Changeset 11922961a781bb840c7e06b0ca32054ae0e65645

Timestamp:

18/05/08 01:39:45 (7 months ago)

Author:

Rafaël Carré <funman@videolan.org>

git-committer:

Rafaël Carré <funman@videolan.org> 1211067585 +0200

git-parent:

[96250779f78d93eb59cc49388cbb519c14c27307]

git-author:

Rafaël Carré <funman@videolan.org> 1211067568 +0200

Message:

Update: supports file v4 signatures

Note: public key v3 signatures are not supported
Fix various bugs and potentials buffer overflows

Files:

• doc/release-howto.txt (modified) (3 diffs)
• include/vlc_pgpkey.h (modified) (2 diffs)
• include/vlc_update.h (modified) (5 diffs)
• src/misc/update.c (modified) (32 diffs)

doc/release-howto.txt

@@ -24 +24 @@
-    /opt/ftp/pub/videolan/testing/vlc-X.X.X/
-  - generate md5 hashes and gpg signature of these files
- --force-v3-sigs
+
-
- * Contribs
@@ -37 +37 @@
-    # add the .zip files to /opt/ftp/pub/videolan/testing/vlc-X.X.X/beos/
-   generate md5 hashes and gpg signature of these files
- --force-v3-sigs
+
-
- * Win32 Packages
@@ -45 +45 @@
-    add the .zip and .exe files to /opt/ftp/pub/videolan/testing/vlc-X.X.X/win32/
-   generate md5 hashes and gpg signature of these files
- --force-v3-sigs
+
-
- * OS X packages
-   configure with --enable-update-check
-   generate md5 hashes and gpg signature of these files
- --force-v3-sigs
+
-
- * Commit changes ... it never works the first time

include/vlc_pgpkey.h

@@ -33 +33 @@
-};
-
+/* gpg --export --armor "VideoLAN Release"|sed -e s/^/\"/ -e s/\$/\\\\n\"/ */
-static uint8_t videolan_public_key[] = {
-"-----BEGIN PGP PUBLIC KEY BLOCK-----\n"
@@ -79 +80 @@
-"-----END PGP PUBLIC KEY BLOCK-----\n"
-};
-

include/vlc_update.h

@@ -34 +34 @@
-#include <vlc/vlc.h>
-
-#include <vlc_stream.h>     /* key & signature downloading */
-#include <vlc_strings.h>    /* b64 decoding */
-#include <vlc_charset.h>    /* utf8_fopen() */
-#include <gcrypt.h>         /* cryptography and digest algorithms */
-
-/**
- * \defgroup update Update
- *
- * @{
+ */
+
+/* Go reading the rfc 4880 ! NOW !! */
+
+/*
+ * XXX
+ *  When PGP-signing a file, we only sign a SHA-1 hash of this file
+ *
+ *  As soon as SHA-1 is broken, this method is not secure anymore, because an
+ *  attacker could generate a file with the same SHA-1 hash.
+ *
+ *  Whenever this happens, we need to use another algorithm / type of key.
+ * XXX
- */
-
@@ -76 +84 @@
-};
-
-
-enum    /* Signature subpacket types */
-{
-    ISSUER_SUBPACKET    = 0x10
-};
-
-
-
-struct public_key_packet_t
@@ -97 +102 @@
-};
-
-
-v4_
- /* hashed_data or unhashed_data can be empty, so the signature packet is
-* theorically at least 54 bytes long, but always more than that.
+and file 
+
+
+ uint8_t version; /* 3 or 4
-
-    uint8_t version;
-    uint8_t type;
-
-
-
-
-
-
+
+
+
-    uint8_t hash_verification[2];
+    uint8_t issuer_longid[8];
+
+    union   /* version specific data */
+    {
+        struct
+        {
+            uint8_t hashed_data_len[2];     /* scalar number */
+            uint8_t *hashed_data;           /* hashed_data_len bytes */
+            uint8_t unhashed_data_len[2];   /* scalar number */
+            uint8_t *unhashed_data;         /* unhashed_data_len bytes */
+        } v4;
+        struct
+        {
+            uint8_t hashed_data_len;    /* MUST be 5 */
+            uint8_t timestamp[4];       /* 4 bytes scalar number */
+        } v3;
+    } specific;
-
-    /* The part below is made of consecutive MPIs, their number and size being
-     * public-key-algorithm dependant.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
-    uint8_t r[2+20];
-    uint8_t s[2+20];
@@ -141 +144 @@
-
-typedef struct public_key_packet_t public_key_packet_t;
-
-
+
-
-struct public_key_t
@@ -151 +153 @@
-    public_key_packet_t key;       /* Public key packet */
-
-v4_
+
-};
-

src/misc/update.c

@@ -23 +23 @@
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111, USA.
- *****************************************************************************/
-
-
-
+
-/**
- *   \file
@@ -48 +46 @@
-#include <vlc_pgpkey.h>
-#include <vlc_stream.h>
+#include <vlc_strings.h>
+#include <vlc_charset.h>
-#include <vlc_interface.h>
+
+#include <gcrypt.h>
-#include <vlc_gcrypt.h>
-
@@ -102 +104 @@
-static inline int scalar_number( uint8_t *p, int header_len )
-{
+    assert( header_len == 1 || header_len == 2 || header_len == 4 );
+
-    if( header_len == 1 )
-        return( p[0] );
@@ -108 +112 @@
-    else if( header_len == 4 )
-        return( (p[0] << 24) + (p[1] << 16) + (p[2] << 8) + p[3] );
-
-    abort();
+
+abort(); /* to shut up GCC warning */
-}
-
@@ -122 +126 @@
-                                    size_t i_packet_len )
-{
-
-
-
-
+
+
+
+
+
+
+
-    if( p_key->version != 4 )
-        return VLC_EGENERIC;
-
-
-
-
-
+XXX: 
+ i_read += 4;
+
+ i_read++;
-    if( p_key->algo != PUBLIC_KEY_ALGO_DSA )
-        return VLC_EGENERIC;
-
+    /* read p */
+    if( i_read + 2 > i_packet_len )
+        return VLC_EGENERIC;
+
-    int i_p_len = mpi_len( p_buf );
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-
-    int i_q_len = mpi_len( p_buf );
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-
-    int i_g_len = mpi_len( p_buf );
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-
-    int i_y_len = mpi_len( p_buf );
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-
-    return VLC_SUCCESS;
+}
+
+static size_t parse_signature_v3_packet( signature_packet_t *p_sig,
+                                      uint8_t *p_buf, size_t i_sig_len )
+{
+    size_t i_read = 1; /* we already read the version byte */
+
+    if( i_sig_len < 19 ) /* signature is at least 19 bytes + the 2 MPIs */
+        return 0;
+
+    p_sig->specific.v3.hashed_data_len = *p_buf++; i_read++;
+    if( p_sig->specific.v3.hashed_data_len != 5 )
+        return 0;
+
+    p_sig->type = *p_buf++; i_read++;
+
+    memcpy( p_sig->specific.v3.timestamp, p_buf, 4 );
+    p_buf += 4; i_read += 4;
+
+    memcpy( p_sig->issuer_longid, p_buf, 8 );
+    p_buf += 8; i_read += 8;
+
+    p_sig->public_key_algo = *p_buf++; i_read++;
+
+    p_sig->digest_algo = *p_buf++; i_read++;
+
+    p_sig->hash_verification[0] = *p_buf++; i_read++;
+    p_sig->hash_verification[1] = *p_buf++; i_read++;
+
+    assert( i_read == 19 );
+
+    return i_read;
-}
-
@@ -179 +234 @@
- * verify that it was used with a DSA public key, using SHA-1 digest
- */
-int parse_signature_v4_packet( signature_packet_v4
+size_t parse_signature_v4_packet( signature_packet
-                                      uint8_t *p_buf, size_t i_sig_len )
-{
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        return VLC_EGENERIC;
-
-    p_sig->version = *p_buf++;
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-    if( p_sig->public_key_algo != PUBLIC_KEY_ALGO_DSA )
-
-
-
+
+
-    if( p_sig->digest_algo != DIGEST_ALGO_SHA1 )
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    return VLC_SUCCESS;
+
+error:
+
+    if( p_sig->version == 4 )
+    {
+        free( p_sig->specific.v4.hashed_data );
+        free( p_sig->specific.v4.unhashed_data );
+    }
+
+    return VLC_EGENERIC;
-}
-
@@ -363 +511 @@
- */
-static int download_signature(  vlc_object_t *p_this,
-v3_
+
-                                const char *psz_url )
-{
@@ -380 +528 @@
-
-    int64_t i_size = stream_Size( p_stream );
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
-    if( !p_buf )
-    {
@@ -406 +541 @@
-    stream_Delete( p_stream );
-
-
-
-
+
+
+
+
-        free( p_buf );
-        return VLC_EGENERIC;
-    }
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-    free( p_buf );
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -505 +682 @@
-
-/*
- * Return the long id (8 bytes) of the public key used to generate a signature
- */
-static uint8_t *get_issuer_from_signature_v4( signature_packet_v4_t *p_sig )
-{
-    uint8_t *p = p_sig->unhashed_data;
-    uint8_t *max_pos = p + scalar_number( p_sig->unhashed_data_len, 2 );
-
-    while( p < max_pos )
-    {
-        int i_subpacket_len = *p < 192 ? *p++ :
-                *p < 255 ? ((*p++ - 192) << 8) + *p++ + 192 :
-                ((*++p) << 24) + (*++p << 16) + (*++p << 8) + *++p;
-
-        if( p >= max_pos - 1 )
-            return NULL;
-
-        if( *p == ISSUER_SUBPACKET )
-            return p+1;
-        else
-            p += i_subpacket_len;
-    }
-    return NULL;
-}
-
-/*
- * fill a public_key_t with public key data, including:
- *   * public key packet
@@ -535 +687 @@
- *   * user id packet
- */
-
+
+
-{
-    uint8_t *pos = (uint8_t*) p_key_data;
@@ -547 +700 @@
-    uint8_t *p_key_unarmored = NULL;
-
-    signature_packet_v4_t sig;
-
-    p_key->psz_username = NULL;
-
+
+
-
-    if( !( *pos & 0x80 ) )
@@ -575 +727 @@
-
-        int i_header_len = packet_header_len( *pos++ );
-
+
+
-            goto error;
-
@@ -586 +739 @@
-        switch( i_type )
-        {
-            uint8_t *p_issuer;
-
-            case PUBLIC_KEY_PACKET:
-                i_status |= PUBLIC_KEY_FOUND;
@@ -594 +745 @@
-                break;
-
-
-
-
+
+
-                    break;
-
-
+
+
+
-                {
-
+
+
+
+
+
+
+
+
+
+
-                    i_status |= SIGNATURE_FOUND;
-                }
-                else
-                {
-                    free( sig.hashed_data );
-                    free( sig.unhashed_data );
-                }
-                break;
@@ -630 +785 @@
-    free( p_key_unarmored );
-
-+
+|
-        return VLC_EGENERIC;
-
@@ -639 +794 @@
-
-error:
-
-
+
+
+
+
+
-    free( p_key->psz_username );
-    free( p_key_unarmored );
@@ -650 +808 @@
- */
-static uint8_t *hash_sha1_from_file( const char *psz_file,
-
-
+
+
+
+
+
-    FILE *f = utf8_fopen( psz_file, "r" );
-    if( !f )
@@ -669 +830 @@
-        gcry_md_write( hd, buffer, i_read );
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    fclose( f );
@@ -686 +865 @@
- * download a public key (the last one) from videolan server, and parse it
- */
-
+
+
-{
-    char *psz_url;
@@ -730 +910 @@
-    }
-
+    memcpy( p_pkey->longid, p_longid, 8 );
+
-    int i_error = parse_public_key( p_buf, i_read, p_pkey, p_signature_issuer );
-    free( p_buf );
@@ -744 +926 @@
-
-/*
--
-
+
+(v4) 
- */
-static uint8_t *key_sign_hash( public_key_t *p_pkey )
-{
+    if( p_pkey->sig.version != 4 )
+        return NULL;
+
+    if( p_pkey->sig.type < GENERIC_KEY_SIGNATURE ||
+        p_pkey->sig.type > POSITIVE_KEY_SIGNATURE )
+        return NULL;
+
-    gcry_error_t error = 0;
-    gcry_md_hd_t hd;
@@ -758 +947 @@
-    gcry_md_putc( hd, 0x99 );
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-    gcry_md_write( hd, (uint8_t*)&p_pkey->key.p, 2 );
-    gcry_md_write( hd, (uint8_t*)&p_pkey->key.p + 2, i_p_len );
-
-
+
+
+
-    gcry_md_write( hd, (uint8_t*)&p_pkey->key.g, 2 );
-    gcry_md_write( hd, (uint8_t*)&p_pkey->key.g + 2, i_g_len );
-
-    int i_q_len = mpi_len( p_pkey->key.q );
-    gcry_md_write( hd, (uint8_t*)&p_pkey->key.q, 2 );
-    gcry_md_write( hd, (uint8_t*)&p_pkey->key.q + 2, i_q_len );
-
-    int i_y_len = mpi_len( p_pkey->key.y );
-    gcry_md_write( hd, (uint8_t*)&p_pkey->key.y, 2 );
-    gcry_md_write( hd, (uint8_t*)&p_pkey->key.y + 2, i_y_len );
@@ -781 +975 @@
-    gcry_md_putc( hd, 0xb4 );
-
-in
+size_
-
-    gcry_md_putc( hd, (i_len << 24) & 0xff );
@@ -790 +984 @@
-    gcry_md_write( hd, p_pkey->psz_username, i_len );
-
-
+
+
-
-    gcry_md_putc( hd, p_pkey->sig.version );
@@ -796 +991 @@
-    gcry_md_putc( hd, p_pkey->sig.public_key_algo );
-    gcry_md_putc( hd, p_pkey->sig.digest_algo );
-
-
+specific.v4.
+specific.v4.
-
-    gcry_md_putc( hd, 0x04 );
@@ -969 +1164 @@
-    /* Now that we know the status is valid, we must download its signature
-     * to authenticate it */
-v3_
+
-    if( download_signature( VLC_OBJECT( p_update->p_libvlc ), &sign,
-            UPDATE_VLC_STATUS_URL ) != VLC_SUCCESS )
@@ -995 +1190 @@
-    }
-
-
+
+
+
-    {
-        msg_Dbg( p_update->p_libvlc, "Need to download the GPG key" );
@@ -1053 +1250 @@
-    gcry_md_putc( hd, '\n' );
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+