author | Michael Krelin <hacker@klever.net> | 2009-04-05 13:32:38 (UTC) |
---|---|---|
committer | Michael Krelin <hacker@klever.net> | 2009-04-05 13:32:38 (UTC) |
commit | 702c6bc69bb9bf511f6f5639d90d49139674339c (patch) (unidiff) | |
tree | 9672670cc28f5e743f372a82fd1aefb2bb87479e | |
parent | 878315238f71307b5b62ed314096f4a7c465bf3e (diff) | |
download | iii-702c6bc69bb9bf511f6f5639d90d49139674339c.zip iii-702c6bc69bb9bf511f6f5639d90d49139674339c.tar.gz iii-702c6bc69bb9bf511f6f5639d90d49139674339c.tar.bz2 |
check uploaded file integrity
Signed-off-by: Michael Krelin <hacker@klever.net>
-rw-r--r-- | src/eyefiservice.cc | 75 |
1 files changed, 46 insertions, 29 deletions
diff --git a/src/eyefiservice.cc b/src/eyefiservice.cc index 153a7c4..d233a07 100644 --- a/src/eyefiservice.cc +++ b/src/eyefiservice.cc | |||
@@ -29,157 +29,174 @@ static bool detached_child() { | |||
29 | } | 29 | } |
30 | _exit(0); | 30 | _exit(0); |
31 | } | 31 | } |
32 | int rc; | 32 | int rc; |
33 | if(waitpid(p,&rc,0)<0) throw std::runtime_error("failed to waitpid()"); | 33 | if(waitpid(p,&rc,0)<0) throw std::runtime_error("failed to waitpid()"); |
34 | if(!WIFEXITED(rc)) throw std::runtime_error("error in forked process"); | 34 | if(!WIFEXITED(rc)) throw std::runtime_error("error in forked process"); |
35 | if(WEXITSTATUS(rc)) throw std::runtime_error("forked process signalled error"); | 35 | if(WEXITSTATUS(rc)) throw std::runtime_error("forked process signalled error"); |
36 | return false; | 36 | return false; |
37 | } | 37 | } |
38 | 38 | ||
39 | int eyefiService::StartSession( | 39 | int eyefiService::StartSession( |
40 | std::string macaddress,std::string cnonce, | 40 | std::string macaddress,std::string cnonce, |
41 | int transfermode,long transfermodetimestamp, | 41 | int transfermode,long transfermodetimestamp, |
42 | struct rns__StartSessionResponse &r ) { | 42 | struct rns__StartSessionResponse &r ) { |
43 | #ifndef NDEBUG | 43 | #ifndef NDEBUG |
44 | syslog(LOG_DEBUG, | 44 | syslog(LOG_DEBUG, |
45 | "StartSession request from %s with cnonce=%s, transfermode=%d, transfermodetimestamp=%ld", | 45 | "StartSession request from %s with cnonce=%s, transfermode=%d, transfermodetimestamp=%ld", |
46 | macaddress.c_str(), cnonce.c_str(), transfermode, transfermodetimestamp ); | 46 | macaddress.c_str(), cnonce.c_str(), transfermode, transfermodetimestamp ); |
47 | #endif | 47 | #endif |
48 | r.credential = binary_t(macaddress+cnonce+eyekinfig_t(macaddress).get_upload_key()).md5().hex(); | 48 | r.credential = binary_t(macaddress+cnonce+eyekinfig_t(macaddress).get_upload_key()).md5().hex(); |
49 | /* TODO: better nonce generator */ | 49 | /* TODO: better nonce generator */ |
50 | time_t t = time(0); | 50 | time_t t = time(0); |
51 | r.snonce = binary_t(&t,sizeof(t)).md5().hex(); | 51 | r.snonce = binary_t(&t,sizeof(t)).md5().hex(); |
52 | r.transfermode=transfermode; | 52 | r.transfermode=transfermode; |
53 | r.transfermodetimestamp=transfermodetimestamp; | 53 | r.transfermodetimestamp=transfermodetimestamp; |
54 | r.upsyncallowed=false; | 54 | r.upsyncallowed=false; |
55 | 55 | ||
56 | std::string cmd = eyekinfig_t(macaddress).get_on_start_session(); | 56 | std::string cmd = eyekinfig_t(macaddress).get_on_start_session(); |
57 | if(!cmd.empty()) { | 57 | if(!cmd.empty()) { |
58 | if(detached_child()) { | 58 | if(detached_child()) { |
59 | putenv( gnu::autosprintf("EYEFI_MACADDRESS=%s",macaddress.c_str()) ); | 59 | putenv( gnu::autosprintf("EYEFI_MACADDRESS=%s",macaddress.c_str()) ); |
60 | putenv( gnu::autosprintf("EYEFI_TRANSFERMODE=%d",transfermode) ); | 60 | putenv( gnu::autosprintf("EYEFI_TRANSFERMODE=%d",transfermode) ); |
61 | putenv( gnu::autosprintf("EYEFI_TRANSFERMODETIMESTAMP=%ld",transfermodetimestamp) ); | 61 | putenv( gnu::autosprintf("EYEFI_TRANSFERMODETIMESTAMP=%ld",transfermodetimestamp) ); |
62 | char *argv[] = { (char*)"/bin/sh", (char*)"-c", (char*)cmd.c_str(), 0 }; | 62 | char *argv[] = { (char*)"/bin/sh", (char*)"-c", (char*)cmd.c_str(), 0 }; |
63 | execv("/bin/sh",argv); | 63 | execv("/bin/sh",argv); |
64 | syslog(LOG_ERR,"Failed to execute '%s'",cmd.c_str()); | 64 | syslog(LOG_ERR,"Failed to execute '%s'",cmd.c_str()); |
65 | _exit(-1); | 65 | _exit(-1); |
66 | } | 66 | } |
67 | } | 67 | } |
68 | return SOAP_OK; | 68 | return SOAP_OK; |
69 | } | 69 | } |
70 | 70 | ||
71 | int eyefiService::GetPhotoStatus( | 71 | int eyefiService::GetPhotoStatus( |
72 | std::string credential, std::string macaddress, | 72 | std::string credential, std::string macaddress, |
73 | std::string filename, long filesize, std::string filesignature, | 73 | std::string filename, long filesize, std::string filesignature, |
74 | struct rns__GetPhotoStatusResponse &r ) { | 74 | struct rns__GetPhotoStatusResponse &r ) { |
75 | #ifndef NDEBUG | 75 | #ifndef NDEBUG |
76 | syslog(LOG_DEBUG, | 76 | syslog(LOG_DEBUG, |
77 | "GetPhotoStatus request from %s with credential=%s, filename=%s, filesize=%ld, filesignature=%s", | 77 | "GetPhotoStatus request from %s with credential=%s, filename=%s, filesize=%ld, filesignature=%s", |
78 | macaddress.c_str(), credential.c_str(), filename.c_str(), filesize, filesignature.c_str() ); | 78 | macaddress.c_str(), credential.c_str(), filename.c_str(), filesize, filesignature.c_str() ); |
79 | #endif | 79 | #endif |
80 | r.fileid = 1; r.offset = 0; | 80 | r.fileid = 1; r.offset = 0; |
81 | return SOAP_OK; | 81 | return SOAP_OK; |
82 | } | 82 | } |
83 | 83 | ||
84 | int eyefiService::MarkLastPhotoInRoll( | 84 | int eyefiService::MarkLastPhotoInRoll( |
85 | std::string macaddress, int mergedelta, | 85 | std::string macaddress, int mergedelta, |
86 | struct rns__MarkLastPhotoInRollResponse &r ) { | 86 | struct rns__MarkLastPhotoInRollResponse &r ) { |
87 | #ifndef NDEBUG | 87 | #ifndef NDEBUG |
88 | syslog(LOG_DEBUG, | 88 | syslog(LOG_DEBUG, |
89 | "MarkLastPhotoInRoll request from %s with mergedelta=%d", | 89 | "MarkLastPhotoInRoll request from %s with mergedelta=%d", |
90 | macaddress.c_str(), mergedelta ); | 90 | macaddress.c_str(), mergedelta ); |
91 | #endif | 91 | #endif |
92 | std::string cmd = eyekinfig_t(macaddress).get_on_mark_last_photo_in_roll(); | 92 | std::string cmd = eyekinfig_t(macaddress).get_on_mark_last_photo_in_roll(); |
93 | if(!cmd.empty()) { | 93 | if(!cmd.empty()) { |
94 | if(detached_child()) { | 94 | if(detached_child()) { |
95 | putenv( gnu::autosprintf("EYEFI_MACADDRESS=%s",macaddress.c_str()) ); | 95 | putenv( gnu::autosprintf("EYEFI_MACADDRESS=%s",macaddress.c_str()) ); |
96 | putenv( gnu::autosprintf("EYEFI_MERGEDELTA=%d",mergedelta) ); | 96 | putenv( gnu::autosprintf("EYEFI_MERGEDELTA=%d",mergedelta) ); |
97 | char *argv[] = { (char*)"/bin/sh", (char*)"-c", (char*)cmd.c_str(), 0 }; | 97 | char *argv[] = { (char*)"/bin/sh", (char*)"-c", (char*)cmd.c_str(), 0 }; |
98 | execv("/bin/sh",argv); | 98 | execv("/bin/sh",argv); |
99 | syslog(LOG_ERR,"Failed to execute '%s'",cmd.c_str()); | 99 | syslog(LOG_ERR,"Failed to execute '%s'",cmd.c_str()); |
100 | _exit(-1); | 100 | _exit(-1); |
101 | } | 101 | } |
102 | } | 102 | } |
103 | return SOAP_OK; | 103 | return SOAP_OK; |
104 | } | 104 | } |
105 | 105 | ||
106 | int eyefiService::UploadPhoto( | 106 | int eyefiService::UploadPhoto( |
107 | int fileid, std::string macaddress, | 107 | int fileid, std::string macaddress, |
108 | std::string filename, long filesize, std::string filesignature, | 108 | std::string filename, long filesize, std::string filesignature, |
109 | std::string encryption, int flags, | 109 | std::string encryption, int flags, |
110 | struct rns__UploadPhotoResponse& r ) { | 110 | struct rns__UploadPhotoResponse& r ) { |
111 | #ifndef NDEBUG | 111 | #ifndef NDEBUG |
112 | syslog(LOG_DEBUG, | 112 | syslog(LOG_DEBUG, |
113 | "UploadPhoto request from %s with fileid=%d, filename=%s, filesize=%ld," | 113 | "UploadPhoto request from %s with fileid=%d, filename=%s, filesize=%ld," |
114 | " filesignature=%s, encryption=%s, flags=%04X", | 114 | " filesignature=%s, encryption=%s, flags=%04X", |
115 | macaddress.c_str(), fileid, filename.c_str(), filesize, | 115 | macaddress.c_str(), fileid, filename.c_str(), filesize, |
116 | filesignature.c_str(), encryption.c_str(), flags ); | 116 | filesignature.c_str(), encryption.c_str(), flags ); |
117 | #endif | 117 | #endif |
118 | eyekinfig_t eyekinfig(macaddress); | 118 | eyekinfig_t eyekinfig(macaddress); |
119 | 119 | ||
120 | umask(eyekinfig.get_umask()); | 120 | umask(eyekinfig.get_umask()); |
121 | 121 | ||
122 | std::string td = eyekinfig.get_targetdir(); | 122 | std::string td = eyekinfig.get_targetdir(); |
123 | tmpdir_t indir(td+"/.incoming.XXXXXX"); | 123 | tmpdir_t indir(td+"/.incoming.XXXXXX"); |
124 | 124 | ||
125 | std::string jf; | ||
126 | binary_t digest, idigest; | ||
127 | |||
125 | for(soap_multipart::iterator i=mime.begin(),ie=mime.end();i!=ie;++i) { | 128 | for(soap_multipart::iterator i=mime.begin(),ie=mime.end();i!=ie;++i) { |
126 | #ifndef NDEBUG | 129 | #ifndef NDEBUG |
127 | syslog(LOG_DEBUG, | 130 | syslog(LOG_DEBUG, |
128 | " MIME attachment with id=%s, type=%s, size=%ld", | 131 | " MIME attachment with id=%s, type=%s, size=%ld", |
129 | (*i).id, (*i).type, (long)(*i).size ); | 132 | (*i).id, (*i).type, (long)(*i).size ); |
130 | #endif | 133 | #endif |
131 | 134 | ||
132 | #ifndef NDEBUG | ||
133 | if((*i).id && !strcmp((*i).id,"INTEGRITYDIGEST")) { | 135 | if((*i).id && !strcmp((*i).id,"INTEGRITYDIGEST")) { |
134 | std::string idigest((*i).ptr,(*i).size); | 136 | std::string idigestr((*i).ptr,(*i).size); |
135 | syslog(LOG_DEBUG, " INTEGRITYDIGEST=%s", idigest.c_str()); | 137 | #ifndef NDEBUG |
136 | } | 138 | syslog(LOG_DEBUG, " INTEGRITYDIGEST=%s", idigestr.c_str()); |
137 | #endif | 139 | #endif |
140 | idigest.from_hex(idigestr); | ||
141 | } | ||
138 | if( (*i).id && !strcmp((*i).id,"FILENAME") ) { | 142 | if( (*i).id && !strcmp((*i).id,"FILENAME") ) { |
139 | assert( (*i).type && !strcmp((*i).type,"application/x-tar") ); | 143 | assert( (*i).type && !strcmp((*i).type,"application/x-tar") ); |
140 | #ifdef III_SAVE_TARS | 144 | #ifdef III_SAVE_TARS |
141 | std::string tarfile = indir.get_file(filename); | 145 | std::string tarfile = indir.get_file(filename); |
142 | { | 146 | { |
143 | std::ofstream(tarfile.c_str(),std::ios::out|std::ios::binary).write((*i).ptr,(*i).size); | 147 | std::ofstream(tarfile.c_str(),std::ios::out|std::ios::binary).write((*i).ptr,(*i).size); |
144 | } | 148 | } |
145 | #endif | 149 | #endif |
150 | |||
151 | if(!jf.empty()) throw std::runtime_error("already seen tarball"); | ||
152 | if(!digest.empty()) throw std::runtime_error("already have integrity digest"); | ||
153 | digest = integrity_digest((*i).ptr,(*i).size,eyekinfig.get_upload_key()); | ||
154 | #ifndef NDEBUG | ||
155 | syslog(LOG_DEBUG," computed integrity digest=%s", digest.hex().c_str()); | ||
156 | #endif | ||
157 | |||
146 | tarchive_t a((*i).ptr,(*i).size); | 158 | tarchive_t a((*i).ptr,(*i).size); |
147 | if(!a.read_next_header()) | 159 | if(!a.read_next_header()) |
148 | throw std::runtime_error("failed to tarchive_t::read_next_header())"); | 160 | throw std::runtime_error("failed to tarchive_t::read_next_header())"); |
149 | std::string jf = indir.get_file(a.entry_pathname()); | 161 | jf = indir.get_file(a.entry_pathname()); |
150 | std::string::size_type ls = jf.rfind('/'); | ||
151 | std::string jbn = (ls==std::string::npos)?jf:jf.substr(ls+1); | ||
152 | int fd=open(jf.c_str(),O_CREAT|O_WRONLY,0666); | 162 | int fd=open(jf.c_str(),O_CREAT|O_WRONLY,0666); |
153 | assert(fd>0); | 163 | assert(fd>0); |
154 | a.read_data_into_fd(fd); | 164 | a.read_data_into_fd(fd); |
155 | close(fd); | 165 | close(fd); |
156 | std::string tf = td+'/'+jbn; | 166 | } |
157 | bool success = false; | 167 | } |
168 | |||
169 | if(jf.empty()) throw std::runtime_error("haven't seen jpeg file"); | ||
170 | if(digest!=idigest) throw std::runtime_error("integrity digest verification failed"); | ||
171 | |||
172 | std::string::size_type ls = jf.rfind('/'); | ||
173 | std::string jbn = (ls==std::string::npos)?jf:jf.substr(ls+1); | ||
174 | std::string tf = td+'/'+jbn; | ||
175 | bool success = false; | ||
176 | if(!link(jf.c_str(), tf.c_str())) { | ||
177 | unlink(jf.c_str()); success = true; | ||
178 | }else{ | ||
179 | for(int i=1;i<32767;++i) { | ||
180 | tf = (const char*)gnu::autosprintf( "%s/(%05d)%s", | ||
181 | td.c_str(), i, jbn.c_str() ); | ||
158 | if(!link(jf.c_str(), tf.c_str())) { | 182 | if(!link(jf.c_str(), tf.c_str())) { |
159 | unlink(jf.c_str()); success = true; | 183 | unlink(jf.c_str()); success = true; |
160 | }else{ | 184 | break; |
161 | for(int i=1;i<32767;++i) { | ||
162 | tf = (const char*)gnu::autosprintf( "%s/(%05d)%s", | ||
163 | td.c_str(), i, jbn.c_str() ); | ||
164 | if(!link(jf.c_str(), tf.c_str())) { | ||
165 | unlink(jf.c_str()); success = true; | ||
166 | break; | ||
167 | } | ||
168 | } | ||
169 | } | ||
170 | std::string cmd = eyekinfig.get_on_upload_photo(); | ||
171 | if(success && !cmd.empty()) { | ||
172 | if(detached_child()) { | ||
173 | putenv( gnu::autosprintf("EYEFI_MACADDRESS=%s",macaddress.c_str()) ); | ||
174 | putenv( gnu::autosprintf("EYEFI_UPLOADED=%s",tf.c_str()) ); | ||
175 | char *argv[] = { (char*)"/bin/sh", (char*)"-c", (char*)cmd.c_str(), 0 }; | ||
176 | execv("/bin/sh",argv); | ||
177 | syslog(LOG_ERR,"Failed to execute '%s'",cmd.c_str()); | ||
178 | _exit(-1); | ||
179 | } | ||
180 | } | 185 | } |
181 | } | 186 | } |
182 | } | 187 | } |
188 | std::string cmd = eyekinfig.get_on_upload_photo(); | ||
189 | if(success && !cmd.empty()) { | ||
190 | if(detached_child()) { | ||
191 | putenv( gnu::autosprintf("EYEFI_MACADDRESS=%s",macaddress.c_str()) ); | ||
192 | putenv( gnu::autosprintf("EYEFI_UPLOADED=%s",tf.c_str()) ); | ||
193 | char *argv[] = { (char*)"/bin/sh", (char*)"-c", (char*)cmd.c_str(), 0 }; | ||
194 | execv("/bin/sh",argv); | ||
195 | syslog(LOG_ERR,"Failed to execute '%s'",cmd.c_str()); | ||
196 | _exit(-1); | ||
197 | } | ||
198 | } | ||
199 | |||
183 | r.success = true; | 200 | r.success = true; |
184 | return SOAP_OK; | 201 | return SOAP_OK; |
185 | } | 202 | } |