Annotation of src/usr.bin/gzsig/verify.c, Revision 1.1.1.1
1.1 marius 1: /* $OpenBSD$ */
2:
3: /*
4: * verify.c
5: *
6: * Copyright (c) 2001 Dug Song <dugsong@arbor.net>
7: * Copyright (c) 2001 Arbor Networks, Inc.
8: *
9: * Redistribution and use in source and binary forms, with or without
10: * modification, are permitted provided that the following conditions
11: * are met:
12: *
13: * 1. Redistributions of source code must retain the above copyright
14: * notice, this list of conditions and the following disclaimer.
15: * 2. Redistributions in binary form must reproduce the above copyright
16: * notice, this list of conditions and the following disclaimer in the
17: * documentation and/or other materials provided with the distribution.
18: * 3. The names of the copyright holders may not be used to endorse or
19: * promote products derived from this software without specific
20: * prior written permission.
21: *
22: * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
23: * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
24: * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
25: * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
26: * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
27: * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
28: * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
29: * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
30: * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
31: * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32: *
33: * $Id: verify.c,v 1.3 2005/04/07 23:19:35 dugsong Exp $
34: */
35:
36: #include <sys/types.h>
37:
38: #include <openssl/ssl.h>
39: #include <openssl/evp.h>
40: #include <openssl/sha.h>
41:
42: #include <errno.h>
43: #include <stdio.h>
44: #include <stdlib.h>
45: #include <string.h>
46: #include <unistd.h>
47:
48: #include "extern.h"
49: #include "gzip.h"
50: #include "key.h"
51: #include "util.h"
52:
53: static int
54: verify_signature(struct key *key, FILE *fin)
55: {
56: struct gzip_header gh;
57: struct gzip_xfield *gx;
58: struct gzsig_data *gd;
59: u_char *sig, digest[20], buf[8192], sbuf[4096];
60: SHA_CTX ctx;
61: int i, siglen;
62:
63: /* Read gzip header. */
64: if ((i = fread((u_char *)&gh, 1, sizeof(gh), fin)) != sizeof(gh)) {
65: fprintf(stderr, "Error reading gzip header: %s\n",
66: strerror(errno));
67: return (-1);
68: }
69: /* Verify gzip header. */
70: if (memcmp(gh.magic, GZIP_MAGIC, sizeof(gh.magic)) != 0) {
71: fprintf(stderr, "Invalid gzip file\n");
72: return (-1);
73: } else if (gh.flags & GZIP_FCONT){
74: fprintf(stderr, "Multi-part gzip files not supported\n");
75: return (-1);
76: } else if ((gh.flags & GZIP_FEXTRA) == 0) {
77: fprintf(stderr, "No gzip signature found\n");
78: return (-1);
79: }
80: /* Read signature. */
81: gx = (struct gzip_xfield *)buf;
82:
83: if ((i = fread((u_char *)gx, 1, sizeof(*gx), fin)) != sizeof(*gx)) {
84: fprintf(stderr, "Error reading extra field: %s\n",
85: strerror(errno));
86: return (-1);
87: }
88: if (memcmp(gx->subfield.id, GZSIG_ID, sizeof(gx->subfield.id)) != 0) {
89: fprintf(stderr, "Unknown extra field\n");
90: return (-1);
91: }
92: gx->subfield.len = letoh16(gx->subfield.len);
93:
94: if (gx->subfield.len <= 0 || gx->subfield.len > sizeof(sbuf)) {
95: fprintf(stderr, "Invalid signature length\n");
96: return (-1);
97: }
98: gd = (struct gzsig_data *)sbuf;
99:
100: if ((i = fread((u_char *)gd, 1, gx->subfield.len, fin)) !=
101: gx->subfield.len) {
102: fprintf(stderr, "Error reading signature: %s\n",
103: strerror(errno));
104: return (-1);
105: }
106: /* Skip over any options. */
107: if (gh.flags & GZIP_FNAME) {
108: while (getc(fin) != '\0')
109: ;
110: }
111: if (gh.flags & GZIP_FCOMMENT) {
112: while (getc(fin) != '\0')
113: ;
114: }
115: if (gh.flags & GZIP_FENCRYPT &&
116: fread(buf, 1, GZIP_FENCRYPT_LEN, fin) != GZIP_FENCRYPT_LEN)
117: return (-1);
118:
119: /* Check signature version. */
120: if (gd->version != GZSIG_VERSION) {
121: fprintf(stderr, "Unknown signature version: %d\n",
122: gd->version);
123: return (-1);
124: }
125: /* Compute SHA1 checksum over compressed data and trailer. */
126: sig = (u_char *)(gd + 1);
127: siglen = gx->subfield.len - sizeof(*gd);
128:
129: SHA1_Init(&ctx);
130:
131: while ((i = fread(buf, 1, sizeof(buf), fin)) > 0) {
132: SHA1_Update(&ctx, buf, i);
133: }
134: SHA1_Final(digest, &ctx);
135:
136: /* Verify signature. */
137: if (key_verify(key, digest, sizeof(digest), sig, siglen) < 0) {
138: fprintf(stderr, "Error verifying signature\n");
139: return (-1);
140: }
141: return (0);
142: }
143:
144: void
145: verify_usage(void)
146: {
147: fprintf(stderr, "Usage: gzsig verify [-v] pubkey [file ...]\n");
148: }
149:
150: void
151: verify(int argc, char *argv[])
152: {
153: struct key *key;
154: char *gzipfile;
155: FILE *fin;
156: int i, error, vflag;
157:
158: vflag = 0;
159:
160: while ((i = getopt(argc, argv, "vh?")) != -1) {
161: switch (i) {
162: case 'v':
163: vflag = 1;
164: break;
165: default:
166: verify_usage();
167: exit(1);
168: }
169: }
170: argc -= optind;
171: argv += optind;
172:
173: if (argc < 1) {
174: verify_usage();
175: exit(1);
176: }
177: OpenSSL_add_all_algorithms();
178:
179: if ((key = key_new()) == NULL)
180: fatal(1, "Can't initialize public key");
181:
182: if (key_load_public(key, argv[0]) < 0)
183: fatal(1, "Can't load public key");
184:
185: if (argc == 1 || *argv[1] == '-') {
186: argc = 0;
187:
188: if (verify_signature(key, stdin) == 0) {
189: if (vflag)
190: fprintf(stderr, "Verified input\n");
191: } else
192: fatal(1, "Couldn't verify input");
193: }
194: for (i = 1; i < argc; i++) {
195: gzipfile = argv[i];
196:
197: if ((fin = fopen(gzipfile, "r")) < 0) {
198: fprintf(stderr, "Couldn't open %s: %s\n",
199: gzipfile, strerror(errno));
200: continue;
201: }
202: error = verify_signature(key, fin);
203: fclose(fin);
204:
205: if (!error) {
206: if (vflag)
207: fprintf(stderr, "Verified %s\n", gzipfile);
208: } else
209: fatal(1, "Couldn't verify %s", gzipfile);
210: }
211: key_free(key);
212: }
![[BACK]](/icons/back.gif){kind=icon}
Return to verify.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / gzsig