From db3b86e7f34f4c3ccb42e98465f2069aa642a85f Mon Sep 17 00:00:00 2001 From: Dan McGee Date: Tue, 7 Jun 2011 17:29:55 -0500 Subject: Do database signature checking at load time This is the ideal place to do it as all clients should be checking the return value and ensuring there are no errors. This is similar to pkg_load(). We also add an additional step of validation after we download a new database; a subsequent '-y' operation can potentially invalidate the original check at registration time. Note that this implementation is still a bit naive; if a signature is invalid it is currently impossible to refresh and re-download the file without manually deleting it first. Similarly, if one downloads a database and the check fails, the database object is still there and can be used. These shortcomings will be addressed in a future commit. Signed-off-by: Dan McGee --- lib/libalpm/alpm.h | 5 ++++- lib/libalpm/be_sync.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++- lib/libalpm/db.c | 5 +++-- lib/libalpm/db.h | 3 ++- 4 files changed, 64 insertions(+), 5 deletions(-) (limited to 'lib') diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index 715e502a..eb2eff88 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -357,9 +357,12 @@ alpm_list_t *alpm_option_get_syncdbs(pmhandle_t *handle); /** Register a sync database of packages. * @param handle the context handle * @param treename the name of the sync repository + * @param check_sig what level of signature checking to perform on the + * database; note that this must be a '.sig' file type verification * @return a pmdb_t* on success (the value), NULL on error */ -pmdb_t *alpm_db_register_sync(pmhandle_t *handle, const char *treename); +pmdb_t *alpm_db_register_sync(pmhandle_t *handle, const char *treename, + pgp_verify_t check_sig); /** Unregister a package database. * @param db pointer to the package database to unregister diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c index e5fc6a70..2cf90544 100644 --- a/lib/libalpm/be_sync.c +++ b/lib/libalpm/be_sync.c @@ -20,7 +20,9 @@ #include "config.h" +#include #include +#include /* libarchive */ #include @@ -65,6 +67,37 @@ static char *get_sync_dir(pmhandle_t *handle) return syncpath; } +static int sync_db_validate(pmdb_t *db) +{ + /* this takes into account the default verification level if UNKNOWN + * was assigned to this db */ + pgp_verify_t check_sig = _alpm_db_get_sigverify_level(db); + + if(check_sig != PM_PGP_VERIFY_NEVER) { + int ret; + const char *dbpath = _alpm_db_path(db); + if(!dbpath) { + /* pm_errno set in _alpm_db_path() */ + return -1; + } + + /* we can skip any validation if the database doesn't exist */ + if(access(dbpath, R_OK) != 0 && errno == ENOENT) { + return 0; + } + + _alpm_log(db->handle, PM_LOG_DEBUG, "checking signature for %s\n", + db->treename); + ret = _alpm_gpgme_checksig(db->handle, dbpath, NULL); + if((check_sig == PM_PGP_VERIFY_ALWAYS && ret != 0) || + (check_sig == PM_PGP_VERIFY_OPTIONAL && ret == 1)) { + RET_ERR(db->handle, PM_ERR_SIG_INVALID, -1); + } + } + + return 0; +} + /** Update a package database * * An update of the package database \a db will be attempted. Unless @@ -144,6 +177,15 @@ int SYMEXPORT alpm_db_update(int force, pmdb_t *db) if(ret == 0 && (check_sig == PM_PGP_VERIFY_ALWAYS || check_sig == PM_PGP_VERIFY_OPTIONAL)) { + /* an existing sig file is no good at this point */ + char *sigpath = _alpm_db_sig_path(db); + if(!sigpath) { + ret = -1; + break; + } + unlink(sigpath); + free(sigpath); + int errors_ok = (check_sig == PM_PGP_VERIFY_OPTIONAL); /* if we downloaded a DB, we want the .sig from the same server */ snprintf(fileurl, len, "%s/%s.db.sig", server, db->treename); @@ -173,6 +215,11 @@ int SYMEXPORT alpm_db_update(int force, pmdb_t *db) /* Cache needs to be rebuilt */ _alpm_db_free_pkgcache(db); + if(sync_db_validate(db)) { + /* pm_errno should be set */ + ret = -1; + } + cleanup: free(syncpath); @@ -523,7 +570,8 @@ struct db_operations sync_db_ops = { .version = sync_db_version, }; -pmdb_t *_alpm_db_register_sync(pmhandle_t *handle, const char *treename) +pmdb_t *_alpm_db_register_sync(pmhandle_t *handle, const char *treename, + pgp_verify_t level) { pmdb_t *db; @@ -535,6 +583,12 @@ pmdb_t *_alpm_db_register_sync(pmhandle_t *handle, const char *treename) } db->ops = &sync_db_ops; db->handle = handle; + db->pgp_verify = level; + + if(sync_db_validate(db)) { + _alpm_db_free(db); + return NULL; + } handle->dbs_sync = alpm_list_add(handle->dbs_sync, db); return db; diff --git a/lib/libalpm/db.c b/lib/libalpm/db.c index c3a7abd2..2b50c064 100644 --- a/lib/libalpm/db.c +++ b/lib/libalpm/db.c @@ -45,7 +45,8 @@ */ /** Register a sync database of packages. */ -pmdb_t SYMEXPORT *alpm_db_register_sync(pmhandle_t *handle, const char *treename) +pmdb_t SYMEXPORT *alpm_db_register_sync(pmhandle_t *handle, const char *treename, + pgp_verify_t check_sig) { /* Sanity checks */ CHECK_HANDLE(handle, return NULL); @@ -54,7 +55,7 @@ pmdb_t SYMEXPORT *alpm_db_register_sync(pmhandle_t *handle, const char *treename /* Do not register a database if a transaction is on-going */ ASSERT(handle->trans == NULL, RET_ERR(handle, PM_ERR_TRANS_NOT_NULL, NULL)); - return _alpm_db_register_sync(handle, treename); + return _alpm_db_register_sync(handle, treename, check_sig); } /* Helper function for alpm_db_unregister{_all} */ diff --git a/lib/libalpm/db.h b/lib/libalpm/db.h index e3faeeb4..c5fcd5f0 100644 --- a/lib/libalpm/db.h +++ b/lib/libalpm/db.h @@ -77,7 +77,8 @@ int _alpm_db_version(pmdb_t *db); int _alpm_db_cmp(const void *d1, const void *d2); alpm_list_t *_alpm_db_search(pmdb_t *db, const alpm_list_t *needles); pmdb_t *_alpm_db_register_local(pmhandle_t *handle); -pmdb_t *_alpm_db_register_sync(pmhandle_t *handle, const char *treename); +pmdb_t *_alpm_db_register_sync(pmhandle_t *handle, const char *treename, + pgp_verify_t level); void _alpm_db_unregister(pmdb_t *db); /* be_*.c, backend specific calls */ -- cgit v1.2.3-70-g09d2