CryptAuthenticode.c 5.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192
  1. /** @file
  2. Authenticode Portable Executable Signature Verification over OpenSSL.
  3. Caution: This module requires additional review when modified.
  4. This library will have external input - signature (e.g. PE/COFF Authenticode).
  5. This external input must be validated carefully to avoid security issue like
  6. buffer overflow, integer overflow.
  7. AuthenticodeVerify() will get PE/COFF Authenticode and will do basic check for
  8. data structure.
  9. Copyright (c) 2011 - 2015, Intel Corporation. All rights reserved.<BR>
  10. SPDX-License-Identifier: BSD-2-Clause-Patent
  11. **/
  12. #include "InternalCryptLib.h"
  13. #include <openssl/objects.h>
  14. #include <openssl/x509.h>
  15. #include <openssl/pkcs7.h>
  16. //
  17. // OID ASN.1 Value for SPC_INDIRECT_DATA_OBJID
  18. //
  19. UINT8 mSpcIndirectOidValue[] = {
  20. 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x01, 0x04
  21. };
  22. /**
  23. Verifies the validity of a PE/COFF Authenticode Signature as described in "Windows
  24. Authenticode Portable Executable Signature Format".
  25. If AuthData is NULL, then return FALSE.
  26. If ImageHash is NULL, then return FALSE.
  27. Caution: This function may receive untrusted input.
  28. PE/COFF Authenticode is external input, so this function will do basic check for
  29. Authenticode data structure.
  30. @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
  31. PE/COFF image to be verified.
  32. @param[in] DataSize Size of the Authenticode Signature in bytes.
  33. @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
  34. is used for certificate chain verification.
  35. @param[in] CertSize Size of the trusted certificate in bytes.
  36. @param[in] ImageHash Pointer to the original image file hash value. The procedure
  37. for calculating the image hash value is described in Authenticode
  38. specification.
  39. @param[in] HashSize Size of Image hash value in bytes.
  40. @retval TRUE The specified Authenticode Signature is valid.
  41. @retval FALSE Invalid Authenticode Signature.
  42. **/
  43. BOOLEAN
  44. EFIAPI
  45. AuthenticodeVerify (
  46. IN CONST UINT8 *AuthData,
  47. IN UINTN DataSize,
  48. IN CONST UINT8 *TrustedCert,
  49. IN UINTN CertSize,
  50. IN CONST UINT8 *ImageHash,
  51. IN UINTN HashSize
  52. )
  53. {
  54. BOOLEAN Status;
  55. PKCS7 *Pkcs7;
  56. CONST UINT8 *Temp;
  57. CONST UINT8 *OrigAuthData;
  58. UINT8 *SpcIndirectDataContent;
  59. UINT8 Asn1Byte;
  60. UINTN ContentSize;
  61. CONST UINT8 *SpcIndirectDataOid;
  62. //
  63. // Check input parameters.
  64. //
  65. if ((AuthData == NULL) || (TrustedCert == NULL) || (ImageHash == NULL)) {
  66. return FALSE;
  67. }
  68. if ((DataSize > INT_MAX) || (CertSize > INT_MAX) || (HashSize > INT_MAX)) {
  69. return FALSE;
  70. }
  71. Status = FALSE;
  72. Pkcs7 = NULL;
  73. OrigAuthData = AuthData;
  74. //
  75. // Retrieve & Parse PKCS#7 Data (DER encoding) from Authenticode Signature
  76. //
  77. Temp = AuthData;
  78. Pkcs7 = d2i_PKCS7 (NULL, &Temp, (int)DataSize);
  79. if (Pkcs7 == NULL) {
  80. goto _Exit;
  81. }
  82. //
  83. // Check if it's PKCS#7 Signed Data (for Authenticode Scenario)
  84. //
  85. if (!PKCS7_type_is_signed (Pkcs7)) {
  86. goto _Exit;
  87. }
  88. //
  89. // NOTE: OpenSSL PKCS7 Decoder didn't work for Authenticode-format signed data due to
  90. // some authenticode-specific structure. Use opaque ASN.1 string to retrieve
  91. // PKCS#7 ContentInfo here.
  92. //
  93. SpcIndirectDataOid = OBJ_get0_data(Pkcs7->d.sign->contents->type);
  94. if (OBJ_length(Pkcs7->d.sign->contents->type) != sizeof(mSpcIndirectOidValue) ||
  95. CompareMem (
  96. SpcIndirectDataOid,
  97. mSpcIndirectOidValue,
  98. sizeof (mSpcIndirectOidValue)
  99. ) != 0) {
  100. //
  101. // Un-matched SPC_INDIRECT_DATA_OBJID.
  102. //
  103. goto _Exit;
  104. }
  105. SpcIndirectDataContent = (UINT8 *)(Pkcs7->d.sign->contents->d.other->value.asn1_string->data);
  106. //
  107. // Retrieve the SEQUENCE data size from ASN.1-encoded SpcIndirectDataContent.
  108. //
  109. Asn1Byte = *(SpcIndirectDataContent + 1);
  110. if ((Asn1Byte & 0x80) == 0) {
  111. //
  112. // Short Form of Length Encoding (Length < 128)
  113. //
  114. ContentSize = (UINTN) (Asn1Byte & 0x7F);
  115. //
  116. // Skip the SEQUENCE Tag;
  117. //
  118. SpcIndirectDataContent += 2;
  119. } else if ((Asn1Byte & 0x81) == 0x81) {
  120. //
  121. // Long Form of Length Encoding (128 <= Length < 255, Single Octet)
  122. //
  123. ContentSize = (UINTN) (*(UINT8 *)(SpcIndirectDataContent + 2));
  124. //
  125. // Skip the SEQUENCE Tag;
  126. //
  127. SpcIndirectDataContent += 3;
  128. } else if ((Asn1Byte & 0x82) == 0x82) {
  129. //
  130. // Long Form of Length Encoding (Length > 255, Two Octet)
  131. //
  132. ContentSize = (UINTN) (*(UINT8 *)(SpcIndirectDataContent + 2));
  133. ContentSize = (ContentSize << 8) + (UINTN)(*(UINT8 *)(SpcIndirectDataContent + 3));
  134. //
  135. // Skip the SEQUENCE Tag;
  136. //
  137. SpcIndirectDataContent += 4;
  138. } else {
  139. goto _Exit;
  140. }
  141. //
  142. // Compare the original file hash value to the digest retrieve from SpcIndirectDataContent
  143. // defined in Authenticode
  144. // NOTE: Need to double-check HashLength here!
  145. //
  146. if (CompareMem (SpcIndirectDataContent + ContentSize - HashSize, ImageHash, HashSize) != 0) {
  147. //
  148. // Un-matched PE/COFF Hash Value
  149. //
  150. goto _Exit;
  151. }
  152. //
  153. // Verifies the PKCS#7 Signed Data in PE/COFF Authenticode Signature
  154. //
  155. Status = (BOOLEAN) Pkcs7Verify (OrigAuthData, DataSize, TrustedCert, CertSize, SpcIndirectDataContent, ContentSize);
  156. _Exit:
  157. //
  158. // Release Resources
  159. //
  160. PKCS7_free (Pkcs7);
  161. return Status;
  162. }