Fixes #15247: Validating signatures in shared-files API

relay/sources/relayd/src/remote_run.rs

@@ -157,8 +157,7 @@ impl FromStr for Condition {
                 s.to_string(),
                 condition_regex
             )))
-        }
-         else {
+        } else {
             Ok(Condition {
                 data: s.to_string(),
             })
@@ -291,8 +290,7 @@ mod tests {
     }
 
     #[test]
-    fn it_handles_too_long_conditions()
-    {
+    fn it_handles_too_long_conditions() {
         assert!(Condition::from_str("Qr6U6s161z8umvzZTMSPtsZpe3s2sAjwUeCD5pbzvwtT9jg8AsqaW1hbgJhDvOQ34J6GdUS0bEJLKz4zfWHO70rYdq70jrKip5gYwdbVyB7APyK3RRAGHGS7EZ8bUNEXUlHp1QsYOQeqPyPKCCJUYhAzWsD8b1lC4gOkmzATyabEBhaoAb5TLELtBra5dS1YzG1TxgHEthd8z7Qf7PHeltK1X628rfwPqVY2FHkgBGvNMAFTYUdnyabV0j7PHal4f31nNRCqZPdUv6iIlHHQo0oUQlwZ7ATUNYt2cznLYu5v8RhBL0uqOxMD9xHAnRxYRo57BDQxkunNyb7oTjruainGIqbXoDPjcKCQRrf3IrVvAQ6mwAgIdEzJkxBaZUkAGeNQFZEh5b3zJSryfgML2kc87ohLMmsIh5OvNnrPUipSnkpGruJV2uCRX1EYNH6skC9QY1oji6D3SYNeH0lZFIe8goO0Sa1geORlB5UpDwrGeWKgo6k7xBORpPdiVFjR1fAsO7po2CPrR2OwBv6IP0VcU4pPY3eIXgSWSecRE4UXDR2dyaSqSyo4E2l4KAIwy7LieKechiA3yROPrkk0MBC6JfUeOXrCvFBDpQ29Q0TE1J8LK0Xt8DexBZdTUI2ni3Gs1Clli4cvXwfyvTGWFpnTsgS7S7zOyYaIGVqI8UmmszQM8Y4IZBt5nmUsMcrsNBvp4ZqseHoaR0WHTp93c6l83dw3EuuQyFvbqmwQAeDNOrSW2YYAL6Ab5ru5XoRfxCB0LitHWeocyUCo6ukE7YnS8ZmqBIWjLizUD7OnaCSWajdalXINhHDmUQgBehAbPOOiFSlLEyUQeBfZEmWvV5CJ4NN2gBgpDGJywm9mKxr8KcN1TPtp4rGpVYWgDK4N3RjUcQiH7rkSN2zd3vb1MkvtvQsMSX45CpmVng6UQf2LPeRIBNBEaiiNeQAvhfTm86EWNkOwnhHr8QHd7yzLQ6kd4D7Q05oNkRrDDNn5zhS6rvJCujTVFqp5eMa2jbiUa").is_err());
     }
 }

relay/sources/relayd/src/shared_files.rs

@@ -33,9 +33,11 @@ use chrono::prelude::DateTime;
 use chrono::{Duration, Utc};
 use hyper::StatusCode;
 use openssl::error::ErrorStack;
+use openssl::hash::MessageDigest;
 use openssl::pkey::PKey;
 use openssl::pkey::Public;
 use openssl::rsa::Rsa;
+use openssl::sign::{Signer, Verifier};
 use regex::Regex;
 use sha2::{Digest, Sha256, Sha512};
 use std::collections::HashMap;
@@ -76,6 +78,13 @@ impl HashType {
             }
         }
     }
+
+    fn to_openssl_hash(&self) -> MessageDigest {
+        match &self {
+            HashType::Sha256 => MessageDigest::sha256(),
+            HashType::Sha512 => MessageDigest::sha512(),
+        }
+    }
 }
 
 #[derive(Debug)]
@@ -177,6 +186,17 @@ pub fn get_pubkey(pubkey: String) -> Result<PKey<Public>, ErrorStack> {
     )?)
 }
 
+pub fn validate_signature(
+    file: &[u8],
+    pubkey: PKey<Public>,
+    hash_type: HashType,
+    digest: &[u8],
+) -> Result<bool, ErrorStack> {
+    let mut verifier = Verifier::new(hash_type.to_openssl_hash(), &pubkey).unwrap();
+    verifier.update(file).unwrap();
+    verifier.verify(digest)
+}
+
 pub fn parse_ttl(ttl: String) -> Result<i64, Error> {
     let regex_numbers = Regex::new(r"^(?:(?P<days>\d+)(?:d|days))?\s*(?:(?P<hours>\d+)(?:h|hours))?\s*(?:(?P<minutes>\d+)(?:m|minutes))?\s*(?:(?P<seconds>\d+)(?:s|seconds))?").unwrap();
 
@@ -273,3 +293,24 @@ z5VEb9yx2KikbWyChM1Akp82AV5BzqE80QIBIw==".to_string()).unwrap(),
         "3c4641f2e99ade126b9923ffdfc432d486043e11ce7bd5528cc50ed372fc4c224dba7f2a2a3a24f114c06e42af5f45f5c248abd7ae300eeefc27bcf0687d7040"
     ).unwrap(), true);
 }
+
+#[test]
+pub fn it_validates_signatures() {
+    // Generate a keypair
+    let k0 = Rsa::generate(2048).unwrap();
+    let k0pkey = k0.public_key_to_pem().unwrap();
+    let k1 = Rsa::public_key_from_pem(&k0pkey).unwrap();
+
+    let keypriv = PKey::from_rsa(k0).unwrap();
+    let keypub = PKey::from_rsa(k1).unwrap();
+
+    let data = b"hello, world!";
+
+    // Sign the data
+    let mut signer = Signer::new(HashType::Sha512.to_openssl_hash(), &keypriv).unwrap();
+    signer.update(data).unwrap();
+
+    let signature = signer.sign_to_vec().unwrap();
+
+    assert!(validate_signature(data, keypub, HashType::Sha512, &signature).unwrap());
+}