Yaya48/dolphin
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove the EnableSignatureChecks setting

Browse Source 
Since Dolphin can do NUS downloads over plain HTTP, we really don't
want people to be able to silently disable signature verification
indefinitely. Removing the setting shouldn't have any significant
negative impact now that signature verification always is disabled
when installing WAD files.
This commit is contained in:
JosJuice committed 2019-07-21 18:47:35 +02:00
1 parent 4304f5f7fc
commit 732d157011
9 files changed
+42 -47
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Source/Core/Core/IOS/ES/ES.cpp
-6
View File
@@ -841,9 +841,6 @@ static const std::string CERT_STORE_PATH = "/sys/cert.sys";
ReturnCode ES::ReadCertStore(std::vector<u8>* buffer) const
{
if (!SConfig::GetInstance().m_enable_signature_checks)
return IPC_SUCCESS;
const auto store_file =
m_ios.GetFS()->OpenFile(PID_KERNEL, PID_KERNEL, CERT_STORE_PATH, FS::Mode::Read);
if (!store_file)
@@ -884,9 +881,6 @@ ReturnCode ES::VerifyContainer(VerifyContainerType type, VerifyMode mode,
const IOS::ES::SignedBlobReader& signed_blob,
const std::vector<u8>& cert_chain, u32* issuer_handle_out)
{
if (!SConfig::GetInstance().m_enable_signature_checks)
return IPC_SUCCESS;
if (!signed_blob.IsSignatureValid())
return ES_EINVAL;
Source/Core/Core/IOS/ES/ES.h
+9 -2
View File
@@ -104,11 +104,18 @@ public:
// Ticket is unpersonalised, so ignore any console specific decryption data.
Unpersonalised,
};
enum class VerifySignature
{
No,
Yes,
};
ReturnCode ImportTicket(const std::vector<u8>& ticket_bytes, const std::vector<u8>& cert_chain,
TicketImportType type = TicketImportType::PossiblyPersonalised);
TicketImportType type = TicketImportType::PossiblyPersonalised,
VerifySignature verify_signature = VerifySignature::Yes);
ReturnCode ImportTmd(Context& context, const std::vector<u8>& tmd_bytes);
ReturnCode ImportTitleInit(Context& context, const std::vector<u8>& tmd_bytes,
const std::vector<u8>& cert_chain);
const std::vector<u8>& cert_chain,
VerifySignature verify_signature = VerifySignature::Yes);
ReturnCode ImportContentBegin(Context& context, u64 title_id, u32 content_id);
ReturnCode ImportContentData(Context& context, u32 content_fd, const u8* data, u32 data_size);
ReturnCode ImportContentEnd(Context& context, u32 content_fd);
Source/Core/Core/IOS/ES/Identity.cpp
-6
View File
@@ -120,12 +120,6 @@ IPCCommandResult ES::Sign(const IOCtlVRequest& request)
ReturnCode ES::VerifySign(const std::vector<u8>& hash, const std::vector<u8>& ecc_signature,
const std::vector<u8>& certs_bytes)
{
if (!SConfig::GetInstance().m_enable_signature_checks)
{
WARN_LOG(IOS_ES, "VerifySign: signature checks are disabled. Skipping.");
return IPC_SUCCESS;
}
const std::map<std::string, IOS::ES::CertReader> certs = IOS::ES::ParseCertChain(certs_bytes);
if (certs.empty())
return ES_EINVAL;
Source/Core/Core/IOS/ES/TitleManagement.cpp
+29 -18
View File
@@ -51,7 +51,7 @@ void ES::TitleImportExportContext::DoState(PointerWrap& p)
}
ReturnCode ES::ImportTicket(const std::vector<u8>& ticket_bytes, const std::vector<u8>& cert_chain,
TicketImportType type)
TicketImportType type, VerifySignature verify_signature)
{
IOS::ES::TicketReader ticket{ticket_bytes};
if (!ticket.IsValid())
@@ -75,10 +75,13 @@ ReturnCode ES::ImportTicket(const std::vector<u8>& ticket_bytes, const std::vect
}
}
const ReturnCode verify_ret =
VerifyContainer(VerifyContainerType::Ticket, VerifyMode::UpdateCertStore, ticket, cert_chain);
if (verify_ret != IPC_SUCCESS)
return verify_ret;
if (verify_signature != VerifySignature::No)
{
const ReturnCode verify_ret = VerifyContainer(VerifyContainerType::Ticket,
VerifyMode::UpdateCertStore, ticket, cert_chain);
if (verify_ret != IPC_SUCCESS)
return verify_ret;
}
const ReturnCode write_ret = WriteTicket(m_ios.GetFS().get(), ticket);
if (write_ret != IPC_SUCCESS)
@@ -207,7 +210,7 @@ static ReturnCode InitTitleImportKey(const std::vector<u8>& ticket_bytes, IOSC&
}
ReturnCode ES::ImportTitleInit(Context& context, const std::vector<u8>& tmd_bytes,
const std::vector<u8>& cert_chain)
const std::vector<u8>& cert_chain, VerifySignature verify_signature)
{
INFO_LOG(IOS_ES, "ImportTitleInit");
ResetTitleImportContext(&context, m_ios.GetIOSC());
@@ -221,24 +224,32 @@ ReturnCode ES::ImportTitleInit(Context& context, const std::vector<u8>& tmd_byte
// Finish a previous import (if it exists).
FinishStaleImport(context.title_import_export.tmd.GetTitleId());
ReturnCode ret = VerifyContainer(VerifyContainerType::TMD, VerifyMode::UpdateCertStore,
context.title_import_export.tmd, cert_chain);
if (ret != IPC_SUCCESS)
return ret;
ReturnCode ret = IPC_SUCCESS;
if (verify_signature != VerifySignature::No)
{
ret = VerifyContainer(VerifyContainerType::TMD, VerifyMode::UpdateCertStore,
context.title_import_export.tmd, cert_chain);
if (ret != IPC_SUCCESS)
return ret;
}
const auto ticket = FindSignedTicket(context.title_import_export.tmd.GetTitleId());
if (!ticket.IsValid())
return ES_NO_TICKET;
std::vector<u8> cert_store;
ret = ReadCertStore(&cert_store);
if (ret != IPC_SUCCESS)
return ret;
if (verify_signature != VerifySignature::No)
{
std::vector<u8> cert_store;
ret = ReadCertStore(&cert_store);
if (ret != IPC_SUCCESS)
return ret;
ret = VerifyContainer(VerifyContainerType::Ticket, VerifyMode::DoNotUpdateCertStore, ticket,
cert_store);
if (ret != IPC_SUCCESS)
return ret;
ret = VerifyContainer(VerifyContainerType::Ticket, VerifyMode::DoNotUpdateCertStore, ticket,
cert_store);
if (ret != IPC_SUCCESS)
return ret;
}
ret = InitTitleImportKey(ticket.GetBytes(), m_ios.GetIOSC(),
&context.title_import_export.key_handle);