chibipub

sigcheck.c (14722B)

---

 
 #define SCRATCH_SIZE 134217728
 #define MAX_PARALLEL 10
 
 #include <sys/mman.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <stdlib.h>
 #include <assert.h>
 #include <unistd.h>
 #include <openssl/rsa.h>
 #include <openssl/pem.h>
 
 #include "json.h"
 #include "debug.h"
 #include "ubjson.h"
 #include "hash.h"
 #include "hex.h"
 #include "base64.h"
 #include "io.h"
 #include "sigcheck.h"
 #include "util.h"
 #include "inbox.h"
 #include "errors.h"
 
 #include "sha256/sha256.h"
 
 #include <ctype.h>
 #include <curl/curl.h>
 
 struct keyid_pubkey {
 	unsigned char *data;
 	int len;
 };
 
 enum key_writer_flags {
 	KW_FAILED = 1 << 0,
 	KW_STARTED = 1 << 1,
 };
 
 struct key_writer {
 	CURL *curl;
 	struct cursor *arena;
 	struct keyid_pubkey *pubkey;
 	const char *keyid;
 	struct cursor slice;
 	struct errors errs;
 	int flags;
 };
 
 static int is_delete_activity(struct ubjson *ubjson)
 {
 	struct json val;
 	static const char *type_path[] = {"type"};
 
 	if (!ubjson_lookup(ubjson, type_path, ARRAY_SIZE(type_path), &val)) {
 		printf("unusual: couldn't determine object type\n");
 		return 1;
 	}
 
 	return val.type == JSON_STRING && !memcmp(val.string, "Delete", val.len);
 }
 
 
 static int get_cached_pubkey(const char *keyid, int keyid_len,
 		struct cursor *arena, unsigned char **pubkey, int *pubkey_size)
 {
 	unsigned char hash[32];
 	char hash_str[64];
 	char path[2048] = {0};
 	int ok;
 
 	// no objects dir, definitely don't have any cached pubkeys
 	if (!dir_exists(".chibipub/objects")) {
 		return 0;
 	}
 
 	hashdata32((unsigned char *)keyid, keyid_len, hash, sizeof(hash));
 	if (!hex_bytes(hash, 32, hash_str, 64)) {
 		assert(0);
 	}
 
 	sprintf(path, ".chibipub/objects/%c%c/%.*s",
 			hash_str[0], hash_str[1], 64, hash_str);
 
 	if (access(path, F_OK)) {
 		debug("key cache '%s' doesn't exist", path);
 		return 0;
 	}
 
 	*pubkey = arena->p;
 	ok = read_file(path, arena->p, arena->end - arena->p, pubkey_size);
 
 	arena->p += *pubkey_size;
 	return ok;
 }
 
 static int verify_signature_rsa(unsigned char *pubkey, int pubkey_len,
 		unsigned char *sig, int sig_len,
 		unsigned char *sigbuf, int sigbuf_len)
 {
 	unsigned char hash[32];
 
 	RSA *rsa = NULL;
 	BIO *keybio;
 
 	keybio = BIO_new_mem_buf((void*)pubkey, pubkey_len);
 	if (!keybio) {
 		return 0;
 	}
 
 	rsa = PEM_read_bio_RSA_PUBKEY(keybio, &rsa, 0, 0);
 
 	if (!rsa) {
 		fprintf(stderr, "verify_signature_rsa: PEM read failed\n");
 		return 0;
 	}
 
 	sha256_hash(hash, sigbuf, sigbuf_len);
 
 	return RSA_verify(NID_sha256, hash, 32, sig, sig_len, rsa);
 }
 
 static int verify_signature(struct cursor cur, struct cursor arena)
 {
 	struct ubjson ubjson;
 	struct json sigbuf, keyid, sig;
 	unsigned char *pubkey, *sig_data;
 	int pubkey_size;
 	size_t sig_len;
 
 	init_ubjson(&ubjson, cur.start, cur.p - cur.start);
 	ubjson.data_end = cur.p;
 
 	if (is_delete_activity(&ubjson))
 		return 2;
 
 	static const char *sig_path[] = {"@wssig"};
 	if (!ubjson_lookup(&ubjson, sig_path, ARRAY_SIZE(sig_path), &sig)) {
 		note_error(&ubjson.errs, "@wssig field not found");
 		return 0;
 	}
 
 	static const char *sb_path[] = {"@wssigbuf"};
 	if (!ubjson_lookup(&ubjson, sb_path, ARRAY_SIZE(sb_path), &sigbuf)) {
 		note_error(&ubjson.errs, "@wssigbuf field not found");
 		return 0;
 	}
 
 	static const char *keyid_path[] = {"@wskeyid"};
 	if (!ubjson_lookup(&ubjson, keyid_path, ARRAY_SIZE(keyid_path), &keyid)) {
 		note_error(&ubjson.errs, "keyid not fond");
 		return 0;
 	}
 
 	if (!get_cached_pubkey(keyid.string, keyid.len, &arena, &pubkey, &pubkey_size)) {
 		note_error(&ubjson.errs, "no cached pubkey for '%.*s'", keyid.len, keyid.string);
 		return 0;
 	}
 
 	sig_data = arena.p;
 	if (!base64_decode((const unsigned char*)sig.string,
 			   sig.len, arena.p, arena.end - arena.p,
 			   &sig_len)) {
 		note_error(&ubjson.errs, "base64 decode signature");
 		return 0;
 	}
 
 	return verify_signature_rsa(
 			pubkey, pubkey_size,
 			sig_data, sig_len,
 			(unsigned char*)sigbuf.string, sigbuf.len);
 }
 
 static inline int push_keyid(struct cursor *c, const char *keyid, int keyid_len)
 {
 	struct keyid_pubkey pubkey = {0};
 	return push_int(c, keyid_len)
 		&& push_data(c, (unsigned char *)keyid, keyid_len)
 		&& push_byte(c, 0)
 		&& push_data(c, (unsigned char *)&pubkey, sizeof(pubkey)); // reserved for pubkey data index
 }
 
 static int pull_keyid(struct cursor *c, const char **keyid_str, int *keyid_len,
 		struct keyid_pubkey **pubkey)
 {
 	if (!pull_int(c, keyid_len)) {
 		return 0;
 	}
 
 	*keyid_str = (const char*)c->p;
 	c->p += (*keyid_len) + 1; /* plus zero */
 	*pubkey = (struct keyid_pubkey*)c->p;
 	c->p += sizeof(struct keyid_pubkey);
 
 	return 1;
 }
 
 static int has_keyid(struct cursor *keyids, const char *keyid, int keyid_len)
 {
 	struct cursor scan;
 	int size;
 	const char *keyid_str;
 	struct keyid_pubkey *offset;
 
 	scan.start = keyids->start;
 	scan.p = keyids->start;
 	scan.end = keyids->p;
 
 	while (scan.p < scan.end) {
 		if (!pull_keyid(&scan, &keyid_str, &size, &offset)) {
 			return 0;
 		}
 		if (size != keyid_len) {
 			continue;
 		}
 		if (!memcmp(keyid, keyid_str, keyid_len)) {
 			return 1;
 		}
 	}
 
 	return 0;
 }
 
 /*
 static int print_keyids(struct cursor keyids)
 {
 	int size;
 	const char *keyid_str;
 	struct keyid_pubkey *pubkey;
 
 	keyids.end = keyids.p;
 	keyids.p = keyids.start;
 
 	printf("keyids\n");
 	while (keyids.p < keyids.end) {
 		if (!pull_keyid(&keyids, &keyid_str, &size, &pubkey))
 			return 0;
 		printf("%.*s\n", size, keyid_str);
 	}
 
 	return 1;
 }
 */
 
 static int gather_keyids(unsigned char *json, int json_len,
 		struct cursor *arena, struct cursor *keyids_cur)
 {
 	static const char *path[] = {"@wskeyid"};
 	const int ubjson_mem_size = 1024 * 256;
 
 	struct ubjson ubjson;
 	struct json val;
 	struct json_parser parser;
 	struct json_handlers handlers;
 	unsigned char *ubjson_mem;
 
 	ubjson_mem = cursor_alloc(arena, ubjson_mem_size);
 	make_cursor(arena->p, arena->end, keyids_cur);
 	init_ubjson(&ubjson, ubjson_mem, ubjson_mem_size);
 	make_ubjson_handlers(&handlers, &ubjson.cur);
 	init_json_parser(&parser, json, json_len, &handlers);
 
 	while (parse_json(&parser)) {
 		init_ubjson(&ubjson, ubjson_mem, ubjson_mem_size);
 		ubjson.data_end = ubjson.cur.p;
 
 		if (is_delete_activity(&ubjson))
 			continue;
 
 		if (!ubjson_lookup(&ubjson, path, ARRAY_SIZE(path), &val)) {
 			note_error(&parser.errs, "@wskeyid not found");
 			return 0;
 		}
 
 		if (has_keyid(keyids_cur, val.string, val.len)) {
 			continue;
 		}
 
 		if (!push_keyid(keyids_cur, val.string, val.len)) {
 			note_error(&parser.errs, "push_keyid");
 			return 0;
 		}
 	}
 
 	keyids_cur->end = keyids_cur->p;
 	keyids_cur->p = keyids_cur->start;
 	arena->p = keyids_cur->end;
 
 	return 1;
 }
 
 static size_t write_cb(char *data, size_t n, size_t l, void *userp)
 {
 	double dcl;
 	int cl;
 	int res;
 	size_t size = n*l;
 	struct key_writer *writer = (struct key_writer *)userp;
 
 	if (!(writer->flags & KW_STARTED)) {
 		res = curl_easy_getinfo(writer->curl,
 				CURLINFO_CONTENT_LENGTH_DOWNLOAD, &dcl);
 		if (res) {
 			fprintf(stderr, "'%s' download failed, content-length unknown\n",
 					writer->keyid);
 			writer->flags |= KW_FAILED;
 			return 0;
 		}
 
 		cl = (int)dcl;
 		if (cl == -1) {
 			cl = 1024*1024;
 		}
 
 		writer->pubkey->data = cursor_alloc(writer->arena, cl);
 		if (!writer->pubkey->data) {
 			fprintf(stderr, "cursor_alloc failed, remaining (%ld) + %d (%ld total)\n",
 				writer->arena->end - writer->arena->p,
 				cl, writer->arena->end - writer->arena->start);
 			writer->flags |= KW_FAILED;
 			return 0;
 		}
 
 		writer->flags |= KW_STARTED;
 		writer->pubkey->len = 0;
 		make_cursor(writer->pubkey->data, writer->pubkey->data + cl,
 				&writer->slice);
 	}
 
 	if (!push_data(&writer->slice, (unsigned char*)data, size)) {
 		writer->flags |= KW_FAILED;
 		return 0;
 	}
 
 	writer->pubkey->len += size;
 
 	return size;
 }
 
 static int add_signature_transfer(CURLM *cm, struct key_writer *writer)
 {
 	struct curl_slist *list = NULL;
 
 	CURL *eh = curl_easy_init();
 	writer->curl = eh;
 	curl_easy_setopt(eh, CURLOPT_WRITEFUNCTION, write_cb);
 	curl_easy_setopt(eh, CURLOPT_WRITEDATA, writer);
 	curl_easy_setopt(eh, CURLOPT_URL, writer->keyid);
 	curl_easy_setopt(eh, CURLOPT_PRIVATE, writer);
 
 	list = curl_slist_append(list, "Accept: application/ld+json");
 	curl_easy_setopt(eh, CURLOPT_HTTPHEADER, list);
 
 	curl_multi_add_handle(cm, eh);
 
 	return 1;
 }
 
 static void prepare_transfers(CURLM **cm)
 {
 	curl_global_init(CURL_GLOBAL_ALL);
 	*cm = curl_multi_init();
 	curl_multi_setopt(*cm, CURLMOPT_MAXCONNECTS, (long)10);
 }
 
 static int get_keyid_hash(const char *keyid, struct cursor *arena,
 		char **hash_str)
 {
 	unsigned char *hash;
 
 	if (!(*hash_str = cursor_alloc(arena, 65))) {
 		return 0;
 	}
 
 	if (!(hash = cursor_alloc(arena, 32))) {
 		return 0;
 	}
 
 	hashdata32((unsigned char*)keyid, strlen(keyid), hash, 32);
 	if (!hex_bytes(hash, 32, *hash_str, 64)) {
 		return 0;
 	}
 
 	arena->p -= 32;
 
 	return 1;
 }
 
 static int write_pubkey_cache(struct key_writer *writer, struct cursor arena)
 {
 	char *hash_str;
 	char *path;
 
 	if (!get_keyid_hash(writer->keyid, &arena, &hash_str)) {
 		note_error(&writer->errs, "get_keyid_hash");
 		return 0;
 	}
 
 	path = (char*)arena.p;
 
 	if (!(push_str(&arena, ".chibipub/objects/") &&
 		push_sized_str(&arena, hash_str, 2) &&
 		push_byte(&arena, 0) &&
 		mkdirp(path)))
 	{
 		note_error(&writer->errs, "mkdir -p '%s'", path);
 		return 0;
 	}
 
 	// continue path
 	arena.p--;
 
 	if (!(push_byte(&arena,'/') &&
 		push_sized_str(&arena, hash_str, 64) &&
 		push_byte(&arena, 0)))
 	{
 		note_error(&writer->errs, "push path oob");
 		return 0;
 	}
 
 	if (!write_file(path, (unsigned char*)writer->pubkey->data,
 				writer->pubkey->len)) {
 		note_error(&writer->errs, "write_file '%s' pubkey failed", path);
 		return 0;
 	}
 
 	return 1;
 }
 
 static int handle_pubkey_response(struct cursor arena,
 		struct key_writer *writer, unsigned char *json, int json_len)
 {
 	unsigned char *start;
 	struct ubjson ubjson;
 	struct json_handlers handler;
 	struct json_parser parser;
 	struct json val;
 	static const char *path[] = {"publicKey", "publicKeyPem"};
 
 	start = arena.p;
 
 	make_ubjson_handlers(&handler, &arena);
 	init_json_parser(&parser, json, json_len, &handler);
 	if (!parse_json(&parser)) {
 		note_error(&writer->errs, "keyid '%s' activity json parse failed",
 				writer->keyid);
 		return 0;
 	}
 
 	init_ubjson(&ubjson, start, arena.p - start);
 	ubjson.data_end = arena.p;
 
 	if (!ubjson_lookup(&ubjson, path, ARRAY_SIZE(path), &val)) {
 		note_error(&writer->errs,
 			"keyid '%s' could not find 'publicKeyPem' field",
 			writer->keyid);
 		return 0;
 	}
 
 	writer->pubkey->data = (unsigned char*)val.string;
 	writer->pubkey->len = val.len;
 
 	if (!write_pubkey_cache(writer, arena)) {
 		note_error(&writer->errs, "failed to write pubkey");
 		return 0;
 	}
 
 	return 1;
 }
 
 static int handle_transfer_msg(struct cursor *arena, CURLM *cm, CURLMsg *msg, int *transfers,
 		struct key_writer *to_fetch, int n_to_fetch)
 {
 	struct key_writer *writer;
 	int ok = 1;
 
 	if (msg->msg == CURLMSG_DONE) {
 		CURL *e = msg->easy_handle;
 
 		curl_easy_getinfo(msg->easy_handle, CURLINFO_PRIVATE, &writer);
 
 		fprintf(stderr, "R: %d - %s <%s>\n",
 				msg->data.result,
 				curl_easy_strerror(msg->data.result),
 				writer->keyid);
 
 		if (msg->data.result == CURLE_OK) {
 			ok = handle_pubkey_response(*arena, writer,
 					writer->pubkey->data,
 					writer->pubkey->len);
 		}
 
 		curl_multi_remove_handle(cm, e);
 		curl_easy_cleanup(e);
 	} else {
 		fprintf(stderr, "E: CURLMsg (%d)\n", msg->msg);
 	}
 
 	if (*transfers < n_to_fetch) {
 		add_signature_transfer(cm, &to_fetch[*transfers]);
 		*transfers = *transfers + 1;
 	}
 
 	return ok;
 }
 
 static int perform_transfers(struct cursor *arena, CURLM *cm, int transfers,
 		struct key_writer *to_fetch, int n_to_fetch)
 {
 	CURLMsg *msg;
 	int still_alive = 1;
 	int msgs_left = -1;
 
 	do {
 		curl_multi_perform(cm, &still_alive);
 
 		while ((msg = curl_multi_info_read(cm, &msgs_left))) {
 			handle_transfer_msg(arena,
 				cm, msg, &transfers, to_fetch, n_to_fetch);
 		}
 
 		if (still_alive) {
 			curl_multi_wait(cm, NULL, 0, 1000, NULL);
 		}
 	} while (still_alive || (transfers < n_to_fetch));
 
 	curl_multi_cleanup(cm);
 	curl_global_cleanup();
 
 	return 1;
 }
 
 static int count_keyids(struct cursor scan, int *count)
 {
 	int size;
 	const char *keyid_str;
 	struct keyid_pubkey *pubkey;
 
 	*count = 0;
 
 	while (scan.p < scan.end) {
 		if (!pull_keyid(&scan, &keyid_str, &size, &pubkey)) {
 			return 0;
 		}
 		*count = *count + 1;
 	}
 
 	return 1;
 }
 
 static int fetch_signatures(unsigned char *json, int json_len,
 		struct cursor *arena)
 {
 	struct cursor keyids;
 	struct cursor scan;
 	int size, transfers;
 	int n_to_fetch, n_keyids;
 	const char *keyid_str;
 	struct key_writer *to_fetch, *kw;
 	struct keyid_pubkey *pubkey;
 	CURLM *cm;
 	n_to_fetch = 0;
 
 	if (!gather_keyids(json, json_len, arena, &keyids)) {
 		return 0;
 	}
 
 	prepare_transfers(&cm);
 
 	scan.p = scan.start = keyids.start;
 	scan.end = keyids.end;
 
 	if (!count_keyids(scan, &n_keyids)) {
 		return 0;
 	}
 
 	if (!(to_fetch = cursor_alloc(arena, n_keyids * sizeof(struct key_writer)))) {
 		return 0;
 	}
 
 	while (scan.p < scan.end) {
 
 		if (!pull_keyid(&scan, &keyid_str, &size, &pubkey)) {
 			return 0;
 		}
 
 		if (get_cached_pubkey(keyid_str, strlen(keyid_str), arena,
 					&pubkey->data, &pubkey->len)) {
 			/*
 			printf("got cached pubkey of size %d... do something\n",
 					pubkey->len);
 					*/
 			continue;
 		}
 
 		pubkey->len = 0;
 
 		kw = &to_fetch[n_to_fetch++];
 		init_errors(&kw->errs);
 		kw->keyid = keyid_str;
 		kw->arena = arena;
 		kw->pubkey = pubkey;
 		kw->flags = 0;
 	}
 
 	for (transfers = 0; transfers < MAX_PARALLEL && transfers < n_to_fetch; transfers++) {
 		add_signature_transfer(cm, &to_fetch[transfers]);
 	}
 
 	if (!perform_transfers(arena, cm, transfers, to_fetch, n_to_fetch)) {
 		return 0;
 	}
 
 	return 1;
 }
 
 int sigcheck(struct sigcheck *check)
 {
 	int count = 0, res;
 	unsigned char *p, *start, *scratch;
 	size_t flen;
 	struct json_parser jsonp;
 	struct json_handlers handlers;
 	struct cursor out_cur;
 
 	scratch = malloc(SCRATCH_SIZE);
 	map_file(check->activity_file, &p, &flen);
 
 	init_json_handlers(&handlers);
 	make_cursor(scratch, scratch + SCRATCH_SIZE, &out_cur);
 	make_ubjson_handlers(&handlers, &out_cur);
 	init_json_parser(&jsonp, p, flen, &handlers);
 
 	if (!fetch_signatures(p, flen, &out_cur)) {
 		note_error(&jsonp.errs, "fatal error fetching signature");
 		return 0;
 	}
 
 	make_cursor(scratch, scratch + SCRATCH_SIZE, &out_cur);
 	make_ubjson_handlers(&handlers, &out_cur);
 	init_json_parser(&jsonp, p, flen, &handlers);
 
 	start = out_cur.p;
 	while (parse_json(&jsonp)) {
 		count++;
 		fprintf(stderr, "[%d] parse success\r", count);
 
 		res = verify_signature(out_cur, out_cur);
 
 		if (res == 0) {
 			printf("bad signature #%d\n", count);
 		} else if (res == 1) {
 			printf("good signature #%d\r", count);
 		}
 
 		// overwrite last ubjson
 		out_cur.p = start;
 	}
 
 	printf("\n");
 
 	munmap(p, flen);
 
 	return 1;
 }