Fixes to agent code signing, #4161
Ylian Saint-Hilaire committed
Jun 23, 2022 at 10:51 UTC
0605422ccd4d4638389d9a1b06c3dcb99d0cd004
2 files changed
+27
-13
MeshCentralServer.njsproj
-2
@@ -261,10 +261,8 @@
261
<Content Include="agents\MeshCommander-Small.gz" />
262
<Content Include="agents\meshinstall-initd.sh" />
263
<Content Include="agents\meshinstall-linux.sh" />
264
- <Content Include="agents\MeshService-signed.exe" />
264
<Content Include="agents\MeshService.exe" />
265
<Content Include="agents\MeshService.pdb" />
267
- <Content Include="agents\MeshService64-signed.exe" />
266
<Content Include="agents\MeshService64.exe" />
267
<Content Include="agents\MeshService64.pdb" />
268
<Content Include="agents\modules_meshcore\coretranslations.json" />
authenticode.js
+27
-11
@@ -408,7 +408,12 @@ function createAuthenticodeHandler(path) {
408
409
// Make an HTTP request
410
const http = require('http');
411
- var options = {
411
+ const timeServerUrl = new URL(args.time);
412
+ const options = {
413
+ protocol: timeServerUrl.protocol,
414
+ hostname: timeServerUrl.hostname,
415
+ path: timeServerUrl.pathname,
416
+ port: ((timeServerUrl.port == '') ? 80 : parseInt(timeServerUrl.port)),
417
method: 'POST',
418
headers: {
419
'accept': 'application/octet-stream',
@@ -421,7 +426,7 @@ function createAuthenticodeHandler(path) {
426
427
// Set up the request
428
var responseAccumulator = '';
424
- var req = http.request(args.time, options, function (res) {
429
+ var req = http.request(options, function (res) {
430
res.setEncoding('utf8');
431
res.on('data', function (chunk) { responseAccumulator += chunk; });
432
res.on('end', function () {
@@ -431,7 +436,7 @@ function createAuthenticodeHandler(path) {
436
437
// Decode the executable signature block
438
var pkcs7der = null;
434
- try { forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(obj.getRawSignatureBlock(), 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
439
+ try { pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(obj.getRawSignatureBlock(), 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
440
441
// Get the ASN1 certificates used to sign the timestamp and add them to the certs in the PKCS7 of the executable
442
// TODO: We could look to see if the certificate is already present in the executable
@@ -1294,7 +1299,7 @@ function createAuthenticodeHandler(path) {
1299
} else {
1300
// Decode the signature block
1301
var pkcs7der = null;
1297
- try { forge.asn1.fromDer(forge.util.createBuffer(p7signature)); } catch (ex) { func('' + ex); return; }
1302
+ try { pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(p7signature)); } catch (ex) { func('' + ex); return; }
1303
1304
// To work around ForgeJS PKCS#7 limitation, this may break PKCS7 verify if ForgeJS adds support for it in the future
1305
// Switch content type from "1.3.6.1.4.1.311.2.1.4" to "1.2.840.113549.1.7.1"
@@ -1326,7 +1331,12 @@ function createAuthenticodeHandler(path) {
1331
1332
// Make an HTTP request
1333
const http = require('http');
1329
- var options = {
1334
+ const timeServerUrl = new URL(args.time);
1335
+ const options = {
1336
+ protocol: timeServerUrl.protocol,
1337
+ hostname: timeServerUrl.hostname,
1338
+ path: timeServerUrl.pathname,
1339
+ port: ((timeServerUrl.port == '') ? 80 : parseInt(timeServerUrl.port)),
1340
method: 'POST',
1341
headers: {
1342
'accept': 'application/octet-stream',
@@ -1339,13 +1349,13 @@ function createAuthenticodeHandler(path) {
1349
1350
// Set up the request
1351
var responseAccumulator = '';
1342
- var req = http.request(args.time, options, function (res) {
1352
+ var req = http.request(options, function (res) {
1353
res.setEncoding('utf8');
1354
res.on('data', function (chunk) { responseAccumulator += chunk; });
1355
res.on('end', function () {
1356
// Decode the timestamp signature block
1347
- const timepkcs7der = null;
1348
- try { forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(responseAccumulator, 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
1357
+ var timepkcs7der = null;
1358
+ try { timepkcs7der = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(responseAccumulator, 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
1359
1360
// Get the ASN1 certificates used to sign the timestamp and add them to the certs in the PKCS7 of the executable
1361
// TODO: We could look to see if the certificate is already present in the executable
@@ -1642,7 +1652,12 @@ function createAuthenticodeHandler(path) {
1652
1653
// Make an HTTP request
1654
const http = require('http');
1645
- var options = {
1655
+ const timeServerUrl = new URL(args.time);
1656
+ const options = {
1657
+ protocol: timeServerUrl.protocol,
1658
+ hostname: timeServerUrl.hostname,
1659
+ path: timeServerUrl.pathname,
1660
+ port: ((timeServerUrl.port == '') ? 80 : parseInt(timeServerUrl.port)),
1661
method: 'POST',
1662
headers: {
1663
'accept': 'application/octet-stream',
@@ -1655,12 +1670,13 @@ function createAuthenticodeHandler(path) {
1670
1671
// Set up the request
1672
var responseAccumulator = '';
1658
- var req = http.request(args.time, options, function (res) {
1673
+ var req = http.request(options, function (res) {
1674
res.setEncoding('utf8');
1675
res.on('data', function (chunk) { responseAccumulator += chunk; });
1676
res.on('end', function () {
1677
// Decode the timestamp signature block
1663
- const timepkcs7der = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(responseAccumulator, 'base64').toString('binary')));
1678
+ var timepkcs7der = null;
1679
+ try { timepkcs7der = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(responseAccumulator, 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
1680
1681
// Get the ASN1 certificates used to sign the timestamp and add them to the certs in the PKCS7 of the executable
1682
// TODO: We could look to see if the certificate is already present in the executable