diff options
Diffstat (limited to 'usr.sbin/pkg_add/OpenBSD')
| -rw-r--r-- | usr.sbin/pkg_add/OpenBSD/Delete.pm | 10 | ||||
| -rw-r--r-- | usr.sbin/pkg_add/OpenBSD/PackingElement.pm | 9 | ||||
| -rw-r--r-- | usr.sbin/pkg_add/OpenBSD/PackingList.pm | 5 | ||||
| -rw-r--r-- | usr.sbin/pkg_add/OpenBSD/Paths.pm | 3 | ||||
| -rw-r--r-- | usr.sbin/pkg_add/OpenBSD/x509.pm | 108 |
5 files changed, 130 insertions, 5 deletions
diff --git a/usr.sbin/pkg_add/OpenBSD/Delete.pm b/usr.sbin/pkg_add/OpenBSD/Delete.pm index e7a9552cfe4..bf9174a9ffb 100644 --- a/usr.sbin/pkg_add/OpenBSD/Delete.pm +++ b/usr.sbin/pkg_add/OpenBSD/Delete.pm @@ -1,5 +1,5 @@ # ex:ts=8 sw=4: -# $OpenBSD: Delete.pm,v 1.78 2008/10/20 10:25:16 espie Exp $ +# $OpenBSD: Delete.pm,v 1.79 2009/04/14 17:53:58 espie Exp $ # # Copyright (c) 2003-2007 Marc Espie <espie@openbsd.org> # @@ -98,6 +98,14 @@ sub delete_package if ($plist->pkgname ne $pkgname) { Fatal "Package $pkgname real name does not match"; } + if ($plist->is_signed) { + if (!$state->{quick}) { + require OpenBSD::x509; + if (!OpenBSD::x509::check_signature($plist, $state)) { + Fatal "Package $pkgname is corrupted"; + } + } + } $state->{problems} = 0; validate_plist($plist, $state); diff --git a/usr.sbin/pkg_add/OpenBSD/PackingElement.pm b/usr.sbin/pkg_add/OpenBSD/PackingElement.pm index 4662cdd5dec..2b29a4b46d7 100644 --- a/usr.sbin/pkg_add/OpenBSD/PackingElement.pm +++ b/usr.sbin/pkg_add/OpenBSD/PackingElement.pm @@ -1,5 +1,5 @@ # ex:ts=8 sw=4: -# $OpenBSD: PackingElement.pm,v 1.154 2009/03/05 10:43:00 espie Exp $ +# $OpenBSD: PackingElement.pm,v 1.155 2009/04/14 17:53:58 espie Exp $ # # Copyright (c) 2003-2007 Marc Espie <espie@openbsd.org> # @@ -387,6 +387,7 @@ sub may_check_digest sub check_digest { my ($self, $file, $state) = @_; + return if $self->{link} or $self->{symlink}; if (!defined $self->{d}) { $state->fatal($self->fullname, " does not have a signature"); } @@ -1646,6 +1647,12 @@ sub new $class; } +sub new_x509 +{ + my ($class) = @_; + bless { key => 'x509', timestamp => time, b64sig => '' }, $class; +} + sub stringize { diff --git a/usr.sbin/pkg_add/OpenBSD/PackingList.pm b/usr.sbin/pkg_add/OpenBSD/PackingList.pm index 4a9c6d19a47..c60ce2bc828 100644 --- a/usr.sbin/pkg_add/OpenBSD/PackingList.pm +++ b/usr.sbin/pkg_add/OpenBSD/PackingList.pm @@ -1,5 +1,5 @@ # ex:ts=8 sw=4: -# $OpenBSD: PackingList.pm,v 1.86 2009/03/05 10:43:00 espie Exp $ +# $OpenBSD: PackingList.pm,v 1.87 2009/04/14 17:53:58 espie Exp $ # # Copyright (c) 2003-2007 Marc Espie <espie@openbsd.org> # @@ -377,7 +377,8 @@ sub localbase sub is_signed { - return 0; + my $self = shift; + return defined $self->{'digital-signature'}; } our @unique_categories = diff --git a/usr.sbin/pkg_add/OpenBSD/Paths.pm b/usr.sbin/pkg_add/OpenBSD/Paths.pm index 29f5a8ed1c6..b182b052393 100644 --- a/usr.sbin/pkg_add/OpenBSD/Paths.pm +++ b/usr.sbin/pkg_add/OpenBSD/Paths.pm @@ -1,5 +1,5 @@ # ex:ts=8 sw=4: -# $OpenBSD: Paths.pm,v 1.6 2007/08/28 10:39:03 espie Exp $ +# $OpenBSD: Paths.pm,v 1.7 2009/04/14 17:53:58 espie Exp $ # # Copyright (c) 2007 Marc Espie <espie@openbsd.org> # @@ -31,6 +31,7 @@ sub useradd() { '/usr/sbin/useradd' } sub groupadd() { '/usr/sbin/groupadd' } sub sysctl() { '/sbin/sysctl' } sub openssl() { '/usr/sbin/openssl' } +sub pkgca() { '/etc/ssl/pkgca.pem' } sub chmod() { '/bin/chmod' } # external command is used for symbolic modes. sub gzip() { '/usr/bin/gzip' } sub ftp() { $ENV{'FETCH_CMD'} || '/usr/bin/ftp' } diff --git a/usr.sbin/pkg_add/OpenBSD/x509.pm b/usr.sbin/pkg_add/OpenBSD/x509.pm new file mode 100644 index 00000000000..07d73a68627 --- /dev/null +++ b/usr.sbin/pkg_add/OpenBSD/x509.pm @@ -0,0 +1,108 @@ +# ex:ts=8 sw=4: +# $OpenBSD: x509.pm,v 1.1 2009/04/14 17:53:58 espie Exp $ +# +# Copyright (c) 2003-2007 Marc Espie <espie@openbsd.org> +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +use strict; +use warnings; + +package OpenBSD::x509; + +use OpenBSD::PackageInfo; +use OpenBSD::Paths; +use MIME::Base64; +use File::Temp qw/mkstemp/; + + +sub compute_signature +{ + my ($plist, $cert, $key) = @_; + + open my $fh, ">", $plist->infodir.CONTENTS; + $plist->write_no_sig($fh); + close $fh; + open(my $sighandle, "-|", OpenBSD::Paths->openssl, "smime", "-sign", + "-binary", "-signer", $cert ,"-in", $plist->infodir.CONTENTS, + "-inkey", $key, "-outform", "DEM") or die; + my $sig; + sysread($sighandle, $sig, 16384); + close($sighandle) or die "problem generating signature $!"; + + return encode_base64($sig, ''); +} + +sub dump_certificate_info +{ + my $fname2 = shift; + + open my $fh, "-|", OpenBSD::Paths->openssl, "asn1parse", + "-inform", "DEM", "-in", $fname2; + my %want = map {($_, 1)} + qw(countryName localityName organizationName + organizationalUnitName commonName emailAddress); + while (<$fh>) { + if (m/\sprim\:\s+OBJECT\s*\:(.*)\s*$/) { + my $objectname = $1; + $_ = <$fh>; + if (m/\sprim\:\s+[A-Z0-9]+\s*\:(.*)\s*$/) { + if ($want{$objectname}) { + print "$objectname=$1\n"; + } + } + } + } + close($fh); +} + +sub print_certificate_info +{ + my $plist = shift; + + my ($fh, $fname) = mkstemp("/tmp/pkgsig.XXXXXXXXX"); + print $fh decode_base64($plist->{'digital-signature'}->{b64sig}); + close $fh; + dump_certificate_info($fname); + unlink $fname; +} + +sub check_signature +{ + my ($plist, $state) = @_; + my $sig = $plist->get('digital-signature'); + if ($sig->{key} ne 'x509') { + $state->warn("Error: unknown signature style"); + return 0; + } + my ($fh, $fname) = mkstemp("/tmp/pkgcontent.XXXXXXXXX"); + my ($fh2, $fname2) = mkstemp("/tmp/pkgsig.XXXXXXXXX"); + $plist->write_no_sig($fh); + print $fh2 decode_base64($sig->{b64sig}); + close $fh; + close $fh2; + if (system (OpenBSD::Paths->openssl, "smime", "-verify", "-binary", + "-inform", "DEM", "-in", $fname2, "-content", $fname, + "-CAfile", OpenBSD::Paths->pkgca, "-out", "/dev/null") != 0) { + $state->warn("Bad signature"); + return 0; + } + if ($state->{verbose}) { + dump_certificate_info($fname2); + } + unlink $fname; + unlink $fname2; + return 1; +} + +1; |