1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
|
#!/usr/bin/env perl
#
# extract-mod-sig <part> <module-file>
#
# Reads the module file and writes out some or all of the signature
# section to stdout. Part is the bit to be written and is one of:
#
# -0: The unsigned module, no signature data at all
# -a: All of the signature data, including magic number
# -d: Just the descriptor values as a sequence of numbers
# -n: Just the signer's name
# -k: Just the key ID
# -s: Just the crypto signature or PKCS#7 message
#
use warnings;
use strict;
die "Format: $0 -[0adnks] module-file >out\n"
if ($#ARGV != 1);
my $part = $ARGV[0];
my $modfile = $ARGV[1];
my $magic_number = "~Module signature appended~\n";
#
# Read the module contents
#
open FD, "<$modfile" || die $modfile;
binmode(FD);
my @st = stat(FD);
die "$modfile" unless (@st);
my $buf = "";
my $len = sysread(FD, $buf, $st[7]);
die "$modfile" unless (defined($len));
die "Short read on $modfile\n" unless ($len == $st[7]);
close(FD) || die $modfile;
print STDERR "Read ", $len, " bytes from module file\n";
die "The file is too short to have a sig magic number and descriptor\n"
if ($len < 12 + length($magic_number));
#
# Check for the magic number and extract the information block
#
my $p = $len - length($magic_number);
my $raw_magic = substr($buf, $p);
die "Magic number not found at $len\n"
if ($raw_magic ne $magic_number);
print STDERR "Found magic number at $len\n";
$p -= 12;
my $raw_info = substr($buf, $p, 12);
my @info = unpack("CCCCCxxxN", $raw_info);
my ($algo, $hash, $id_type, $name_len, $kid_len, $sig_len) = @info;
if ($id_type == 0) {
print STDERR "Found PGP key identifier\n";
} elsif ($id_type == 1) {
print STDERR "Found X.509 cert identifier\n";
} elsif ($id_type == 2) {
print STDERR "Found PKCS#7/CMS encapsulation\n";
} else {
print STDERR "Found unsupported identifier type $id_type\n";
}
#
# Extract the three pieces of info data
#
die "Insufficient name+kid+sig data in file\n"
unless ($p >= $name_len + $kid_len + $sig_len);
$p -= $sig_len;
my $raw_sig = substr($buf, $p, $sig_len);
$p -= $kid_len;
my $raw_kid = substr($buf, $p, $kid_len);
$p -= $name_len;
my $raw_name = substr($buf, $p, $name_len);
my $module_len = $p;
if ($sig_len > 0) {
print STDERR "Found $sig_len bytes of signature [";
my $n = $sig_len > 16 ? 16 : $sig_len;
foreach my $i (unpack("C" x $n, substr($raw_sig, 0, $n))) {
printf STDERR "%02x", $i;
}
print STDERR "]\n";
}
if ($kid_len > 0) {
print STDERR "Found $kid_len bytes of key identifier [";
my $n = $kid_len > 16 ? 16 : $kid_len;
foreach my $i (unpack("C" x $n, substr($raw_kid, 0, $n))) {
printf STDERR "%02x", $i;
}
print STDERR "]\n";
}
if ($name_len > 0) {
print STDERR "Found $name_len bytes of signer's name [$raw_name]\n";
}
#
# Produce the requested output
#
if ($part eq "-0") {
# The unsigned module, no signature data at all
binmode(STDOUT);
print substr($buf, 0, $module_len);
} elsif ($part eq "-a") {
# All of the signature data, including magic number
binmode(STDOUT);
print substr($buf, $module_len);
} elsif ($part eq "-d") {
# Just the descriptor values as a sequence of numbers
print join(" ", @info), "\n";
} elsif ($part eq "-n") {
# Just the signer's name
print STDERR "No signer's name for PKCS#7 message type sig\n"
if ($id_type == 2);
binmode(STDOUT);
print $raw_name;
} elsif ($part eq "-k") {
# Just the key identifier
print STDERR "No key ID for PKCS#7 message type sig\n"
if ($id_type == 2);
binmode(STDOUT);
print $raw_kid;
} elsif ($part eq "-s") {
# Just the crypto signature or PKCS#7 message
binmode(STDOUT);
print $raw_sig;
}
|
