1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
/* SPDX-License-Identifier: MIT
*
* Copyright (C) 2019-2020 WireGuard LLC. All Rights Reserved.
*/
package version
import (
"os"
"unsafe"
"golang.org/x/sys/windows"
)
const (
officialCommonName = "WireGuard LLC"
evPolicyOid = "2.23.140.1.3"
policyExtensionOid = "2.5.29.32"
)
func VerifyAuthenticode(path string) bool {
path16, err := windows.UTF16PtrFromString(path)
if err != nil {
return false
}
data := &windows.WinTrustData{
Size: uint32(unsafe.Sizeof(windows.WinTrustData{})),
UIChoice: windows.WTD_UI_NONE,
RevocationChecks: windows.WTD_REVOKE_WHOLECHAIN, // Full revocation checking, as this is called with network connectivity.
UnionChoice: windows.WTD_CHOICE_FILE,
StateAction: windows.WTD_STATEACTION_VERIFY,
FileOrCatalogOrBlobOrSgnrOrCert: unsafe.Pointer(&windows.WinTrustFileInfo{
Size: uint32(unsafe.Sizeof(windows.WinTrustFileInfo{})),
FilePath: path16,
}),
}
return windows.WinVerifyTrustEx(windows.InvalidHWND, &windows.WINTRUST_ACTION_GENERIC_VERIFY_V2, data) == nil
}
// These are easily by-passable checks, which do not serve serve security purposes. Do not place security-sensitive
// functions below this line.
func IsRunningOfficialVersion() bool {
path, err := os.Executable()
if err != nil {
return false
}
names, err := extractCertificateNames(path)
if err != nil {
return false
}
for _, name := range names {
if name == officialCommonName {
return true
}
}
return false
}
func IsRunningEVSigned() bool {
path, err := os.Executable()
if err != nil {
return false
}
policies, err := extractCertificatePolicies(path, policyExtensionOid)
if err != nil {
return false
}
for _, policy := range policies {
if policy == evPolicyOid {
return true
}
}
return false
}
|
