db: Change how we store file digests and load them from the database

[people/stevee/pakfire.git] / src / libpakfire / file.c

/*#############################################################################
#                                                                             #
# Pakfire - The IPFire package management system                              #
# Copyright (C) 2014 Pakfire development team                                 #
#                                                                             #
# This program is free software: you can redistribute it and/or modify        #
# it under the terms of the GNU General Public License as published by        #
# the Free Software Foundation, either version 3 of the License, or           #
# (at your option) any later version.                                         #
#                                                                             #
# This program is distributed in the hope that it will be useful,             #
# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
# GNU General Public License for more details.                                #
#                                                                             #
# You should have received a copy of the GNU General Public License           #
# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
#                                                                             #
#############################################################################*/

#include <errno.h>
#include <libgen.h>
#include <linux/limits.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <time.h>

#include <archive_entry.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/sha.h>

#include <pakfire/constants.h>
#include <pakfire/file.h>
#include <pakfire/logging.h>
#include <pakfire/pakfire.h>
#include <pakfire/private.h>
#include <pakfire/string.h>
#include <pakfire/util.h>

enum pakfire_file_verification_status {
	PAKFIRE_FILE_NOENT                = (1 << 0),
	PAKFIRE_FILE_TYPE_CHANGED         = (1 << 1),
	PAKFIRE_FILE_PERMISSIONS_CHANGED  = (1 << 2),
	PAKFIRE_FILE_DEV_CHANGED          = (1 << 3),
	PAKFIRE_FILE_SIZE_CHANGED         = (1 << 4),
	PAKFIRE_FILE_OWNER_CHANGED        = (1 << 5),
	PAKFIRE_FILE_GROUP_CHANGED        = (1 << 6),
	PAKFIRE_FILE_CTIME_CHANGED        = (1 << 7),
	PAKFIRE_FILE_MTIME_CHANGED        = (1 << 8),
	PAKFIRE_FILE_PAYLOAD_CHANGED      = (1 << 9),
};

struct pakfire_file {
	struct pakfire* pakfire;
	int nrefs;

	// The relative path
	char path[PATH_MAX];

	// The absolute path in the file system
	char abspath[PATH_MAX];

	// File Ownership
	char user[LOGIN_NAME_MAX];
	char group[LOGIN_NAME_MAX];

	// File Size
	ssize_t size;

	// File Mode
	mode_t mode;

	// Dev Minor/Major
	dev_t dev;

	// Creation/Modification Time
	time_t ctime;
	time_t mtime;

	// Link destinations
	char hardlink[PATH_MAX];
	char symlink[PATH_MAX];

	// Digests
	struct pakfire_file_digests {
		// SHA-512
		unsigned char sha512[SHA512_DIGEST_LENGTH];

		// SHA-256
		unsigned char sha256[SHA256_DIGEST_LENGTH];
	} digests;

	// Verification Status
	int verify_status;

	#warning TODO capabilities, config, data
	// capabilities
	//int is_configfile;
	//int is_datafile;
};

PAKFIRE_EXPORT int pakfire_file_create(struct pakfire_file** file, struct pakfire* pakfire) {
	struct pakfire_file* f = calloc(1, sizeof(*f));
	if (!f)
		return 1;

	// Store reference to Pakfire
	f->pakfire = pakfire_ref(pakfire);

	// Initialize reference counter
	f->nrefs = 1;

	*file = f;
	return 0;
}

int pakfire_file_create_from_archive_entry(struct pakfire_file** file, struct pakfire* pakfire,
		struct archive_entry* entry) {
	int r = pakfire_file_create(file, pakfire);
	if (r)
		return r;

	// Copy archive entry
	r = pakfire_file_copy_archive_entry(*file, entry);
	if (r)
		goto ERROR;

	return 0;

ERROR:
	pakfire_file_unref(*file);
	*file = NULL;

	return r;
}

static const struct pakfire_libarchive_digest {
	enum pakfire_digests pakfire;
	int libarchive;
} pakfire_libarchive_digests[] = {
	{ PAKFIRE_DIGEST_SHA512, ARCHIVE_ENTRY_DIGEST_SHA512 },
	{ PAKFIRE_DIGEST_SHA256, ARCHIVE_ENTRY_DIGEST_SHA256 },
	{ 0, 0 },
};

int pakfire_file_copy_archive_entry(struct pakfire_file* file, struct archive_entry* entry) {
	int r = 0;

	// Set abspath
	pakfire_file_set_abspath(file, archive_entry_sourcepath(entry));

	// Set path
	const char* path = archive_entry_pathname(entry);
	if (path) {
		// Strip any leading dots from paths
		if (pakfire_string_startswith(path, "./"))
			path++;

		pakfire_file_set_path(file, path);
	}

	// Set links
	pakfire_file_set_hardlink(file, archive_entry_hardlink(entry));
	pakfire_file_set_symlink(file, archive_entry_symlink(entry));

	// Set size
	pakfire_file_set_size(file, archive_entry_size(entry));

	// Set mode
	pakfire_file_set_mode(file, archive_entry_mode(entry));

	// Set dev type
	if (archive_entry_dev_is_set(entry))
		pakfire_file_set_dev(file, archive_entry_dev(entry));

	// Set user
	pakfire_file_set_user(file, archive_entry_uname(entry));

	// Set group
	pakfire_file_set_group(file, archive_entry_gname(entry));

	// Set times
	pakfire_file_set_ctime(file, archive_entry_ctime(entry));
	pakfire_file_set_mtime(file, archive_entry_mtime(entry));

	// Copy digest
	for (const struct pakfire_libarchive_digest* type = pakfire_libarchive_digests;
			type->pakfire; type++) {
		const unsigned char* digest = archive_entry_digest(entry, type->libarchive);
		if (digest) {
			r = pakfire_file_set_digest(file, type->pakfire, digest);
			if (r)
				return r;
		}
	}

	return r;
}

struct archive_entry* pakfire_file_archive_entry(struct pakfire_file* file) {
	struct archive_entry* entry = archive_entry_new();
	if (!entry) {
		ERROR(file->pakfire, "Could not allocate archive entry: %m\n");
		return NULL;
	}

	// Set path
	archive_entry_copy_pathname(entry, pakfire_file_get_path(file));

	// Set source path
	archive_entry_copy_sourcepath(entry, file->abspath);

	// Set links
	if (*file->hardlink)
		archive_entry_set_hardlink(entry, file->hardlink);
	if (*file->symlink)
		archive_entry_set_symlink(entry, file->symlink);

	// Set size
	archive_entry_set_size(entry, pakfire_file_get_size(file));

	// Set mode
	archive_entry_set_mode(entry, pakfire_file_get_mode(file));

	// Set user
	archive_entry_set_uname(entry, pakfire_file_get_user(file));

	// Set group
	archive_entry_set_gname(entry, pakfire_file_get_group(file));

	// Set times
	archive_entry_set_ctime(entry, pakfire_file_get_ctime(file), 0);
	archive_entry_set_mtime(entry, pakfire_file_get_mtime(file), 0);

	// XXX copy digest

	return entry;
}

static void pakfire_file_free(struct pakfire_file* file) {
	pakfire_unref(file->pakfire);
	free(file);
}

PAKFIRE_EXPORT struct pakfire_file* pakfire_file_ref(struct pakfire_file* file) {
	file->nrefs++;

	return file;
}

PAKFIRE_EXPORT struct pakfire_file* pakfire_file_unref(struct pakfire_file* file) {
	if (--file->nrefs > 0)
		return file;

	pakfire_file_free(file);
	return NULL;
}

PAKFIRE_EXPORT int pakfire_file_cmp(struct pakfire_file* file1, struct pakfire_file* file2) {
	const char* path1 = pakfire_file_get_path(file1);
	const char* path2 = pakfire_file_get_path(file2);

	return strcmp(path1, path2);
}

const char* pakfire_file_get_abspath(struct pakfire_file* file) {
	return file->abspath;
}

int pakfire_file_set_abspath(struct pakfire_file* file, const char* path) {
	// Check if path is set and absolute
	if (!path || *path != '/') {
		errno = EINVAL;
		return 1;
	}

	return pakfire_string_set(file->abspath, path);
}

PAKFIRE_EXPORT const char* pakfire_file_get_path(struct pakfire_file* file) {
	return file->path;
}

PAKFIRE_EXPORT int pakfire_file_set_path(struct pakfire_file* file, const char* path) {
	// Check if path is set and absolute
	if (!path || *path != '/') {
		errno = EINVAL;
		return 1;
	}

	return pakfire_string_set(file->path, path);
}

PAKFIRE_EXPORT const char* pakfire_file_get_hardlink(struct pakfire_file* file) {
	if (!*file->hardlink)
		return NULL;

	return file->hardlink;
}

PAKFIRE_EXPORT void pakfire_file_set_hardlink(struct pakfire_file* file, const char* link) {
	if (!link || !*link)
		*file->hardlink = '\0';
	else
		pakfire_string_set(file->hardlink, link);
}

PAKFIRE_EXPORT const char* pakfire_file_get_symlink(struct pakfire_file* file) {
	if (!*file->symlink)
		return NULL;

	return file->symlink;
}

PAKFIRE_EXPORT void pakfire_file_set_symlink(struct pakfire_file* file, const char* link) {
	if (!link || !*link)
		*file->hardlink = '\0';
	else
		pakfire_string_set(file->symlink, link);
}

PAKFIRE_EXPORT int pakfire_file_get_type(struct pakfire_file* file) {
	return file->mode & S_IFMT;
}

PAKFIRE_EXPORT ssize_t pakfire_file_get_size(struct pakfire_file* file) {
	return file->size;
}

PAKFIRE_EXPORT void pakfire_file_set_size(struct pakfire_file* file, ssize_t size) {
	file->size = size;
}

PAKFIRE_EXPORT const char* pakfire_file_get_user(struct pakfire_file* file) {
	return file->user;
}

PAKFIRE_EXPORT void pakfire_file_set_user(struct pakfire_file* file, const char* user) {
	pakfire_string_set(file->user, user);
}

PAKFIRE_EXPORT const char* pakfire_file_get_group(struct pakfire_file* file) {
	return file->group;
}

PAKFIRE_EXPORT void pakfire_file_set_group(struct pakfire_file* file, const char* group) {
	pakfire_string_set(file->group, group);
}

PAKFIRE_EXPORT mode_t pakfire_file_get_mode(struct pakfire_file* file) {
	return file->mode;
}

PAKFIRE_EXPORT void pakfire_file_set_mode(struct pakfire_file* file, mode_t mode) {
	file->mode = mode;
}

PAKFIRE_EXPORT dev_t pakfire_file_get_dev(struct pakfire_file* file) {
	return file->dev;
}

PAKFIRE_EXPORT void pakfire_file_set_dev(struct pakfire_file* file, dev_t dev) {
	file->dev = dev;
}

PAKFIRE_EXPORT time_t pakfire_file_get_ctime(struct pakfire_file* file) {
	return file->ctime;
}

PAKFIRE_EXPORT void pakfire_file_set_ctime(struct pakfire_file* file, time_t time) {
	file->ctime = time;
}

PAKFIRE_EXPORT time_t pakfire_file_get_mtime(struct pakfire_file* file) {
	return file->mtime;
}

PAKFIRE_EXPORT void pakfire_file_set_mtime(struct pakfire_file* file, time_t time) {
	file->mtime = time;
}

/*
	Returns one if the digest is not all zeros.
*/
#define pakfire_file_has_digest(digest) __pakfire_file_has_digest(digest, sizeof(digest))

static int __pakfire_file_has_digest(const unsigned char* digest, const size_t length) {
	for (unsigned int i = 0; i < length; i++) {
		if (digest[i])
			return 1;
	}

	return 0;
}

PAKFIRE_EXPORT const unsigned char* pakfire_file_get_digest(
		struct pakfire_file* file, const enum pakfire_digests type, size_t* length) {

	switch (type) {
		case PAKFIRE_DIGEST_SHA512:
			if (!pakfire_file_has_digest(file->digests.sha512))
				return NULL;

			if (length)
				*length = sizeof(file->digests.sha512);

			return file->digests.sha512;

		case PAKFIRE_DIGEST_SHA256:
			if (!pakfire_file_has_digest(file->digests.sha256))
				return NULL;

			if (length)
				*length = sizeof(file->digests.sha256);

			return file->digests.sha256;
	}

	return NULL;
}

PAKFIRE_EXPORT int pakfire_file_set_digest(struct pakfire_file* file,
		const enum pakfire_digests type, const unsigned char* digest) {
	if (!digest) {
		errno = EINVAL;
		return 1;
	}

	switch (type) {
		case PAKFIRE_DIGEST_SHA512:
			memcpy(file->digests.sha512, digest, sizeof(file->digests.sha512));
			break;

		case PAKFIRE_DIGEST_SHA256:
			memcpy(file->digests.sha256, digest, sizeof(file->digests.sha256));
			break;
	}

	return 0;
}

PAKFIRE_EXPORT char* pakfire_file_get_hexdigest(
		struct pakfire_file* file, const enum pakfire_digests type) {
	const unsigned char* digest = NULL;
	size_t length = 0;

	// Fetch the digest
	digest = pakfire_file_get_digest(file, type, &length);
	if (!digest)
		return NULL;

	return __pakfire_hexlify(digest, length);
}

static int pakfire_file_levels(struct pakfire_file* file) {
	if (!*file->path)
		return 0;

	int levels = 0;

	for (char* p = file->path; *p; p++) {
		if (*p == '/')
			levels++;
	}

	return levels;
}

FILE* pakfire_file_open(struct pakfire_file* file) {
	FILE* f = fopen(file->abspath, "r");
	if (!f)
		ERROR(file->pakfire, "Could not open %s: %m\n", file->abspath);

	return f;
}

int pakfire_file_remove(struct pakfire_file* file) {
	if (!*file->abspath) {
		errno = EINVAL;
		return 1;
	}

	DEBUG(file->pakfire, "Removing %s...\n", file->path);

	int r = remove(file->abspath);
	if (r) {
		switch (errno) {
			// Ignore when we could not remove directories
			case ENOTEMPTY:
				return 0;

			// Ignore if the file didn't exist
			case ENOENT:
				return 0;

			default:
				break;
		}

		ERROR(file->pakfire, "Could not remove %s (%s): %m\n", file->path, file->abspath);
	}

	return r;
}

/*
	This function tries to remove the file after it has been packaged.

	It will try to delete any parent directories as well and ignore if directories
	cannot be deleted because they might contain other files
*/
int pakfire_file_cleanup(struct pakfire_file* file) {
	char path[PATH_MAX];

	// Try removing the file
	int r = pakfire_file_remove(file);
	if (r)
		return r;

	// Create a working copy of abspath
	r = pakfire_string_set(path, file->abspath);
	if (r)
		return r;

	// See how many levels this file has
	int levels = pakfire_file_levels(file);

	// Walk all the way up and remove all parent directories if possible
	while (--levels) {
		dirname(path);

		// Break if path is suddenly empty
		if (!*path)
			break;

		r = rmdir(path);
		if (r) {
			if (errno == ENOTEMPTY)
				return 0;

			return r;
		}
	}

	return 0;
}

static int pakfire_file_verify_mode(struct pakfire_file* file, const struct stat* st) {
	// Did the type change?
	if ((file->mode & S_IFMT) != (st->st_mode & S_IFMT)) {
		file->verify_status |= PAKFIRE_FILE_TYPE_CHANGED;

		DEBUG(file->pakfire, "%s: File Type changed\n", file->path);
	}

	// Check permissions
	if ((file->mode & 0777) != (st->st_mode & 0777)) {
		file->verify_status |= PAKFIRE_FILE_PERMISSIONS_CHANGED;

		DEBUG(file->pakfire, "%s: Permissions changed\n", file->path);
	}

	// Check if device node changed
	if (S_ISCHR(st->st_mode) || S_ISBLK(st->st_mode)) {
		if (file->dev != st->st_dev) {
			file->verify_status |= PAKFIRE_FILE_DEV_CHANGED;

			DEBUG(file->pakfire, "%s: Device Node changed\n", file->path);
		}
	}

	return 0;
}

static int pakfire_file_verify_size(struct pakfire_file* file, const struct stat* st) {
	// Nothing to do if size matches
	if (file->size == st->st_size)
		return 0;

	// Size differs
	file->verify_status |= PAKFIRE_FILE_SIZE_CHANGED;

	DEBUG(file->pakfire, "%s: Filesize differs (expected %zu, got %zu byte(s))\n",
		file->path, file->size, st->st_size);

	return 0;
}

static int pakfire_file_verify_ownership(struct pakfire_file* file, const struct stat* st) {
	// Fetch UID/GID
#if 0
	const uid_t uid = pakfire_unmap_id(file->pakfire, st->st_uid);
	const gid_t gid = pakfire_unmap_id(file->pakfire, st->st_gid);
#else
	const uid_t uid = st->st_uid;
	const gid_t gid = st->st_gid;
#endif

	// Fetch owner & group
	struct passwd* owner = pakfire_getpwnam(file->pakfire, file->user);
	struct group*  group = pakfire_getgrnam(file->pakfire, file->group);

	// Check if owner matches
	if (!owner || owner->pw_uid != uid) {
		file->verify_status |= PAKFIRE_FILE_OWNER_CHANGED;

		DEBUG(file->pakfire, "%s: Owner differs\n", file->path);
	}

	// Check if group matches
	if (!group || group->gr_gid != gid) {
		file->verify_status |= PAKFIRE_FILE_GROUP_CHANGED;

		DEBUG(file->pakfire, "%s: Group differs\n", file->path);
	}

	return 0;
}

static int pakfire_file_verify_timestamps(struct pakfire_file* file, const struct stat* st) {
	// Check creation time
	if (file->ctime != st->st_ctime) {
		file->verify_status |= PAKFIRE_FILE_CTIME_CHANGED;

		DEBUG(file->pakfire, "%s: Creation time changed\n", file->path);
	}

	// Check modification time
	if (file->mtime != st->st_mtime) {
		file->verify_status |= PAKFIRE_FILE_MTIME_CHANGED;

		DEBUG(file->pakfire, "%s: Modification time changed\n", file->path);
	}

	return 0;
}

static int pakfire_file_verify_payload(struct pakfire_file* file, const struct stat* st) {
	char buffer[PAKFIRE_BUFFER_SIZE];
	FILE* f = NULL;
	int r;

	EVP_MD_CTX* sha512_ctx = NULL;
	EVP_MD_CTX* sha256_ctx = NULL;

	struct pakfire_file_digests computed_digests;

	// Nothing to do for anything that isn't a regular file
	if (!S_ISREG(st->st_mode))
		return 0;

	// Fast-path if size changed. The payload will have changed, too
	if (file->verify_status & PAKFIRE_FILE_SIZE_CHANGED) {
		file->verify_status |= PAKFIRE_FILE_PAYLOAD_CHANGED;
		return 0;
	}

	// Check if this file has any digests at all
	if (!pakfire_file_has_digest(file->digests.sha512) &&
			!pakfire_file_has_digest(file->digests.sha256)) {
		ERROR(file->pakfire, "%s: No digests available\n", file->path);
		return 0;
	}

	// Initialize context for SHA-512
	sha512_ctx = EVP_MD_CTX_new();
	if (!sha512_ctx) {
		ERROR(file->pakfire, "Could not initialize OpenSSL context: %s\n",
			ERR_error_string(ERR_get_error(), NULL));
		r = 1;
		goto ERROR;
	}

	// Setup SHA-512 digest
	r = EVP_DigestInit_ex(sha512_ctx, EVP_sha512(), NULL);
	if (r != 1) {
		ERROR(file->pakfire, "Could not setup SHA-512 digest: %s\n",
			ERR_error_string(ERR_get_error(), NULL));
		r = 1;
		goto ERROR;
	}

	// Initialize context for SHA-256
	sha256_ctx = EVP_MD_CTX_new();
	if (!sha256_ctx) {
		ERROR(file->pakfire, "Could not initialize OpenSSL context: %s\n",
			ERR_error_string(ERR_get_error(), NULL));
		r = 1;
		goto ERROR;
	}

	// Setup SHA-256 digest
	r = EVP_DigestInit_ex(sha256_ctx, EVP_sha256(), NULL);
	if (r != 1) {
		ERROR(file->pakfire, "Could not setup SHA-256 digest: %s\n",
			ERR_error_string(ERR_get_error(), NULL));
		r = 1;
		goto ERROR;
	}

	// Open the file
	f = pakfire_file_open(file);
	if (!f) {
		ERROR(file->pakfire, "Could not open %s: %m\n", file->path);
		goto ERROR;
	}

	// Read the file into the hash functions
	while (!feof(f)) {
		size_t bytes_read = fread(buffer, 1, sizeof(buffer), f);

		// Raise any reading errors
		if (ferror(f)) {
			r = 1;
			goto ERROR;
		}

		// SHA-512
		r = EVP_DigestUpdate(sha512_ctx, buffer, bytes_read);
		if (r != 1) {
			ERROR(file->pakfire, "EVP_Digest_Update() failed: %s\n",
				ERR_error_string(ERR_get_error(), NULL));
			r = 1;
			goto ERROR;
		}

		// SHA-256
		r = EVP_DigestUpdate(sha256_ctx, buffer, bytes_read);
		if (r != 1) {
			ERROR(file->pakfire, "EVP_Digest_Update() failed: %s\n",
				ERR_error_string(ERR_get_error(), NULL));
			r = 1;
			goto ERROR;
		}
	}

	// Finalize SHA-512
	r = EVP_DigestFinal_ex(sha512_ctx, computed_digests.sha512, NULL);
	if (r != 1) {
		ERROR(file->pakfire, "EVP_DigestFinal_ex() failed: %s\n",
			ERR_error_string(ERR_get_error(), NULL));
		r = 1;
		goto ERROR;
	}

	// Finalize SHA-256
	r = EVP_DigestFinal_ex(sha256_ctx, computed_digests.sha256, NULL);
	if (r != 1) {
		ERROR(file->pakfire, "EVP_DigestFinal_ex() failed: %s\n",
			ERR_error_string(ERR_get_error(), NULL));
		r = 1;
		goto ERROR;
	}

	// Check SHA-512
	r = CRYPTO_memcmp(computed_digests.sha512,
		file->digests.sha512, sizeof(file->digests.sha512));
	if (r) {
		file->verify_status |= PAKFIRE_FILE_PAYLOAD_CHANGED;

		DEBUG(file->pakfire, "%s: SHA-512 digest does not match\n", file->path);
	}

	// Check SHA-256
	r = CRYPTO_memcmp(computed_digests.sha256,
		file->digests.sha256, sizeof(file->digests.sha256));
	if (r) {
		file->verify_status |= PAKFIRE_FILE_PAYLOAD_CHANGED;

		DEBUG(file->pakfire, "%s: SHA-256 digest does not match\n", file->path);
	}

	// Success
	r = 0;

ERROR:
	if (sha512_ctx)
		EVP_MD_CTX_free(sha512_ctx);
	if (sha256_ctx)
		EVP_MD_CTX_free(sha256_ctx);
	if (f)
		fclose(f);

	return r;
}

/*
	Verify the file - i.e. does the metadata match what is on disk?
*/
int pakfire_file_verify(struct pakfire_file* file, int* status) {
	struct stat st;
	int r;

	DEBUG(file->pakfire, "Verifying %s...\n", file->path);

	// stat() the file
	r = lstat(file->abspath, &st);
	if (r) {
		// File does not exist
		if (errno == ENOENT) {
			file->verify_status |= PAKFIRE_FILE_NOENT;
			return 1;
		}

		// Raise any other errors from stat()
		return r;
	}

	// Verify mode
	r = pakfire_file_verify_mode(file, &st);
	if (r)
		return r;

	// Verify size
	r = pakfire_file_verify_size(file, &st);
	if (r)
		return r;

	// Verify ownership
	r = pakfire_file_verify_ownership(file, &st);
	if (r)
		return r;

	// Verify timestamps
	r = pakfire_file_verify_timestamps(file, &st);
	if (r)
		return r;

	// Verify payload
	r = pakfire_file_verify_payload(file, &st);
	if (r)
		return r;

	return 0;
}