- certificate stuff

svn path=/trunk/boinc/; revision=15957

client/client_types.C

@@ -636,6 +636,7 @@ FILE_INFO::FILE_INFO() {
     strcpy(signed_xml, "");
     strcpy(xml_signature, "");
     strcpy(file_signature, "");
+    certificates = 0;
 }
 
 FILE_INFO::~FILE_INFO() {
@@ -745,6 +746,15 @@ int FILE_INFO::parse(MIOFILE& in, bool from_server) {
             }
             continue;
         }
+        if (match_tag(buf, "<signatures>")) {
+            if (!certificates->parse_miofile_embed(in)) {
+                msg_printf(0, MSG_INTERNAL_ERROR,
+                    "FILE_INFO::parse(): cannot parse <signatures>\n");
+                return ERR_XML_PARSE;
+            }
+            continue;
+        }
+
         strcat(signed_xml, buf);
         if (parse_str(buf, "<name>", name, sizeof(name))) continue;
         if (parse_str(buf, "<url>", url)) {

client/client_types.h

@@ -31,6 +31,7 @@
 #endif
 
 #include "md5_file.h"
+#include "certificate.h"
 #include "hostinfo.h"
 #include "coproc.h"
 #include "miofile.h"
@@ -77,7 +78,7 @@ class FILE_INFO {
     class PERS_FILE_XFER* pers_file_xfer;
         // nonzero if in the process of being up/downloaded
     struct RESULT* result;         // for upload files (to authenticate)
-    class PROJECT* project;
+    struct PROJECT* project;
     int ref_cnt;
     std::vector<std::string> urls;
     int start_url;
@@ -94,6 +95,7 @@ class FILE_INFO {
         // this is the signature
     std::string error_msg;       // if permanent error occurs during file xfer,
                             // it's recorded here
+    CERTIFICATES* certificates;
 
     FILE_INFO();
     ~FILE_INFO();
@@ -111,6 +113,7 @@ class FILE_INFO {
     void failure_message(std::string&);
     int merge_info(FILE_INFO&);
     int verify_file(bool, bool);
+    bool verify_file_certs();
     int gzip();     // gzip file and add .gz to name
 };
 

client/cs_files.C

@@ -36,6 +36,7 @@
 #include "crypt.h"
 #include "str_util.h"
 #include "filesys.h"
+#include "certificate.h"
 #include "error_numbers.h"
 
 #include "file_names.h"
@@ -88,6 +89,27 @@ int CLIENT_STATE::make_project_dirs() {
     return 0;
 }
 
+// Is app signed by one of the Application Certifiers?
+//
+bool FILE_INFO::verify_file_certs() {
+    string file;
+    bool retval = false;
+
+    if (!is_dir(CERTIFICATE_DIRECTORY)) return false;
+    DIRREF dir = dir_open(CERTIFICATE_DIRECTORY);
+    while (dir_scan(file, dir)) {
+        if (cert_verify_file(certificates, file.c_str(), CERTIFICATE_DIRECTORY)) {
+            msg_printf(project, MSG_INFO,
+                "Signature verified using certificate %s", file.c_str()
+            );
+            retval = true;
+            break;
+        }
+    }
+    dir_close(dir);
+    return retval;
+}
+
 // Check the existence and/or validity of a file
 // If "strict" is true, check either the digital signature of the file
 // (if signature_required is set) or its MD5 checksum.
@@ -137,7 +159,7 @@ int FILE_INFO::verify_file(bool strict, bool show_errors) {
     if (!strict) return 0;
 
     if (signature_required) {
-        if (!strlen(file_signature)) {
+        if (!strlen(file_signature) && !certificates) {
             msg_printf(project, MSG_INTERNAL_ERROR,
                 "Application file %s missing signature", name
             );
@@ -148,6 +170,18 @@ int FILE_INFO::verify_file(bool strict, bool show_errors) {
             status = ERR_NO_SIGNATURE;
             return ERR_NO_SIGNATURE;
         }
+        if (config.use_certs || config.use_certs_only) {
+            if (verify_file_certs()) {
+                verified = true;
+                return 0;
+            }
+        }
+        if (config.use_certs_only) {
+            msg_printf(project, MSG_INTERNAL_ERROR,
+                "Unable to verify %s using certificates", name
+            );
+            return ERR_NO_SIGNATURE;
+        }
         retval = verify_file2(
             pathname, file_signature, project->code_sign_key, verified
         );

client/file_names.h

@@ -87,5 +87,6 @@ extern void send_log_after(const char* filename, double t, MIOFILE& mf);
 #define JOB_LOG_BASE                "job_log_"
 #define CA_BUNDLE_FILENAME          "ca-bundle.crt"
 #define CLIENT_AUTH_FILENAME        "client_auth.xml"
+#define CERTIFICATE_DIRECTORY       "certificates"
 
 #endif

client/log_flags.C

@@ -253,6 +253,9 @@ int CONFIG::parse_options(XML_PARSER& xp) {
             downcase_string(force_auth);
             continue;
         }
+        if (xp.parse_bool(tag, "allow_multiple_clients", allow_multiple_clients)) continue;
+        if (xp.parse_bool(tag, "use_certs", use_certs)) continue;
+        if (xp.parse_bool(tag, "use_certs_only", use_certs_only)) continue;
         msg_printf(NULL, MSG_USER_ERROR, "Unrecognized tag in %s: <%s>\n",
             CONFIG_FILE, tag
         );

client/log_flags.h

@@ -102,6 +102,9 @@ struct CONFIG {
     bool run_apps_manually;
     std::string force_auth;
     bool allow_multiple_clients;
+    bool use_certs;
+    bool use_certs_only;
+        // overrides use_certs
 
     CONFIG();
     void defaults();

lib/Makefile.am

@@ -56,6 +56,7 @@ endif
 libboinc_a_SOURCES = \
     app_ipc.C \
     base64.C \
+	certificate.C \
     coproc.C \
     crypt.C \
     diagnostics.C \