folkslinux
/
rpm
mirror of https://github.com/rpm-software-management/rpm.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
rpm/lib/rpmvs.c

451 lines
11 KiB
C
Raw Normal View History

Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
#include "system.h"
#include <rpm/rpmkeyring.h>
#include "lib/rpmvs.h"
#include "rpmio/digest.h"
#include "debug.h"
struct rpmvs_s {
struct rpmsinfo_s *sigs;
int nsigs;
Handle dynamic reallocation in rpmvsAppend() Preallocate a little but (for now) so little that reallocation always takes place so it doesn't rot while surroundings still change.
2017-05-22 17:32:32 +08:00
int nalloced;
Always honor vsflags when appending new items to verify set Remember the vsflags passed to us in rpmvsCreate(), check for disabled in rpmvsAppend() instead.
2018-04-05 19:10:37 +08:00
rpmVSFlags vsflags;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
};
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
struct vfytag_s {
rpmTagVal tag;
rpmTagType tagtype;
rpm_count_t tagcount;
rpm_count_t tagsize;
};
static const struct vfytag_s rpmvfytags[] = {
{ RPMSIGTAG_SIZE, RPM_BIN_TYPE, 0, 0, },
{ RPMSIGTAG_PGP, RPM_BIN_TYPE, 0, 0, },
{ RPMSIGTAG_MD5, RPM_BIN_TYPE, 0, 16, },
{ RPMSIGTAG_GPG, RPM_BIN_TYPE, 0, 0, },
{ RPMSIGTAG_PGP5, RPM_BIN_TYPE, 0, 0, },
{ RPMSIGTAG_PAYLOADSIZE, RPM_INT32_TYPE, 1, 4, },
{ RPMSIGTAG_RESERVEDSPACE, RPM_BIN_TYPE, 0, 0, },
{ RPMTAG_DSAHEADER, RPM_BIN_TYPE, 0, 0, },
{ RPMTAG_RSAHEADER, RPM_BIN_TYPE, 0, 0, },
{ RPMTAG_SHA1HEADER, RPM_STRING_TYPE, 1, 41, },
{ RPMSIGTAG_LONGSIZE, RPM_INT64_TYPE, 1, 8, },
{ RPMSIGTAG_LONGARCHIVESIZE, RPM_INT64_TYPE, 1, 8, },
{ RPMTAG_SHA256HEADER, RPM_STRING_TYPE, 1, 65, },
{ RPMTAG_PAYLOADDIGEST, RPM_STRING_ARRAY_TYPE, 0, 0, },
{ 0 } /* sentinel */
};
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
struct vfyinfo_s {
rpmTagVal tag;
struct rpmsinfo_s vi;
};
static const struct vfyinfo_s rpmvfyitems[] = {
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMSIGTAG_SIZE,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_OTHER_TYPE, 0,
(RPMSIG_HEADER|RPMSIG_PAYLOAD), 0, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMSIGTAG_PGP,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_SIGNATURE_TYPE, RPMVSF_NORSA,
(RPMSIG_HEADER|RPMSIG_PAYLOAD), 0, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMSIGTAG_MD5,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_DIGEST_TYPE, RPMVSF_NOMD5,
(RPMSIG_HEADER|RPMSIG_PAYLOAD), PGPHASHALGO_MD5, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMSIGTAG_GPG,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_SIGNATURE_TYPE, RPMVSF_NODSA,
(RPMSIG_HEADER|RPMSIG_PAYLOAD), 0, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMSIGTAG_PGP5,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_SIGNATURE_TYPE, RPMVSF_NORSA,
(RPMSIG_HEADER|RPMSIG_PAYLOAD), 0, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMSIGTAG_PAYLOADSIZE,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_OTHER_TYPE, 0,
(RPMSIG_PAYLOAD), 0, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMSIGTAG_RESERVEDSPACE,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_OTHER_TYPE, 0,
0, 0, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMTAG_DSAHEADER,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_SIGNATURE_TYPE, RPMVSF_NODSAHEADER,
(RPMSIG_HEADER), 0, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMTAG_RSAHEADER,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_SIGNATURE_TYPE, RPMVSF_NORSAHEADER,
(RPMSIG_HEADER), 0, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMTAG_SHA1HEADER,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_DIGEST_TYPE, RPMVSF_NOSHA1HEADER,
(RPMSIG_HEADER), PGPHASHALGO_SHA1, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMSIGTAG_LONGSIZE,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_OTHER_TYPE, 0,
(RPMSIG_HEADER|RPMSIG_PAYLOAD), 0, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMSIGTAG_LONGARCHIVESIZE,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_OTHER_TYPE, 0,
(RPMSIG_HEADER|RPMSIG_PAYLOAD), 0, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMTAG_SHA256HEADER,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_DIGEST_TYPE, RPMVSF_NOSHA256HEADER,
(RPMSIG_HEADER), PGPHASHALGO_SHA256, }, },
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
{ RPMTAG_PAYLOADDIGEST,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_DIGEST_TYPE, RPMVSF_NOPAYLOAD,
(RPMSIG_PAYLOAD), PGPHASHALGO_SHA256, }, },
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{ 0 } /* sentinel */
};
Start separating verify item description from its result Add internal API to get a textual description of signature/digest, use where appropriate for formatting the verbose messages.
2017-05-24 16:20:35 +08:00
static const char *rangeName(int range);
Separate sig/dig verify results from verbose error messages Add and use an internal helper for formatting the verbose messages from callbacks, this gives us nicer and more uniform messages for data that failed to initialize at all. It's also ends up involving more rasprintf()'s and whatnot per result but that can be tuned later.
2017-05-24 17:17:46 +08:00
static const char * rpmSigString(rpmRC res);
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
static void rpmVerifySignature(rpmKeyring keyring, struct rpmsinfo_s *sinfo,
DIGEST_CTX ctx);
Bury remaining internal signature API inside rpmvs.c
2017-05-12 18:05:20 +08:00
Change sinfoLookup() to return an index into rpmvfyitems Not supposed to change any behavior, just preparing for the next steps.
2017-05-11 15:18:00 +08:00
static int sinfoLookup(rpmTagVal tag)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
const struct vfyinfo_s *start = &rpmvfyitems[0];
Change sinfoLookup() to return an index into rpmvfyitems Not supposed to change any behavior, just preparing for the next steps.
2017-05-11 15:18:00 +08:00
int ix = -1;
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
for (const struct vfyinfo_s *si = start; si->tag; si++) {
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
if (tag == si->tag) {
Change sinfoLookup() to return an index into rpmvfyitems Not supposed to change any behavior, just preparing for the next steps.
2017-05-11 15:18:00 +08:00
ix = si - start;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
break;
}
}
Change sinfoLookup() to return an index into rpmvfyitems Not supposed to change any behavior, just preparing for the next steps.
2017-05-11 15:18:00 +08:00
return ix;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
Split out hex validity checking to helper function, enhance Besides testing for valid characters, also test for legal length: always divisible by two, at least sha-1 size.
2017-05-30 15:16:05 +08:00
static int validHex(const char *str, size_t slen)
{
int valid = 0; /* Assume invalid */
const char *b;
/* Our hex data is always even sized and at least sha-1 long */
if (slen % 2 || slen < 40)
goto exit;
for (b = str ; *b != '\0'; b++) {
if (strchr("0123456789abcdefABCDEF", *b) == NULL)
goto exit;
}
valid = 1;
exit:
return valid;
}
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
static void rpmsinfoInit(const struct vfyinfo_s *vinfo,
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
const struct vfytag_s *tinfo,
rpmtd td, const char *origin,
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
struct rpmsinfo_s *sinfo)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
rpmRC rc = RPMRC_FAIL;
const void *data = NULL;
rpm_count_t dlen = 0;
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
*sinfo = vinfo->vi; /* struct assignment */
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
if (tinfo->tagtype && tinfo->tagtype != td->type) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg, _("%s tag %u: invalid type %u"),
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
origin, td->tag, td->type);
goto exit;
}
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
if (tinfo->tagcount && tinfo->tagcount != td->count) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg, _("%s: tag %u: invalid count %u"),
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
origin, td->tag, td->count);
goto exit;
}
switch (td->type) {
case RPM_STRING_TYPE:
case RPM_STRING_ARRAY_TYPE:
data = rpmtdGetString(td);
if (data)
dlen = strlen(data);
break;
case RPM_BIN_TYPE:
data = td->data;
dlen = td->count;
break;
}
/* MD5 has data length of 16, everything else is (much) larger */
if (sinfo->hashalgo && (data == NULL || dlen < 16)) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg, _("%s tag %u: invalid data %p (%u)"),
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
origin, td->tag, data, dlen);
goto exit;
}
if (td->type == RPM_STRING_TYPE && td->size == 0)
td->size = dlen + 1;
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
if (tinfo->tagsize && (td->flags & RPMTD_IMMUTABLE) &&
tinfo->tagsize != td->size) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg, _("%s tag %u: invalid size %u"),
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
origin, td->tag, td->size);
goto exit;
}
if (sinfo->type == RPMSIG_SIGNATURE_TYPE) {
if (pgpPrtParams(data, dlen, PGPTAG_SIGNATURE, &sinfo->sig)) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg, _("%s tag %u: invalid OpenPGP signature"),
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
origin, td->tag);
goto exit;
}
sinfo->hashalgo = pgpDigParamsAlgo(sinfo->sig, PGPVAL_HASHALGO);
sinfo->keyid = pgpGrab(sinfo->sig->signid+4, 4);
} else if (sinfo->type == RPMSIG_DIGEST_TYPE) {
Only non-binary digests have hex strings to validate
2017-05-30 17:31:49 +08:00
if (td->type == RPM_BIN_TYPE) {
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
sinfo->dig = pgpHexStr(data, dlen);
Only non-binary digests have hex strings to validate
2017-05-30 17:31:49 +08:00
} else {
if (!validHex(data, dlen)) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg,
_("%s: tag %u: invalid hex"), origin, td->tag);
Only non-binary digests have hex strings to validate
2017-05-30 17:31:49 +08:00
goto exit;
}
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
sinfo->dig = xstrdup(data);
Only non-binary digests have hex strings to validate
2017-05-30 17:31:49 +08:00
}
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
if (sinfo->hashalgo)
Account for arrays when generating verify item id Currently we only have one digest/signature per tag but that might change, account for this in the way we generate the id number: tag goes in the high 16 bits, array index into low 16 bits. I have some trouble seeing anybody needing more than 65536 signatures on a package...
2017-05-15 16:14:18 +08:00
sinfo->id = (td->tag << 16) | rpmtdGetIndex(td);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
rc = RPMRC_OK;
exit:
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
sinfo->rc = rc;
return;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
Bury remaining internal signature API inside rpmvs.c
2017-05-12 18:05:20 +08:00
static void rpmsinfoFini(struct rpmsinfo_s *sinfo)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
if (sinfo) {
if (sinfo->type == RPMSIG_SIGNATURE_TYPE)
pgpDigParamsFree(sinfo->sig);
else if (sinfo->type == RPMSIG_DIGEST_TYPE)
free(sinfo->dig);
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
free(sinfo->msg);
Start separating verify item description from its result Add internal API to get a textual description of signature/digest, use where appropriate for formatting the verbose messages.
2017-05-24 16:20:35 +08:00
free(sinfo->descr);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
memset(sinfo, 0, sizeof(*sinfo));
}
}
Bury remaining internal signature API inside rpmvs.c
2017-05-12 18:05:20 +08:00
static int rpmsinfoDisabled(const struct rpmsinfo_s *sinfo, rpmVSFlags vsflags)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
if (!(sinfo->type & RPMSIG_VERIFIABLE_TYPE))
return 1;
if (vsflags & sinfo->disabler)
return 1;
if ((vsflags & RPMVSF_NEEDPAYLOAD) && (sinfo->range & RPMSIG_PAYLOAD))
return 1;
return 0;
}
Handle dynamic reallocation in rpmvsAppend() Preallocate a little but (for now) so little that reallocation always takes place so it doesn't rot while surroundings still change.
2017-05-22 17:32:32 +08:00
static void rpmvsReserve(struct rpmvs_s *vs, int n)
{
if (vs->nsigs + n >= vs->nalloced) {
vs->nalloced = (vs->nsigs * 2) + n;
vs->sigs = xrealloc(vs->sigs, vs->nalloced * sizeof(*vs->sigs));
}
}
Start separating verify item description from its result Add internal API to get a textual description of signature/digest, use where appropriate for formatting the verbose messages.
2017-05-24 16:20:35 +08:00
const char *rpmsinfoDescr(struct rpmsinfo_s *sinfo)
{
if (sinfo->descr == NULL) {
char *t;
switch (sinfo->type) {
case RPMSIG_DIGEST_TYPE:
rasprintf(&sinfo->descr, _("%s%s %s"),
rangeName(sinfo->range),
pgpValString(PGPVAL_HASHALGO, sinfo->hashalgo),
_("digest"));
break;
case RPMSIG_SIGNATURE_TYPE:
t = sinfo->sig ? pgpIdentItem(sinfo->sig) : NULL;
rasprintf(&sinfo->descr, _("%s%s"),
rangeName(sinfo->range), t ? t : _("signature"));
free(t);
break;
}
}
return sinfo->descr;
}
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
char *rpmsinfoMsg(struct rpmsinfo_s *sinfo)
Separate sig/dig verify results from verbose error messages Add and use an internal helper for formatting the verbose messages from callbacks, this gives us nicer and more uniform messages for data that failed to initialize at all. It's also ends up involving more rasprintf()'s and whatnot per result but that can be tuned later.
2017-05-24 17:17:46 +08:00
{
char *msg = NULL;
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
if (sinfo->msg) {
Separate sig/dig verify results from verbose error messages Add and use an internal helper for formatting the verbose messages from callbacks, this gives us nicer and more uniform messages for data that failed to initialize at all. It's also ends up involving more rasprintf()'s and whatnot per result but that can be tuned later.
2017-05-24 17:17:46 +08:00
rasprintf(&msg, "%s: %s (%s)",
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rpmsinfoDescr(sinfo), rpmSigString(sinfo->rc), sinfo->msg);
Separate sig/dig verify results from verbose error messages Add and use an internal helper for formatting the verbose messages from callbacks, this gives us nicer and more uniform messages for data that failed to initialize at all. It's also ends up involving more rasprintf()'s and whatnot per result but that can be tuned later.
2017-05-24 17:17:46 +08:00
} else {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&msg, "%s: %s",
rpmsinfoDescr(sinfo), rpmSigString(sinfo->rc));
Separate sig/dig verify results from verbose error messages Add and use an internal helper for formatting the verbose messages from callbacks, this gives us nicer and more uniform messages for data that failed to initialize at all. It's also ends up involving more rasprintf()'s and whatnot per result but that can be tuned later.
2017-05-24 17:17:46 +08:00
}
return msg;
}
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
static void rpmvsAppend(struct rpmvs_s *sis, hdrblob blob,
const struct vfyinfo_s *vi, const struct vfytag_s *ti)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
Always honor vsflags when appending new items to verify set Remember the vsflags passed to us in rpmvsCreate(), check for disabled in rpmvsAppend() instead.
2018-04-05 19:10:37 +08:00
if (rpmsinfoDisabled(&vi->vi, sis->vsflags))
return;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
struct rpmtd_s td;
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
rpmRC rc = hdrblobGet(blob, vi->tag, &td);
Handle dynamic reallocation in rpmvsAppend() Preallocate a little but (for now) so little that reallocation always takes place so it doesn't rot while surroundings still change.
2017-05-22 17:32:32 +08:00
if (rc == RPMRC_OK) {
Use dribbles as heuristics for header/package output differentation Installed packages will have dribbles so their index length is larger than region length. The whole differentation is a bit arbitrary since the stuff is always headers of course, but keeping in tradition... This "fixes" the output for rpmReadPackageFile() to talk about packages and not headers because it always deals with packages.
2017-05-12 16:25:19 +08:00
const char *o = (blob->il > blob->ril) ? _("header") : _("package");
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
int ix;
Handle dynamic reallocation in rpmvsAppend() Preallocate a little but (for now) so little that reallocation always takes place so it doesn't rot while surroundings still change.
2017-05-22 17:32:32 +08:00
rpmvsReserve(sis, rpmtdCount(&td));
while ((ix = rpmtdNext(&td)) >= 0) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rpmsinfoInit(vi, ti, &td, o, &sis->sigs[sis->nsigs]);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
sis->nsigs++;
}
rpmtdFreeData(&td);
}
}
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
void rpmvsAppendTag(struct rpmvs_s *vs, hdrblob blob, rpmTagVal tag)
{
int ix = sinfoLookup(tag);
if (ix >= 0) {
const struct vfyinfo_s *vi = &rpmvfyitems[ix];
const struct vfytag_s *ti = &rpmvfytags[ix];
rpmvsAppend(vs, blob, vi, ti);
}
}
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
struct rpmvs_s *rpmvsCreate(hdrblob blob, rpmVSFlags vsflags)
{
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
const struct vfyinfo_s *si = &rpmvfyitems[0];
const struct vfytag_s *ti = &rpmvfytags[0];
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
struct rpmvs_s *sis = xcalloc(1, sizeof(*sis));
Always honor vsflags when appending new items to verify set Remember the vsflags passed to us in rpmvsCreate(), check for disabled in rpmvsAppend() instead.
2018-04-05 19:10:37 +08:00
sis->vsflags = vsflags;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
Handle dynamic reallocation in rpmvsAppend() Preallocate a little but (for now) so little that reallocation always takes place so it doesn't rot while surroundings still change.
2017-05-22 17:32:32 +08:00
rpmvsReserve(sis, 2); /* XXX bump this up later */
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
for (; si->tag && ti->tag; si++, ti++) {
rpmvsAppend(sis, blob, si, ti);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
return sis;
}
struct rpmvs_s *rpmvsFree(struct rpmvs_s *sis)
{
if (sis) {
for (int i = 0; i < sis->nsigs; i++) {
rpmsinfoFini(&sis->sigs[i]);
}
free(sis->sigs);
free(sis);
}
return NULL;
}
void rpmvsInitDigests(struct rpmvs_s *sis, int range, rpmDigestBundle bundle)
{
for (int i = 0; i < sis->nsigs; i++) {
struct rpmsinfo_s *sinfo = &sis->sigs[i];
if (sinfo->range & range) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
if (sinfo->rc == RPMRC_OK)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
rpmDigestBundleAddID(bundle, sinfo->hashalgo, sinfo->id, 0);
}
}
}
int rpmvsVerifyItems(struct rpmvs_s *sis, int range, rpmDigestBundle bundle,
rpmKeyring keyring, rpmsinfoCb cb, void *cbdata)
{
int failed = 0;
Allow verification callbacks to signal stopping, document the callback Move the rc code from return value to a parameter, change to a pointer to allow modification from the callback. Make the message modifiable from callback too if only for consistency. Change the parameter names on all callback users to force all relevant places to be updated. With all this, a verification callback now force verification to abort by returning 0. No actual behavior is changed in this commit though.
2018-03-08 19:22:49 +08:00
int cont = 1;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
Allow verification callbacks to signal stopping, document the callback Move the rc code from return value to a parameter, change to a pointer to allow modification from the callback. Make the message modifiable from callback too if only for consistency. Change the parameter names on all callback users to force all relevant places to be updated. With all this, a verification callback now force verification to abort by returning 0. No actual behavior is changed in this commit though.
2018-03-08 19:22:49 +08:00
for (int i = 0; i < sis->nsigs && cont; i++) {
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
struct rpmsinfo_s *sinfo = &sis->sigs[i];
if (sinfo->range == range) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
if (sinfo->rc == RPMRC_OK) {
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
DIGEST_CTX ctx = rpmDigestBundleDupCtx(bundle, sinfo->id);
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rpmVerifySignature(keyring, sinfo, ctx);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
rpmDigestFinal(ctx, NULL, NULL, 0);
rpmDigestBundleFinal(bundle, sinfo->id, NULL, NULL, 0);
}
if (cb)
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
cont = cb(sinfo, cbdata);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
if (sinfo->rc != RPMRC_OK)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
failed++;
}
}
return failed;
}
static const char * rpmSigString(rpmRC res)
{
const char * str;
switch (res) {
case RPMRC_OK: str = "OK"; break;
case RPMRC_FAIL: str = "BAD"; break;
case RPMRC_NOKEY: str = "NOKEY"; break;
case RPMRC_NOTTRUSTED: str = "NOTTRUSTED"; break;
default:
case RPMRC_NOTFOUND: str = "UNKNOWN"; break;
}
return str;
}
static const char *rangeName(int range)
{
switch (range) {
case RPMSIG_HEADER: return _("Header ");
case RPMSIG_PAYLOAD: return _("Payload ");
}
/* trad. output for (RPMSIG_HEADER|RPMSIG_PAYLOAD) range is "" */
return "";
}
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
static rpmRC verifyDigest(struct rpmsinfo_s *sinfo, DIGEST_CTX digctx)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
rpmRC res = RPMRC_FAIL; /* assume failure */
char * dig = NULL;
size_t diglen = 0;
DIGEST_CTX ctx = rpmDigestDup(digctx);
Format verbose message strings centrally in rpmVerifySignature() Another step towards separating descriptions from result messages, handle formatting centrally. This also drops the strange "BAD PARAMETERS" message which now fits in even less than it did before: it didn't really know whether it was "uhhuh, s*** happened" internal error or actual validation error. rpmVerifySignature() only gets called for known, pre-validated data now so let it think everything is just a validation failure.
2017-05-24 16:23:48 +08:00
if (rpmDigestFinal(ctx, (void **)&dig, &diglen, 1) || diglen == 0)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
goto exit;
if (strcasecmp(sinfo->dig, dig) == 0) {
res = RPMRC_OK;
} else {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg, "Expected %s != %s", sinfo->dig, dig);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
exit:
free(dig);
return res;
}
/**
* Verify DSA/RSA signature.
* @param keyring pubkey keyring
* @param sinfo OpenPGP signature parameters
* @param hashctx digest context
* @retval msg verbose success/failure text
* @return RPMRC_OK on success
*/
static rpmRC
verifySignature(rpmKeyring keyring, struct rpmsinfo_s *sinfo,
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
DIGEST_CTX hashctx)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
rpmRC res = rpmKeyringVerifySig(keyring, sinfo->sig, hashctx);
return res;
}
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
static void
rpmVerifySignature(rpmKeyring keyring, struct rpmsinfo_s *sinfo, DIGEST_CTX ctx)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
if (sinfo->type == RPMSIG_DIGEST_TYPE)
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
sinfo->rc = verifyDigest(sinfo, ctx);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
else if (sinfo->type == RPMSIG_SIGNATURE_TYPE)
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
sinfo->rc = verifySignature(keyring, sinfo, ctx);
else
sinfo->rc = RPMRC_FAIL;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}