Make the script usable without a .config file.
Unified · Split
| @@ -723,7 +723,7 @@ ifeq ($(CONFIG_MODULE_SIG),y) · 722 unmodified lines | ||
| 723 | 723 | MODSECKEY = ./signing_key.priv |
| 724 | 724 | MODPUBKEY = ./signing_key.x509 |
| 725 | 725 | export MODPUBKEY |
| 726 | −mod_sign_cmd = perl $(srctree)/scripts/sign-file $(MODSECKEY) $(MODPUBKEY) | |
| 726 | +mod_sign_cmd = perl $(srctree)/scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(MODSECKEY) $(MODPUBKEY) | |
| 727 | 727 | else |
| 728 | 728 | mod_sign_cmd = true |
| 729 | 729 | endif |
| @@ -4,7 +4,7 @@ · 3 unmodified lines | ||
| 4 | 4 | # |
| 5 | 5 | # Format: |
| 6 | 6 | # |
| 7 | −# ./scripts/sign-file [-v] <key> <x509> <module> [<dest>] | |
| 7 | +# ./scripts/sign-file [-v] <hash algo> <key> <x509> <module> [<dest>] | |
| 8 | 8 | # |
| 9 | 9 | # |
| 10 | 10 | use strict; |
| @@ -17,35 +17,19 @@ if ($#ARGV >= 0 && $ARGV[0] eq "-v") { · 6 unmodified lines | ||
| 17 | 17 | shift; |
| 18 | 18 | } |
| 19 | 19 | |
| 20 | −die "Format: ./scripts/sign-file [-v] <key> <x509> <module> [<dest>]\n" | |
| 21 | − if ($#ARGV != 2 && $#ARGV != 3); | |
| 20 | +die "Format: ./scripts/sign-file [-v] <hash algo> <key> <x509> <module> [<dest>]\n" | |
| 21 | + if ($#ARGV != 3 && $#ARGV != 4); | |
| 22 | 22 | |
| 23 | −my $private_key = $ARGV[0]; | |
| 24 | −my $x509 = $ARGV[1]; | |
| 25 | −my $module = $ARGV[2]; | |
| 26 | −my $dest = ($#ARGV == 3) ? $ARGV[3] : $ARGV[2] . "~"; | |
| 23 | +my $dgst = $ARGV[0]; | |
| 24 | +my $private_key = $ARGV[1]; | |
| 25 | +my $x509 = $ARGV[2]; | |
| 26 | +my $module = $ARGV[3]; | |
| 27 | +my $dest = ($#ARGV == 4) ? $ARGV[4] : $ARGV[3] . "~"; | |
| 27 | 28 | |
| 28 | 29 | die "Can't read private key\n" unless (-r $private_key); |
| 29 | 30 | die "Can't read X.509 certificate\n" unless (-r $x509); |
| 30 | 31 | die "Can't read module\n" unless (-r $module); |
| 31 | 32 | |
| 32 | −# | |
| 33 | −# Read the kernel configuration | |
| 34 | −# | |
| 35 | −my %config = ( | |
| 36 | − CONFIG_MODULE_SIG_SHA512 => 1 | |
| 37 | − ); | |
| 38 | − | |
| 39 | −if (-r ".config") { | |
| 40 | − open(FD, "<.config") || die ".config"; | |
| 41 | − while (<FD>) { | |
| 42 | − if ($_ =~ /^(CONFIG_.*)=[ym]/) { | |
| 43 | − $config{$1} = 1; | |
| 44 | − } | |
| 45 | − } | |
| 46 | − close(FD); | |
| 47 | −} | |
| 48 | − | |
| 49 | 33 | # |
| 50 | 34 | # Function to read the contents of a file into a variable. |
| 51 | 35 | # |
| @@ -321,51 +305,46 @@ my $id_type = 1; # Identifier type: X.509 · 269 unmodified lines | ||
| 321 | 305 | # |
| 322 | 306 | # Digest the data |
| 323 | 307 | # |
| 324 | −my ($dgst, $prologue) = (); | |
| 325 | −if (exists $config{"CONFIG_MODULE_SIG_SHA1"}) { | |
| 308 | +my $prologue; | |
| 309 | +if ($dgst eq "sha1") { | |
| 326 | 310 | $prologue = pack("C*", |
| 327 | 311 | 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, |
| 328 | 312 | 0x2B, 0x0E, 0x03, 0x02, 0x1A, |
| 329 | 313 | 0x05, 0x00, 0x04, 0x14); |
| 330 | − $dgst = "-sha1"; | |
| 331 | 314 | $hash = 2; |
| 332 | −} elsif (exists $config{"CONFIG_MODULE_SIG_SHA224"}) { | |
| 315 | +} elsif ($dgst eq "sha224") { | |
| 333 | 316 | $prologue = pack("C*", |
| 334 | 317 | 0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09, |
| 335 | 318 | 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, |
| 336 | 319 | 0x05, 0x00, 0x04, 0x1C); |
| 337 | − $dgst = "-sha224"; | |
| 338 | 320 | $hash = 7; |
| 339 | −} elsif (exists $config{"CONFIG_MODULE_SIG_SHA256"}) { | |
| 321 | +} elsif ($dgst eq "sha256") { | |
| 340 | 322 | $prologue = pack("C*", |
| 341 | 323 | 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, |
| 342 | 324 | 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, |
| 343 | 325 | 0x05, 0x00, 0x04, 0x20); |
| 344 | − $dgst = "-sha256"; | |
| 345 | 326 | $hash = 4; |
| 346 | −} elsif (exists $config{"CONFIG_MODULE_SIG_SHA384"}) { | |
| 327 | +} elsif ($dgst eq "sha384") { | |
| 347 | 328 | $prologue = pack("C*", |
| 348 | 329 | 0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, |
| 349 | 330 | 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, |
| 350 | 331 | 0x05, 0x00, 0x04, 0x30); |
| 351 | − $dgst = "-sha384"; | |
| 352 | 332 | $hash = 5; |
| 353 | −} elsif (exists $config{"CONFIG_MODULE_SIG_SHA512"}) { | |
| 333 | +} elsif ($dgst eq "sha512") { | |
| 354 | 334 | $prologue = pack("C*", |
| 355 | 335 | 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, |
| 356 | 336 | 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, |
| 357 | 337 | 0x05, 0x00, 0x04, 0x40); |
| 358 | − $dgst = "-sha512"; | |
| 359 | 338 | $hash = 6; |
| 360 | 339 | } else { |
| 361 | − die "Can't determine hash algorithm"; | |
| 340 | + die "Unknown hash algorithm: $dgst\n"; | |
| 362 | 341 | } |
| 363 | 342 | |
| 364 | 343 | # |
| 365 | 344 | # Generate the digest and read from openssl's stdout |
| 366 | 345 | # |
| 367 | 346 | my $digest; |
| 368 | −$digest = readpipe("openssl dgst $dgst -binary $module") || die "openssl dgst"; | |
| 347 | +$digest = readpipe("openssl dgst -$dgst -binary $module") || die "openssl dgst"; | |
| 369 | 348 | |
| 370 | 349 | # |
| 371 | 350 | # Generate the binary signature, which will be just the integer that comprises |