]>
Commit | Line | Data |
---|---|---|
1 | #include "cache.h" | |
2 | #include "config.h" | |
3 | #include "run-command.h" | |
4 | #include "strbuf.h" | |
5 | #include "gpg-interface.h" | |
6 | #include "sigchain.h" | |
7 | #include "tempfile.h" | |
8 | ||
9 | static char *configured_signing_key; | |
10 | struct gpg_format { | |
11 | const char *name; | |
12 | const char *program; | |
13 | const char **verify_args; | |
14 | const char **sigs; | |
15 | }; | |
16 | ||
17 | static const char *openpgp_verify_args[] = { | |
18 | "--keyid-format=long", | |
19 | NULL | |
20 | }; | |
21 | static const char *openpgp_sigs[] = { | |
22 | "-----BEGIN PGP SIGNATURE-----", | |
23 | "-----BEGIN PGP MESSAGE-----", | |
24 | NULL | |
25 | }; | |
26 | ||
27 | static const char *x509_verify_args[] = { | |
28 | NULL | |
29 | }; | |
30 | static const char *x509_sigs[] = { | |
31 | "-----BEGIN SIGNED MESSAGE-----", | |
32 | NULL | |
33 | }; | |
34 | ||
35 | static struct gpg_format gpg_format[] = { | |
36 | { .name = "openpgp", .program = "gpg", | |
37 | .verify_args = openpgp_verify_args, | |
38 | .sigs = openpgp_sigs | |
39 | }, | |
40 | { .name = "x509", .program = "gpgsm", | |
41 | .verify_args = x509_verify_args, | |
42 | .sigs = x509_sigs | |
43 | }, | |
44 | }; | |
45 | ||
46 | static struct gpg_format *use_format = &gpg_format[0]; | |
47 | ||
48 | static struct gpg_format *get_format_by_name(const char *str) | |
49 | { | |
50 | int i; | |
51 | ||
52 | for (i = 0; i < ARRAY_SIZE(gpg_format); i++) | |
53 | if (!strcmp(gpg_format[i].name, str)) | |
54 | return gpg_format + i; | |
55 | return NULL; | |
56 | } | |
57 | ||
58 | static struct gpg_format *get_format_by_sig(const char *sig) | |
59 | { | |
60 | int i, j; | |
61 | ||
62 | for (i = 0; i < ARRAY_SIZE(gpg_format); i++) | |
63 | for (j = 0; gpg_format[i].sigs[j]; j++) | |
64 | if (starts_with(sig, gpg_format[i].sigs[j])) | |
65 | return gpg_format + i; | |
66 | return NULL; | |
67 | } | |
68 | ||
69 | void signature_check_clear(struct signature_check *sigc) | |
70 | { | |
71 | FREE_AND_NULL(sigc->payload); | |
72 | FREE_AND_NULL(sigc->gpg_output); | |
73 | FREE_AND_NULL(sigc->gpg_status); | |
74 | FREE_AND_NULL(sigc->signer); | |
75 | FREE_AND_NULL(sigc->key); | |
76 | FREE_AND_NULL(sigc->fingerprint); | |
77 | FREE_AND_NULL(sigc->primary_key_fingerprint); | |
78 | } | |
79 | ||
80 | /* An exclusive status -- only one of them can appear in output */ | |
81 | #define GPG_STATUS_EXCLUSIVE (1<<0) | |
82 | /* The status includes key identifier */ | |
83 | #define GPG_STATUS_KEYID (1<<1) | |
84 | /* The status includes user identifier */ | |
85 | #define GPG_STATUS_UID (1<<2) | |
86 | /* The status includes key fingerprints */ | |
87 | #define GPG_STATUS_FINGERPRINT (1<<3) | |
88 | ||
89 | /* Short-hand for standard exclusive *SIG status with keyid & UID */ | |
90 | #define GPG_STATUS_STDSIG (GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID|GPG_STATUS_UID) | |
91 | ||
92 | static struct { | |
93 | char result; | |
94 | const char *check; | |
95 | unsigned int flags; | |
96 | } sigcheck_gpg_status[] = { | |
97 | { 'G', "GOODSIG ", GPG_STATUS_STDSIG }, | |
98 | { 'B', "BADSIG ", GPG_STATUS_STDSIG }, | |
99 | { 'U', "TRUST_NEVER", 0 }, | |
100 | { 'U', "TRUST_UNDEFINED", 0 }, | |
101 | { 'E', "ERRSIG ", GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID }, | |
102 | { 'X', "EXPSIG ", GPG_STATUS_STDSIG }, | |
103 | { 'Y', "EXPKEYSIG ", GPG_STATUS_STDSIG }, | |
104 | { 'R', "REVKEYSIG ", GPG_STATUS_STDSIG }, | |
105 | { 0, "VALIDSIG ", GPG_STATUS_FINGERPRINT }, | |
106 | }; | |
107 | ||
108 | static void parse_gpg_output(struct signature_check *sigc) | |
109 | { | |
110 | const char *buf = sigc->gpg_status; | |
111 | const char *line, *next; | |
112 | int i, j; | |
113 | int seen_exclusive_status = 0; | |
114 | ||
115 | /* Iterate over all lines */ | |
116 | for (line = buf; *line; line = strchrnul(line+1, '\n')) { | |
117 | while (*line == '\n') | |
118 | line++; | |
119 | if (!*line) | |
120 | break; | |
121 | ||
122 | /* Skip lines that don't start with GNUPG status */ | |
123 | if (!skip_prefix(line, "[GNUPG:] ", &line)) | |
124 | continue; | |
125 | ||
126 | /* Iterate over all search strings */ | |
127 | for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) { | |
128 | if (skip_prefix(line, sigcheck_gpg_status[i].check, &line)) { | |
129 | if (sigcheck_gpg_status[i].flags & GPG_STATUS_EXCLUSIVE) { | |
130 | if (seen_exclusive_status++) | |
131 | goto found_duplicate_status; | |
132 | } | |
133 | ||
134 | if (sigcheck_gpg_status[i].result) | |
135 | sigc->result = sigcheck_gpg_status[i].result; | |
136 | /* Do we have key information? */ | |
137 | if (sigcheck_gpg_status[i].flags & GPG_STATUS_KEYID) { | |
138 | next = strchrnul(line, ' '); | |
139 | free(sigc->key); | |
140 | sigc->key = xmemdupz(line, next - line); | |
141 | /* Do we have signer information? */ | |
142 | if (*next && (sigcheck_gpg_status[i].flags & GPG_STATUS_UID)) { | |
143 | line = next + 1; | |
144 | next = strchrnul(line, '\n'); | |
145 | free(sigc->signer); | |
146 | sigc->signer = xmemdupz(line, next - line); | |
147 | } | |
148 | } | |
149 | /* Do we have fingerprint? */ | |
150 | if (sigcheck_gpg_status[i].flags & GPG_STATUS_FINGERPRINT) { | |
151 | next = strchrnul(line, ' '); | |
152 | free(sigc->fingerprint); | |
153 | sigc->fingerprint = xmemdupz(line, next - line); | |
154 | ||
155 | /* Skip interim fields */ | |
156 | for (j = 9; j > 0; j--) { | |
157 | if (!*next) | |
158 | break; | |
159 | line = next + 1; | |
160 | next = strchrnul(line, ' '); | |
161 | } | |
162 | ||
163 | next = strchrnul(line, '\n'); | |
164 | free(sigc->primary_key_fingerprint); | |
165 | sigc->primary_key_fingerprint = xmemdupz(line, next - line); | |
166 | } | |
167 | ||
168 | break; | |
169 | } | |
170 | } | |
171 | } | |
172 | return; | |
173 | ||
174 | found_duplicate_status: | |
175 | /* | |
176 | * GOODSIG, BADSIG etc. can occur only once for each signature. | |
177 | * Therefore, if we had more than one then we're dealing with multiple | |
178 | * signatures. We don't support them currently, and they're rather | |
179 | * hard to create, so something is likely fishy and we should reject | |
180 | * them altogether. | |
181 | */ | |
182 | sigc->result = 'E'; | |
183 | /* Clear partial data to avoid confusion */ | |
184 | FREE_AND_NULL(sigc->primary_key_fingerprint); | |
185 | FREE_AND_NULL(sigc->fingerprint); | |
186 | FREE_AND_NULL(sigc->signer); | |
187 | FREE_AND_NULL(sigc->key); | |
188 | } | |
189 | ||
190 | int check_signature(const char *payload, size_t plen, const char *signature, | |
191 | size_t slen, struct signature_check *sigc) | |
192 | { | |
193 | struct strbuf gpg_output = STRBUF_INIT; | |
194 | struct strbuf gpg_status = STRBUF_INIT; | |
195 | int status; | |
196 | ||
197 | sigc->result = 'N'; | |
198 | ||
199 | status = verify_signed_buffer(payload, plen, signature, slen, | |
200 | &gpg_output, &gpg_status); | |
201 | if (status && !gpg_output.len) | |
202 | goto out; | |
203 | sigc->payload = xmemdupz(payload, plen); | |
204 | sigc->gpg_output = strbuf_detach(&gpg_output, NULL); | |
205 | sigc->gpg_status = strbuf_detach(&gpg_status, NULL); | |
206 | parse_gpg_output(sigc); | |
207 | status |= sigc->result != 'G' && sigc->result != 'U'; | |
208 | ||
209 | out: | |
210 | strbuf_release(&gpg_status); | |
211 | strbuf_release(&gpg_output); | |
212 | ||
213 | return !!status; | |
214 | } | |
215 | ||
216 | void print_signature_buffer(const struct signature_check *sigc, unsigned flags) | |
217 | { | |
218 | const char *output = flags & GPG_VERIFY_RAW ? | |
219 | sigc->gpg_status : sigc->gpg_output; | |
220 | ||
221 | if (flags & GPG_VERIFY_VERBOSE && sigc->payload) | |
222 | fputs(sigc->payload, stdout); | |
223 | ||
224 | if (output) | |
225 | fputs(output, stderr); | |
226 | } | |
227 | ||
228 | size_t parse_signature(const char *buf, size_t size) | |
229 | { | |
230 | size_t len = 0; | |
231 | size_t match = size; | |
232 | while (len < size) { | |
233 | const char *eol; | |
234 | ||
235 | if (get_format_by_sig(buf + len)) | |
236 | match = len; | |
237 | ||
238 | eol = memchr(buf + len, '\n', size - len); | |
239 | len += eol ? eol - (buf + len) + 1 : size - len; | |
240 | } | |
241 | return match; | |
242 | } | |
243 | ||
244 | void set_signing_key(const char *key) | |
245 | { | |
246 | free(configured_signing_key); | |
247 | configured_signing_key = xstrdup(key); | |
248 | } | |
249 | ||
250 | int git_gpg_config(const char *var, const char *value, void *cb) | |
251 | { | |
252 | struct gpg_format *fmt = NULL; | |
253 | char *fmtname = NULL; | |
254 | ||
255 | if (!strcmp(var, "user.signingkey")) { | |
256 | if (!value) | |
257 | return config_error_nonbool(var); | |
258 | set_signing_key(value); | |
259 | return 0; | |
260 | } | |
261 | ||
262 | if (!strcmp(var, "gpg.format")) { | |
263 | if (!value) | |
264 | return config_error_nonbool(var); | |
265 | fmt = get_format_by_name(value); | |
266 | if (!fmt) | |
267 | return error("unsupported value for %s: %s", | |
268 | var, value); | |
269 | use_format = fmt; | |
270 | return 0; | |
271 | } | |
272 | ||
273 | if (!strcmp(var, "gpg.program") || !strcmp(var, "gpg.openpgp.program")) | |
274 | fmtname = "openpgp"; | |
275 | ||
276 | if (!strcmp(var, "gpg.x509.program")) | |
277 | fmtname = "x509"; | |
278 | ||
279 | if (fmtname) { | |
280 | fmt = get_format_by_name(fmtname); | |
281 | return git_config_string(&fmt->program, var, value); | |
282 | } | |
283 | ||
284 | return 0; | |
285 | } | |
286 | ||
287 | const char *get_signing_key(void) | |
288 | { | |
289 | if (configured_signing_key) | |
290 | return configured_signing_key; | |
291 | return git_committer_info(IDENT_STRICT|IDENT_NO_DATE); | |
292 | } | |
293 | ||
294 | int sign_buffer(struct strbuf *buffer, struct strbuf *signature, const char *signing_key) | |
295 | { | |
296 | struct child_process gpg = CHILD_PROCESS_INIT; | |
297 | int ret; | |
298 | size_t i, j, bottom; | |
299 | struct strbuf gpg_status = STRBUF_INIT; | |
300 | ||
301 | argv_array_pushl(&gpg.args, | |
302 | use_format->program, | |
303 | "--status-fd=2", | |
304 | "-bsau", signing_key, | |
305 | NULL); | |
306 | ||
307 | bottom = signature->len; | |
308 | ||
309 | /* | |
310 | * When the username signingkey is bad, program could be terminated | |
311 | * because gpg exits without reading and then write gets SIGPIPE. | |
312 | */ | |
313 | sigchain_push(SIGPIPE, SIG_IGN); | |
314 | ret = pipe_command(&gpg, buffer->buf, buffer->len, | |
315 | signature, 1024, &gpg_status, 0); | |
316 | sigchain_pop(SIGPIPE); | |
317 | ||
318 | ret |= !strstr(gpg_status.buf, "\n[GNUPG:] SIG_CREATED "); | |
319 | strbuf_release(&gpg_status); | |
320 | if (ret) | |
321 | return error(_("gpg failed to sign the data")); | |
322 | ||
323 | /* Strip CR from the line endings, in case we are on Windows. */ | |
324 | for (i = j = bottom; i < signature->len; i++) | |
325 | if (signature->buf[i] != '\r') { | |
326 | if (i != j) | |
327 | signature->buf[j] = signature->buf[i]; | |
328 | j++; | |
329 | } | |
330 | strbuf_setlen(signature, j); | |
331 | ||
332 | return 0; | |
333 | } | |
334 | ||
335 | int verify_signed_buffer(const char *payload, size_t payload_size, | |
336 | const char *signature, size_t signature_size, | |
337 | struct strbuf *gpg_output, struct strbuf *gpg_status) | |
338 | { | |
339 | struct child_process gpg = CHILD_PROCESS_INIT; | |
340 | struct gpg_format *fmt; | |
341 | struct tempfile *temp; | |
342 | int ret; | |
343 | struct strbuf buf = STRBUF_INIT; | |
344 | ||
345 | temp = mks_tempfile_t(".git_vtag_tmpXXXXXX"); | |
346 | if (!temp) | |
347 | return error_errno(_("could not create temporary file")); | |
348 | if (write_in_full(temp->fd, signature, signature_size) < 0 || | |
349 | close_tempfile_gently(temp) < 0) { | |
350 | error_errno(_("failed writing detached signature to '%s'"), | |
351 | temp->filename.buf); | |
352 | delete_tempfile(&temp); | |
353 | return -1; | |
354 | } | |
355 | ||
356 | fmt = get_format_by_sig(signature); | |
357 | if (!fmt) | |
358 | BUG("bad signature '%s'", signature); | |
359 | ||
360 | argv_array_push(&gpg.args, fmt->program); | |
361 | argv_array_pushv(&gpg.args, fmt->verify_args); | |
362 | argv_array_pushl(&gpg.args, | |
363 | "--status-fd=1", | |
364 | "--verify", temp->filename.buf, "-", | |
365 | NULL); | |
366 | ||
367 | if (!gpg_status) | |
368 | gpg_status = &buf; | |
369 | ||
370 | sigchain_push(SIGPIPE, SIG_IGN); | |
371 | ret = pipe_command(&gpg, payload, payload_size, | |
372 | gpg_status, 0, gpg_output, 0); | |
373 | sigchain_pop(SIGPIPE); | |
374 | ||
375 | delete_tempfile(&temp); | |
376 | ||
377 | ret |= !strstr(gpg_status->buf, "\n[GNUPG:] GOODSIG "); | |
378 | strbuf_release(&buf); /* no matter it was used or not */ | |
379 | ||
380 | return ret; | |
381 | } |