sign_time_year;
|
||||||
|
unsigned long sign_time_mon;
|
||||||
|
unsigned long sign_time_day;
|
||||||
|
unsigned long sign_time_hour;
|
||||||
|
unsigned long sign_time_min;
|
||||||
|
|
||||||
|
const void *tbs; /* Signed data */
|
||||||
|
unsigned tbs_size; /* Size of signed data */
|
||||||
|
unsigned raw_sig_size; /* Size of sigature */
|
||||||
|
const void *raw_sig; /* Signature data */
|
||||||
|
const void *raw_serial; /* Raw serial number in ASN.1 */
|
||||||
|
unsigned raw_serial_size;
|
||||||
|
unsigned raw_issuer_size;
|
||||||
|
const void *raw_issuer; /* Raw issuer name in ASN.1 */
|
||||||
|
const void *raw_subject; /* Raw subject name in ASN.1 */
|
||||||
|
unsigned raw_subject_size;
|
||||||
|
unsigned raw_akid_size; // Fix to 4 bytes by gmh
|
||||||
|
unsigned raw_skid_size;
|
||||||
|
const void *raw_skid; /* Raw subjectKeyId in ASN.1 */
|
||||||
|
unsigned index;
|
||||||
|
unsigned char /*BOOLEAN*/ seen; /* Infinite recursion prevention */
|
||||||
|
unsigned char /*BOOLEAN*/ verified;
|
||||||
|
unsigned char /*BOOLEAN*/ self_signed; /* T if self-signed (check unsupported_sig too) */
|
||||||
|
unsigned char /*BOOLEAN*/ unsupported_key; /* T if key uses unsupported crypto */
|
||||||
|
unsigned char /*BOOLEAN*/ unsupported_sig; /* T if signature uses unsupported crypto */
|
||||||
|
unsigned char /*BOOLEAN*/ blacklisted;
|
||||||
|
};
|
||||||
|
|
||||||
|
struct x509_parse_context
|
||||||
|
{
|
||||||
|
struct x509_certificate *cert; /* Certificate being constructed */
|
||||||
|
/*unsigned long*/ void *data; /* Start of data */ // Fix to void* by gmh
|
||||||
|
const void *cert_start; /* Start of cert content */
|
||||||
|
const void *key; /* Key data */
|
||||||
|
size_t key_size; /* Size of key data */
|
||||||
|
enum OID last_oid; /* Last OID encountered */
|
||||||
|
enum OID algo_oid; /* Algorithm OID */
|
||||||
|
unsigned char nr_mpi; /* Number of MPIs stored */
|
||||||
|
/*u8*/ unsigned char o_size; /* Size of organizationName (O) */
|
||||||
|
/*u8*/ unsigned char cn_size; /* Size of commonName (CN) */
|
||||||
|
/*u8*/ unsigned char email_size; /* Size of emailAddress */
|
||||||
|
/*u16*/ unsigned short o_offset; /* Offset of organizationName (O) */
|
||||||
|
/*u16*/ unsigned short cn_offset; /* Offset of commonName (CN) */
|
||||||
|
/*u16*/ unsigned short email_offset; /* Offset of emailAddress */
|
||||||
|
unsigned raw_akid_size;
|
||||||
|
const void *raw_akid; /* Raw authorityKeyId in ASN.1 */
|
||||||
|
const void *akid_raw_issuer; /* Raw directoryName in authorityKeyId */
|
||||||
|
unsigned akid_raw_issuer_size;
|
||||||
|
};
|
||||||
|
|
||||||
|
/*
|
||||||
|
* x509_cert_parser.c
|
||||||
|
*/
|
||||||
|
extern void
|
||||||
|
x509_free_certificate(struct x509_certificate *cert);
|
||||||
|
extern struct x509_certificate *
|
||||||
|
x509_cert_parse(const void *data, size_t datalen);
|
||||||
|
extern int
|
||||||
|
x509_decode_time(
|
||||||
|
struct x509_certificate *cert,
|
||||||
|
unsigned char isfrom,
|
||||||
|
unsigned char issign,
|
||||||
|
/*time64_t*/ long long *_t,
|
||||||
|
size_t hdrlen,
|
||||||
|
unsigned char tag,
|
||||||
|
const unsigned char *value,
|
||||||
|
size_t vlen);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* x509_public_key.c
|
||||||
|
*/
|
||||||
|
extern int
|
||||||
|
x509_get_sig_params(struct x509_certificate *cert);
|
||||||
|
extern int
|
||||||
|
x509_check_for_self_signed(struct x509_certificate *cert);
|
||||||
@ -0,0 +1,304 @@
|
|||||||
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
||||||
|
/* Instantiate a public key crypto key from an X.509 Certificate
|
||||||
|
*
|
||||||
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
||||||
|
* Written by David Howells (dhowells@redhat.com)
|
||||||
|
*/
|
||||||
|
|
||||||
|
//#define pr_fmt(fmt) "X.509: "fmt
|
||||||
|
//#include <linux/module.h>
|
||||||
|
//#include <linux/kernel.h>
|
||||||
|
//#include <linux/slab.h>
|
||||||
|
//#include <keys/asymmetric-subtype.h>
|
||||||
|
//#include <keys/asymmetric-parser.h>
|
||||||
|
//#include <keys/system_keyring.h>
|
||||||
|
//#include <crypto/hash.h>
|
||||||
|
//#include "asymmetric_keys.h"
|
||||||
|
//#include "x509_parser.h"
|
||||||
|
|
||||||
|
#include "x509_parser.h"
|
||||||
|
#include "errno.h"
|
||||||
|
#include "config.h"
|
||||||
|
|
||||||
|
#include "../rewrite/Lib.SoulExtraction.rewrite.h"
|
||||||
|
|
||||||
|
//
|
||||||
|
// macro
|
||||||
|
//
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Set up the signature parameters in an X.509 certificate. This involves
|
||||||
|
* digesting the signed data and extracting the signature.
|
||||||
|
*/
|
||||||
|
// int x509_get_sig_params(struct x509_certificate *cert)
|
||||||
|
//{
|
||||||
|
// struct public_key_signature *sig = cert->sig;
|
||||||
|
// struct crypto_shash *tfm;
|
||||||
|
// struct shash_desc *desc;
|
||||||
|
// size_t desc_size;
|
||||||
|
// int ret;
|
||||||
|
//
|
||||||
|
// pr_devel("==>%s()\n", __func__);
|
||||||
|
//
|
||||||
|
// if (!cert->pub->pkey_algo)
|
||||||
|
// cert->unsupported_key = true;
|
||||||
|
//
|
||||||
|
// if (!sig->pkey_algo)
|
||||||
|
// cert->unsupported_sig = true;
|
||||||
|
//
|
||||||
|
// /* We check the hash if we can - even if we can't then verify it */
|
||||||
|
// if (!sig->hash_algo) {
|
||||||
|
// cert->unsupported_sig = true;
|
||||||
|
// return 0;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// sig->s = kmemdup(cert->raw_sig, cert->raw_sig_size, GFP_KERNEL);
|
||||||
|
// if (!sig->s)
|
||||||
|
// return -ENOMEM;
|
||||||
|
//
|
||||||
|
// sig->s_size = cert->raw_sig_size;
|
||||||
|
//
|
||||||
|
// /* Allocate the hashing algorithm we're going to need and find out how
|
||||||
|
// * big the hash operational data will be.
|
||||||
|
// */
|
||||||
|
// tfm = crypto_alloc_shash(sig->hash_algo, 0, 0);
|
||||||
|
// if (IS_ERR(tfm)) {
|
||||||
|
// if (PTR_ERR(tfm) == -ENOENT) {
|
||||||
|
// cert->unsupported_sig = true;
|
||||||
|
// return 0;
|
||||||
|
// }
|
||||||
|
// return PTR_ERR(tfm);
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
|
||||||
|
// sig->digest_size = crypto_shash_digestsize(tfm);
|
||||||
|
//
|
||||||
|
// ret = -ENOMEM;
|
||||||
|
// sig->digest = kmalloc(sig->digest_size, GFP_KERNEL);
|
||||||
|
// if (!sig->digest)
|
||||||
|
// goto error;
|
||||||
|
//
|
||||||
|
// desc = kzalloc(desc_size, GFP_KERNEL);
|
||||||
|
// if (!desc)
|
||||||
|
// goto error;
|
||||||
|
//
|
||||||
|
// desc->tfm = tfm;
|
||||||
|
//
|
||||||
|
// ret = crypto_shash_digest(desc, cert->tbs, cert->tbs_size, sig->digest);
|
||||||
|
// if (ret < 0)
|
||||||
|
// goto error_2;
|
||||||
|
//
|
||||||
|
// ret = is_hash_blacklisted(sig->digest, sig->digest_size, "tbs");
|
||||||
|
// if (ret == -EKEYREJECTED) {
|
||||||
|
// pr_err("Cert %p is blacklisted\n",
|
||||||
|
// sig->digest_size, sig->digest);
|
||||||
|
// cert->blacklisted = true;
|
||||||
|
// ret = 0;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// error_2:
|
||||||
|
// kfree(desc);
|
||||||
|
// error:
|
||||||
|
// crypto_free_shash(tfm);
|
||||||
|
// pr_devel("<==%s() = %d\n", __func__, ret);
|
||||||
|
// return ret;
|
||||||
|
// }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Check for self-signedness in an X.509 cert and if found, check the signature
|
||||||
|
* immediately if we can.
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
x509_check_for_self_signed(struct x509_certificate *cert)
|
||||||
|
{
|
||||||
|
int ret = 0;
|
||||||
|
|
||||||
|
pr_devel("==>%s()\n", __func__);
|
||||||
|
|
||||||
|
pr_devel("raw_subject_size=%d,raw_issuer_size=%d\n", cert->raw_subject_size, cert->raw_issuer_size);
|
||||||
|
|
||||||
|
/*if (cert->raw_subject_size != cert->raw_issuer_size ||
|
||||||
|
memcmp(cert->raw_subject, cert->raw_issuer,
|
||||||
|
cert->raw_issuer_size) != 0)
|
||||||
|
{
|
||||||
|
|
||||||
|
goto not_self_signed;
|
||||||
|
}*/
|
||||||
|
|
||||||
|
if (cert->sig->auth_ids[0] || cert->sig->auth_ids[1])
|
||||||
|
{
|
||||||
|
/* If the AKID is present it may have one or two parts. If
|
||||||
|
* both are supplied, both must match.
|
||||||
|
*/
|
||||||
|
unsigned char a = asymmetric_key_id_same(cert->skid, cert->sig->auth_ids[1]);
|
||||||
|
unsigned char b = asymmetric_key_id_same(cert->id, cert->sig->auth_ids[0]);
|
||||||
|
|
||||||
|
pr_devel(
|
||||||
|
"skid=%p,auth_ids[1]=%p,id=%p,auth_ids[0]=%p,a=%d,b=%d\n",
|
||||||
|
cert->skid,
|
||||||
|
cert->sig->auth_ids[1],
|
||||||
|
cert->id,
|
||||||
|
cert->sig->auth_ids[0],
|
||||||
|
a,
|
||||||
|
b);
|
||||||
|
|
||||||
|
if (!a && !b)
|
||||||
|
{
|
||||||
|
pr_devel("232323232323\n");
|
||||||
|
goto not_self_signed;
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = -EKEYREJECTED;
|
||||||
|
if (((a && !b) || (b && !a)) && cert->sig->auth_ids[0] && cert->sig->auth_ids[1])
|
||||||
|
{
|
||||||
|
pr_devel("3.3333\n");
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = -EKEYREJECTED;
|
||||||
|
if (strcmp(cert->pub->pkey_algo, cert->sig->pkey_algo) != 0)
|
||||||
|
{
|
||||||
|
pr_devel("3.444\n");
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*ret = public_key_verify_signature(cert->pub, cert->sig);
|
||||||
|
if (ret < 0) {
|
||||||
|
if (ret == -ENOPKG) {
|
||||||
|
cert->unsupported_sig = TRUE;
|
||||||
|
ret = 0;
|
||||||
|
}
|
||||||
|
goto out;
|
||||||
|
}*/
|
||||||
|
|
||||||
|
pr_devel("Cert Self-signature verified");
|
||||||
|
cert->self_signed = TRUE;
|
||||||
|
|
||||||
|
out:
|
||||||
|
pr_devel("<==%s() = %d\n", __func__, ret);
|
||||||
|
return ret;
|
||||||
|
|
||||||
|
not_self_signed:
|
||||||
|
pr_devel("<==%s() = 0 [not]\n", __func__);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Attempt to parse a data blob for a key as an X509 certificate.
|
||||||
|
*/
|
||||||
|
// static int x509_key_preparse(struct key_preparsed_payload *prep)
|
||||||
|
//{
|
||||||
|
// struct asymmetric_key_ids *kids;
|
||||||
|
// struct x509_certificate *cert;
|
||||||
|
// const char *q;
|
||||||
|
// size_t srlen, sulen;
|
||||||
|
// char *desc = NULL, *p;
|
||||||
|
// int ret;
|
||||||
|
//
|
||||||
|
// cert = x509_cert_parse(prep->data, prep->datalen);
|
||||||
|
// if (IS_ERR(cert))
|
||||||
|
// return PTR_ERR(cert);
|
||||||
|
//
|
||||||
|
// pr_devel("Cert Issuer: %s\n", cert->issuer);
|
||||||
|
// pr_devel("Cert Subject: %s\n", cert->subject);
|
||||||
|
//
|
||||||
|
// if (cert->unsupported_key) {
|
||||||
|
// ret = -ENOPKG;
|
||||||
|
// goto error_free_cert;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// pr_devel("Cert Key Algo: %s\n", cert->pub->pkey_algo);
|
||||||
|
// pr_devel("Cert Valid period: %lld-%lld\n", cert->valid_from, cert->valid_to);
|
||||||
|
//
|
||||||
|
// cert->pub->id_type = "X509";
|
||||||
|
//
|
||||||
|
// if (cert->unsupported_sig) {
|
||||||
|
// public_key_signature_free(cert->sig);
|
||||||
|
// cert->sig = NULL;
|
||||||
|
// } else {
|
||||||
|
// pr_devel("Cert Signature: %s + %s\n",
|
||||||
|
// cert->sig->pkey_algo, cert->sig->hash_algo);
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// /* Don't permit addition of blacklisted keys */
|
||||||
|
// ret = -EKEYREJECTED;
|
||||||
|
// if (cert->blacklisted)
|
||||||
|
// goto error_free_cert;
|
||||||
|
//
|
||||||
|
// /* Propose a description */
|
||||||
|
// sulen = strlen(cert->subject);
|
||||||
|
// if (cert->raw_skid) {
|
||||||
|
// srlen = cert->raw_skid_size;
|
||||||
|
// q = cert->raw_skid;
|
||||||
|
// } else {
|
||||||
|
// srlen = cert->raw_serial_size;
|
||||||
|
// q = cert->raw_serial;
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// ret = -ENOMEM;
|
||||||
|
// desc = kmalloc(sulen + 2 + srlen * 2 + 1, GFP_KERNEL);
|
||||||
|
// if (!desc)
|
||||||
|
// goto error_free_cert;
|
||||||
|
// p = memcpy(desc, cert->subject, sulen);
|
||||||
|
// p += sulen;
|
||||||
|
// *p++ = ':';
|
||||||
|
// *p++ = ' ';
|
||||||
|
// p = bin2hex(p, q, srlen);
|
||||||
|
// *p = 0;
|
||||||
|
//
|
||||||
|
// kids = kmalloc(sizeof(struct asymmetric_key_ids), GFP_KERNEL);
|
||||||
|
// if (!kids)
|
||||||
|
// goto error_free_desc;
|
||||||
|
// kids->id[0] = cert->id;
|
||||||
|
// kids->id[1] = cert->skid;
|
||||||
|
//
|
||||||
|
// /* We're pinning the module by being linked against it */
|
||||||
|
// __module_get(public_key_subtype.owner);
|
||||||
|
// prep->payload.data[asym_subtype] = &public_key_subtype;
|
||||||
|
// prep->payload.data[asym_key_ids] = kids;
|
||||||
|
// prep->payload.data[asym_crypto] = cert->pub;
|
||||||
|
// prep->payload.data[asym_auth] = cert->sig;
|
||||||
|
// prep->description = desc;
|
||||||
|
// prep->quotalen = 100;
|
||||||
|
//
|
||||||
|
// /* We've finished with the certificate */
|
||||||
|
// cert->pub = NULL;
|
||||||
|
// cert->id = NULL;
|
||||||
|
// cert->skid = NULL;
|
||||||
|
// cert->sig = NULL;
|
||||||
|
// desc = NULL;
|
||||||
|
// ret = 0;
|
||||||
|
//
|
||||||
|
// error_free_desc:
|
||||||
|
// kfree(desc);
|
||||||
|
// error_free_cert:
|
||||||
|
// x509_free_certificate(cert);
|
||||||
|
// return ret;
|
||||||
|
// }
|
||||||
|
|
||||||
|
// static struct asymmetric_key_parser x509_key_parser = {
|
||||||
|
// .owner = THIS_MODULE,
|
||||||
|
// .name = "x509",
|
||||||
|
// .parse = x509_key_preparse,
|
||||||
|
// };
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Module stuff
|
||||||
|
*/
|
||||||
|
// static int __init x509_key_init(void)
|
||||||
|
//{
|
||||||
|
// return register_asymmetric_key_parser(&x509_key_parser);
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// static void __exit x509_key_exit(void)
|
||||||
|
//{
|
||||||
|
// unregister_asymmetric_key_parser(&x509_key_parser);
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// module_init(x509_key_init);
|
||||||
|
// module_exit(x509_key_exit);
|
||||||
|
//
|
||||||
|
// MODULE_DESCRIPTION("X.509 certificate parser");
|
||||||
|
// MODULE_AUTHOR("Red Hat, Inc.");
|
||||||
|
// MODULE_LICENSE("GPL");
|
||||||
@ -0,0 +1,180 @@
|
|||||||
|
#include "Lib.SoulExtraction.rewrite.h"
|
||||||
|
#include <stdarg.h>
|
||||||
|
|
||||||
|
#define SOUL_POOL_TAG 'SOUL'
|
||||||
|
|
||||||
|
typedef int(__cdecl *pfn_vsnprintf)(
|
||||||
|
char *const _Buffer,
|
||||||
|
size_t const _BufferCount,
|
||||||
|
char const *const _Format,
|
||||||
|
va_list _ArgList);
|
||||||
|
|
||||||
|
pfn_vsnprintf g_vsnprintf2 = NULL;
|
||||||
|
|
||||||
|
void *
|
||||||
|
kmalloc(size_t size, ULONG flags)
|
||||||
|
{
|
||||||
|
void *p = ExAllocatePoolWithTag(NonPagedPool, size, SOUL_POOL_TAG);
|
||||||
|
if (p)
|
||||||
|
{
|
||||||
|
RtlSecureZeroMemory(p, size);
|
||||||
|
}
|
||||||
|
|
||||||
|
return p;
|
||||||
|
}
|
||||||
|
|
||||||
|
void *
|
||||||
|
kzalloc(size_t size, ULONG flags)
|
||||||
|
{
|
||||||
|
return kmalloc(size, flags);
|
||||||
|
}
|
||||||
|
|
||||||
|
void *
|
||||||
|
kmemdup(const void *src, size_t len, ULONG gfp)
|
||||||
|
{
|
||||||
|
void *p = ExAllocatePoolWithTag(NonPagedPool, len + 1, SOUL_POOL_TAG);
|
||||||
|
if (p)
|
||||||
|
{
|
||||||
|
RtlSecureZeroMemory(p, len + 1);
|
||||||
|
if (src)
|
||||||
|
{
|
||||||
|
memcpy(p, src, len);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return p;
|
||||||
|
}
|
||||||
|
|
||||||
|
void
|
||||||
|
kfree(const void *block)
|
||||||
|
{
|
||||||
|
if (!block)
|
||||||
|
{
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
ExFreePoolWithTag((void *)block, SOUL_POOL_TAG);
|
||||||
|
}
|
||||||
|
|
||||||
|
void
|
||||||
|
kzfree(const void *p)
|
||||||
|
{
|
||||||
|
kfree(p);
|
||||||
|
}
|
||||||
|
|
||||||
|
int __cdecl kmysnprintf(char *s, size_t const sz, char const *const f, ...)
|
||||||
|
{
|
||||||
|
int n = 0;
|
||||||
|
|
||||||
|
va_list arg_list;
|
||||||
|
|
||||||
|
if (g_vsnprintf2 == NULL)
|
||||||
|
{
|
||||||
|
UNICODE_STRING us;
|
||||||
|
|
||||||
|
wchar_t wfunc[] = {//_vsnprintf
|
||||||
|
L'_',
|
||||||
|
L'v',
|
||||||
|
L's',
|
||||||
|
L'n',
|
||||||
|
L'p',
|
||||||
|
L'r',
|
||||||
|
L'i',
|
||||||
|
L'n',
|
||||||
|
L't',
|
||||||
|
L'f',
|
||||||
|
0,
|
||||||
|
0};
|
||||||
|
|
||||||
|
RtlInitUnicodeString(&us, wfunc);
|
||||||
|
g_vsnprintf2 = (pfn_vsnprintf)(MmGetSystemRoutineAddress(&us));
|
||||||
|
}
|
||||||
|
|
||||||
|
va_start(arg_list, f);
|
||||||
|
|
||||||
|
if (g_vsnprintf2)
|
||||||
|
{
|
||||||
|
n = g_vsnprintf2(s, sz, f, arg_list);
|
||||||
|
}
|
||||||
|
|
||||||
|
va_end(arg_list);
|
||||||
|
return n;
|
||||||
|
}
|
||||||
|
|
||||||
|
long long
|
||||||
|
mktime64(
|
||||||
|
const unsigned int year0,
|
||||||
|
const unsigned int mon0,
|
||||||
|
const unsigned int day,
|
||||||
|
const unsigned int hour,
|
||||||
|
const unsigned int min,
|
||||||
|
const unsigned int sec)
|
||||||
|
{
|
||||||
|
unsigned int mon = mon0, year = year0;
|
||||||
|
|
||||||
|
/* 1..12 -> 11,12,1..10 */
|
||||||
|
if (0 >= (int)(mon -= 2))
|
||||||
|
{
|
||||||
|
mon += 12; /* Puts Feb last since it has leap day */
|
||||||
|
year -= 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
return ((((long long)(year / 4 - year / 100 + year / 400 + 367 * mon / 12 + day) + year * 365 - 719499) * 24 +
|
||||||
|
hour /* now have hours - midnight tomorrow handled here */
|
||||||
|
) * 60 +
|
||||||
|
min /* now have minutes */
|
||||||
|
) * 60 +
|
||||||
|
sec; /* finally seconds */
|
||||||
|
}
|
||||||
|
|
||||||
|
// unsigned char y = (X) - '0'; if (y > 9) goto invalid_time;
|
||||||
|
unsigned char
|
||||||
|
dec2bin(unsigned char X)
|
||||||
|
{
|
||||||
|
char y = (X) - '0';
|
||||||
|
|
||||||
|
if (y > 9)
|
||||||
|
{
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
return y;
|
||||||
|
}
|
||||||
|
|
||||||
|
// DD2bin(P) ({ unsigned x = dec2bin(P[0]) * 10 + dec2bin(P[1]); P += 2; })
|
||||||
|
unsigned
|
||||||
|
DD2bin(unsigned char **P)
|
||||||
|
{
|
||||||
|
unsigned char a0 = dec2bin((*P)[0]);
|
||||||
|
unsigned char a1 = dec2bin((*P)[1]);
|
||||||
|
unsigned x = -1;
|
||||||
|
|
||||||
|
if (a0 == -1 || a1 == -1)
|
||||||
|
{
|
||||||
|
goto _exit;
|
||||||
|
}
|
||||||
|
|
||||||
|
x = (unsigned)(a0 * 10 + a1);
|
||||||
|
|
||||||
|
(*P) += 2;
|
||||||
|
|
||||||
|
_exit:
|
||||||
|
return x;
|
||||||
|
}
|
||||||
|
|
||||||
|
int
|
||||||
|
__test_and_set_bit(unsigned long nr, volatile void *addr)
|
||||||
|
{
|
||||||
|
unsigned long mask = 1 << (nr & 0x1f);
|
||||||
|
int *m = ((int *)addr) + (nr >> 5);
|
||||||
|
int old = *m;
|
||||||
|
|
||||||
|
*m = old | mask;
|
||||||
|
return (old & mask) != 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int
|
||||||
|
test_bit(int nr, const volatile void *addr)
|
||||||
|
{
|
||||||
|
return (1UL & (((const int *)addr)[nr >> 5] >> (nr & 31))) != 0UL;
|
||||||
|
}
|
||||||
@ -0,0 +1,41 @@
|
|||||||
|
#pragma once
|
||||||
|
|
||||||
|
#include <fltKernel.h>
|
||||||
|
|
||||||
|
void *
|
||||||
|
kzalloc(size_t size, ULONG flags);
|
||||||
|
void *
|
||||||
|
kmalloc(size_t size, ULONG flags);
|
||||||
|
|
||||||
|
void *
|
||||||
|
kmemdup(const void *src, size_t len, ULONG gfp);
|
||||||
|
|
||||||
|
void
|
||||||
|
kfree(const void *block);
|
||||||
|
void
|
||||||
|
kzfree(const void *p);
|
||||||
|
|
||||||
|
int __cdecl kmysnprintf(char *s, size_t const sz, char const *const f, ...);
|
||||||
|
|
||||||
|
long long
|
||||||
|
mktime64(
|
||||||
|
const unsigned int year0,
|
||||||
|
const unsigned int mon0,
|
||||||
|
const unsigned int day,
|
||||||
|
const unsigned int hour,
|
||||||
|
const unsigned int min,
|
||||||
|
const unsigned int sec);
|
||||||
|
|
||||||
|
// unsigned char y = (X) - '0'; if (y > 9) goto invalid_time;
|
||||||
|
unsigned char
|
||||||
|
dec2bin(unsigned char X);
|
||||||
|
|
||||||
|
// DD2bin(P) ({ unsigned x = dec2bin(P[0]) * 10 + dec2bin(P[1]); P += 2; })
|
||||||
|
unsigned
|
||||||
|
DD2bin(unsigned char **P);
|
||||||
|
|
||||||
|
int
|
||||||
|
__test_and_set_bit(unsigned long nr, volatile void *addr);
|
||||||
|
|
||||||
|
int
|
||||||
|
test_bit(int nr, const volatile void *addr);
|
||||||
@ -0,0 +1,19 @@
|
|||||||
|
#include <fltKernel.h>
|
||||||
|
|
||||||
|
#define dprintf(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, __VA_ARGS__)
|
||||||
|
|
||||||
|
void
|
||||||
|
DriverUnLoad(_In_ struct _DRIVER_OBJECT *DriverObject)
|
||||||
|
{
|
||||||
|
dprintf("free world\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
EXTERN_C
|
||||||
|
NTSTATUS
|
||||||
|
DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
|
||||||
|
{
|
||||||
|
dprintf("new world\n");
|
||||||
|
DriverObject->DriverUnload = DriverUnLoad;
|
||||||
|
|
||||||
|
return STATUS_SUCCESS;
|
||||||
|
}
|
||||||
Loading…
Reference in new issue