コード例 #1
0
ファイル: main.c プロジェクト: AlfredArouna/illumos-gate
void
quit(int retcode)
{
	PKG_ERR	*err;

	err = pkgerr_new();
	(void) signal(SIGINT, SIG_IGN);
	(void) signal(SIGHUP, SIG_IGN);
	(void) ds_close(1);
	(void) pkghead(NULL);
	if (keystore != NULL) {
		(void) close_keystore(err, keystore, NULL);
		pkgerr_free(err);
	}
	exit(retcode);
}
コード例 #2
0
ファイル: pkgtrans.c プロジェクト: apprisi/illumos-gate
/* will return 0, 1, 3, or 99 */
static int
_pkgtrans(char *device1, char *device2, char **pkg, int options,
    keystore_handle_t keystore, char *keystore_alias)
{
	BIO			*p7_bio = NULL;
	EVP_PKEY		*privkey = NULL;
	PKCS7			*sec_pkcs7 = NULL;
	PKCS7_SIGNER_INFO	*sec_signerinfo = NULL;
	PKG_ERR			*err;
	STACK_OF(X509)		*cacerts = NULL;
	STACK_OF(X509)		*clcerts = NULL;
	STACK_OF(X509)		*sec_chain = NULL;
	X509			*pubcert = NULL;
	boolean_t		making_sig = B_FALSE;
	char			*src, *dst;
	int			errflg, i, n;
	struct			dm_buf *hdr;

	making_sig = (keystore != NULL) ? B_TRUE : B_FALSE;

	if (making_sig) {

		/* new error object */
		err = pkgerr_new();

		/* find matching cert and key */
		if (find_key_cert_pair(err, keystore,
		    keystore_alias, &privkey, &pubcert) != 0) {
			pkgerr(err);
			pkgerr_free(err);
			return (1);
		}

		/* get CA certificates */
		if (find_ca_certs(err, keystore, &cacerts) != 0) {
			pkgerr(err);
			pkgerr_free(err);
			return (1);
		}

		/* get CL (aka "chain") certificates */
		if (find_cl_certs(err, keystore, &clcerts) != 0) {
			pkgerr(err);
			pkgerr_free(err);
			return (1);
		}

		/* initialize PKCS7 object to be filled in later */
		sec_pkcs7 = PKCS7_new();
		(void) PKCS7_set_type(sec_pkcs7, NID_pkcs7_signed);
		sec_signerinfo = PKCS7_add_signature(sec_pkcs7,
		    pubcert, privkey, EVP_sha1());

		if (sec_signerinfo == NULL) {
			progerr(gettext(ERR_SEC), keystore_alias);
			ERR_print_errors_fp(stderr);
			pkgerr_free(err);
			return (1);
		}

		/* add signer cert into signature */
		(void) PKCS7_add_certificate(sec_pkcs7, pubcert);

		/* attempt to resolve cert chain starting at the signer cert */
		if (get_cert_chain(err, pubcert, clcerts, cacerts,
		    &sec_chain) != 0) {
			pkgerr(err);
			pkgerr_free(err);
			return (1);
		}

		/*
		 * add the verification chain of certs into the signature.
		 * The first cert is the user cert, which we don't need,
		 * since it's baked in already, so skip it
		 */
		for (i = 1; i < sk_X509_num(sec_chain); i++) {
			(void) PKCS7_add_certificate(sec_pkcs7,
			    sk_X509_value(sec_chain, i));
		}

		pkgerr_free(err);
		err = NULL;
	}

	if (signal_received > 0) {
		return (1);
	}

	/* transfer spool to appropriate device */
	if (devtype(device1, &srcdev)) {
		progerr(pkg_gt(ERR_TRANSFER));
		logerr(pkg_gt(MSG_BADDEV), device1);
		return (1);
	}
	srcdev.rdonly++;

	/* check for datastream */
	ids_name = NULL;
	if (srcdev.bdevice) {
		if (n = _getvol(srcdev.bdevice, NULL, NULL,
		    pkg_gt("Insert %v into %p."), srcdev.norewind)) {
			cleanup();
			if (n == 3)
				return (3);
			progerr(pkg_gt(ERR_TRANSFER));
			logerr(pkg_gt(MSG_GETVOL));
			return (1);
		}
		if (ds_readbuf(srcdev.cdevice))
			ids_name = srcdev.cdevice;
	}

	if (srcdev.cdevice && !srcdev.bdevice)
		ids_name = srcdev.cdevice;
	else if (srcdev.pathname) {
		ids_name = srcdev.pathname;
		if (access(ids_name, 0) == -1) {
			progerr(ERR_TRANSFER);
			logerr(pkg_gt(MSG_GETVOL));
			return (1);
		}
	}

	if (!ids_name && device2 == (char *)0) {
		if (n = pkgmount(&srcdev, NULL, 1, 0, 0)) {
			cleanup();
			return (n);
		}
		if (srcdev.mount && *srcdev.mount)
			pkgdir = strdup(srcdev.mount);
		return (0);
	}

	if (ids_name && device2 == (char *)0) {
		tmppath = tmpnam(NULL);
		tmppath = strdup(tmppath);
		if (tmppath == NULL) {
			progerr(pkg_gt(ERR_TRANSFER));
			logerr(pkg_gt(MSG_MEM));
			return (1);
		}
		if (mkdir(tmppath, 0755)) {
			progerr(pkg_gt(ERR_TRANSFER));
			logerr(pkg_gt(MSG_MKDIR), tmppath);
			return (1);
		}
		device2 = tmppath;
	}

	if (devtype(device2, &dstdev)) {
		progerr(pkg_gt(ERR_TRANSFER));
		logerr(pkg_gt(MSG_BADDEV), device2);
		return (1);
	}

	if ((srcdev.cdevice && dstdev.cdevice) &&
	    strcmp(srcdev.cdevice, dstdev.cdevice) == 0) {
		progerr(pkg_gt(ERR_TRANSFER));
		logerr(pkg_gt(MSG_SAMEDEV));
		return (1);
	}

	ods_name = NULL;
	if (dstdev.cdevice && !dstdev.bdevice || dstdev.pathname)
		options |= PT_ODTSTREAM;

	if (options & PT_ODTSTREAM) {
		if (!((ods_name = dstdev.cdevice) != NULL ||
		    (ods_name = dstdev.pathname) != NULL)) {
			progerr(pkg_gt(ERR_TRANSFER));
			logerr(pkg_gt(MSG_BADDEV), device2);
			return (1);
		}
		if (ids_name) {
			progerr(pkg_gt(ERR_TRANSFER));
			logerr(pkg_gt(MSG_TWODSTREAM));
			return (1);
		}
	} else {
		/*
		 * output device isn't a stream.  If we're making a signed
		 * package, then fail, since we can't make signed,
		 * non-stream pkgs
		 */
		if (making_sig) {
			progerr(pkg_gt(ERR_TRANSFER));
			logerr(pkg_gt(ERR_CANTSIGN));
			return (1);
		}
	}

	if ((srcdev.dirname && dstdev.dirname) &&
	    strcmp(srcdev.dirname, dstdev.dirname) == 0) {
		progerr(pkg_gt(ERR_TRANSFER));
		logerr(pkg_gt(MSG_SAMEDEV));
		return (1);
	}

	if ((srcdev.pathname && dstdev.pathname) &&
	    strcmp(srcdev.pathname, dstdev.pathname) == 0) {
		progerr(pkg_gt(ERR_TRANSFER));
		logerr(pkg_gt(MSG_SAMEDEV));
		return (1);
	}

	if (signal_received > 0) {
		return (1);
	}

	if (ids_name) {
		if (srcdev.cdevice && !srcdev.bdevice &&
		(n = _getvol(srcdev.cdevice, NULL, NULL, NULL,
		    srcdev.norewind))) {
			cleanup();
			if (n == 3)
				return (3);
			progerr(pkg_gt(ERR_TRANSFER));
			logerr(pkg_gt(MSG_GETVOL));
			return (1);
		}
		if (srcdev.dirname = tmpnam(NULL))
			tmpdir = srcdev.dirname = strdup(srcdev.dirname);

		if ((srcdev.dirname == NULL) || mkdir(srcdev.dirname, 0755) ||
		    chdir(srcdev.dirname)) {
			progerr(pkg_gt(ERR_TRANSFER));
			logerr(pkg_gt(MSG_NOTEMP), srcdev.dirname);
			cleanup();
			return (1);
		}
		if (ds_init(ids_name, pkg, srcdev.norewind)) {
			cleanup();
			return (1);
		}
	} else if (srcdev.mount) {
		if (n = pkgmount(&srcdev, NULL, 1, 0, 0)) {
			cleanup();
			return (n);
		}
	}

	src = srcdev.dirname;
	dst = dstdev.dirname;

	if (chdir(src)) {
		progerr(pkg_gt(ERR_TRANSFER));
		logerr(pkg_gt(MSG_CHDIR), src);
		cleanup();
		return (1);
	}

	if (signal_received > 0) {
		return (1);
	}

	xpkg = pkg = gpkglist(src, pkg, NULL);
	if (!pkg) {
		progerr(pkg_gt(ERR_TRANSFER));
		logerr(pkg_gt(MSG_NOPKGS), src);
		cleanup();
		return (1);
	}

	for (nxpkg = 0; pkg[nxpkg]; /* void */) {
		nxpkg++; /* count */
	}

	if (ids_name) {
		ds_order(pkg); /* order requests */
	}

	if (signal_received > 0) {
		return (1);
	}

	if (options & PT_ODTSTREAM) {
		char line[128];

		if (!dstdev.pathname &&
		    (n = _getvol(ods_name, NULL, DM_FORMAT, NULL,
		    dstdev.norewind))) {
			cleanup();
			if (n == 3)
				return (3);
			progerr(pkg_gt(ERR_TRANSFER));
			logerr(pkg_gt(MSG_GETVOL));
			return (1);
		}
		if ((hdr = genheader(src, pkg)) == NULL) {
			cleanup();
			return (1);
		}
		if (making_sig) {
			/* start up signature data stream */
			(void) PKCS7_content_new(sec_pkcs7, NID_pkcs7_data);
			(void) PKCS7_set_detached(sec_pkcs7, 1);
			p7_bio = PKCS7_dataInit(sec_pkcs7, NULL);

			/*
			 * Here we generate all the data that will go into
			 * the package, and send it through the signature
			 * generator, essentially calculating the signature
			 * of the entire package so we can place it in the
			 * header.  Otherwise we'd have to place it at the end
			 * of the pkg, which would break the ABI
			 */
			if (!(options & PT_SILENT)) {
				(void) fprintf(stderr, pkg_gt(MSG_SIGNING),
				    get_subject_display_name(pubcert));
			}
			if (dump_hdr_and_pkgs(p7_bio, hdr, pkg) != 0) {
			    progerr(gettext(ERR_NOGEN));
			    logerr(pkg_gt(MSG_GETVOL));
			    cleanup();
			    return (1);

			}

			BIO_flush(p7_bio);

			/*
			 * now generate PKCS7 signature
			 */
			if (!PKCS7_dataFinal(sec_pkcs7, p7_bio)) {
			    progerr(gettext(ERR_NOGEN));
			    logerr(pkg_gt(MSG_GETVOL));
			    cleanup();
			    return (1);
			}

			(void) BIO_free(p7_bio);
		}

		/* write out header to stream, which includes signature */
		if (wdsheader(hdr, src, ods_name, pkg, sec_pkcs7)) {
			cleanup();
			return (1);
		}

		if (sec_pkcs7 != NULL) {
			/* nuke in-memory signature for safety */
			PKCS7_free(sec_pkcs7);
			sec_pkcs7 = NULL;
		}

		ds_volno = 1; /* number of volumes in datastream */
		pinput = hdrbuf.text_buffer;
		/* skip past first line in header */
		(void) mgets(line, 128);
	}

	if (signal_received > 0) {
		return (1);
	}

	errflg = 0;

	for (i = 0; pkg[i]; i++) {

		if (signal_received > 0) {
			return (1);
		}

		if (!(options & PT_ODTSTREAM) && dstdev.mount) {
			if (n = pkgmount(&dstdev, NULL, 0, 0, 1)) {
				cleanup();
				return (n);
			}
		}
		if (errflg = pkgxfer(pkg[i], options)) {
			pkg[i] = NULL;
			if ((options & PT_ODTSTREAM) || (errflg != 2))
				break;
		} else if (strcmp(dstinst, pkg[i]))
			pkg[i] = strdup(dstinst);
	}

	if (!(options & PT_ODTSTREAM) && dst) {
		pkgdir = strdup(dst);
	}

	/*
	 * No cleanup of temporary directories created in this
	 * function is done here. The calling function must do
	 * the cleanup.
	 */

	return (signal_received > 0 ? 1 : errflg);
}
コード例 #3
0
ファイル: addcert.c プロジェクト: AlfredArouna/illumos-gate
/*
 * Name:	addcert
 * Desc:  	Imports a user certificate into the keystore, along with a
 *		private key.
 * Returns:	0 on success, non-zero otherwise.
 */
int
addcert(int argc, char **argv)
{
	int i;
	char	keystore_file[MAXPATHLEN] = "";
	char	*keystore_base = NULL;
	char	*homedir;
	char	*passarg = NULL;
	char	*import_passarg = NULL;
	char	*altroot = NULL;
	char	*prog = NULL;
	char	*alias = NULL;
	char	*infile = NULL;
	char	*inkeyfile = NULL;
	keystore_encoding_format_t	informat = NULL;
	char	*informat_str = NULL;
	int	ret = 1;
	boolean_t	trusted = B_FALSE;
	boolean_t	implicit_trust = B_FALSE;

	FILE	*certfile = NULL;
	FILE	*keyfile = NULL;
	X509	*cert = NULL;
	STACK_OF(X509) *trustcerts = NULL;
	EVP_PKEY *key = NULL;
	PKG_ERR	*err = NULL;
	keystore_handle_t	keystore = NULL;

	while ((i = getopt(argc, argv, ":a:k:e:f:n:P:p:R:ty")) != EOF) {
		switch (i) {
		case 'a':
			prog = optarg;
			break;
		case 'k':
			keystore_base = optarg;
			break;
		case 'e':
			inkeyfile = optarg;
			break;
		case 'f':
			informat_str = optarg;
			break;
		case 'n':
			alias = optarg;
			break;
		case 'P':
			passarg = optarg;
			break;
		case 'p':
			import_passarg = optarg;
			break;
		case 'R':
			altroot = optarg;
			break;
		case 't':
			trusted = B_TRUE;
			break;
		case 'y':
			implicit_trust = B_TRUE;
			break;
		case ':':
			log_msg(LOG_MSG_ERR, MSG_MISSING_OPERAND, optopt);
			/* LINTED fallthrough intentional */
		case '?':
		default:
			log_msg(LOG_MSG_ERR, MSG_USAGE);
			goto cleanup;
		}
	}

	if (!trusted && alias == NULL) {
		/* for untrusted (user) certs, we require a name */
		log_msg(LOG_MSG_ERR, MSG_USER_NAME);
		log_msg(LOG_MSG_ERR, MSG_USAGE);
		goto cleanup;
	} else if (trusted && alias != NULL) {
		/* for trusted certs, we cannot have a name */
		log_msg(LOG_MSG_ERR, MSG_TRUSTED_NAME);
		log_msg(LOG_MSG_ERR, MSG_USAGE);
		goto cleanup;
	}

	if (trusted && inkeyfile != NULL) {
		/* for trusted certs, we cannot have a private key */
		log_msg(LOG_MSG_ERR, MSG_TRUSTED_KEY);
		log_msg(LOG_MSG_ERR, MSG_USAGE);
		goto cleanup;
	}

	/* last argument should be the path to the certificate */
	if ((argc-optind) > 1) {
	    log_msg(LOG_MSG_ERR, MSG_USAGE);
	    goto cleanup;
	} else if ((argc-optind) < 1) {
		infile = "stdin";
		certfile = stdin;
		log_msg(LOG_MSG_DEBUG, "Loading stdin certificate");
	} else {
		infile = argv[optind];
		log_msg(LOG_MSG_DEBUG, "Loading <%s> certificate",
		    argv[optind]);
		if ((certfile = fopen(infile, "r")) == NULL) {
			log_msg(LOG_MSG_ERR, MSG_OPEN, infile);
			goto cleanup;
		}
	}

	/*
	 * if specific key file supplied, open it, otherwise open
	 * default (stdin)
	 */
	if (inkeyfile != NULL) {
		if ((keyfile = fopen(inkeyfile, "r")) == NULL) {
			log_msg(LOG_MSG_ERR, MSG_OPEN, inkeyfile);
			goto cleanup;
		}
	} else {
		inkeyfile = "stdin";
		keyfile = stdin;
	}

	/* set up proper keystore */
	if (altroot != NULL) {
	    if (strlcpy(keystore_file, altroot, MAXPATHLEN) >= MAXPATHLEN) {
		log_msg(LOG_MSG_ERR, MSG_TOO_LONG, altroot);
		goto cleanup;
	    }

	    if (strlcat(keystore_file, "/", MAXPATHLEN) >= MAXPATHLEN) {
		log_msg(LOG_MSG_ERR, MSG_TOO_LONG, altroot);
		goto cleanup;
	    }
	}

	if (keystore_base == NULL) {
		if (geteuid() == 0 || altroot != NULL) {
				/*
				 * If we have an alternate
				 * root, then we have no choice but to use
				 * root's keystore on that alternate root,
				 * since there is no way to resolve a
				 * user's home dir given an alternate root
				 */
			if (strlcat(keystore_file, PKGSEC,
			    MAXPATHLEN) >= MAXPATHLEN) {
				log_msg(LOG_MSG_ERR, MSG_TOO_LONG,
				    keystore_file);
				goto cleanup;
			}
		} else {
			if ((homedir = getenv("HOME")) == NULL) {
				/*
				 * not superuser, but no home dir, so
				 * use superuser's keystore
				 */
				if (strlcat(keystore_file, PKGSEC,
				    MAXPATHLEN) >= MAXPATHLEN) {
					log_msg(LOG_MSG_ERR, MSG_TOO_LONG,
					    keystore_file);
					goto cleanup;
				}
			} else {
				if (strlcat(keystore_file, homedir,
				    MAXPATHLEN) >= MAXPATHLEN) {
					log_msg(LOG_MSG_ERR, MSG_TOO_LONG,
					    homedir);
					goto cleanup;
				}
				if (strlcat(keystore_file, "/.pkg/security",
				    MAXPATHLEN) >= MAXPATHLEN) {
					log_msg(LOG_MSG_ERR, MSG_TOO_LONG,
					    keystore_file);
					goto cleanup;
				}
			}
		}
	} else {
		if (strlcat(keystore_file, keystore_base,
		    MAXPATHLEN) >= MAXPATHLEN) {
		    log_msg(LOG_MSG_ERR, MSG_TOO_LONG,
			keystore_base);
		    goto cleanup;
		}
	}

	/* figure out input format */
	if (informat_str == NULL) {
		informat = KEYSTORE_FORMAT_PEM;
	} else {
		if (ci_streq(informat_str, "pem")) {
			informat = KEYSTORE_FORMAT_PEM;
		} else if (ci_streq(informat_str, "der")) {
			informat = KEYSTORE_FORMAT_DER;
		} else {
			log_msg(LOG_MSG_ERR, MSG_BAD_FORMAT, informat_str);
			goto cleanup;
		}
	}

	err = pkgerr_new();

	if (trusted) {
		/* load all possible certs */
		if (load_all_certs(err, certfile, informat, import_passarg,
		    &trustcerts) != 0) {
			log_pkgerr(LOG_MSG_ERR, err);
			log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
			goto cleanup;
		}

		/* we must have gotten at least one cert, if not, fail */
		if (sk_X509_num(trustcerts) < 1) {
			log_msg(LOG_MSG_ERR, MSG_NO_CERTS, infile);
			goto cleanup;
		}
	} else {
		/* first, try to load user certificate and key */
		if (load_cert_and_key(err, certfile, informat, import_passarg,
		    &key, &cert) != 0) {
			log_pkgerr(LOG_MSG_ERR, err);
			log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
			goto cleanup;
		}

		/* we must have gotten a cert, if not, fail */
		if (cert == NULL) {
			log_msg(LOG_MSG_ERR, MSG_NO_CERTS, infile);
			goto cleanup;
		}

		if (key == NULL) {
			/*
			 * if we are importing a user cert, and did not get
			 * a key, try to load it from the key file
			 */
			if (keyfile == NULL) {
				log_msg(LOG_MSG_ERR, MSG_NEED_KEY, infile);
				goto cleanup;
			} else {
				log_msg(LOG_MSG_DEBUG,
				    "Loading private key <%s>", inkeyfile);
				if (load_cert_and_key(err, keyfile, informat,
				    import_passarg,
				    &key, NULL) != 0) {
					log_pkgerr(LOG_MSG_ERR, err);
					log_msg(LOG_MSG_ERR,
					    MSG_NO_ADDKEY, inkeyfile);
					goto cleanup;
				}

				if (key == NULL) {
					log_msg(LOG_MSG_ERR, MSG_NO_PRIVKEY,
					    inkeyfile);
					log_msg(LOG_MSG_ERR,
					    MSG_NO_ADDKEY, inkeyfile);
					goto cleanup;
				}
			}
		}
	}

	if (trusted) {
		/* check validity date of all certificates */
		for (i = 0; i < sk_X509_num(trustcerts); i++) {
			/* LINTED pointer cast may result in improper algnmnt */
			cert = sk_X509_value(trustcerts, i);
			if (check_cert(err, cert) != 0) {
				log_pkgerr(LOG_MSG_ERR, err);
				log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT,
				    infile);
				goto cleanup;
			}
		}
	} else {
		/* check validity date of user certificate */
		if (check_cert_and_key(err, cert, key) != 0) {
			log_pkgerr(LOG_MSG_ERR, err);
			log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
			goto cleanup;
		}
	}

	if (trusted && !implicit_trust) {
		/*
		 * if importing more than one cert, must use implicit trust,
		 * because we can't ask the user to individually trust
		 * each one, since there may be many
		 */
		if (sk_X509_num(trustcerts) != 1) {
			log_pkgerr(LOG_MSG_ERR, err);
			log_msg(LOG_MSG_ERR, MSG_MULTIPLE_TRUST, infile, "-y");
			goto cleanup;
		} else {
			/* LINTED pointer cast may result in improper algnmnt */
			cert = sk_X509_value(trustcerts, 0);
		}

		/* ask the user */
		switch (verify_trust(cert)) {
		case Accept:
			/* user accepted */
			break;
		case Reject:
			/* user aborted operation */
			log_msg(LOG_MSG_ERR, MSG_ADDCERT_ABORT);
			goto cleanup;
		case VerifyFailed:
		default:
			log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
			goto cleanup;
		}
	}

	/* now load the key store */
	log_msg(LOG_MSG_DEBUG, "Loading keystore <%s>", keystore_file);

	set_passphrase_prompt(MSG_KEYSTORE_PASSPROMPT);
	set_passphrase_passarg(passarg);
	if (open_keystore(err, keystore_file, prog, pkg_passphrase_cb,
	    KEYSTORE_ACCESS_READWRITE | KEYSTORE_PATH_HARD, &keystore) != 0) {
		log_pkgerr(LOG_MSG_ERR, err);
		log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
		goto cleanup;
	}

	/* now merge the new cert into the keystore */
	log_msg(LOG_MSG_DEBUG, "Merging certificate <%s>",
	    get_subject_display_name(cert));
	if (trusted) {
		/* merge all trusted certs found */
		for (i = 0; i < sk_X509_num(trustcerts); i++) {
			/* LINTED pointer cast may result in improper algnmnt */
			cert = sk_X509_value(trustcerts, i);
			if (merge_ca_cert(err, cert, keystore) != 0) {
				log_pkgerr(LOG_MSG_ERR, err);
				log_msg(LOG_MSG_ERR,
				    MSG_NO_ADDCERT, infile);
				goto cleanup;

			} else {
				log_msg(LOG_MSG_INFO, MSG_TRUSTING,
				    get_subject_display_name(cert));
			}
		}
	} else {
		/* merge user cert */
		if (merge_cert_and_key(err, cert, key, alias, keystore) != 0) {
			log_pkgerr(LOG_MSG_ERR, err);
			log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
			goto cleanup;
		}
	}

	/* now write it back out */
	log_msg(LOG_MSG_DEBUG, "Closing keystore");
	set_passphrase_prompt(MSG_KEYSTORE_PASSOUTPROMPT);
	set_passphrase_passarg(passarg);
	if (close_keystore(err, keystore, pkg_passphrase_cb) != 0) {
		log_pkgerr(LOG_MSG_ERR, err);
		log_msg(LOG_MSG_ERR, MSG_NO_ADDCERT, infile);
		goto cleanup;
	}

	if (trusted) {
		log_msg(LOG_MSG_INFO, MSG_TRUSTED, infile);
	} else {
		log_msg(LOG_MSG_INFO, MSG_ADDED, infile, alias);
	}

	ret = 0;

	/* fallthrough intentional */
cleanup:
	if (err != NULL)
		pkgerr_free(err);

	if (certfile != NULL)
		(void) fclose(certfile);

	if (keyfile != NULL)
		(void) fclose(keyfile);

	return (ret);
	}
コード例 #4
0
ファイル: addcert.c プロジェクト: AlfredArouna/illumos-gate
/* Asks user to verify certificate data before proceeding */
static VerifyStatus verify_trust(X509 *cert)
{
	char		vfy_trust = 'y';
	VerifyStatus	ret = Accept;
	PKG_ERR		*err;
	UI		*ui = NULL;

	err = pkgerr_new();
	/* print cert data */
	if (print_cert(err, cert, KEYSTORE_FORMAT_TEXT,
	    get_subject_display_name(cert), B_TRUE, stdout) != 0) {
		log_pkgerr(LOG_MSG_ERR, err);
		ret = VerifyFailed;
		goto cleanup;
	}

	if ((ui = UI_new()) == NULL) {
		log_msg(LOG_MSG_ERR, MSG_MEM);
		ret = VerifyFailed;
		goto cleanup;
	}

	/*
	 * The prompt is internationalized, but the valid
	 * response values are fixed, to avoid any complex
	 * multibyte processing that results in bugs
	 */
	if (UI_add_input_boolean(ui, MSG_VERIFY_TRUST,
	    "",
	    "yY", "nN",
	    UI_INPUT_FLAG_ECHO, &vfy_trust) <= 0) {
		log_msg(LOG_MSG_ERR, MSG_MEM);
		ret = VerifyFailed;
		goto cleanup;
	}

	if (UI_process(ui) != 0) {
		log_msg(LOG_MSG_ERR, MSG_MEM);
		ret = VerifyFailed;
		goto cleanup;
	}

	if (vfy_trust != 'y') {
		ret = Reject;
		goto cleanup;
	}

	/*
	 * if the cert does not appear to be a CA cert
	 * r is not self-signed, verify that as well
	 */
	if (!is_ca_cert(cert)) {
		UI_free(ui);
		if ((ui = UI_new()) == NULL) {
			log_msg(LOG_MSG_ERR, MSG_MEM);
			ret = VerifyFailed;
			goto cleanup;
		}

		if (UI_add_input_boolean(ui,
		    MSG_VERIFY_NOT_CA,
		    "",
		    "yY", "nN",
		    UI_INPUT_FLAG_ECHO, &vfy_trust) <= 0) {
			ret = VerifyFailed;
			goto cleanup;
		}

		if (UI_process(ui) != 0) {
			log_msg(LOG_MSG_ERR, MSG_MEM);
			ret = VerifyFailed;
			goto cleanup;
		}

		if (vfy_trust != 'y') {
			ret = Reject;
			goto cleanup;
		}
	}

cleanup:
	if (ui != NULL)
		UI_free(ui);

	if (err != NULL)
		pkgerr_free(err);

	return (ret);
}
コード例 #5
0
ファイル: main.c プロジェクト: AlfredArouna/illumos-gate
int
main(int argc, char *argv[])
{
	int	c;
	void	(*func)();
	extern char	*optarg;
	extern int	optind;
	char		*keystore_alias = NULL;
	char		*keystore_file = NULL;
	boolean_t	create_sig = B_FALSE;
	char		*homedir = NULL;
	PKG_ERR		*err;
	int		ret, len;

	(void) setlocale(LC_ALL, "");

#if !defined(TEXT_DOMAIN)	/* Should be defined by cc -D */
#define	TEXT_DOMAIN "SYS_TEST"
#endif
	(void) textdomain(TEXT_DOMAIN);

	(void) set_prog_name(argv[0]);

	while ((c = getopt(argc, argv, "ga:P:k:snio?")) != EOF) {
		switch (c) {
		case 'n':
			options |= PT_RENAME;
			break;

		case 'i':
			options |= PT_INFO_ONLY;
			break;

		case 'o':
			options |= PT_OVERWRITE;
			break;

		case 's':
			options |= PT_ODTSTREAM;
			break;

		case 'g':
			/* this should eventually be a PT_ option */
			create_sig = B_TRUE;
			break;

		case 'k':
			keystore_file = optarg;
			break;

		case 'a':
			keystore_alias = optarg;
			break;

		case 'P':
			set_passphrase_passarg(optarg);
			if (ci_strneq(optarg, "pass:"******"pass:<pass>");
			}
			break;

		default:
			usage();
			return (1);
		}
	}
	func = signal(SIGINT, trap);
	if (func != SIG_DFL)
		(void) signal(SIGINT, func);
	(void) signal(SIGHUP, trap);
	(void) signal(SIGQUIT, trap);
	(void) signal(SIGTERM, trap);
	(void) signal(SIGPIPE, trap);
	(void) signal(SIGPWR, trap);

	if ((argc-optind) < 2) {
		usage();
		return (1);
	}

	if (create_sig) {
		sec_init();
		err = pkgerr_new();

		/* figure out which keystore to use */
		if (keystore_file == NULL) {
			if (geteuid() == 0) {
				/* we are superuser, so use their keystore */
				keystore_file = PKGSEC;

			} else if ((homedir = getenv("HOME")) == NULL) {
				/*
				 * not superuser, but no home dir, so
				 * use superuser's keystore
				 */
				keystore_file = PKGSEC;

			} else if (asprintf(&keystore_file, "%s/.pkg/security",
			    homedir) < 0) {
				logerr(ERR_MEM);
				quit(1);
			}
		}

		logerr(gettext(KEYSTORE_OPEN), keystore_file);

		set_passphrase_prompt(MSG_PASSPROMPT);

		/* open keystore for reading */
		if (open_keystore(err, keystore_file, get_prog_name(),
		    pkg_passphrase_cb, KEYSTORE_DFLT_FLAGS, &keystore) != 0) {
			pkgerr(err);
			pkgerr_free(err);
			quit(1);
		}

	} else {
		/* no signature, so don't use a keystore */
		keystore = NULL;
	}

	ret = pkgtrans(flex_device(argv[optind], 1),
	    flex_device(argv[optind+1], 1), &argv[optind+2], options,
	    keystore, keystore_alias);

	if (create_sig) {
		/* close keystore */
		if (close_keystore(err, keystore, NULL) != 0) {
			pkgerr(err);
			pkgerr_free(err);
			quit(1);
		}
		keystore = NULL;
	}

	quit(ret);
	/*NOTREACHED*/
}
コード例 #6
0
ファイル: pkgtrans.c プロジェクト: Sunshine-OS/pkg-gate
/* will return 0, 1, 3, or 99 */
static int
_pkgtrans(char *device1, char *device2, char **pkg, int options,
    keystore_handle_t keystore, char *keystore_alias)
{
#ifdef	USE_KEYSTORE
	BIO			*p7_bio = NULL;
	EVP_PKEY		*privkey = NULL;
#endif
	PKCS7			*sec_pkcs7 = NULL;
#ifdef	USE_KEYSTORE
	PKCS7_SIGNER_INFO	*sec_signerinfo = NULL;
	PKG_ERR			*err;
	STACK_OF(X509)		*cacerts = NULL;
	STACK_OF(X509)		*clcerts = NULL;
	STACK_OF(X509)		*sec_chain = NULL;
	X509			*pubcert = NULL;
#endif
	boolean_t		making_sig = B_FALSE;
	char			*src, *dst;
	int			errflg, i, n;
	struct			dm_buf *hdr;

	making_sig = (keystore != NULL) ? B_TRUE : B_FALSE;

#ifdef	USE_KEYSTORE
	if (making_sig) {

		/* new error object */
		err = pkgerr_new();

		/* find matching cert and key */
		if (find_key_cert_pair(err, keystore,
		    keystore_alias, &privkey, &pubcert) != 0) {
			pkgerr(err);
			pkgerr_free(err);
			return (1);
		}

		/* get CA certificates */
		if (find_ca_certs(err, keystore, &cacerts) != 0) {
			pkgerr(err);
			pkgerr_free(err);
			return (1);
		}

		/* get CL (aka "chain") certificates */
		if (find_cl_certs(err, keystore, &clcerts) != 0) {
			pkgerr(err);
			pkgerr_free(err);
			return (1);
		}

		/* initialize PKCS7 object to be filled in later */
		sec_pkcs7 = PKCS7_new();
		PKCS7_set_type(sec_pkcs7, NID_pkcs7_signed);
		sec_signerinfo = PKCS7_add_signature(sec_pkcs7,
		    pubcert, privkey, EVP_sha1());

		if (sec_signerinfo == NULL) {
			progerr(gettext(ERR_SEC), keystore_alias);
			ERR_print_errors_fp(stderr);
			pkgerr_free(err);
			return (1);
		}

		/* add signer cert into signature */
		PKCS7_add_certificate(sec_pkcs7, pubcert);

		/* attempt to resolve cert chain starting at the signer cert */
		if (get_cert_chain(err, pubcert, clcerts, cacerts,
		    &sec_chain) != 0) {
			pkgerr(err);
			pkgerr_free(err);
			return (1);
		}

		/*
		 * add the verification chain of certs into the signature.
		 * The first cert is the user cert, which we don't need,
		 * since it's baked in already, so skip it
		 */
		for (i = 1; i < sk_X509_num(sec_chain); i++) {
			PKCS7_add_certificate(sec_pkcs7,
			    sk_X509_value(sec_chain, i));
		}

		pkgerr_free(err);
		err = NULL;
	}
#endif	/* USE_KEYSTORE */

	if (signal_received > 0) {
		return (1);
	}

	/* transfer spool to appropriate device */
	if (devtype(device1, &srcdev)) {
		progerr(pkg_gt(ERR_TRANSFER));
		logerr(pkg_gt(MSG_BADDEV), device1);
		return (1);
	}
	srcdev.rdonly++;

	/* check for datastream */
	ids_name = NULL;
	if (srcdev.bdevice) {
		if (ds_readbuf(srcdev.cdevice))
			ids_name = srcdev.cdevice;
	}

	if (srcdev.cdevice && !srcdev.bdevice)
		ids_name = srcdev.cdevice;
	else if (srcdev.pathname) {
		ids_name = srcdev.pathname;
		if (access(ids_name, 0) == -1) {
			progerr(ERR_TRANSFER);
			logerr(pkg_gt(MSG_GETVOL));
			return (1);
		}
	}

	if (!ids_name && device2 == (char *)0) {
		if (n = pkgmount(&srcdev, NULL, 1, 0, 0)) {
			cleanup();
			return (n);
		}
		if (srcdev.mount && *srcdev.mount)
			pkgdir = strdup(srcdev.mount);
		return (0);
	}

	if (ids_name && device2 == (char *)0) {
		char	template[] = "/var/tmp/ptXXXXXX";