static int
HashDecodeAndVerify(FILE *out, FILE *content, PRFileDesc *signature,
SECCertUsage usage, char *progName)
{
SECItem derdata;
SEC_PKCS7ContentInfo *cinfo;
SEC_PKCS7SignedData *signedData;
HASH_HashType digestType;
SECItem digest;
unsigned char buffer[32];
if (SECU_ReadDERFromFile(&derdata, signature, PR_FALSE) != SECSuccess) {
SECU_PrintError(progName, "error reading signature file");
return -1;
}
cinfo = SEC_PKCS7DecodeItem(&derdata, NULL, NULL, NULL, NULL,
NULL, NULL, NULL);
if (cinfo == NULL)
return -1;
if (! SEC_PKCS7ContentIsSigned(cinfo)) {
fprintf (out, "Signature file is pkcs7 data, but not signed.\n");
return -1;
}
signedData = cinfo->content.signedData;
/* assume that there is only one digest algorithm for now */
digestType = AlgorithmToHashType(signedData->digestAlgorithms[0]);
if (digestType == HASH_AlgNULL) {
fprintf (out, "Invalid hash algorithmID\n");
return -1;
}
digest.data = buffer;
if (DigestFile (digest.data, &digest.len, 32, content, digestType)) {
SECU_PrintError (progName, "problem computing message digest");
return -1;
}
fprintf(out, "Signature is ");
if (SEC_PKCS7VerifyDetachedSignature (cinfo, usage, &digest, digestType,
PR_FALSE))
fprintf(out, "valid.\n");
else
fprintf(out, "invalid (Reason: %s).\n",
SECU_Strerror(PORT_GetError()));
SEC_PKCS7DestroyContentInfo(cinfo);
return 0;
}
static int wrap_cgpt(int argc,
const char *const argv[],
const char *mtd_device) {
uint8_t *original_hash = NULL;
uint8_t *modified_hash = NULL;
int ret = 0;
// Create a temp dir to work in.
ret++;
char temp_dir[] = "/tmp/cgpt_wrapper.XXXXXX";
if (ReadNorFlash(temp_dir) != 0) {
return ret;
}
char rw_gpt_path[PATH_MAX];
if (snprintf(rw_gpt_path, sizeof(rw_gpt_path), "%s/rw_gpt", temp_dir) < 0) {
goto cleanup;
}
original_hash = DigestFile(rw_gpt_path, SHA1_DIGEST_ALGORITHM);
// Obtain the MTD size.
ret++;
uint64_t drive_size = 0;
if (GetMtdSize(mtd_device, &drive_size) != 0) {
Error("Cannot get the size of %s.\n", mtd_device);
goto cleanup;
}
// Launch cgpt on "rw_gpt" with -D size.
ret++;
const char** my_argv = calloc(argc + 2 + 1, sizeof(char *));
if (my_argv == NULL) {
errno = ENOMEM;
goto cleanup;
}
memcpy(my_argv, argv, sizeof(char *) * argc);
char *real_cgpt;
if (asprintf(&real_cgpt, "%s.bin", argv[0]) == -1) {
free(my_argv);
goto cleanup;
}
my_argv[0] = real_cgpt;
int i;
for (i = 2; i < argc; ++i) {
if (strcmp(my_argv[i], mtd_device) == 0) {
my_argv[i] = rw_gpt_path;
}
}
my_argv[argc] = "-D";
char size[32];
snprintf(size, sizeof(size), "%" PRIu64, drive_size);
my_argv[argc + 1] = size;
i = ForkExecV(NULL, my_argv);
free(real_cgpt);
free(my_argv);
if (i != 0) {
Error("Cannot exec cgpt to modify rw_gpt.\n");
goto cleanup;
}
// Write back "rw_gpt" to NOR flash in two chunks.
ret++;
modified_hash = DigestFile(rw_gpt_path, SHA1_DIGEST_ALGORITHM);
if (original_hash != NULL && modified_hash != NULL) {
if (memcmp(original_hash, modified_hash, SHA1_DIGEST_SIZE) != 0) {
ret = WriteNorFlash(temp_dir);
} else {
ret = 0;
}
}
cleanup:
free(original_hash);
free(modified_hash);
RemoveDir(temp_dir);
return ret;
}
int
main(int argc, char **argv)
{
char *progName;
FILE *inFile, *outFile;
char *hashName;
SECOidData *hashOID;
PLOptState *optstate;
PLOptStatus status;
SECStatus rv;
progName = strrchr(argv[0], '/');
progName = progName ? progName+1 : argv[0];
inFile = NULL;
outFile = NULL;
hashName = NULL;
rv = NSS_Init("/tmp");
if (rv != SECSuccess) {
fprintf(stderr, "%s: NSS_Init failed in directory %s\n",
progName, "/tmp");
return -1;
}
/*
* Parse command line arguments
*/
optstate = PL_CreateOptState(argc, argv, "t:i:o:");
while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
switch (optstate->option) {
case '?':
Usage(progName);
break;
case 'i':
inFile = fopen(optstate->value, "r");
if (!inFile) {
fprintf(stderr, "%s: unable to open \"%s\" for reading\n",
progName, optstate->value);
return -1;
}
break;
case 'o':
outFile = fopen(optstate->value, "w");
if (!outFile) {
fprintf(stderr, "%s: unable to open \"%s\" for writing\n",
progName, optstate->value);
return -1;
}
break;
case 't':
hashName = strdup(optstate->value);
break;
}
}
if (!hashName) Usage(progName);
if (!inFile) inFile = stdin;
if (!outFile) outFile = stdout;
hashOID = HashNameToOID(hashName);
if (hashOID == NULL) {
fprintf(stderr, "%s: invalid digest type\n", progName);
Usage(progName);
}
if (DigestFile(outFile, inFile, hashOID)) {
fprintf(stderr, "%s: problem digesting data (%s)\n",
progName, SECU_Strerror(PORT_GetError()));
return -1;
}
if (NSS_Shutdown() != SECSuccess) {
exit(1);
}
return 0;
}
int main(int argc, char *argv[])
#endif
{
#ifdef _CRTDBG_LEAK_CHECK_DF
// Turn on leak-checking
int tempflag = _CrtSetDbgFlag( _CRTDBG_REPORT_FLAG );
tempflag |= _CRTDBG_LEAK_CHECK_DF;
_CrtSetDbgFlag( tempflag );
#endif
#if defined(__MWERKS__) && defined(macintosh)
argc = ccommand(&argv);
#endif
try
{
std::string command, executableName, edcFilename;
if (argc < 2)
command = 'h';
else
command = argv[1];
if (FIPS_140_2_ComplianceEnabled())
{
edcFilename = "edc.dat";
#ifdef CRYPTOPP_WIN32_AVAILABLE
TCHAR filename[MAX_PATH];
GetModuleFileName(GetModuleHandle(NULL), filename, sizeof(filename));
executableName = filename;
std::string::size_type pos = executableName.rfind('\\');
if (pos != std::string::npos)
edcFilename = executableName.substr(0, pos+1) + edcFilename;
#else
executableName = argv[0];
#endif
if (command.substr(0, 4) != "fips")
{
byte expectedModuleDigest[SHA1::DIGESTSIZE];
FileSource(edcFilename.c_str(), true, new HexDecoder(new ArraySink(expectedModuleDigest, sizeof(expectedModuleDigest))));
DoPowerUpSelfTest(executableName.c_str(), expectedModuleDigest);
}
}
switch (command[0])
{
case 'g':
{
char seed[1024], privFilename[128], pubFilename[128];
unsigned int keyLength;
cout << "Key length in bits: ";
cin >> keyLength;
cout << "\nSave private key to file: ";
cin >> privFilename;
cout << "\nSave public key to file: ";
cin >> pubFilename;
cout << "\nRandom Seed: ";
ws(cin);
cin.getline(seed, 1024);
GenerateRSAKey(keyLength, privFilename, pubFilename, seed);
return 0;
}
case 'r':
{
switch (argv[1][1])
{
case 's':
RSASignFile(argv[2], argv[3], argv[4]);
return 0;
case 'v':
{
bool verified = RSAVerifyFile(argv[2], argv[3], argv[4]);
cout << (verified ? "valid signature" : "invalid signature") << endl;
return 0;
}
default:
{
char privFilename[128], pubFilename[128];
char seed[1024], message[1024];
cout << "Private key file: ";
cin >> privFilename;
cout << "\nPublic key file: ";
cin >> pubFilename;
cout << "\nRandom Seed: ";
ws(cin);
cin.getline(seed, 1024);
cout << "\nMessage: ";
cin.getline(message, 1024);
string ciphertext = RSAEncryptString(pubFilename, seed, message);
cout << "\nCiphertext: " << ciphertext << endl;
string decrypted = RSADecryptString(privFilename, ciphertext.c_str());
cout << "\nDecrypted: " << decrypted << endl;
return 0;
}
}
}
case 'm':
DigestFile(argv[2]);
return 0;
case 't':
{
if (command == "tv")
{
return !RunTestDataFile(argv[2]);
}
// VC60 workaround: use char array instead of std::string to workaround MSVC's getline bug
char passPhrase[MAX_PHRASE_LENGTH], plaintext[1024];
cout << "Passphrase: ";
cin.getline(passPhrase, MAX_PHRASE_LENGTH);
cout << "\nPlaintext: ";
cin.getline(plaintext, 1024);
string ciphertext = EncryptString(plaintext, passPhrase);
cout << "\nCiphertext: " << ciphertext << endl;
string decrypted = DecryptString(ciphertext.c_str(), passPhrase);
cout << "\nDecrypted: " << decrypted << endl;
return 0;
}
case 'e':
case 'd':
if (command == "e64")
Base64Encode(argv[2], argv[3]);
else if (command == "d64")
Base64Decode(argv[2], argv[3]);
else if (command == "e16")
HexEncode(argv[2], argv[3]);
else if (command == "d16")
HexDecode(argv[2], argv[3]);
else
{
char passPhrase[MAX_PHRASE_LENGTH];
cout << "Passphrase: ";
cin.getline(passPhrase, MAX_PHRASE_LENGTH);
if (command == "e")
EncryptFile(argv[2], argv[3], passPhrase);
else
DecryptFile(argv[2], argv[3], passPhrase);
}
return 0;
case 's':
if (argv[1][1] == 's')
{
char seed[1024];
cout << "\nRandom Seed: ";
ws(cin);
cin.getline(seed, 1024);
SecretShareFile(atoi(argv[2]), atoi(argv[3]), argv[4], seed);
}
else
SecretRecoverFile(argc-3, argv[2], argv+3);
return 0;
case 'i':
if (argv[1][1] == 'd')
InformationDisperseFile(atoi(argv[2]), atoi(argv[3]), argv[4]);
else
InformationRecoverFile(argc-3, argv[2], argv+3);
return 0;
case 'v':
return !Validate(argc>2 ? atoi(argv[2]) : 0, argv[1][1] == 'v', argc>3 ? argv[3] : NULL);
case 'b':
if (argc<3)
BenchMarkAll();
else
BenchMarkAll((float)atof(argv[2]));
return 0;
case 'z':
GzipFile(argv[3], argv[4], argv[2][0]-'0');
return 0;
case 'u':
GunzipFile(argv[2], argv[3]);
return 0;
case 'f':
if (command == "fips")
FIPS140_SampleApplication(executableName.c_str(), edcFilename.c_str());
else if (command == "fips-rand")
FIPS140_GenerateRandomFiles();
else if (command == "ft")
ForwardTcpPort(argv[2], argv[3], argv[4]);
return 0;
case 'a':
if (AdhocTest)
return (*AdhocTest)(argc, argv);
else
return 0;
default:
FileSource usage("usage.dat", true, new FileSink(cout));
return 1;
}
}
catch(CryptoPP::Exception &e)
{
cout << "\nCryptoPP::Exception caught: " << e.what() << endl;
return -1;
}
catch(std::exception &e)
{
cout << "\nstd::exception caught: " << e.what() << endl;
return -2;
}
}
