Commit | Line | Data |
---|---|---|
ea542140 DK |
1 | #include <config.h> |
2 | ||
b3d44315 MV |
3 | #include <apt-pkg/error.h> |
4 | #include <apt-pkg/acquire-method.h> | |
5 | #include <apt-pkg/strutl.h> | |
46e39c8e | 6 | #include <apt-pkg/fileutl.h> |
a319c4ee | 7 | #include <apt-pkg/indexcopy.h> |
b3d44315 | 8 | |
b3d44315 MV |
9 | #include <utime.h> |
10 | #include <stdio.h> | |
11 | #include <fcntl.h> | |
12 | #include <errno.h> | |
13 | #include <sys/wait.h> | |
14 | #include <iostream> | |
da9ed163 | 15 | #include <sstream> |
f5a3d009 DK |
16 | #include <vector> |
17 | ||
ea542140 DK |
18 | #include <apti18n.h> |
19 | ||
b3d44315 MV |
20 | #define GNUPGPREFIX "[GNUPG:]" |
21 | #define GNUPGBADSIG "[GNUPG:] BADSIG" | |
22 | #define GNUPGNOPUBKEY "[GNUPG:] NO_PUBKEY" | |
23 | #define GNUPGVALIDSIG "[GNUPG:] VALIDSIG" | |
c5d8878d MV |
24 | #define GNUPGGOODSIG "[GNUPG:] GOODSIG" |
25 | #define GNUPGKEYEXPIRED "[GNUPG:] KEYEXPIRED" | |
26 | #define GNUPGREVKEYSIG "[GNUPG:] REVKEYSIG" | |
2abb68b7 | 27 | #define GNUPGNODATA "[GNUPG:] NODATA" |
b3d44315 MV |
28 | |
29 | class GPGVMethod : public pkgAcqMethod | |
30 | { | |
31 | private: | |
da9ed163 | 32 | string VerifyGetSigners(const char *file, const char *outfile, |
c5d8878d MV |
33 | vector<string> &GoodSigners, |
34 | vector<string> &BadSigners, | |
35 | vector<string> &WorthlessSigners, | |
b3d44315 MV |
36 | vector<string> &NoPubKeySigners); |
37 | ||
38 | protected: | |
39 | virtual bool Fetch(FetchItem *Itm); | |
40 | ||
41 | public: | |
42 | ||
43 | GPGVMethod() : pkgAcqMethod("1.0",SingleInstance | SendConfig) {}; | |
44 | }; | |
45 | ||
da9ed163 | 46 | string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile, |
b3d44315 MV |
47 | vector<string> &GoodSigners, |
48 | vector<string> &BadSigners, | |
c5d8878d | 49 | vector<string> &WorthlessSigners, |
b3d44315 MV |
50 | vector<string> &NoPubKeySigners) |
51 | { | |
46e39c8e | 52 | bool const Debug = _config->FindB("Debug::Acquire::gpgv", false); |
da9ed163 MV |
53 | // setup a (empty) stringstream for formating the return value |
54 | std::stringstream ret; | |
b2c22075 | 55 | ret.str(""); |
da9ed163 | 56 | |
46e39c8e MV |
57 | if (Debug == true) |
58 | std::clog << "inside VerifyGetSigners" << std::endl; | |
59 | ||
b3d44315 | 60 | int fd[2]; |
46e39c8e | 61 | |
b3d44315 | 62 | if (pipe(fd) < 0) |
b3d44315 | 63 | return "Couldn't create pipe"; |
b3d44315 | 64 | |
cf440fac | 65 | pid_t pid = fork(); |
b3d44315 | 66 | if (pid < 0) |
da9ed163 | 67 | return string("Couldn't spawn new process") + strerror(errno); |
b3d44315 MV |
68 | else if (pid == 0) |
69 | { | |
89c4c588 MV |
70 | _error->PushToStack(); |
71 | bool const success = SigVerify::RunGPGV(outfile, file, 3, fd); | |
72 | if (success == false) | |
b3d44315 | 73 | { |
89c4c588 MV |
74 | string errmsg; |
75 | _error->PopMessage(errmsg); | |
76 | _error->RevertToStack(); | |
77 | return errmsg; | |
b3d44315 | 78 | } |
89c4c588 | 79 | _error->RevertToStack(); |
b3d44315 MV |
80 | exit(111); |
81 | } | |
82 | close(fd[1]); | |
83 | ||
cf440fac DK |
84 | FILE *pipein = fdopen(fd[0], "r"); |
85 | ||
b3d44315 MV |
86 | // Loop over the output of gpgv, and check the signatures. |
87 | size_t buffersize = 64; | |
88 | char *buffer = (char *) malloc(buffersize); | |
89 | size_t bufferoff = 0; | |
90 | while (1) | |
91 | { | |
92 | int c; | |
93 | ||
94 | // Read a line. Sigh. | |
95 | while ((c = getc(pipein)) != EOF && c != '\n') | |
96 | { | |
97 | if (bufferoff == buffersize) | |
98 | buffer = (char *) realloc(buffer, buffersize *= 2); | |
99 | *(buffer+bufferoff) = c; | |
100 | bufferoff++; | |
101 | } | |
102 | if (bufferoff == 0 && c == EOF) | |
103 | break; | |
104 | *(buffer+bufferoff) = '\0'; | |
105 | bufferoff = 0; | |
46e39c8e MV |
106 | if (Debug == true) |
107 | std::clog << "Read: " << buffer << std::endl; | |
b3d44315 MV |
108 | |
109 | // Push the data into three separate vectors, which | |
110 | // we later concatenate. They're kept separate so | |
111 | // if we improve the apt method communication stuff later | |
112 | // it will be better. | |
113 | if (strncmp(buffer, GNUPGBADSIG, sizeof(GNUPGBADSIG)-1) == 0) | |
114 | { | |
46e39c8e MV |
115 | if (Debug == true) |
116 | std::clog << "Got BADSIG! " << std::endl; | |
b3d44315 MV |
117 | BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX))); |
118 | } | |
119 | ||
120 | if (strncmp(buffer, GNUPGNOPUBKEY, sizeof(GNUPGNOPUBKEY)-1) == 0) | |
121 | { | |
46e39c8e MV |
122 | if (Debug == true) |
123 | std::clog << "Got NO_PUBKEY " << std::endl; | |
b3d44315 MV |
124 | NoPubKeySigners.push_back(string(buffer+sizeof(GNUPGPREFIX))); |
125 | } | |
2abb68b7 MV |
126 | if (strncmp(buffer, GNUPGNODATA, sizeof(GNUPGBADSIG)-1) == 0) |
127 | { | |
46e39c8e MV |
128 | if (Debug == true) |
129 | std::clog << "Got NODATA! " << std::endl; | |
2abb68b7 MV |
130 | BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX))); |
131 | } | |
c5d8878d MV |
132 | if (strncmp(buffer, GNUPGKEYEXPIRED, sizeof(GNUPGKEYEXPIRED)-1) == 0) |
133 | { | |
46e39c8e MV |
134 | if (Debug == true) |
135 | std::clog << "Got KEYEXPIRED! " << std::endl; | |
c5d8878d MV |
136 | WorthlessSigners.push_back(string(buffer+sizeof(GNUPGPREFIX))); |
137 | } | |
138 | if (strncmp(buffer, GNUPGREVKEYSIG, sizeof(GNUPGREVKEYSIG)-1) == 0) | |
139 | { | |
46e39c8e MV |
140 | if (Debug == true) |
141 | std::clog << "Got REVKEYSIG! " << std::endl; | |
c5d8878d MV |
142 | WorthlessSigners.push_back(string(buffer+sizeof(GNUPGPREFIX))); |
143 | } | |
144 | if (strncmp(buffer, GNUPGGOODSIG, sizeof(GNUPGGOODSIG)-1) == 0) | |
b3d44315 MV |
145 | { |
146 | char *sig = buffer + sizeof(GNUPGPREFIX); | |
c5d8878d | 147 | char *p = sig + sizeof("GOODSIG"); |
b3d44315 MV |
148 | while (*p && isxdigit(*p)) |
149 | p++; | |
150 | *p = 0; | |
46e39c8e MV |
151 | if (Debug == true) |
152 | std::clog << "Got GOODSIG, key ID:" << sig << std::endl; | |
b3d44315 MV |
153 | GoodSigners.push_back(string(sig)); |
154 | } | |
155 | } | |
156 | fclose(pipein); | |
157 | ||
cf440fac | 158 | int status; |
b3d44315 | 159 | waitpid(pid, &status, 0); |
46e39c8e | 160 | if (Debug == true) |
b3d44315 | 161 | { |
46e39c8e | 162 | std::clog << "gpgv exited\n"; |
b3d44315 MV |
163 | } |
164 | ||
165 | if (WEXITSTATUS(status) == 0) | |
166 | { | |
167 | if (GoodSigners.empty()) | |
339690e4 | 168 | return _("Internal error: Good signature, but could not determine key fingerprint?!"); |
da9ed163 | 169 | return ""; |
b3d44315 MV |
170 | } |
171 | else if (WEXITSTATUS(status) == 1) | |
172 | { | |
339690e4 | 173 | return _("At least one invalid signature was encountered."); |
b3d44315 MV |
174 | } |
175 | else if (WEXITSTATUS(status) == 111) | |
176 | { | |
cf440fac | 177 | ioprintf(ret, _("Could not execute 'gpgv' to verify signature (is gpgv installed?)")); |
da9ed163 | 178 | return ret.str(); |
b3d44315 MV |
179 | } |
180 | else | |
181 | { | |
339690e4 | 182 | return _("Unknown error executing gpgv"); |
b3d44315 MV |
183 | } |
184 | } | |
185 | ||
186 | bool GPGVMethod::Fetch(FetchItem *Itm) | |
187 | { | |
188 | URI Get = Itm->Uri; | |
189 | string Path = Get.Host + Get.Path; // To account for relative paths | |
190 | string keyID; | |
191 | vector<string> GoodSigners; | |
192 | vector<string> BadSigners; | |
c5d8878d MV |
193 | // a worthless signature is a expired or revoked one |
194 | vector<string> WorthlessSigners; | |
b3d44315 MV |
195 | vector<string> NoPubKeySigners; |
196 | ||
197 | FetchResult Res; | |
198 | Res.Filename = Itm->DestFile; | |
199 | URIStart(Res); | |
200 | ||
201 | // Run gpgv on file, extract contents and get the key ID of the signer | |
da9ed163 | 202 | string msg = VerifyGetSigners(Path.c_str(), Itm->DestFile.c_str(), |
c5d8878d MV |
203 | GoodSigners, BadSigners, WorthlessSigners, |
204 | NoPubKeySigners); | |
b3d44315 MV |
205 | if (GoodSigners.empty() || !BadSigners.empty() || !NoPubKeySigners.empty()) |
206 | { | |
207 | string errmsg; | |
208 | // In this case, something bad probably happened, so we just go | |
209 | // with what the other method gave us for an error message. | |
c5d8878d | 210 | if (BadSigners.empty() && WorthlessSigners.empty() && NoPubKeySigners.empty()) |
b3d44315 MV |
211 | errmsg = msg; |
212 | else | |
213 | { | |
214 | if (!BadSigners.empty()) | |
215 | { | |
339690e4 | 216 | errmsg += _("The following signatures were invalid:\n"); |
b3d44315 MV |
217 | for (vector<string>::iterator I = BadSigners.begin(); |
218 | I != BadSigners.end(); I++) | |
219 | errmsg += (*I + "\n"); | |
220 | } | |
c5d8878d MV |
221 | if (!WorthlessSigners.empty()) |
222 | { | |
223 | errmsg += _("The following signatures were invalid:\n"); | |
224 | for (vector<string>::iterator I = WorthlessSigners.begin(); | |
225 | I != WorthlessSigners.end(); I++) | |
226 | errmsg += (*I + "\n"); | |
227 | } | |
b3d44315 MV |
228 | if (!NoPubKeySigners.empty()) |
229 | { | |
339690e4 | 230 | errmsg += _("The following signatures couldn't be verified because the public key is not available:\n"); |
b3d44315 MV |
231 | for (vector<string>::iterator I = NoPubKeySigners.begin(); |
232 | I != NoPubKeySigners.end(); I++) | |
233 | errmsg += (*I + "\n"); | |
234 | } | |
235 | } | |
ce424cd4 MV |
236 | // this is only fatal if we have no good sigs or if we have at |
237 | // least one bad signature. good signatures and NoPubKey signatures | |
238 | // happen easily when a file is signed with multiple signatures | |
239 | if(GoodSigners.empty() or !BadSigners.empty()) | |
f23153d0 | 240 | return _error->Error("%s", errmsg.c_str()); |
b3d44315 MV |
241 | } |
242 | ||
b3d44315 MV |
243 | // Just pass the raw output up, because passing it as a real data |
244 | // structure is too difficult with the method stuff. We keep it | |
245 | // as three separate vectors for future extensibility. | |
246 | Res.GPGVOutput = GoodSigners; | |
247 | Res.GPGVOutput.insert(Res.GPGVOutput.end(),BadSigners.begin(),BadSigners.end()); | |
248 | Res.GPGVOutput.insert(Res.GPGVOutput.end(),NoPubKeySigners.begin(),NoPubKeySigners.end()); | |
249 | URIDone(Res); | |
250 | ||
251 | if (_config->FindB("Debug::Acquire::gpgv", false)) | |
252 | { | |
46e39c8e | 253 | std::clog << "gpgv succeeded\n"; |
b3d44315 MV |
254 | } |
255 | ||
256 | return true; | |
257 | } | |
258 | ||
259 | ||
260 | int main() | |
261 | { | |
339690e4 MV |
262 | setlocale(LC_ALL, ""); |
263 | ||
b3d44315 MV |
264 | GPGVMethod Mth; |
265 | ||
266 | return Mth.Run(); | |
267 | } |