apt  2.2.4
About: Apt (Advanced Package Tool) is a management system for software packages (Debian/Ubuntu). Release series 2.2.
  Fossies Dox: apt-2.2.4.tar.gz  ("unofficial" and yet experimental doxygen-generated source code documentation)  

gpgv.cc
Go to the documentation of this file.
1 // -*- mode: cpp; mode: fold -*-
2 // Include Files /*{{{*/
3 #include <config.h>
4 
5 #include <apt-pkg/configuration.h>
6 #include <apt-pkg/error.h>
7 #include <apt-pkg/fileutl.h>
8 #include <apt-pkg/gpgv.h>
9 #include <apt-pkg/strutl.h>
10 
11 #include <errno.h>
12 #include <fcntl.h>
13 #include <stddef.h>
14 #include <stdio.h>
15 #include <stdlib.h>
16 #include <string.h>
17 #include <sys/wait.h>
18 #include <unistd.h>
19 
20 #include <algorithm>
21 #include <fstream>
22 #include <iostream>
23 #include <memory>
24 #include <sstream>
25 #include <string>
26 #include <vector>
27 
28 #include <apti18n.h>
29  /*}}}*/
30 
31 // syntactic sugar to wrap a raw pointer with a custom deleter in a std::unique_ptr
32 static std::unique_ptr<char, decltype(&free)> make_unique_char(void *const str = nullptr)
33 {
34  return {static_cast<char *>(str), &free};
35 }
36 static std::unique_ptr<FILE, decltype(&fclose)> make_unique_FILE(std::string const &filename, char const *const mode)
37 {
38  return {fopen(filename.c_str(), mode), &fclose};
39 }
40 
41 class LineBuffer /*{{{*/
42 {
43  char *buffer = nullptr;
44  size_t buffer_size = 0;
45  int line_length = 0;
46  // a "normal" find_last_not_of returns npos if not found
48  {
49  for (int result = line_length - 1; result >= 0; --result)
50  if (bad.find(buffer[result]) == APT::StringView::npos)
51  return result + 1;
52  return 0;
53  }
54 
55  public:
56  bool empty() const noexcept { return view().empty(); }
57  APT::StringView view() const noexcept { return {buffer, static_cast<size_t>(line_length)}; }
58  bool starts_with(APT::StringView const start) const { return view().substr(0, start.size()) == start; }
59 
60  bool writeTo(FileFd *const to, size_t offset = 0) const
61  {
62  if (to == nullptr)
63  return true;
64  return to->Write(buffer + offset, line_length - offset);
65  }
66  bool writeLineTo(FileFd *const to) const
67  {
68  if (to == nullptr)
69  return true;
70  buffer[line_length] = '\n';
71  bool const result = to->Write(buffer, line_length + 1);
72  buffer[line_length] = '\0';
73  return result;
74  }
75  bool writeNewLineIf(FileFd *const to, bool const condition) const
76  {
77  if (not condition || to == nullptr)
78  return true;
79  return to->Write("\n", 1);
80  }
81 
82  bool readFrom(FILE *stream, std::string const &InFile, bool acceptEoF = false)
83  {
84  errno = 0;
85  line_length = getline(&buffer, &buffer_size, stream);
86  if (errno != 0)
87  return _error->Errno("getline", "Could not read from %s", InFile.c_str());
88  if (line_length == -1)
89  {
90  if (acceptEoF)
91  return false;
92  return _error->Error("Splitting of clearsigned file %s failed as it doesn't contain all expected parts", InFile.c_str());
93  }
94  // a) remove newline characters, so we can work consistently with lines
96  // b) remove trailing whitespaces as defined by rfc4880 §7.1
98  buffer[line_length] = '\0';
99  return true;
100  }
101 
102  ~LineBuffer() { free(buffer); }
103 };
104 static bool operator==(LineBuffer const &buf, APT::StringView const exp) noexcept
105 {
106  return buf.view() == exp;
107 }
108 static bool operator!=(LineBuffer const &buf, APT::StringView const exp) noexcept
109 {
110  return buf.view() != exp;
111 }
112  /*}}}*/
113 // ExecGPGV - returns the command needed for verify /*{{{*/
114 // ---------------------------------------------------------------------
115 /* Generating the commandline for calling gpg is somehow complicated as
116  we need to add multiple keyrings and user supplied options.
117  Also, as gpg has no options to enforce a certain reduced style of
118  clear-signed files (=the complete content of the file is signed and
119  the content isn't encoded) we do a divide and conquer approach here
120  and split up the clear-signed file in message and signature for gpg.
121  And as a cherry on the cake, we use our apt-key wrapper to do part
122  of the lifting in regards to merging keyrings. Fun for the whole family.
123 */
124 static void APT_PRINTF(4) apt_error(std::ostream &outterm, int const statusfd, int fd[2], const char *format, ...)
125 {
126  std::ostringstream outstr;
127  std::ostream &out = (statusfd == -1) ? outterm : outstr;
128  va_list args;
129  ssize_t size = 400;
130  while (true) {
131  bool ret;
132  va_start(args,format);
133  ret = iovprintf(out, format, args, size);
134  va_end(args);
135  if (ret)
136  break;
137  }
138  if (statusfd != -1)
139  {
140  auto const errtag = "[APTKEY:] ERROR ";
141  outstr << '\n';
142  auto const errtext = outstr.str();
143  if (not FileFd::Write(fd[1], errtag, strlen(errtag)) ||
144  not FileFd::Write(fd[1], errtext.data(), errtext.size()))
145  outterm << errtext << std::flush;
146  }
147 }
148 void ExecGPGV(std::string const &File, std::string const &FileGPG,
149  int const &statusfd, int fd[2], std::string const &key)
150 {
151  #define EINTERNAL 111
152  std::string const aptkey = _config->Find("Dir::Bin::apt-key", CMAKE_INSTALL_FULL_BINDIR "/apt-key");
153 
154  bool const Debug = _config->FindB("Debug::Acquire::gpgv", false);
155  struct exiter {
156  std::vector<const char *> files;
157  void operator ()(int code) APT_NORETURN {
158  std::for_each(files.begin(), files.end(), unlink);
159  exit(code);
160  }
161  } local_exit;
162 
163 
164  std::vector<const char *> Args;
165  Args.reserve(10);
166 
167  Args.push_back(aptkey.c_str());
168  Args.push_back("--quiet");
169  Args.push_back("--readonly");
170  auto const keysFileFpr = VectorizeString(key, ',');
171  for (auto const &k: keysFileFpr)
172  {
173  if (unlikely(k.empty()))
174  continue;
175  if (k[0] == '/')
176  {
177  Args.push_back("--keyring");
178  Args.push_back(k.c_str());
179  }
180  else
181  {
182  Args.push_back("--keyid");
183  Args.push_back(k.c_str());
184  }
185  }
186  Args.push_back("verify");
187 
188  char statusfdstr[10];
189  if (statusfd != -1)
190  {
191  Args.push_back("--status-fd");
192  snprintf(statusfdstr, sizeof(statusfdstr), "%i", statusfd);
193  Args.push_back(statusfdstr);
194  }
195 
196  Configuration::Item const *Opts;
197  Opts = _config->Tree("Acquire::gpgv::Options");
198  if (Opts != 0)
199  {
200  Opts = Opts->Child;
201  for (; Opts != 0; Opts = Opts->Next)
202  {
203  if (Opts->Value.empty())
204  continue;
205  Args.push_back(Opts->Value.c_str());
206  }
207  }
208 
209  enum { DETACHED, CLEARSIGNED } releaseSignature = (FileGPG != File) ? DETACHED : CLEARSIGNED;
210  auto sig = make_unique_char();
211  auto data = make_unique_char();
212  auto conf = make_unique_char();
213 
214  // Dump the configuration so apt-key picks up the correct Dir values
215  {
216  {
217  std::string tmpfile;
218  strprintf(tmpfile, "%s/apt.conf.XXXXXX", GetTempDir().c_str());
219  conf.reset(strdup(tmpfile.c_str()));
220  }
221  if (conf == nullptr) {
222  apt_error(std::cerr, statusfd, fd, "Couldn't create tempfile names for passing config to apt-key");
223  local_exit(EINTERNAL);
224  }
225  int confFd = mkstemp(conf.get());
226  if (confFd == -1) {
227  apt_error(std::cerr, statusfd, fd, "Couldn't create temporary file %s for passing config to apt-key", conf.get());
228  local_exit(EINTERNAL);
229  }
230  local_exit.files.push_back(conf.get());
231 
232  std::ofstream confStream(conf.get());
233  close(confFd);
234  _config->Dump(confStream);
235  confStream.close();
236  setenv("APT_CONFIG", conf.get(), 1);
237  }
238 
239  // Tell apt-key not to emit warnings
240  setenv("APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE", "1", 1);
241 
242  if (releaseSignature == DETACHED)
243  {
244  auto detached = make_unique_FILE(FileGPG, "r");
245  if (detached.get() == nullptr)
246  {
247  apt_error(std::cerr, statusfd, fd, "Detached signature file '%s' could not be opened", FileGPG.c_str());
248  local_exit(EINTERNAL);
249  }
250  LineBuffer buf;
251  bool open_signature = false;
252  bool found_badcontent = false;
253  size_t found_signatures = 0;
254  while (buf.readFrom(detached.get(), FileGPG, true))
255  {
256  if (open_signature)
257  {
258  if (buf == "-----END PGP SIGNATURE-----")
259  open_signature = false;
260  else if (buf.starts_with("-"))
261  {
262  // the used Radix-64 is not using dash for any value, so a valid line can't
263  // start with one. Header keys could, but no existent one does and seems unlikely.
264  // Instead it smells a lot like a header the parser didn't recognize.
265  apt_error(std::cerr, statusfd, fd, "Detached signature file '%s' contains unexpected line starting with a dash", FileGPG.c_str());
266  local_exit(112);
267  }
268  }
269  else //if (not open_signature)
270  {
271  if (buf == "-----BEGIN PGP SIGNATURE-----")
272  {
273  open_signature = true;
274  ++found_signatures;
275  if (found_badcontent)
276  break;
277  }
278  else
279  {
280  found_badcontent = true;
281  if (found_signatures != 0)
282  break;
283  }
284  }
285  }
286  if (found_signatures == 0 && statusfd != -1)
287  {
288  auto const errtag = "[GNUPG:] NODATA\n";
289  FileFd::Write(fd[1], errtag, strlen(errtag));
290  // guess if this is a binary signature, we never officially supported them,
291  // but silently accepted them via passing them unchecked to gpgv
292  if (found_badcontent)
293  {
294  rewind(detached.get());
295  auto ptag = fgetc(detached.get());
296  // §4.2 says that the first bit is always set and gpg seems to generate
297  // only old format which is indicated by the second bit not set
298  if (ptag != EOF && (ptag & 0x80) != 0 && (ptag & 0x40) == 0)
299  {
300  apt_error(std::cerr, statusfd, fd, "Detached signature file '%s' is in unsupported binary format", FileGPG.c_str());
301  local_exit(112);
302  }
303  }
304  // This is not an attack attempt but a file even gpgv would complain about
305  // likely the result of a paywall which is covered by the gpgv method
306  local_exit(113);
307  }
308  else if (found_badcontent)
309  {
310  apt_error(std::cerr, statusfd, fd, "Detached signature file '%s' contains lines not belonging to a signature", FileGPG.c_str());
311  local_exit(112);
312  }
313  if (open_signature)
314  {
315  apt_error(std::cerr, statusfd, fd, "Detached signature file '%s' contains unclosed signatures", FileGPG.c_str());
316  local_exit(112);
317  }
318 
319  Args.push_back(FileGPG.c_str());
320  Args.push_back(File.c_str());
321  }
322  else // clear-signed file
323  {
324  FileFd signature;
325  if (GetTempFile("apt.sig", false, &signature) == nullptr)
326  local_exit(EINTERNAL);
327  sig.reset(strdup(signature.Name().c_str()));
328  local_exit.files.push_back(sig.get());
329  FileFd message;
330  if (GetTempFile("apt.data", false, &message) == nullptr)
331  local_exit(EINTERNAL);
332  data.reset(strdup(message.Name().c_str()));
333  local_exit.files.push_back(data.get());
334 
335  if (signature.Failed() || message.Failed() ||
336  not SplitClearSignedFile(File, &message, nullptr, &signature))
337  {
338  apt_error(std::cerr, statusfd, fd, "Splitting up %s into data and signature failed", File.c_str());
339  local_exit(112);
340  }
341  Args.push_back(sig.get());
342  Args.push_back(data.get());
343  }
344 
345  Args.push_back(NULL);
346 
347  if (Debug)
348  {
349  std::clog << "Preparing to exec: ";
350  for (std::vector<const char *>::const_iterator a = Args.begin(); *a != NULL; ++a)
351  std::clog << " " << *a;
352  std::clog << std::endl;
353  }
354 
355  if (statusfd != -1)
356  {
357  int const nullfd = open("/dev/null", O_WRONLY);
358  close(fd[0]);
359  // Redirect output to /dev/null; we read from the status fd
360  if (statusfd != STDOUT_FILENO)
361  dup2(nullfd, STDOUT_FILENO);
362  if (statusfd != STDERR_FILENO)
363  dup2(nullfd, STDERR_FILENO);
364  // Redirect the pipe to the status fd (3)
365  dup2(fd[1], statusfd);
366 
367  putenv((char *)"LANG=");
368  putenv((char *)"LC_ALL=");
369  putenv((char *)"LC_MESSAGES=");
370  }
371 
372 
373  // We have created tempfiles we have to clean up
374  // and we do an additional check, so fork yet another time …
375  pid_t pid = ExecFork();
376  if(pid < 0) {
377  apt_error(std::cerr, statusfd, fd, "Fork failed for %s to check %s", Args[0], File.c_str());
378  local_exit(EINTERNAL);
379  }
380  if(pid == 0)
381  {
382  if (statusfd != -1)
383  dup2(fd[1], statusfd);
384  execvp(Args[0], (char **) &Args[0]);
385  apt_error(std::cerr, statusfd, fd, "Couldn't execute %s to check %s", Args[0], File.c_str());
386  local_exit(EINTERNAL);
387  }
388 
389  // Wait and collect the error code - taken from WaitPid as we need the exact Status
390  int Status;
391  while (waitpid(pid,&Status,0) != pid)
392  {
393  if (errno == EINTR)
394  continue;
395  apt_error(std::cerr, statusfd, fd, _("Waited for %s but it wasn't there"), "apt-key");
396  local_exit(EINTERNAL);
397  }
398 
399  // check if it exit'ed normally …
400  if (not WIFEXITED(Status))
401  {
402  apt_error(std::cerr, statusfd, fd, _("Sub-process %s exited unexpectedly"), "apt-key");
403  local_exit(EINTERNAL);
404  }
405 
406  // … and with a good exit code
407  if (WEXITSTATUS(Status) != 0)
408  {
409  // we forward the statuscode, so don't generate a message on the fd in this case
410  apt_error(std::cerr, -1, fd, _("Sub-process %s returned an error code (%u)"), "apt-key", WEXITSTATUS(Status));
411  local_exit(WEXITSTATUS(Status));
412  }
413 
414  // everything fine
415  local_exit(0);
416 }
417  /*}}}*/
418 // SplitClearSignedFile - split message into data/signature /*{{{*/
419 bool SplitClearSignedFile(std::string const &InFile, FileFd * const ContentFile,
420  std::vector<std::string> * const ContentHeader, FileFd * const SignatureFile)
421 {
422  auto in = make_unique_FILE(InFile, "r");
423  if (in.get() == nullptr)
424  return _error->Errno("fopen", "can not open %s", InFile.c_str());
425 
426  struct ScopedErrors
427  {
428  ScopedErrors() { _error->PushToStack(); }
429  ~~ScopedErrors() { _error->MergeWithStack(); }
430  } scoped;
431  LineBuffer buf;
432 
433  // start of the message
434  if (not buf.readFrom(in.get(), InFile))
435  return false; // empty or read error
436  if (buf != "-----BEGIN PGP SIGNED MESSAGE-----")
437  {
438  // this might be an unsigned file we don't want to report errors for,
439  // but still finish unsuccessful none the less.
440  while (buf.readFrom(in.get(), InFile, true))
441  if (buf == "-----BEGIN PGP SIGNED MESSAGE-----")
442  return _error->Error("Clearsigned file '%s' does not start with a signed message block.", InFile.c_str());
443 
444  return false;
445  }
446 
447  // save "Hash" Armor Headers
448  while (true)
449  {
450  if (not buf.readFrom(in.get(), InFile))
451  return false;
452  if (buf.empty())
453  break; // empty line ends the Armor Headers
454  if (buf.starts_with("-"))
455  // § 6.2 says unknown keys should be reported to the user. We don't go that far,
456  // but we assume that there will never be a header key starting with a dash
457  return _error->Error("Clearsigned file '%s' contains unexpected line starting with a dash (%s)", InFile.c_str(), "armor");
458  if (ContentHeader != nullptr && buf.starts_with("Hash: "))
459  ContentHeader->push_back(buf.view().to_string());
460  }
461 
462  // the message itself
463  bool first_line = true;
464  while (true)
465  {
466  if (not buf.readFrom(in.get(), InFile))
467  return false;
468 
469  if (buf.starts_with("-"))
470  {
471  if (buf == "-----BEGIN PGP SIGNATURE-----")
472  {
473  if (not buf.writeLineTo(SignatureFile))
474  return false;
475  break;
476  }
477  else if (buf.starts_with("- "))
478  {
479  // we don't have any fields which need to be dash-escaped,
480  // but implementations are free to escape all lines …
481  if (not buf.writeNewLineIf(ContentFile, not first_line) || not buf.writeTo(ContentFile, 2))
482  return false;
483  }
484  else
485  // § 7.1 says a client should warn, but we don't really work with files which
486  // should contain lines starting with a dash, so it is a lot more likely that
487  // this is an attempt to trick our parser vs. gpgv parser into ignoring a header
488  return _error->Error("Clearsigned file '%s' contains unexpected line starting with a dash (%s)", InFile.c_str(), "msg");
489  }
490  else if (not buf.writeNewLineIf(ContentFile, not first_line) || not buf.writeTo(ContentFile))
491  return false;
492  first_line = false;
493  }
494 
495  // collect all signatures
496  bool open_signature = true;
497  while (true)
498  {
499  if (not buf.readFrom(in.get(), InFile, true))
500  break;
501 
502  if (open_signature)
503  {
504  if (buf == "-----END PGP SIGNATURE-----")
505  open_signature = false;
506  else if (buf.starts_with("-"))
507  // the used Radix-64 is not using dash for any value, so a valid line can't
508  // start with one. Header keys could, but no existent one does and seems unlikely.
509  // Instead it smells a lot like a header the parser didn't recognize.
510  return _error->Error("Clearsigned file '%s' contains unexpected line starting with a dash (%s)", InFile.c_str(), "sig");
511  }
512  else //if (not open_signature)
513  {
514  if (buf == "-----BEGIN PGP SIGNATURE-----")
515  open_signature = true;
516  else
517  return _error->Error("Clearsigned file '%s' contains unsigned lines.", InFile.c_str());
518  }
519 
520  if (not buf.writeLineTo(SignatureFile))
521  return false;
522  }
523  if (open_signature)
524  return _error->Error("Signature in file %s wasn't closed", InFile.c_str());
525 
526  // Flush the files
527  if (SignatureFile != nullptr)
528  SignatureFile->Flush();
529  if (ContentFile != nullptr)
530  ContentFile->Flush();
531 
532  // Catch-all for "unhandled" read/sync errors
533  if (_error->PendingError())
534  return false;
535  return true;
536 }
537  /*}}}*/
538 bool OpenMaybeClearSignedFile(std::string const &ClearSignedFileName, FileFd &MessageFile) /*{{{*/
539 {
540  // Buffered file
541  if (GetTempFile("clearsigned.message", true, &MessageFile, true) == nullptr)
542  return false;
543  if (MessageFile.Failed())
544  return _error->Error("Couldn't open temporary file to work with %s", ClearSignedFileName.c_str());
545 
546  _error->PushToStack();
547  bool const splitDone = SplitClearSignedFile(ClearSignedFileName, &MessageFile, NULL, NULL);
548  bool const errorDone = _error->PendingError();
549  _error->MergeWithStack();
550  if (not splitDone)
551  {
552  MessageFile.Close();
553 
554  if (errorDone)
555  return false;
556 
557  // we deal with an unsigned file
558  MessageFile.Open(ClearSignedFileName, FileFd::ReadOnly);
559  }
560  else // clear-signed
561  {
562  if (not MessageFile.Seek(0))
563  return _error->Errno("lseek", "Unable to seek back in message for file %s", ClearSignedFileName.c_str());
564  }
565 
566  return not MessageFile.Failed();
567 }
568  /*}}}*/
strprintf(m, msg, repo.c_str())
I Status
void ExecGPGV(std::string const &File, std::string const &FileGPG, int const &statusfd, int fd[2], std::string const &key)
generates and run the command to verify a file with gpgv
Definition: gpgv.cc:148
static std::unique_ptr< FILE, decltype(&fclose)> make_unique_FILE(std::string const &filename, char const *const mode)
Definition: gpgv.cc:36
static void APT_PRINTF(4) apt_error(std
Definition: gpgv.cc:124
#define EINTERNAL
bool OpenMaybeClearSignedFile(std::string const &ClearSignedFileName, FileFd &MessageFile)
open a file which might be clear-signed
Definition: gpgv.cc:538
bool SplitClearSignedFile(std::string const &InFile, FileFd *const ContentFile, std::vector< std::string > *const ContentHeader, FileFd *const SignatureFile)
Split an inline signature into message and signature.
Definition: gpgv.cc:419
static std::unique_ptr< char, decltype(&free)> make_unique_char(void *const str=nullptr)
Definition: gpgv.cc:32
static bool operator!=(LineBuffer const &buf, APT::StringView const exp) noexcept
Definition: gpgv.cc:108
static bool operator==(LineBuffer const &buf, APT::StringView const exp) noexcept
Definition: gpgv.cc:104
Simple subset of std::string_view from C++17.
Definition: string_view.h:27
constexpr StringView substr(size_t pos, size_t n=npos) const
Definition: string_view.h:48
static constexpr size_t npos
Definition: string_view.h:32
std::string to_string() const
Definition: string_view.h:106
constexpr size_t size() const
Definition: string_view.h:137
size_t find(int c, size_t pos) const
Definition: string_view.h:52
constexpr bool empty() const
Definition: string_view.h:132
const Item * Tree(const char *Name) const
std::string Find(const char *Name, const char *Default=0) const
bool FindB(const char *Name, bool const &Default=false) const
Definition: fileutl.h:39
@ ReadOnly
Definition: fileutl.h:59
bool Flush()
Definition: fileutl.cc:2808
bool Write(const void *From, unsigned long long Size)
Definition: fileutl.cc:2819
bool Seek(unsigned long long To)
Definition: fileutl.cc:2875
bool Failed()
Definition: fileutl.h:151
bool Open(std::string FileName, unsigned int const Mode, CompressMode Compress, unsigned long const AccessMode=0666)
Definition: fileutl.cc:2415
bool Close()
Definition: fileutl.cc:2977
std::string & Name()
Definition: fileutl.h:156
int find_last_not_of_length(APT::StringView const bad) const
Definition: gpgv.cc:47
bool writeTo(FileFd *const to, size_t offset=0) const
Definition: gpgv.cc:60
bool empty() const noexcept
Definition: gpgv.cc:56
int line_length
Definition: gpgv.cc:45
~LineBuffer()
Definition: gpgv.cc:102
size_t buffer_size
Definition: gpgv.cc:44
bool writeNewLineIf(FileFd *const to, bool const condition) const
Definition: gpgv.cc:75
APT::StringView view() const noexcept
Definition: gpgv.cc:57
bool readFrom(FILE *stream, std::string const &InFile, bool acceptEoF=false)
Definition: gpgv.cc:82
bool starts_with(APT::StringView const start) const
Definition: gpgv.cc:58
bool writeLineTo(FileFd *const to) const
Definition: gpgv.cc:66
char * buffer
Definition: gpgv.cc:43
FILE
Configuration * _config
FileFd * GetTempFile(std::string const &Prefix, bool ImmediateUnlink, FileFd *const TmpFd)
Definition: fileutl.cc:3134
std::string GetTempDir()
Definition: fileutl.cc:3103
pid_t ExecFork()
Definition: fileutl.cc:881
#define APT_NORETURN
Definition: macros.h:57
vector< string > VectorizeString(string const &haystack, char const &split)
Definition: strutl.cc:1308
bool iovprintf(std::ostream &out, const char *format, va_list &args, ssize_t &size)
Definition: strutl.cc:1418