void
quit(int retcode)
{
PKG_ERR *err;
err = pkgerr_new();
(void) signal(SIGINT, SIG_IGN);
(void) signal(SIGHUP, SIG_IGN);
(void) ds_close(1);
(void) pkghead(NULL);
if (keystore != NULL) {
(void) close_keystore(err, keystore, NULL);
pkgerr_free(err);
}
exit(retcode);
}
/* will return 0, 1, 3, or 99 */
static int
_pkgtrans(char *device1, char *device2, char **pkg, int options,
keystore_handle_t keystore, char *keystore_alias)
{
BIO *p7_bio = NULL;
EVP_PKEY *privkey = NULL;
PKCS7 *sec_pkcs7 = NULL;
PKCS7_SIGNER_INFO *sec_signerinfo = NULL;
PKG_ERR *err;
STACK_OF(X509) *cacerts = NULL;
STACK_OF(X509) *clcerts = NULL;
STACK_OF(X509) *sec_chain = NULL;
X509 *pubcert = NULL;
boolean_t making_sig = B_FALSE;
char *src, *dst;
int errflg, i, n;
struct dm_buf *hdr;
making_sig = (keystore != NULL) ? B_TRUE : B_FALSE;
if (making_sig) {
/* new error object */
err = pkgerr_new();
/* find matching cert and key */
if (find_key_cert_pair(err, keystore,
keystore_alias, &privkey, &pubcert) != 0) {
pkgerr(err);
pkgerr_free(err);
return (1);
}
/* get CA certificates */
if (find_ca_certs(err, keystore, &cacerts) != 0) {
pkgerr(err);
pkgerr_free(err);
return (1);
}
/* get CL (aka "chain") certificates */
if (find_cl_certs(err, keystore, &clcerts) != 0) {
pkgerr(err);
pkgerr_free(err);
return (1);
}
/* initialize PKCS7 object to be filled in later */
sec_pkcs7 = PKCS7_new();
(void) PKCS7_set_type(sec_pkcs7, NID_pkcs7_signed);
sec_signerinfo = PKCS7_add_signature(sec_pkcs7,
pubcert, privkey, EVP_sha1());
if (sec_signerinfo == NULL) {
progerr(gettext(ERR_SEC), keystore_alias);
ERR_print_errors_fp(stderr);
pkgerr_free(err);
return (1);
}
/* add signer cert into signature */
(void) PKCS7_add_certificate(sec_pkcs7, pubcert);
/* attempt to resolve cert chain starting at the signer cert */
if (get_cert_chain(err, pubcert, clcerts, cacerts,
&sec_chain) != 0) {
pkgerr(err);
pkgerr_free(err);
return (1);
}
/*
* add the verification chain of certs into the signature.
* The first cert is the user cert, which we don't need,
* since it's baked in already, so skip it
*/
for (i = 1; i < sk_X509_num(sec_chain); i++) {
(void) PKCS7_add_certificate(sec_pkcs7,
sk_X509_value(sec_chain, i));
}
pkgerr_free(err);
err = NULL;
}
if (signal_received > 0) {
return (1);
}
/* transfer spool to appropriate device */
if (devtype(device1, &srcdev)) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_BADDEV), device1);
return (1);
}
srcdev.rdonly++;
/* check for datastream */
ids_name = NULL;
if (srcdev.bdevice) {
if (n = _getvol(srcdev.bdevice, NULL, NULL,
pkg_gt("Insert %v into %p."), srcdev.norewind)) {
cleanup();
if (n == 3)
return (3);
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_GETVOL));
return (1);
}
if (ds_readbuf(srcdev.cdevice))
ids_name = srcdev.cdevice;
}
if (srcdev.cdevice && !srcdev.bdevice)
ids_name = srcdev.cdevice;
else if (srcdev.pathname) {
ids_name = srcdev.pathname;
if (access(ids_name, 0) == -1) {
progerr(ERR_TRANSFER);
logerr(pkg_gt(MSG_GETVOL));
return (1);
}
}
if (!ids_name && device2 == (char *)0) {
if (n = pkgmount(&srcdev, NULL, 1, 0, 0)) {
cleanup();
return (n);
}
if (srcdev.mount && *srcdev.mount)
pkgdir = strdup(srcdev.mount);
return (0);
}
if (ids_name && device2 == (char *)0) {
tmppath = tmpnam(NULL);
tmppath = strdup(tmppath);
if (tmppath == NULL) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_MEM));
return (1);
}
if (mkdir(tmppath, 0755)) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_MKDIR), tmppath);
return (1);
}
device2 = tmppath;
}
if (devtype(device2, &dstdev)) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_BADDEV), device2);
return (1);
}
if ((srcdev.cdevice && dstdev.cdevice) &&
strcmp(srcdev.cdevice, dstdev.cdevice) == 0) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_SAMEDEV));
return (1);
}
ods_name = NULL;
if (dstdev.cdevice && !dstdev.bdevice || dstdev.pathname)
options |= PT_ODTSTREAM;
if (options & PT_ODTSTREAM) {
if (!((ods_name = dstdev.cdevice) != NULL ||
(ods_name = dstdev.pathname) != NULL)) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_BADDEV), device2);
return (1);
}
if (ids_name) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_TWODSTREAM));
return (1);
}
} else {
/*
* output device isn't a stream. If we're making a signed
* package, then fail, since we can't make signed,
* non-stream pkgs
*/
if (making_sig) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(ERR_CANTSIGN));
return (1);
}
}
if ((srcdev.dirname && dstdev.dirname) &&
strcmp(srcdev.dirname, dstdev.dirname) == 0) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_SAMEDEV));
return (1);
}
if ((srcdev.pathname && dstdev.pathname) &&
strcmp(srcdev.pathname, dstdev.pathname) == 0) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_SAMEDEV));
return (1);
}
if (signal_received > 0) {
return (1);
}
if (ids_name) {
if (srcdev.cdevice && !srcdev.bdevice &&
(n = _getvol(srcdev.cdevice, NULL, NULL, NULL,
srcdev.norewind))) {
cleanup();
if (n == 3)
return (3);
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_GETVOL));
return (1);
}
if (srcdev.dirname = tmpnam(NULL))
tmpdir = srcdev.dirname = strdup(srcdev.dirname);
if ((srcdev.dirname == NULL) || mkdir(srcdev.dirname, 0755) ||
chdir(srcdev.dirname)) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_NOTEMP), srcdev.dirname);
cleanup();
return (1);
}
if (ds_init(ids_name, pkg, srcdev.norewind)) {
cleanup();
return (1);
}
} else if (srcdev.mount) {
if (n = pkgmount(&srcdev, NULL, 1, 0, 0)) {
cleanup();
return (n);
}
}
src = srcdev.dirname;
dst = dstdev.dirname;
if (chdir(src)) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_CHDIR), src);
cleanup();
return (1);
}
if (signal_received > 0) {
return (1);
}
xpkg = pkg = gpkglist(src, pkg, NULL);
if (!pkg) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_NOPKGS), src);
cleanup();
return (1);
}
for (nxpkg = 0; pkg[nxpkg]; /* void */) {
nxpkg++; /* count */
}
if (ids_name) {
ds_order(pkg); /* order requests */
}
if (signal_received > 0) {
return (1);
}
if (options & PT_ODTSTREAM) {
char line[128];
if (!dstdev.pathname &&
(n = _getvol(ods_name, NULL, DM_FORMAT, NULL,
dstdev.norewind))) {
cleanup();
if (n == 3)
return (3);
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_GETVOL));
return (1);
}
if ((hdr = genheader(src, pkg)) == NULL) {
cleanup();
return (1);
}
if (making_sig) {
/* start up signature data stream */
(void) PKCS7_content_new(sec_pkcs7, NID_pkcs7_data);
(void) PKCS7_set_detached(sec_pkcs7, 1);
p7_bio = PKCS7_dataInit(sec_pkcs7, NULL);
/*
* Here we generate all the data that will go into
* the package, and send it through the signature
* generator, essentially calculating the signature
* of the entire package so we can place it in the
* header. Otherwise we'd have to place it at the end
* of the pkg, which would break the ABI
*/
if (!(options & PT_SILENT)) {
(void) fprintf(stderr, pkg_gt(MSG_SIGNING),
get_subject_display_name(pubcert));
}
if (dump_hdr_and_pkgs(p7_bio, hdr, pkg) != 0) {
progerr(gettext(ERR_NOGEN));
logerr(pkg_gt(MSG_GETVOL));
cleanup();
return (1);
}
BIO_flush(p7_bio);
/*
* now generate PKCS7 signature
*/
if (!PKCS7_dataFinal(sec_pkcs7, p7_bio)) {
progerr(gettext(ERR_NOGEN));
logerr(pkg_gt(MSG_GETVOL));
cleanup();
return (1);
}
(void) BIO_free(p7_bio);
}
/* write out header to stream, which includes signature */
if (wdsheader(hdr, src, ods_name, pkg, sec_pkcs7)) {
cleanup();
return (1);
}
if (sec_pkcs7 != NULL) {
/* nuke in-memory signature for safety */
PKCS7_free(sec_pkcs7);
sec_pkcs7 = NULL;
}
ds_volno = 1; /* number of volumes in datastream */
pinput = hdrbuf.text_buffer;
/* skip past first line in header */
(void) mgets(line, 128);
}
if (signal_received > 0) {
return (1);
}
errflg = 0;
for (i = 0; pkg[i]; i++) {
if (signal_received > 0) {
return (1);
}
if (!(options & PT_ODTSTREAM) && dstdev.mount) {
if (n = pkgmount(&dstdev, NULL, 0, 0, 1)) {
cleanup();
return (n);
}
}
if (errflg = pkgxfer(pkg[i], options)) {
pkg[i] = NULL;
if ((options & PT_ODTSTREAM) || (errflg != 2))
break;
} else if (strcmp(dstinst, pkg[i]))
pkg[i] = strdup(dstinst);
}
if (!(options & PT_ODTSTREAM) && dst) {
pkgdir = strdup(dst);
}
/*
* No cleanup of temporary directories created in this
* function is done here. The calling function must do
* the cleanup.
*/
return (signal_received > 0 ? 1 : errflg);
}
/*
* Name: addcert
* Desc: Imports a user certificate into the keystore, along with a
* private key.
* Returns: 0 on success, non-zero otherwise.
*/
int
addcert(int argc, char **argv)
{
int i;
char keystore_file[MAXPATHLEN] = "";
char *keystore_base = NULL;
char *homedir;
char *passarg = NULL;
char *import_passarg = NULL;
char *altroot = NULL;
char *prog = NULL;
char *alias = NULL;
char *infile = NULL;
char *inkeyfile = NULL;
keystore_encoding_format_t informat = NULL;
char *informat_str = NULL;
int ret = 1;
boolean_t trusted = B_FALSE;
boolean_t implicit_trust = B_FALSE;
FILE *certfile = NULL;
FILE *keyfile = NULL;
X509 *cert = NULL;
STACK_OF(X509) *trustcerts = NULL;
EVP_PKEY *key = NULL;
PKG_ERR *err = NULL;
keystore_handle_t keystore = NULL;
while ((i = getopt(argc, argv, ":a:k:e:f:n:P:p:R:ty")) != EOF) {
switch (i) {
case 'a':
prog = optarg;
break;
case 'k':
keystore_base = optarg;
break;
case 'e':
inkeyfile = optarg;
break;
case 'f':
informat_str = optarg;
break;
case 'n':
alias = optarg;
break;
case 'P':
passarg = optarg;
break;
case 'p':
import_passarg = optarg;
break;
case 'R':
altroot = optarg;
break;
case 't':
trusted = B_TRUE;
break;
case 'y':
implicit_trust = B_TRUE;
break;
case ':':
log_msg(LOG_MSG_ERR, MSG_MISSING_OPERAND, optopt);
/* LINTED fallthrough intentional */
case '?':
default:
log_msg(LOG_MSG_ERR, MSG_USAGE);
goto cleanup;
}
}
if (!trusted && alias == NULL) {
/* for untrusted (user) certs, we require a name */
log_msg(LOG_MSG_ERR, MSG_USER_NAME);
log_msg(LOG_MSG_ERR, MSG_USAGE);
goto cleanup;
} else if (trusted && alias != NULL) {
/* for trusted certs, we cannot have a name */
log_msg(LOG_MSG_ERR, MSG_TRUSTED_NAME);
log_msg(LOG_MSG_ERR, MSG_USAGE);
goto cleanup;
}
if (trusted && inkeyfile != NULL) {
/* for trusted certs, we cannot have a private key */
log_msg(LOG_MSG_ERR, MSG_TRUSTED_KEY);
log_msg(LOG_MSG_ERR, MSG_USAGE);
goto cleanup;
}
/* last argument should be the path to the certificate */
if ((argc-optind) > 1) {
log_msg(LOG_MSG_ERR, MSG_USAGE);
goto cleanup;
} else if ((argc-optind) < 1) {
infile = "stdin";
certfile = stdin;
log_msg(LOG_MSG_DEBUG, "Loading stdin certificate");
} else {
infile = argv[optind];
log_msg(LOG_MSG_DEBUG, "Loading <%s> certificate",
argv[optind]);
if ((certfile = fopen(infile, "r")) == NULL) {
log_msg(LOG_MSG_ERR, MSG_OPEN, infile);
goto cleanup;
}
}
/*
* if specific key file supplied, open it, otherwise open
* default (stdin)
*/
if (inkeyfile != NULL) {
if ((keyfile = fopen(inkeyfile, "r")) == NULL) {
log_msg(LOG_MSG_ERR, MSG_OPEN, inkeyfile);
goto cleanup;
}
} else {
inkeyfile = "stdin";
keyfile = stdin;
}
/* set up proper keystore */
if (altroot != NULL) {
if (strlcpy(keystore_file, altroot, MAXPATHLEN) >= MAXPATHLEN) {
log_msg(LOG_MSG_ERR, MSG_TOO_LONG, altroot);
goto cleanup;
}
if (strlcat(keystore_file, "/", MAXPATHLEN) >= MAXPATHLEN) {
log_msg(LOG_MSG_ERR, MSG_TOO_LONG, altroot);
goto cleanup;
}
}
if (keystore_base == NULL) {
if (geteuid() == 0 || altroot != NULL) {
/*
* If we have an alternate
* root, then we have no choice but to use
* root's keystore on that alternate root,
* since there is no way to resolve a
* user's home dir given an alternate root
*/
if (strlcat(keystore_file, PKGSEC,
MAXPATHLEN) >= MAXPATHLEN) {
log_msg(LOG_MSG_ERR, MSG_TOO_LONG,
keystore_file);
goto cleanup;
}
} else {
if ((homedir = getenv("HOME")) == NULL) {
/*
* not superuser, but no home dir, so
* use superuser's keystore
*/
if (strlcat(keystore_file, PKGSEC,
MAXPATHLEN) >= MAXPATHLEN) {
log_msg(LOG_MSG_ERR, MSG_TOO_LONG,
keystore_file);
goto cleanup;
}
} else {
if (strlcat(keystore_file, homedir,
MAXPATHLEN) >= MAXPATHLEN) {
log_msg(LOG_MSG_ERR, MSG_TOO_LONG,
homedir);
goto cleanup;
}
if (strlcat(keystore_file, "/.pkg/security",
MAXPATHLEN) >= MAXPATHLEN) {
log_msg(LOG_MSG_ERR, MSG_TOO_LONG,
keystore_file);
goto cleanup;
}
}
}
} else {
if (strlcat(keystore_file, keystore_base,
MAXPATHLEN) >= MAXPATHLEN) {
log_msg(LOG_MSG_ERR, MSG_TOO_LONG,
keystore_base);
goto cleanup;
}
}
/* figure out input format */
if (informat_str == NULL) {
informat = KEYSTORE_FORMAT_PEM;
} else {
if (ci_streq(informat_str, "pem")) {
informat = KEYSTORE_FORMAT_PEM;
} else if (ci_streq(informat_str, "der")) {
informat = KEYSTORE_FORMAT_DER;
} else {
log_msg(LOG_MSG_ERR, MSG_BAD_FORMAT, informat_str);
goto cleanup;
}
}
err = pkgerr_new();
if (trusted) {
/* load all possible certs */
if (load_all_certs(err, certfile, informat, import_passarg,
&trustcerts) != 0) {
log_pkgerr(LOG_MSG_ERR, err);
log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
goto cleanup;
}
/* we must have gotten at least one cert, if not, fail */
if (sk_X509_num(trustcerts) < 1) {
log_msg(LOG_MSG_ERR, MSG_NO_CERTS, infile);
goto cleanup;
}
} else {
/* first, try to load user certificate and key */
if (load_cert_and_key(err, certfile, informat, import_passarg,
&key, &cert) != 0) {
log_pkgerr(LOG_MSG_ERR, err);
log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
goto cleanup;
}
/* we must have gotten a cert, if not, fail */
if (cert == NULL) {
log_msg(LOG_MSG_ERR, MSG_NO_CERTS, infile);
goto cleanup;
}
if (key == NULL) {
/*
* if we are importing a user cert, and did not get
* a key, try to load it from the key file
*/
if (keyfile == NULL) {
log_msg(LOG_MSG_ERR, MSG_NEED_KEY, infile);
goto cleanup;
} else {
log_msg(LOG_MSG_DEBUG,
"Loading private key <%s>", inkeyfile);
if (load_cert_and_key(err, keyfile, informat,
import_passarg,
&key, NULL) != 0) {
log_pkgerr(LOG_MSG_ERR, err);
log_msg(LOG_MSG_ERR,
MSG_NO_ADDKEY, inkeyfile);
goto cleanup;
}
if (key == NULL) {
log_msg(LOG_MSG_ERR, MSG_NO_PRIVKEY,
inkeyfile);
log_msg(LOG_MSG_ERR,
MSG_NO_ADDKEY, inkeyfile);
goto cleanup;
}
}
}
}
if (trusted) {
/* check validity date of all certificates */
for (i = 0; i < sk_X509_num(trustcerts); i++) {
/* LINTED pointer cast may result in improper algnmnt */
cert = sk_X509_value(trustcerts, i);
if (check_cert(err, cert) != 0) {
log_pkgerr(LOG_MSG_ERR, err);
log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT,
infile);
goto cleanup;
}
}
} else {
/* check validity date of user certificate */
if (check_cert_and_key(err, cert, key) != 0) {
log_pkgerr(LOG_MSG_ERR, err);
log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
goto cleanup;
}
}
if (trusted && !implicit_trust) {
/*
* if importing more than one cert, must use implicit trust,
* because we can't ask the user to individually trust
* each one, since there may be many
*/
if (sk_X509_num(trustcerts) != 1) {
log_pkgerr(LOG_MSG_ERR, err);
log_msg(LOG_MSG_ERR, MSG_MULTIPLE_TRUST, infile, "-y");
goto cleanup;
} else {
/* LINTED pointer cast may result in improper algnmnt */
cert = sk_X509_value(trustcerts, 0);
}
/* ask the user */
switch (verify_trust(cert)) {
case Accept:
/* user accepted */
break;
case Reject:
/* user aborted operation */
log_msg(LOG_MSG_ERR, MSG_ADDCERT_ABORT);
goto cleanup;
case VerifyFailed:
default:
log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
goto cleanup;
}
}
/* now load the key store */
log_msg(LOG_MSG_DEBUG, "Loading keystore <%s>", keystore_file);
set_passphrase_prompt(MSG_KEYSTORE_PASSPROMPT);
set_passphrase_passarg(passarg);
if (open_keystore(err, keystore_file, prog, pkg_passphrase_cb,
KEYSTORE_ACCESS_READWRITE | KEYSTORE_PATH_HARD, &keystore) != 0) {
log_pkgerr(LOG_MSG_ERR, err);
log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
goto cleanup;
}
/* now merge the new cert into the keystore */
log_msg(LOG_MSG_DEBUG, "Merging certificate <%s>",
get_subject_display_name(cert));
if (trusted) {
/* merge all trusted certs found */
for (i = 0; i < sk_X509_num(trustcerts); i++) {
/* LINTED pointer cast may result in improper algnmnt */
cert = sk_X509_value(trustcerts, i);
if (merge_ca_cert(err, cert, keystore) != 0) {
log_pkgerr(LOG_MSG_ERR, err);
log_msg(LOG_MSG_ERR,
MSG_NO_ADDCERT, infile);
goto cleanup;
} else {
log_msg(LOG_MSG_INFO, MSG_TRUSTING,
get_subject_display_name(cert));
}
}
} else {
/* merge user cert */
if (merge_cert_and_key(err, cert, key, alias, keystore) != 0) {
log_pkgerr(LOG_MSG_ERR, err);
log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
goto cleanup;
}
}
/* now write it back out */
log_msg(LOG_MSG_DEBUG, "Closing keystore");
set_passphrase_prompt(MSG_KEYSTORE_PASSOUTPROMPT);
set_passphrase_passarg(passarg);
if (close_keystore(err, keystore, pkg_passphrase_cb) != 0) {
log_pkgerr(LOG_MSG_ERR, err);
log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
goto cleanup;
}
if (trusted) {
log_msg(LOG_MSG_INFO, MSG_TRUSTED, infile);
} else {
log_msg(LOG_MSG_INFO, MSG_ADDED, infile, alias);
}
ret = 0;
/* fallthrough intentional */
cleanup:
if (err != NULL)
pkgerr_free(err);
if (certfile != NULL)
(void) fclose(certfile);
if (keyfile != NULL)
(void) fclose(keyfile);
return (ret);
}
/* Asks user to verify certificate data before proceeding */
static VerifyStatus verify_trust(X509 *cert)
{
char vfy_trust = 'y';
VerifyStatus ret = Accept;
PKG_ERR *err;
UI *ui = NULL;
err = pkgerr_new();
/* print cert data */
if (print_cert(err, cert, KEYSTORE_FORMAT_TEXT,
get_subject_display_name(cert), B_TRUE, stdout) != 0) {
log_pkgerr(LOG_MSG_ERR, err);
ret = VerifyFailed;
goto cleanup;
}
if ((ui = UI_new()) == NULL) {
log_msg(LOG_MSG_ERR, MSG_MEM);
ret = VerifyFailed;
goto cleanup;
}
/*
* The prompt is internationalized, but the valid
* response values are fixed, to avoid any complex
* multibyte processing that results in bugs
*/
if (UI_add_input_boolean(ui, MSG_VERIFY_TRUST,
"",
"yY", "nN",
UI_INPUT_FLAG_ECHO, &vfy_trust) <= 0) {
log_msg(LOG_MSG_ERR, MSG_MEM);
ret = VerifyFailed;
goto cleanup;
}
if (UI_process(ui) != 0) {
log_msg(LOG_MSG_ERR, MSG_MEM);
ret = VerifyFailed;
goto cleanup;
}
if (vfy_trust != 'y') {
ret = Reject;
goto cleanup;
}
/*
* if the cert does not appear to be a CA cert
* r is not self-signed, verify that as well
*/
if (!is_ca_cert(cert)) {
UI_free(ui);
if ((ui = UI_new()) == NULL) {
log_msg(LOG_MSG_ERR, MSG_MEM);
ret = VerifyFailed;
goto cleanup;
}
if (UI_add_input_boolean(ui,
MSG_VERIFY_NOT_CA,
"",
"yY", "nN",
UI_INPUT_FLAG_ECHO, &vfy_trust) <= 0) {
ret = VerifyFailed;
goto cleanup;
}
if (UI_process(ui) != 0) {
log_msg(LOG_MSG_ERR, MSG_MEM);
ret = VerifyFailed;
goto cleanup;
}
if (vfy_trust != 'y') {
ret = Reject;
goto cleanup;
}
}
cleanup:
if (ui != NULL)
UI_free(ui);
if (err != NULL)
pkgerr_free(err);
return (ret);
}
int
main(int argc, char *argv[])
{
int c;
void (*func)();
extern char *optarg;
extern int optind;
char *keystore_alias = NULL;
char *keystore_file = NULL;
boolean_t create_sig = B_FALSE;
char *homedir = NULL;
PKG_ERR *err;
int ret, len;
(void) setlocale(LC_ALL, "");
#if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */
#define TEXT_DOMAIN "SYS_TEST"
#endif
(void) textdomain(TEXT_DOMAIN);
(void) set_prog_name(argv[0]);
while ((c = getopt(argc, argv, "ga:P:k:snio?")) != EOF) {
switch (c) {
case 'n':
options |= PT_RENAME;
break;
case 'i':
options |= PT_INFO_ONLY;
break;
case 'o':
options |= PT_OVERWRITE;
break;
case 's':
options |= PT_ODTSTREAM;
break;
case 'g':
/* this should eventually be a PT_ option */
create_sig = B_TRUE;
break;
case 'k':
keystore_file = optarg;
break;
case 'a':
keystore_alias = optarg;
break;
case 'P':
set_passphrase_passarg(optarg);
if (ci_strneq(optarg, "pass:"******"pass:<pass>");
}
break;
default:
usage();
return (1);
}
}
func = signal(SIGINT, trap);
if (func != SIG_DFL)
(void) signal(SIGINT, func);
(void) signal(SIGHUP, trap);
(void) signal(SIGQUIT, trap);
(void) signal(SIGTERM, trap);
(void) signal(SIGPIPE, trap);
(void) signal(SIGPWR, trap);
if ((argc-optind) < 2) {
usage();
return (1);
}
if (create_sig) {
sec_init();
err = pkgerr_new();
/* figure out which keystore to use */
if (keystore_file == NULL) {
if (geteuid() == 0) {
/* we are superuser, so use their keystore */
keystore_file = PKGSEC;
} else if ((homedir = getenv("HOME")) == NULL) {
/*
* not superuser, but no home dir, so
* use superuser's keystore
*/
keystore_file = PKGSEC;
} else if (asprintf(&keystore_file, "%s/.pkg/security",
homedir) < 0) {
logerr(ERR_MEM);
quit(1);
}
}
logerr(gettext(KEYSTORE_OPEN), keystore_file);
set_passphrase_prompt(MSG_PASSPROMPT);
/* open keystore for reading */
if (open_keystore(err, keystore_file, get_prog_name(),
pkg_passphrase_cb, KEYSTORE_DFLT_FLAGS, &keystore) != 0) {
pkgerr(err);
pkgerr_free(err);
quit(1);
}
} else {
/* no signature, so don't use a keystore */
keystore = NULL;
}
ret = pkgtrans(flex_device(argv[optind], 1),
flex_device(argv[optind+1], 1), &argv[optind+2], options,
keystore, keystore_alias);
if (create_sig) {
/* close keystore */
if (close_keystore(err, keystore, NULL) != 0) {
pkgerr(err);
pkgerr_free(err);
quit(1);
}
keystore = NULL;
}
quit(ret);
/*NOTREACHED*/
}
/* will return 0, 1, 3, or 99 */
static int
_pkgtrans(char *device1, char *device2, char **pkg, int options,
keystore_handle_t keystore, char *keystore_alias)
{
#ifdef USE_KEYSTORE
BIO *p7_bio = NULL;
EVP_PKEY *privkey = NULL;
#endif
PKCS7 *sec_pkcs7 = NULL;
#ifdef USE_KEYSTORE
PKCS7_SIGNER_INFO *sec_signerinfo = NULL;
PKG_ERR *err;
STACK_OF(X509) *cacerts = NULL;
STACK_OF(X509) *clcerts = NULL;
STACK_OF(X509) *sec_chain = NULL;
X509 *pubcert = NULL;
#endif
boolean_t making_sig = B_FALSE;
char *src, *dst;
int errflg, i, n;
struct dm_buf *hdr;
making_sig = (keystore != NULL) ? B_TRUE : B_FALSE;
#ifdef USE_KEYSTORE
if (making_sig) {
/* new error object */
err = pkgerr_new();
/* find matching cert and key */
if (find_key_cert_pair(err, keystore,
keystore_alias, &privkey, &pubcert) != 0) {
pkgerr(err);
pkgerr_free(err);
return (1);
}
/* get CA certificates */
if (find_ca_certs(err, keystore, &cacerts) != 0) {
pkgerr(err);
pkgerr_free(err);
return (1);
}
/* get CL (aka "chain") certificates */
if (find_cl_certs(err, keystore, &clcerts) != 0) {
pkgerr(err);
pkgerr_free(err);
return (1);
}
/* initialize PKCS7 object to be filled in later */
sec_pkcs7 = PKCS7_new();
PKCS7_set_type(sec_pkcs7, NID_pkcs7_signed);
sec_signerinfo = PKCS7_add_signature(sec_pkcs7,
pubcert, privkey, EVP_sha1());
if (sec_signerinfo == NULL) {
progerr(gettext(ERR_SEC), keystore_alias);
ERR_print_errors_fp(stderr);
pkgerr_free(err);
return (1);
}
/* add signer cert into signature */
PKCS7_add_certificate(sec_pkcs7, pubcert);
/* attempt to resolve cert chain starting at the signer cert */
if (get_cert_chain(err, pubcert, clcerts, cacerts,
&sec_chain) != 0) {
pkgerr(err);
pkgerr_free(err);
return (1);
}
/*
* add the verification chain of certs into the signature.
* The first cert is the user cert, which we don't need,
* since it's baked in already, so skip it
*/
for (i = 1; i < sk_X509_num(sec_chain); i++) {
PKCS7_add_certificate(sec_pkcs7,
sk_X509_value(sec_chain, i));
}
pkgerr_free(err);
err = NULL;
}
#endif /* USE_KEYSTORE */
if (signal_received > 0) {
return (1);
}
/* transfer spool to appropriate device */
if (devtype(device1, &srcdev)) {
progerr(pkg_gt(ERR_TRANSFER));
logerr(pkg_gt(MSG_BADDEV), device1);
return (1);
}
srcdev.rdonly++;
/* check for datastream */
ids_name = NULL;
if (srcdev.bdevice) {
if (ds_readbuf(srcdev.cdevice))
ids_name = srcdev.cdevice;
}
if (srcdev.cdevice && !srcdev.bdevice)
ids_name = srcdev.cdevice;
else if (srcdev.pathname) {
ids_name = srcdev.pathname;
if (access(ids_name, 0) == -1) {
progerr(ERR_TRANSFER);
logerr(pkg_gt(MSG_GETVOL));
return (1);
}
}
if (!ids_name && device2 == (char *)0) {
if (n = pkgmount(&srcdev, NULL, 1, 0, 0)) {
cleanup();
return (n);
}
if (srcdev.mount && *srcdev.mount)
pkgdir = strdup(srcdev.mount);
return (0);
}
if (ids_name && device2 == (char *)0) {
char template[] = "/var/tmp/ptXXXXXX";
