verify: support signature checks for multiple fingerprints across repositories

[muratbalaban43]

Introducing vendor/sunnyvalley plugin which contains the vendor package repository information.

Vendor-provided package repository hosts os-sensei package and related dependencies.

[muratbalaban43]

Hi Ad,

In trying to test 19.7.rc1 & new sensei vendor plugin I noticed this:

When there is an additional repository configured, opnsense-verify does not seem to use the OPNsense repo fingerprints, instead using the lately added repository fingerprints.

This causes 19.7.r1 updates to fail, since they were being verified through SunnyValley fingerprints.

This truss output is when we have /usr/local/etc/pkg/repos/SunnyValley.conf

[root@fw /var/cache/opnsense-update/66521]# truss opnsense-verify base-19.7.r1-amd64.txz 2>&1 | grep trusted
open("/usr/local/etc/pkg/fingerprints/SunnyValley/trusted",O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC,00) = 5 (0x5)
lstat("/usr/local/etc/pkg/fingerprints/SunnyValley/trusted",{ mode=drwxr-xr-x ,inode=724136,size=512,blksize=32768 }) = 0 (0x0)
lstat("/usr/local/etc/pkg/fingerprints/SunnyValley/trusted/updates.sunnyvalley.org.20190702",{ mode=-rw-r--r-- ,inode=724137,size=100,blksize=32768 }) = 0 (0x0)
stat("/usr/local/etc/pkg/fingerprints/SunnyValley/trusted/updates.sunnyvalley.org.20190702",{ mode=-rw-r--r-- ,inode=724137,size=100,blksize=32768 }) = 0 (0x0)
openat(AT_FDCWD,"/usr/local/etc/pkg/fingerprints/SunnyValley/trusted/updates.sunnyvalley.org.20190702",O_RDONLY,00) = 6 (0x6)
No trusted fingerprint found matching file's certificate
write(2,"No trusted fingerprint found mat"...,57) = 57 (0x39)
[root@fw /var/cache/opnsense-update/66521]# 

When we remove the repository, the verification is done with the correct repository:

[root@fw /var/cache/opnsense-update/66521]# truss opnsense-verify base-19.7.r1-amd64.txz 2>&1 | grep trusted
open("/usr/local/etc/pkg/fingerprints/OPNsense/trusted",O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC,00) = 5 (0x5)
lstat("/usr/local/etc/pkg/fingerprints/OPNsense/trusted",{ mode=drwxr-xr-x ,inode=659046,size=512,blksize=32768 }) = 0 (0x0)
lstat("/usr/local/etc/pkg/fingerprints/OPNsense/trusted/pkg.opnsense.org.20181218",{ mode=-rw-r--r-- ,inode=659048,size=99,blksize=32768 }) = 0 (0x0)
stat("/usr/local/etc/pkg/fingerprints/OPNsense/trusted/pkg.opnsense.org.20181218",{ mode=-rw-r--r-- ,inode=659048,size=99,blksize=32768 }) = 0 (0x0)
openat(AT_FDCWD,"/usr/local/etc/pkg/fingerprints/OPNsense/trusted/pkg.opnsense.org.20181218",O_RDONLY,00) = 6 (0x6)
lstat("/usr/local/etc/pkg/fingerprints/OPNsense/trusted",{ mode=drwxr-xr-x ,inode=659046,size=512,blksize=32768 }) = 0 (0x0)
lstat("/usr/local/etc/pkg/fingerprints/OPNsense/trusted/pkg.opnsense.org.20190702",{ mode=-rw-r--r-- ,inode=642056,size=99,blksize=32768 }) = 0 (0x0)
stat("/usr/local/etc/pkg/fingerprints/OPNsense/trusted/pkg.opnsense.org.20190702",{ mode=-rw-r--r-- ,inode=642056,size=99,blksize=32768 }) = 0 (0x0)
openat(AT_FDCWD,"/usr/local/etc/pkg/fingerprints/OPNsense/trusted/pkg.opnsense.org.20190702",O_RDONLY,00) = 6 (0x6)
lstat("/usr/local/etc/pkg/fingerprints/OPNsense/trusted",{ mode=drwxr-xr-x ,inode=659046,size=512,blksize=32768 }) = 0 (0x0)
lstat("/usr/local/etc/pkg/fingerprints/OPNsense/trusted/opnsense-update.deciso.com.20180627",{ mode=-rw-r--r-- ,inode=659047,size=99,blksize=32768 }) = 0 (0x0)
stat("/usr/local/etc/pkg/fingerprints/OPNsense/trusted/opnsense-update.deciso.com.20180627",{ mode=-rw-r--r-- ,inode=659047,size=99,blksize=32768 }) = 0 (0x0)
openat(AT_FDCWD,"/usr/local/etc/pkg/fingerprints/OPNsense/trusted/opnsense-update.deciso.com.20180627",O_RDONLY,00) = 6 (0x6)
Verifying signature with trusted certificate pkg.opnsense.org.20190702... done
write(1,"Verifying signature with trusted"...,79) = 79 (0x4f)
[root@fw /var/cache/opnsense-update/66521]# 

Looks like opnsense-verify always use the latest repo. We'll have a look at it.

[fichtner]

I'm hijacking this since this is an error in pkg bootstrap base code borrowed from FreeBSD src.git.

[muratbalaban43]

@fichtner , any updates on this?

[fichtner]

@muratbalaban43 it's complicated... please test db515c8

[AdSchellevis]

@muratbalaban43 @fichtner probably needs one empty file in the revoked directory to function correctly.

truss opnsense-verify base-19.7.2-amd64.txz
......
stat("/usr/local/etc/pkg/fingerprints/SunnyValley/trusted/updates.sunnyvalley.org.20190702",{ mode=-rw-r--r-- ,inode=2171625,size=99,blksize=32768 }) = 0 (0x0)
openat(AT_FDCWD,"/usr/local/etc/pkg/fingerprints/SunnyValley/trusted/updates.sunnyvalley.org.20190702",O_RDONLY,00) = 6 (0x6)
mmap(0x0,99,PROT_READ,MAP_SHARED,6,0x0)		 = 4212770279424 (0x3d4dcad1000)
close(6)					 = 0 (0x0)
munmap(0x3d4dcad1000,99)			 = 0 (0x0)
getdirentries(5,0x3d4de447000,4096,{ 0x200 })	 = 0 (0x0)
close(5)					 = 0 (0x0)
open("/usr/local/etc/pkg/fingerprints/SunnyValley/revoked",O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC,033620470420) ERR#2 'No such file or directory'
opnsense-verify: write(2,"opnsense-verify: ",17)			 = 17 (0x11)
Error loading revoked certificateswrite(2,"Error loading revoked certificat"...,34) = 34 (0x22)

write(2,"\n",1)					 = 1 (0x1)

Then

mkdir /usr/local/etc/pkg/fingerprints/SunnyValley/revoked

......
lseek(3,0x0,SEEK_SET)				 = 0 (0x0)
Verifying signature with trusted certificate pkg.opnsense.org.20190702... done
write(1,"Verifying signature with trusted"...,79) = 79 (0x4f)
close(3)					 = 0 (0x0)
close(4)					 = 0 (0x0)
exit(0x0)					
process exit, rval = 0

[fichtner]

we should probably solve this in the plugin. I don't want to patch this too much

[AdSchellevis]

@fichtner sorry, that's what I meant as well. how about opnsense/plugins@195c182 ?

[fichtner]

looks good, but needs a revision bump for safety :)