1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
|
/* $FreeBSD$ */
/* $OpenBSD: sha1.c,v 1.1 1999/10/04 21:46:29 espie Exp $ */
/*-
* Copyright (c) 1999 Marc Espie.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* This product includes software developed by Marc Espie for the OpenBSD
* Project.
*
* THIS SOFTWARE IS PROVIDED BY THE OPENBSD PROJECT AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OPENBSD
* PROJECT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <sys/types.h>
#include <sys/wait.h>
#include <stdlib.h>
#include <stdio.h>
#include <assert.h>
#include <openssl/sha.h>
#include "stand.h"
#include "gzip.h"
#include "extern.h"
/* private context for sha1 signature checker */
struct sha1_checker {
SHA_CTX context;
const char *id;
const char *filename;
};
#define SHA1_TEMPLATE "SHA1 (%s) = "
#define BUFSIZE (MAXID+sizeof(SHA1_TEMPLATE)+2*SHA_DIGEST_LENGTH+1)
/* Finalize SHA1 checksum for our sha1_context into result
(size at least BUFSIZE). Returns the length of the checksum
marker, e.g., SHA1 (id) = xxxxxxxxx
^here
Return 0 for errors.
*/
size_t
sha1_build_checksum(result, n)
char *result;
struct sha1_checker *n;
{
size_t length;
sprintf(result, "SHA1 (%s) = ", n->id);
length = strlen(result);
SHA1_Final(result + length, &n->context);
strcat(result, "\n");
free(n);
return length;
}
void *
new_sha1_checker(h, sign, userid, envp, filename)
struct mygzip_header *h;
struct signature *sign;
const char *userid;
char *envp[];
/*@observer@*/const char *filename;
{
struct sha1_checker *n;
assert(sign->type == TAG_SHA1);
/* make sure data conforms to what we can handle */
if (sign->length > MAXID || sign->data[sign->length-1] != '\0') {
warnx("Corrupted SHA1 header in %s", filename);
return 0;
}
n = malloc(sizeof *n);
if (n == NULL) {
warnx("Can't allocate sha1_checker");
return NULL;
}
SHA1_Init(&n->context);
n->id = sign->data;
n->filename = filename;
/* copy header, as this is a checksum, we don't strip our own marker */
if (gzip_copy_header(h, sign, sha1_add, n) == 0) {
warnx("Unexpected header in %s", filename);
free(n);
return 0;
}
return n;
}
void
sha1_add(arg, buffer, length)
void *arg;
const char *buffer;
size_t length;
{
struct sha1_checker *n = arg;
SHA1_Update(&n->context, buffer, length);
}
int
sha1_sign_ok(arg)
void *arg;
{
struct sha1_checker *n = arg;
char buffer[BUFSIZE];
char scan[BUFSIZE];
size_t length;
FILE *f;
int tag_found;
length = sha1_build_checksum(buffer, n);
f= fopen(SHA1_DB_NAME, "r");
tag_found = 0;
if (f == NULL) {
warn("Can't access checksum file %s", SHA1_DB_NAME);
return PKG_BADSIG;
}
while (fgets(scan, sizeof(scan), f) != NULL) {
if (strcmp(scan, buffer) == 0) {
fprintf(stderr, "Checksum ok\n");
return PKG_GOODSIG;
}
if (strncmp(scan, buffer, length) == 0)
tag_found = 1;
}
if (tag_found) {
warnx("Checksum incorrect for %s (%s)", n->filename, n->id);
return PKG_BADSIG;
} else {
warnx("No checksum found for %s (%s)", n->filename, n->id);
return PKG_SIGUNKNOWN;
}
}
int
retrieve_sha1_marker(filename, sign, userid)
const char *filename;
struct signature **sign;
const char *userid;
{
struct signature *n;
struct mygzip_header h;
FILE *f;
char buffer[1024];
char result[BUFSIZE];
ssize_t length;
struct sha1_checker *checker;
struct signature *old;
*sign = NULL;
if (userid == NULL)
return 0;
/*
* Create a blank signature and fill it with the userid.
*/
n = malloc(sizeof *n);
if (n == NULL)
return 0;
n->data = (char *)userid;
n->length = strlen(n->data)+1;
n->type = TAG_SHA1;
memcpy(n->tag, sha1tag, sizeof sha1tag);
sign_fill_tag(n);
/*
* Read the gzip header and add our "userid" signature to it.
*/
f = fopen(filename, "r");
if (f == NULL) {
free(n);
return 0;
}
if (gzip_read_header(f, &h, sign) == GZIP_NOT_GZIP) {
warnx("File %s is not a gzip file\n", filename);
fclose(f);
free(n);
return 0;
}
n->next = *sign;
*sign = n;
/*
* Calculate the SHA1 of the remaining data and write it to stderr.
*/
checker = new_sha1_checker(&h, *sign, NULL, NULL, filename);
while ((length = fread(buffer, 1, sizeof buffer, f)) > 0)
sha1_add(checker, buffer, length);
if (fclose(f) != 0 || length == -1) {
warn("Problem checksumming %s", filename);
*sign = n->next;
free(n);
return 0;
}
(void)sha1_build_checksum(result, checker);
fputs(result, stderr);
return 1;
}
|
