nasl_signature.h File Reference

#include <stddef.h>

Include dependency graph for nasl_signature.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions
int	nasl_verify_signature (const char *, const char *, size_t)

Function Documentation

nasl_verify_signature()

int nasl_verify_signature	(	const char *	filename,
		const char *	fcontent,
		size_t	flen
	)

Checks the detached OpenPGP signature of the file given by FILENAME. The name of the signature file is derived from FILENAME by appending ".asc".

If a signature file exists and it contains at least one fully valid signature, the function returns 0. If all of the signatures are not valid or were made by an unknown or untrusted key, the function returns 1. If an error occurs or the file does not have a corresponding detached signature the function returns -1.

Parameters

filename

Filename (e.g. 1.txt) for which to check signature (e.g. 1.txt.asc).

Returns

Zero, if files exists and at least one signature is fully trusted. 1 if all signatures are invalid or untrusted key. -1 on missing file or error.

Definition at line 98 of file nasl_signature.c.

{
  int retcode = -1, sig_count = 0;
  char *sigfilename = NULL;
  gsize siglen = 0;
  gchar *scontent = NULL;
  gchar *offset = NULL;
  gchar *endpos = NULL;
  gchar *path = g_build_filename (OPENVAS_GPG_BASE_DIR, "gnupg", NULL);
  gboolean success;
  gpgme_error_t err;
  gpgme_ctx_t ctx = gvm_init_gpgme_ctx_from_dir (path);
  gpgme_data_t sig = NULL, text = NULL;
 
  g_free (path);
  if (ctx == NULL)
    {
      nasl_trace (NULL, "gpgme context could not be initialized.\n");
      goto fail;
    }
 
  /* Signatures file is buffered. */
  sigfilename = g_malloc0 (strlen (filename) + 4 + 1);
  strcpy (sigfilename, filename);
  strcat (sigfilename, ".asc");
  nasl_trace (NULL, "nasl_verify_signature: loading signature file '%s'\n",
              sigfilename);
 
  success = g_file_get_contents (sigfilename, &scontent, NULL, NULL);
  /* If the signature file doesn't exist, fail without an error message
   * because an unsigned file is a very common and expected
   * condition */
  if (!success)
    goto fail;
 
  /* Start to parse the signature file to find signatures. */
  offset = g_strstr_len (scontent, strlen (scontent), "-----B");
  if (!offset)
    {
      nasl_trace (NULL, "nasl_verify_signature: No signature in '%s'\n",
                  sigfilename);
      goto fail;
    }
  endpos = g_strstr_len (offset, -1, "-----E");
  if (endpos)
    siglen = strlen (offset) - strlen (endpos) + 17;
  else
    {
      nasl_trace (NULL, "nasl_verify_signature: No signature in '%s'\n",
                  sigfilename);
      goto fail;
    }
 
  do
    {
      sig_count++;
 
      /* Load file in memory. */
      err = gpgme_data_new_from_mem (&text, fcontent, flen, 1);
      if (err)
        {
          print_gpgme_error ("gpgme_data_new_from_file", err);
          goto fail;
        }
 
      /* Load a founded signature in memory. */
      err = gpgme_data_new_from_mem (&sig, offset, siglen, 1);
      if (err)
        nasl_trace (NULL, "nasl_verify_signature: %s: %s\n", sigfilename,
                    gpgme_strerror (err));
 
      /* Verify the signature. */
      err = gpgme_op_verify (ctx, sig, text, NULL);
      nasl_trace (NULL,
                  "nasl_verify_signature: gpgme_op_verify "
                  "-> '%d'\n",
                  err);
      if (err)
        print_gpgme_error ("gpgme_op_verify", err);
      else
        {
          if (examine_signatures (gpgme_op_verify_result (ctx), sig_count))
            {
              retcode = 0;
              goto fail;
            }
          else
            retcode = 1;
        }
 
      /* Search a new signature. */
      offset = g_strstr_len (offset + 1, strlen (offset), "-----B");
      if (offset)
        {
          if ((endpos = g_strstr_len (offset, strlen (offset), "-----E")))
            siglen = (strlen (offset) - strlen (endpos) + 17);
          else
            {
              nasl_trace (NULL, "nasl_verify_signature: No signature in '%s'\n",
                          sigfilename);
              goto fail;
            }
        }
 
      gpgme_data_release (sig);
      sig = NULL;
      gpgme_data_release (text);
      text = NULL;
    }
  while (offset);
 
fail:
  g_free (scontent);
  if (sig)
    gpgme_data_release (sig);
  if (text)
    gpgme_data_release (text);
  if (ctx != NULL)
    gpgme_release (ctx);
  g_free (sigfilename);
 
  return retcode;
}

References examine_signatures(), nasl_trace(), and print_gpgme_error().

Here is the call graph for this function: