Skip to content

Commit fa40c57

Browse files
olszomalmtrojnar
olszomal
authored and
mtrojnar
committed
Simplify checking whether a signature exists
1 parent 0b93a94 commit fa40c57

File tree

8 files changed

+255
-265
lines changed

8 files changed

+255
-265
lines changed

‎appx.c‎

Lines changed: 5 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,6 @@ static const EVP_MD *appx_md_get(FILE_FORMAT_CTX *ctx);
250250
static ASN1_OBJECT *appx_spc_sip_info_get(u_char **p, int *plen, FILE_FORMAT_CTX *ctx);
251251
static PKCS7 *appx_pkcs7_contents_get(FILE_FORMAT_CTX *ctx, BIO *hash, const EVP_MD *md);
252252
static int appx_hash_length_get(FILE_FORMAT_CTX *ctx);
253-
static int appx_check_file(FILE_FORMAT_CTX *ctx, int detached);
254253
static int appx_verify_digests(FILE_FORMAT_CTX *ctx, PKCS7 *p7);
255254
static PKCS7 *appx_pkcs7_extract(FILE_FORMAT_CTX *ctx);
256255
static int appx_remove_pkcs7(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata);
@@ -266,7 +265,6 @@ FILE_FORMAT file_format_appx = {
266265
.data_blob_get = appx_spc_sip_info_get,
267266
.pkcs7_contents_get = appx_pkcs7_contents_get,
268267
.hash_length_get = appx_hash_length_get,
269-
.check_file = appx_check_file,
270268
.verify_digests = appx_verify_digests,
271269
.pkcs7_extract = appx_pkcs7_extract,
272270
.remove_pkcs7 = appx_remove_pkcs7,
@@ -466,25 +464,6 @@ static int appx_hash_length_get(FILE_FORMAT_CTX *ctx)
466464
return ctx->appx_ctx->hashlen;
467465
}
468466

469-
/*
470-
* Check if the signature exists.
471-
* [in] ctx: structure holds input and output data
472-
* [in] detached: embedded/detached PKCS#7 signature switch
473-
* [returns] 0 on error or 1 on success
474-
*/
475-
static int appx_check_file(FILE_FORMAT_CTX *ctx, int detached)
476-
{
477-
if (detached) {
478-
printf("APPX format does not support detached PKCS#7 signature\n");
479-
return 0; /* FAILED */
480-
}
481-
if (!zipEntryExist(ctx->appx_ctx->zip, APP_SIGNATURE_FILENAME)) {
482-
printf("%s does not exist\n", APP_SIGNATURE_FILENAME);
483-
return 0; /* FAILED */
484-
}
485-
return 1; /* OK */
486-
}
487-
488467
/*
489468
* Calculate message digest and compare to value retrieved from PKCS#7 signedData.
490469
* [in] ctx: structure holds input and output data
@@ -534,6 +513,11 @@ static PKCS7 *appx_pkcs7_extract(FILE_FORMAT_CTX *ctx)
534513
const u_char *blob;
535514
size_t dataSize;
536515

516+
/* Check if the signature exists */
517+
if (!zipEntryExist(ctx->appx_ctx->zip, APP_SIGNATURE_FILENAME)) {
518+
printf("%s does not exist\n", APP_SIGNATURE_FILENAME);
519+
return NULL; /* FAILED */
520+
}
537521
dataSize = zipReadFileDataByName(&data, ctx->appx_ctx->zip, APP_SIGNATURE_FILENAME);
538522
if (dataSize <= 0) {
539523
return NULL; /* FAILED */

‎cab.c‎

Lines changed: 34 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ static FILE_FORMAT_CTX *cab_ctx_new(GLOBAL_OPTIONS *options, BIO *hash, BIO *out
4545
static ASN1_OBJECT *cab_obsolete_link_get(u_char **p, int *plen, FILE_FORMAT_CTX *ctx);
4646
static PKCS7 *cab_pkcs7_contents_get(FILE_FORMAT_CTX *ctx, BIO *hash, const EVP_MD *md);
4747
static int cab_hash_length_get(FILE_FORMAT_CTX *ctx);
48-
static int cab_check_file(FILE_FORMAT_CTX *ctx, int detached);
4948
static u_char *cab_digest_calc(FILE_FORMAT_CTX *ctx, const EVP_MD *md);
5049
static int cab_verify_digests(FILE_FORMAT_CTX *ctx, PKCS7 *p7);
5150
static PKCS7 *cab_pkcs7_extract(FILE_FORMAT_CTX *ctx);
@@ -57,13 +56,13 @@ static int cab_append_pkcs7(FILE_FORMAT_CTX *ctx, BIO *outdata, PKCS7 *p7);
5756
static void cab_update_data_size(FILE_FORMAT_CTX *ctx, BIO *outdata, PKCS7 *p7);
5857
static BIO *cab_bio_free(BIO *hash, BIO *outdata);
5958
static void cab_ctx_cleanup(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata);
59+
static int cab_is_detaching_supported(void);
6060

6161
FILE_FORMAT file_format_cab = {
6262
.ctx_new = cab_ctx_new,
6363
.data_blob_get = cab_obsolete_link_get,
6464
.pkcs7_contents_get = cab_pkcs7_contents_get,
6565
.hash_length_get = cab_hash_length_get,
66-
.check_file = cab_check_file,
6766
.digest_calc = cab_digest_calc,
6867
.verify_digests = cab_verify_digests,
6968
.pkcs7_extract = cab_pkcs7_extract,
@@ -74,7 +73,8 @@ FILE_FORMAT file_format_cab = {
7473
.append_pkcs7 = cab_append_pkcs7,
7574
.update_data_size = cab_update_data_size,
7675
.bio_free = cab_bio_free,
77-
.ctx_cleanup = cab_ctx_cleanup
76+
.ctx_cleanup = cab_ctx_cleanup,
77+
.is_detaching_supported = cab_is_detaching_supported
7878
};
7979

8080
/* Prototypes */
@@ -83,6 +83,7 @@ static int cab_add_jp_attribute(PKCS7 *p7, int jp);
8383
static size_t cab_write_optional_names(BIO *outdata, char *indata, size_t len, uint16_t flags);
8484
static int cab_modify_header(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata);
8585
static int cab_add_header(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata);
86+
static int cab_check_file(FILE_FORMAT_CTX *ctx);
8687

8788
/*
8889
* FILE_FORMAT method definitions
@@ -192,34 +193,6 @@ static int cab_hash_length_get(FILE_FORMAT_CTX *ctx)
192193
return EVP_MD_size(ctx->options->md);
193194
}
194195

195-
/*
196-
* Check if the signature exists.
197-
* [in, out] ctx: structure holds input and output data
198-
* [in] detached: embedded/detached PKCS#7 signature switch
199-
* [returns] 0 on error or 1 on success
200-
*/
201-
static int cab_check_file(FILE_FORMAT_CTX *ctx, int detached)
202-
{
203-
if (!ctx) {
204-
printf("Init error\n\n");
205-
return 0; /* FAILED */
206-
}
207-
if (detached) {
208-
printf("Checking the specified catalog file\n\n");
209-
return 1; /* OK */
210-
}
211-
if (ctx->cab_ctx->header_size != 20) {
212-
printf("No signature found\n\n");
213-
return 0; /* FAILED */
214-
}
215-
if (ctx->cab_ctx->sigpos == 0 || ctx->cab_ctx->siglen == 0
216-
|| ctx->cab_ctx->sigpos > ctx->cab_ctx->fileend) {
217-
printf("No signature found\n\n");
218-
return 0; /* FAILED */
219-
}
220-
return 1; /* OK */
221-
}
222-
223196
/*
224197
* Compute a message digest value of the signed or unsigned CAB file.
225198
* [in] ctx: structure holds input and output data
@@ -397,8 +370,7 @@ static PKCS7 *cab_pkcs7_extract(FILE_FORMAT_CTX *ctx)
397370
{
398371
const u_char *blob;
399372

400-
if (ctx->cab_ctx->sigpos == 0 || ctx->cab_ctx->siglen == 0
401-
|| ctx->cab_ctx->sigpos > ctx->cab_ctx->fileend) {
373+
if (!cab_check_file(ctx)) {
402374
return NULL; /* FAILED */
403375
}
404376
blob = (u_char *)ctx->options->indata + ctx->cab_ctx->sigpos;
@@ -432,8 +404,7 @@ static int cab_remove_pkcs7(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
432404
/* squash the unused parameter warning */
433405
(void)hash;
434406

435-
if (ctx->cab_ctx->sigpos == 0 || ctx->cab_ctx->siglen == 0
436-
|| ctx->cab_ctx->sigpos > ctx->cab_ctx->fileend) {
407+
if (!cab_check_file(ctx)) {
437408
return 1; /* FAILED, no signature */
438409
}
439410
buf = OPENSSL_malloc(SIZE_64K);
@@ -655,6 +626,11 @@ static void cab_ctx_cleanup(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
655626
OPENSSL_free(ctx);
656627
}
657628

629+
static int cab_is_detaching_supported(void)
630+
{
631+
return 1; /* OK */
632+
}
633+
658634
/*
659635
* CAB helper functions
660636
*/
@@ -972,6 +948,29 @@ static int cab_add_header(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
972948
return 1; /* OK */
973949
}
974950

951+
/*
952+
* Check if the signature exists.
953+
* [in, out] ctx: structure holds input and output data
954+
* [returns] 0 on error or 1 on success
955+
*/
956+
static int cab_check_file(FILE_FORMAT_CTX *ctx)
957+
{
958+
if (!ctx) {
959+
printf("Init error\n\n");
960+
return 0; /* FAILED */
961+
}
962+
if (ctx->cab_ctx->header_size != 20) {
963+
printf("No signature found\n\n");
964+
return 0; /* FAILED */
965+
}
966+
if (ctx->cab_ctx->sigpos == 0 || ctx->cab_ctx->siglen == 0
967+
|| ctx->cab_ctx->sigpos > ctx->cab_ctx->fileend) {
968+
printf("No signature found\n\n");
969+
return 0; /* FAILED */
970+
}
971+
return 1; /* OK */
972+
}
973+
975974
/*
976975
Local Variables:
977976
c-basic-offset: 4

‎cat.c‎

Lines changed: 33 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,6 @@ struct cat_ctx_st {
3636

3737
/* FILE_FORMAT method prototypes */
3838
static FILE_FORMAT_CTX *cat_ctx_new(GLOBAL_OPTIONS *options, BIO *hash, BIO *outdata);
39-
static int cat_check_file(FILE_FORMAT_CTX *ctx, int detached);
4039
static int cat_verify_digests(FILE_FORMAT_CTX *ctx, PKCS7 *p7);
4140
static PKCS7 *cat_pkcs7_extract(FILE_FORMAT_CTX *ctx);
4241
static PKCS7 *cat_pkcs7_signature_new(FILE_FORMAT_CTX *ctx, BIO *hash);
@@ -46,7 +45,6 @@ static void cat_ctx_cleanup(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata);
4645

4746
FILE_FORMAT file_format_cat = {
4847
.ctx_new = cat_ctx_new,
49-
.check_file = cat_check_file,
5048
.verify_digests = cat_verify_digests,
5149
.pkcs7_extract = cat_pkcs7_extract,
5250
.pkcs7_signature_new = cat_pkcs7_signature_new,
@@ -64,6 +62,7 @@ static int cat_print_content_member_digest(ASN1_TYPE *content);
6462
static int cat_print_content_member_name(ASN1_TYPE *content);
6563
static void cat_print_base64(ASN1_OCTET_STRING *value);
6664
static void cat_print_utf16_as_ascii(ASN1_OCTET_STRING *value);
65+
static int cat_check_file(FILE_FORMAT_CTX *ctx);
6766

6867
/*
6968
* FILE_FORMAT method definitions
@@ -118,35 +117,6 @@ static FILE_FORMAT_CTX *cat_ctx_new(GLOBAL_OPTIONS *options, BIO *hash, BIO *out
118117
return ctx;
119118
}
120119

121-
static int cat_check_file(FILE_FORMAT_CTX *ctx, int detached)
122-
{
123-
STACK_OF(PKCS7_SIGNER_INFO) *signer_info;
124-
PKCS7_SIGNER_INFO *si;
125-
126-
if (!ctx) {
127-
printf("Init error\n\n");
128-
return 0; /* FAILED */
129-
}
130-
if (detached) {
131-
printf("CAT format does not support detached PKCS#7 signature\n\n");
132-
return 0; /* FAILED */
133-
}
134-
signer_info = PKCS7_get_signer_info(ctx->cat_ctx->p7);
135-
if (!signer_info) {
136-
printf("Failed catalog file\n\n");
137-
return 0; /* FAILED */
138-
}
139-
si = sk_PKCS7_SIGNER_INFO_value(signer_info, 0);
140-
if (!si) {
141-
printf("No signature found\n\n");
142-
return 0; /* FAILED */
143-
}
144-
if (ctx->options->verbose) {
145-
(void)cat_list_content(ctx->cat_ctx->p7);
146-
}
147-
return 1; /* OK */
148-
}
149-
150120
/*
151121
* ContentInfo value is the inner content of pkcs7-signedData.
152122
* An extra verification is not necessary when a content type data
@@ -167,6 +137,9 @@ static int cat_verify_digests(FILE_FORMAT_CTX *ctx, PKCS7 *p7)
167137
*/
168138
static PKCS7 *cat_pkcs7_extract(FILE_FORMAT_CTX *ctx)
169139
{
140+
if (!cat_check_file(ctx)) {
141+
return NULL; /* FAILED */
142+
}
170143
return PKCS7_dup(ctx->cat_ctx->p7);
171144
}
172145

@@ -472,6 +445,35 @@ static void cat_print_utf16_as_ascii(ASN1_OCTET_STRING *value)
472445
putchar(isprint(data[i]) && !data[i+1] ? data[i] : '.');
473446
}
474447

448+
/*
449+
* Check if the signature exists.
450+
* [in, out] ctx: structure holds input and output data
451+
* [returns] 0 on error or 1 on success
452+
*/
453+
static int cat_check_file(FILE_FORMAT_CTX *ctx)
454+
{
455+
STACK_OF(PKCS7_SIGNER_INFO) *signer_info;
456+
PKCS7_SIGNER_INFO *si;
457+
458+
if (!ctx) {
459+
printf("Init error\n\n");
460+
return 0; /* FAILED */
461+
}
462+
signer_info = PKCS7_get_signer_info(ctx->cat_ctx->p7);
463+
if (!signer_info) {
464+
printf("Failed catalog file\n\n");
465+
return 0; /* FAILED */
466+
}
467+
si = sk_PKCS7_SIGNER_INFO_value(signer_info, 0);
468+
if (!si) {
469+
printf("No signature found\n\n");
470+
return 0; /* FAILED */
471+
}
472+
if (ctx->options->verbose) {
473+
(void)cat_list_content(ctx->cat_ctx->p7);
474+
}
475+
return 1; /* OK */
476+
}
475477
/*
476478
Local Variables:
477479
c-basic-offset: 4

0 commit comments

Comments
 (0)