Fixes to agent code signing, #4161

Ylian Saint-Hilaire committed Jun 23, 2022 at 10:51 UTC 0605422ccd4d4638389d9a1b06c3dcb99d0cd004
2 files changed +27 -13
MeshCentralServer.njsproj
-2
@@ -261,10 +261,8 @@
261 <Content Include="agents\MeshCommander-Small.gz" />
262 <Content Include="agents\meshinstall-initd.sh" />
263 <Content Include="agents\meshinstall-linux.sh" />
264 - <Content Include="agents\MeshService-signed.exe" />
264 <Content Include="agents\MeshService.exe" />
265 <Content Include="agents\MeshService.pdb" />
267 - <Content Include="agents\MeshService64-signed.exe" />
266 <Content Include="agents\MeshService64.exe" />
267 <Content Include="agents\MeshService64.pdb" />
268 <Content Include="agents\modules_meshcore\coretranslations.json" />
authenticode.js
+27 -11
@@ -408,7 +408,12 @@ function createAuthenticodeHandler(path) {
408
409 // Make an HTTP request
410 const http = require('http');
411 - var options = {
411 + const timeServerUrl = new URL(args.time);
412 + const options = {
413 + protocol: timeServerUrl.protocol,
414 + hostname: timeServerUrl.hostname,
415 + path: timeServerUrl.pathname,
416 + port: ((timeServerUrl.port == '') ? 80 : parseInt(timeServerUrl.port)),
417 method: 'POST',
418 headers: {
419 'accept': 'application/octet-stream',
@@ -421,7 +426,7 @@ function createAuthenticodeHandler(path) {
426
427 // Set up the request
428 var responseAccumulator = '';
424 - var req = http.request(args.time, options, function (res) {
429 + var req = http.request(options, function (res) {
430 res.setEncoding('utf8');
431 res.on('data', function (chunk) { responseAccumulator += chunk; });
432 res.on('end', function () {
@@ -431,7 +436,7 @@ function createAuthenticodeHandler(path) {
436
437 // Decode the executable signature block
438 var pkcs7der = null;
434 - try { forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(obj.getRawSignatureBlock(), 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
439 + try { pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(obj.getRawSignatureBlock(), 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
440
441 // Get the ASN1 certificates used to sign the timestamp and add them to the certs in the PKCS7 of the executable
442 // TODO: We could look to see if the certificate is already present in the executable
@@ -1294,7 +1299,7 @@ function createAuthenticodeHandler(path) {
1299 } else {
1300 // Decode the signature block
1301 var pkcs7der = null;
1297 - try { forge.asn1.fromDer(forge.util.createBuffer(p7signature)); } catch (ex) { func('' + ex); return; }
1302 + try { pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(p7signature)); } catch (ex) { func('' + ex); return; }
1303
1304 // To work around ForgeJS PKCS#7 limitation, this may break PKCS7 verify if ForgeJS adds support for it in the future
1305 // Switch content type from "1.3.6.1.4.1.311.2.1.4" to "1.2.840.113549.1.7.1"
@@ -1326,7 +1331,12 @@ function createAuthenticodeHandler(path) {
1331
1332 // Make an HTTP request
1333 const http = require('http');
1329 - var options = {
1334 + const timeServerUrl = new URL(args.time);
1335 + const options = {
1336 + protocol: timeServerUrl.protocol,
1337 + hostname: timeServerUrl.hostname,
1338 + path: timeServerUrl.pathname,
1339 + port: ((timeServerUrl.port == '') ? 80 : parseInt(timeServerUrl.port)),
1340 method: 'POST',
1341 headers: {
1342 'accept': 'application/octet-stream',
@@ -1339,13 +1349,13 @@ function createAuthenticodeHandler(path) {
1349
1350 // Set up the request
1351 var responseAccumulator = '';
1342 - var req = http.request(args.time, options, function (res) {
1352 + var req = http.request(options, function (res) {
1353 res.setEncoding('utf8');
1354 res.on('data', function (chunk) { responseAccumulator += chunk; });
1355 res.on('end', function () {
1356 // Decode the timestamp signature block
1347 - const timepkcs7der = null;
1348 - try { forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(responseAccumulator, 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
1357 + var timepkcs7der = null;
1358 + try { timepkcs7der = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(responseAccumulator, 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
1359
1360 // Get the ASN1 certificates used to sign the timestamp and add them to the certs in the PKCS7 of the executable
1361 // TODO: We could look to see if the certificate is already present in the executable
@@ -1642,7 +1652,12 @@ function createAuthenticodeHandler(path) {
1652
1653 // Make an HTTP request
1654 const http = require('http');
1645 - var options = {
1655 + const timeServerUrl = new URL(args.time);
1656 + const options = {
1657 + protocol: timeServerUrl.protocol,
1658 + hostname: timeServerUrl.hostname,
1659 + path: timeServerUrl.pathname,
1660 + port: ((timeServerUrl.port == '') ? 80 : parseInt(timeServerUrl.port)),
1661 method: 'POST',
1662 headers: {
1663 'accept': 'application/octet-stream',
@@ -1655,12 +1670,13 @@ function createAuthenticodeHandler(path) {
1670
1671 // Set up the request
1672 var responseAccumulator = '';
1658 - var req = http.request(args.time, options, function (res) {
1673 + var req = http.request(options, function (res) {
1674 res.setEncoding('utf8');
1675 res.on('data', function (chunk) { responseAccumulator += chunk; });
1676 res.on('end', function () {
1677 // Decode the timestamp signature block
1663 - const timepkcs7der = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(responseAccumulator, 'base64').toString('binary')));
1678 + var timepkcs7der = null;
1679 + try { timepkcs7der = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(responseAccumulator, 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
1680
1681 // Get the ASN1 certificates used to sign the timestamp and add them to the certs in the PKCS7 of the executable
1682 // TODO: We could look to see if the certificate is already present in the executable