lib/libalpm/signing.c

   1 /*
   2  *  signing.c
   3  *
   4  *  Copyright (c) 2008-2011 Pacman Development Team <pacman-dev@archlinux.org>
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "config.h"
  21
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <string.h>
  25
  26 #if HAVE_LIBGPGME
  27 #include <locale.h> /* setlocale() */
  28 #include <gpgme.h>
  29 #include "base64.h"
  30 #endif
  31
  32 /* libalpm */
  33 #include "signing.h"
  34 #include "package.h"
  35 #include "util.h"
  36 #include "log.h"
  37 #include "alpm.h"
  38
  39 #if HAVE_LIBGPGME
  40 #define CHECK_ERR(void) do { \
  41                 if(err != GPG_ERR_NO_ERROR) { goto error; } \
  42         } while(0)
  43
  44 static const char *gpgme_string_validity(gpgme_validity_t validity)
  45 {
  46         switch(validity) {
  47                 case GPGME_VALIDITY_UNKNOWN:
  48                         return "unknown";
  49                 case GPGME_VALIDITY_UNDEFINED:
  50                         return "undefined";
  51                 case GPGME_VALIDITY_NEVER:
  52                         return "never";
  53                 case GPGME_VALIDITY_MARGINAL:
  54                         return "marginal";
  55                 case GPGME_VALIDITY_FULL:
  56                         return "full";
  57                 case GPGME_VALIDITY_ULTIMATE:
  58                         return "ultimate";
  59         }
  60         return "???";
  61 }
  62
  63 static alpm_list_t *sigsum_test_bit(gpgme_sigsum_t sigsum, alpm_list_t *summary,
  64                 gpgme_sigsum_t bit, const char *value)
  65 {
  66         if(sigsum & bit) {
  67                 summary = alpm_list_add(summary, (void *)value);
  68         }
  69         return summary;
  70 }
  71
  72 static alpm_list_t *gpgme_list_sigsum(gpgme_sigsum_t sigsum)
  73 {
  74         alpm_list_t *summary = NULL;
  75         /* The docs say this can be a bitmask...not sure I believe it, but we'll code
  76          * for it anyway and show all possible flags in the returned string. */
  77
  78         /* The signature is fully valid.  */
  79         summary = sigsum_test_bit(sigsum, summary, GPGME_SIGSUM_VALID, "valid");
  80         /* The signature is good.  */
  81         summary = sigsum_test_bit(sigsum, summary, GPGME_SIGSUM_GREEN, "green");
  82         /* The signature is bad.  */
  83         summary = sigsum_test_bit(sigsum, summary, GPGME_SIGSUM_RED, "red");
  84         /* One key has been revoked.  */
  85         summary = sigsum_test_bit(sigsum, summary, GPGME_SIGSUM_KEY_REVOKED, "key revoked");
  86         /* One key has expired.  */
  87         summary = sigsum_test_bit(sigsum, summary, GPGME_SIGSUM_KEY_EXPIRED, "key expired");
  88         /* The signature has expired.  */
  89         summary = sigsum_test_bit(sigsum, summary, GPGME_SIGSUM_SIG_EXPIRED, "sig expired");
  90         /* Can't verify: key missing.  */
  91         summary = sigsum_test_bit(sigsum, summary, GPGME_SIGSUM_KEY_MISSING, "key missing");
  92         /* CRL not available.  */
  93         summary = sigsum_test_bit(sigsum, summary, GPGME_SIGSUM_CRL_MISSING, "crl missing");
  94         /* Available CRL is too old.  */
  95         summary = sigsum_test_bit(sigsum, summary, GPGME_SIGSUM_CRL_TOO_OLD, "crl too old");
  96         /* A policy was not met.  */
  97         summary = sigsum_test_bit(sigsum, summary, GPGME_SIGSUM_BAD_POLICY, "bad policy");
  98         /* A system error occured.  */
  99         summary = sigsum_test_bit(sigsum, summary, GPGME_SIGSUM_SYS_ERROR, "sys error");
 100         /* Fallback case */
 101         if(!sigsum) {
 102                 summary = alpm_list_add(summary, (void *)"(empty)");
 103         }
 104         return summary;
 105 }
 106
 107 static int gpgme_init(void)
 108 {
 109         static int init = 0;
 110         const char *version;
 111         gpgme_error_t err;
 112         gpgme_engine_info_t enginfo;
 113
 114         if(init) {
 115                 /* we already successfully initialized the library */
 116                 return 0;
 117         }
 118
 119         if(!alpm_option_get_signaturedir()) {
 120                 RET_ERR(PM_ERR_SIG_MISSINGDIR, 1);
 121         }
 122
 123         /* calling gpgme_check_version() returns the current version and runs
 124          * some internal library setup code */
 125         version = gpgme_check_version(NULL);
 126         _alpm_log(PM_LOG_DEBUG, "GPGME version: %s\n", version);
 127         gpgme_set_locale(NULL, LC_CTYPE, setlocale(LC_CTYPE, NULL));
 128 #ifdef LC_MESSAGES
 129         gpgme_set_locale(NULL, LC_MESSAGES, setlocale(LC_MESSAGES, NULL));
 130 #endif
 131         /* NOTE:
 132          * The GPGME library installs a SIGPIPE signal handler automatically if
 133          * the default signal hander is in use. The only time we set a handler
 134          * for SIGPIPE is in dload.c, and we reset it when we are done. Given that
 135          * we do this, we can let GPGME do its automagic. However, if we install
 136          * a library-wide SIGPIPE handler, we will have to be careful.
 137          */
 138
 139         /* check for OpenPGP support (should be a no-brainer, but be safe) */
 140         err = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
 141         CHECK_ERR();
 142
 143         /* set and check engine information */
 144         err = gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP, NULL,
 145                         alpm_option_get_signaturedir());
 146         CHECK_ERR();
 147         err = gpgme_get_engine_info(&enginfo);
 148         CHECK_ERR();
 149         _alpm_log(PM_LOG_DEBUG, "GPGME engine info: file=%s, home=%s\n",
 150                         enginfo->file_name, enginfo->home_dir);
 151
 152         init = 1;
 153         return 0;
 154
 155 error:
 156         _alpm_log(PM_LOG_ERROR, _("GPGME error: %s\n"), gpgme_strerror(err));
 157         RET_ERR(PM_ERR_GPGME, 1);
 158 }
 159
 160 /**
 161  * Decode a loaded signature in base64 form.
 162  * @param base64_data the signature to attempt to decode
 163  * @param data the decoded data; must be freed by the caller
 164  * @param data_len the length of the returned data
 165  * @return 0 on success, 1 on failure to properly decode
 166  */
 167 static int decode_signature(const char *base64_data,
 168                 unsigned char **data, int *data_len) {
 169         unsigned char *usline;
 170         int len;
 171
 172         len = strlen(base64_data);
 173         usline = (unsigned char *)base64_data;
 174         int ret, destlen = 0;
 175         /* get the necessary size for the buffer by passing 0 */
 176         ret = base64_decode(NULL, &destlen, usline, len);
 177         if(ret != 0 && ret != POLARSSL_ERR_BASE64_BUFFER_TOO_SMALL) {
 178                 goto error;
 179         }
 180         /* alloc our memory and repeat the call to decode */
 181         MALLOC(*data, (size_t)destlen, goto error);
 182         ret = base64_decode(*data, &destlen, usline, len);
 183         if(ret != 0) {
 184                 goto error;
 185         }
 186         *data_len = destlen;
 187         return 0;
 188
 189 error:
 190         *data = NULL;
 191         *data_len = 0;
 192         return 1;
 193 }
 194
 195 /**
 196  * Check the PGP signature for the given file.
 197  * @param path the full path to a file
 198  * @param base64_sig PGP signature data in base64 encoding; if NULL, expect a
 199  * signature file next to 'path'
 200  * @return a int value : 0 (valid), 1 (invalid), -1 (an error occured)
 201  */
 202 int _alpm_gpgme_checksig(const char *path, const char *base64_sig)
 203 {
 204         int ret = 0;
 205         gpgme_error_t err;
 206         gpgme_ctx_t ctx;
 207         gpgme_data_t filedata, sigdata;
 208         gpgme_verify_result_t result;
 209         gpgme_signature_t gpgsig;
 210         char *sigpath = NULL;
 211         unsigned char *decoded_sigdata = NULL;
 212         FILE *file = NULL, *sigfile = NULL;
 213
 214         if(!path || access(path, R_OK) != 0) {
 215                 RET_ERR(PM_ERR_NOT_A_FILE, -1);
 216         }
 217
 218         if(!base64_sig) {
 219                 size_t len = strlen(path) + 5;
 220                 CALLOC(sigpath, len, sizeof(char), RET_ERR(PM_ERR_MEMORY, -1));
 221                 snprintf(sigpath, len, "%s.sig", path);
 222
 223                 if(!access(sigpath, R_OK) == 0) {
 224                         FREE(sigpath);
 225                         RET_ERR(PM_ERR_SIG_UNKNOWN, -1);
 226                 }
 227         }
 228
 229         if(gpgme_init()) {
 230                 /* pm_errno was set in gpgme_init() */
 231                 return -1;
 232         }
 233
 234         _alpm_log(PM_LOG_DEBUG, "checking signature for %s\n", path);
 235
 236         memset(&ctx, 0, sizeof(ctx));
 237         memset(&sigdata, 0, sizeof(sigdata));
 238         memset(&filedata, 0, sizeof(filedata));
 239
 240         err = gpgme_new(&ctx);
 241         CHECK_ERR();
 242
 243         /* create our necessary data objects to verify the signature */
 244         file = fopen(path, "rb");
 245         if(file == NULL) {
 246                 pm_errno = PM_ERR_NOT_A_FILE;
 247                 ret = -1;
 248                 goto error;
 249         }
 250         err = gpgme_data_new_from_stream(&filedata, file);
 251         CHECK_ERR();
 252
 253         /* next create data object for the signature */
 254         if(base64_sig) {
 255                 /* memory-based, we loaded it from a sync DB */
 256                 int data_len;
 257                 int decode_ret = decode_signature(base64_sig,
 258                                 &decoded_sigdata, &data_len);
 259                 if(decode_ret) {
 260                         ret = -1;
 261                         goto error;
 262                 }
 263                 err = gpgme_data_new_from_mem(&sigdata,
 264                                 (char *)decoded_sigdata, data_len, 0);
 265         } else {
 266                 /* file-based, it is on disk */
 267                 sigfile = fopen(sigpath, "rb");
 268                 if(sigfile == NULL) {
 269                         pm_errno = PM_ERR_NOT_A_FILE;
 270                         ret = -1;
 271                         goto error;
 272                 }
 273                 err = gpgme_data_new_from_stream(&sigdata, sigfile);
 274         }
 275         CHECK_ERR();
 276
 277         /* here's where the magic happens */
 278         err = gpgme_op_verify(ctx, sigdata, filedata, NULL);
 279         CHECK_ERR();
 280         result = gpgme_op_verify_result(ctx);
 281         gpgsig = result->signatures;
 282         if(!gpgsig || gpgsig->next) {
 283                 int count = 0;
 284                 while(gpgsig) {
 285                         count++;
 286                         gpgsig = gpgsig->next;
 287                 }
 288                 _alpm_log(PM_LOG_ERROR, _("Unexpected number of signatures (%d)\n"),
 289                                 count);
 290                 ret = -1;
 291                 goto error;
 292         }
 293
 294         {
 295                 alpm_list_t *summary_list, *summary;
 296
 297                 _alpm_log(PM_LOG_DEBUG, "fingerprint: %s\n", gpgsig->fpr);
 298                 summary_list = gpgme_list_sigsum(gpgsig->summary);
 299                 for(summary = summary_list; summary; summary = summary->next) {
 300                         _alpm_log(PM_LOG_DEBUG, "summary: %s\n", (const char *)summary->data);
 301                 }
 302                 alpm_list_free(summary_list);
 303                 _alpm_log(PM_LOG_DEBUG, "status: %s\n", gpgme_strerror(gpgsig->status));
 304                 _alpm_log(PM_LOG_DEBUG, "timestamp: %lu\n", gpgsig->timestamp);
 305                 _alpm_log(PM_LOG_DEBUG, "exp_timestamp: %lu\n", gpgsig->exp_timestamp);
 306                 _alpm_log(PM_LOG_DEBUG, "validity: %s\n",
 307                                 gpgme_string_validity(gpgsig->validity));
 308                 _alpm_log(PM_LOG_DEBUG, "validity_reason: %s\n",
 309                                 gpgme_strerror(gpgsig->validity_reason));
 310                 _alpm_log(PM_LOG_DEBUG, "pubkey algo: %s\n",
 311                                 gpgme_pubkey_algo_name(gpgsig->pubkey_algo));
 312                 _alpm_log(PM_LOG_DEBUG, "hash algo: %s\n",
 313                                 gpgme_hash_algo_name(gpgsig->hash_algo));
 314         }
 315
 316         if(gpgsig->summary & GPGME_SIGSUM_VALID) {
 317                 /* good signature, continue */
 318                 _alpm_log(PM_LOG_DEBUG, _("File %s has a valid signature.\n"),
 319                                 path);
 320         } else if(gpgsig->summary & GPGME_SIGSUM_GREEN) {
 321                 /* 'green' signature, not sure what to do here */
 322                 _alpm_log(PM_LOG_WARNING, _("File %s has a green signature.\n"),
 323                                 path);
 324         } else if(gpgsig->summary & GPGME_SIGSUM_KEY_MISSING) {
 325                 pm_errno = PM_ERR_SIG_UNKNOWN;
 326                 _alpm_log(PM_LOG_WARNING, _("File %s has a signature from an unknown key.\n"),
 327                                 path);
 328                 ret = -1;
 329         } else {
 330                 /* we'll capture everything else here */
 331                 pm_errno = PM_ERR_SIG_INVALID;
 332                 _alpm_log(PM_LOG_ERROR, _("File %s has an invalid signature.\n"),
 333                                 path);
 334                 ret = 1;
 335         }
 336
 337 error:
 338         gpgme_data_release(sigdata);
 339         gpgme_data_release(filedata);
 340         gpgme_release(ctx);
 341         if(sigfile) {
 342                 fclose(sigfile);
 343         }
 344         if(file) {
 345                 fclose(file);
 346         }
 347         FREE(sigpath);
 348         FREE(decoded_sigdata);
 349         if(err != GPG_ERR_NO_ERROR) {
 350                 _alpm_log(PM_LOG_ERROR, _("GPGME error: %s\n"), gpgme_strerror(err));
 351                 RET_ERR(PM_ERR_GPGME, -1);
 352         }
 353         return ret;
 354 }
 355 #else
 356 int _alpm_gpgme_checksig(const char *path, const char *base64_sig)
 357 {
 358         return -1;
 359 }
 360 #endif
 361
 362 /**
 363  * Determines the necessity of checking for a valid PGP signature
 364  * @param db the sync database to query
 365  *
 366  * @return signature verification level
 367  */
 368 pgp_verify_t _alpm_db_get_sigverify_level(pmdb_t *db)
 369 {
 370         ASSERT(db != NULL, RET_ERR(PM_ERR_DB_NULL, PM_PGP_VERIFY_UNKNOWN));
 371
 372         if(db->pgp_verify != PM_PGP_VERIFY_UNKNOWN) {
 373                 return db->pgp_verify;
 374         } else {
 375                 return alpm_option_get_default_sigverify();
 376         }
 377 }
 378
 379 /**
 380  * Check the PGP signature for the given package file.
 381  * @param pkg the package to check
 382  * @return a int value : 0 (valid), 1 (invalid), -1 (an error occurred)
 383  */
 384 int SYMEXPORT alpm_pkg_check_pgp_signature(pmpkg_t *pkg)
 385 {
 386         ASSERT(pkg != NULL, return 0);
 387
 388         return _alpm_gpgme_checksig(alpm_pkg_get_filename(pkg), pkg->base64_sig);
 389 }
 390
 391 /**
 392  * Check the PGP signature for the given database.
 393  * @param db the database to check
 394  * @return a int value : 0 (valid), 1 (invalid), -1 (an error occurred)
 395  */
 396 int SYMEXPORT alpm_db_check_pgp_signature(pmdb_t *db)
 397 {
 398         ASSERT(db != NULL, return 0);
 399
 400         return _alpm_gpgme_checksig(_alpm_db_path(db), NULL);
 401 }
 402
 403 /* vim: set ts=2 sw=2 noet: */