1// Copyright (c) 2017, Google Inc. 2// 3// Permission to use, copy, modify, and/or distribute this software for any 4// purpose with or without fee is hereby granted, provided that the above 5// copyright notice and this permission notice appear in all copies. 6// 7// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 8// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 9// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 10// SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 11// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION 12// OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN 13// CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ 14 15// inject-hash parses an archive containing a file object file. It finds a FIPS 16// module inside that object, calculates its hash and replaces the default hash 17// value in the object with the calculated value. 18package main 19 20import ( 21 "bytes" 22 "crypto/hmac" 23 "crypto/sha512" 24 "debug/elf" 25 "errors" 26 "flag" 27 "fmt" 28 "io" 29 "io/ioutil" 30 "os" 31) 32 33func do(outPath, oInput string, arInput string) error { 34 var objectBytes []byte 35 if len(arInput) > 0 { 36 if len(oInput) > 0 { 37 return fmt.Errorf("-in-archive and -in-object are mutually exclusive") 38 } 39 40 arFile, err := os.Open(arInput) 41 if err != nil { 42 return err 43 } 44 defer arFile.Close() 45 46 ar, err := ParseAR(arFile) 47 if err != nil { 48 return err 49 } 50 51 if len(ar) != 1 { 52 return fmt.Errorf("expected one file in archive, but found %d", len(ar)) 53 } 54 55 for _, contents := range ar { 56 objectBytes = contents 57 } 58 } else if len(oInput) > 0 { 59 var err error 60 if objectBytes, err = ioutil.ReadFile(oInput); err != nil { 61 return err 62 } 63 } else { 64 return fmt.Errorf("exactly one of -in-archive or -in-object is required") 65 } 66 67 object, err := elf.NewFile(bytes.NewReader(objectBytes)) 68 if err != nil { 69 return errors.New("failed to parse object: " + err.Error()) 70 } 71 72 // Find the .text section. 73 74 var textSection *elf.Section 75 var textSectionIndex elf.SectionIndex 76 for i, section := range object.Sections { 77 if section.Name == ".text" { 78 textSectionIndex = elf.SectionIndex(i) 79 textSection = section 80 break 81 } 82 } 83 84 if textSection == nil { 85 return errors.New("failed to find .text section in object") 86 } 87 88 // Find the starting and ending symbols for the module. 89 90 var startSeen, endSeen bool 91 var start, end uint64 92 93 symbols, err := object.Symbols() 94 if err != nil { 95 return errors.New("failed to parse symbols: " + err.Error()) 96 } 97 98 for _, symbol := range symbols { 99 if symbol.Section != textSectionIndex { 100 continue 101 } 102 103 switch symbol.Name { 104 case "BORINGSSL_bcm_text_start": 105 if startSeen { 106 return errors.New("duplicate start symbol found") 107 } 108 startSeen = true 109 start = symbol.Value 110 case "BORINGSSL_bcm_text_end": 111 if endSeen { 112 return errors.New("duplicate end symbol found") 113 } 114 endSeen = true 115 end = symbol.Value 116 default: 117 continue 118 } 119 } 120 121 if !startSeen || !endSeen { 122 return errors.New("could not find module boundaries in object") 123 } 124 125 if max := textSection.Size; start > max || start > end || end > max { 126 return fmt.Errorf("invalid module boundaries: start: %x, end: %x, max: %x", start, end, max) 127 } 128 129 // Extract the module from the .text section and hash it. 130 131 text := textSection.Open() 132 if _, err := text.Seek(int64(start), 0); err != nil { 133 return errors.New("failed to seek to module start in .text: " + err.Error()) 134 } 135 moduleText := make([]byte, end-start) 136 if _, err := io.ReadFull(text, moduleText); err != nil { 137 return errors.New("failed to read .text: " + err.Error()) 138 } 139 140 var zeroKey [64]byte 141 mac := hmac.New(sha512.New, zeroKey[:]) 142 mac.Write(moduleText) 143 calculated := mac.Sum(nil) 144 145 // Replace the default hash value in the object with the calculated 146 // value and write it out. 147 148 offset := bytes.Index(objectBytes, uninitHashValue[:]) 149 if offset < 0 { 150 return errors.New("did not find uninitialised hash value in object file") 151 } 152 153 if bytes.Index(objectBytes[offset+1:], uninitHashValue[:]) >= 0 { 154 return errors.New("found two occurrences of uninitialised hash value in object file") 155 } 156 157 copy(objectBytes[offset:], calculated) 158 159 return ioutil.WriteFile(outPath, objectBytes, 0644) 160} 161 162func main() { 163 arInput := flag.String("in-archive", "", "Path to a .a file") 164 oInput := flag.String("in-object", "", "Path to a .o file") 165 outPath := flag.String("o", "", "Path to output object") 166 167 flag.Parse() 168 169 if err := do(*outPath, *oInput, *arInput); err != nil { 170 fmt.Fprintf(os.Stderr, "%s\n", err) 171 os.Exit(1) 172 } 173} 174