PGPainless/pgpainless
PGPainless/pgpainless
1
0
Fork 0
mirror of https://github.com/pgpainless/pgpainless.git synced 2025-12-10 14:21:09 +01:00
Code Issues Releases Wiki Activity

Verify notBefore and notAfter on any message signatures

Browse source
This commit is contained in:
Paul Schaub 2021-08-18 12:55:24 +02:00
parent 099b160656
commit 5a9b8a2c50
Signed by: vanitasvitae
GPG key ID: 62BEE9264BF17311
5 changed files with 247 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

8
pgpainless-core/src/main/java/org/pgpainless/decryption_verification/DecryptionStream.java
View file

@ -15,6 +15,8 @@
*/
package org.pgpainless.decryption_verification;
import static org.pgpainless.signature.SignatureValidator.verifySignatureCreationTimeIsInBounds;
import java.io.IOException;
import java.io.InputStream;
import java.util.List;
@ -39,15 +41,18 @@ public class DecryptionStream extends InputStream {
private static final Logger LOGGER = Logger.getLogger(DecryptionStream.class.getName());
private final InputStream inputStream;
private final ConsumerOptions options;
private final OpenPgpMetadata.Builder resultBuilder;
private boolean isClosed = false;
private List<IntegrityProtectedInputStream> integrityProtectedInputStreamList;
private final InputStream armorStream;
DecryptionStream(@Nonnull InputStream wrapped, @Nonnull OpenPgpMetadata.Builder resultBuilder,
DecryptionStream(@Nonnull InputStream wrapped, @Nonnull ConsumerOptions options,
@Nonnull OpenPgpMetadata.Builder resultBuilder,
List<IntegrityProtectedInputStream> integrityProtectedInputStreamList,
InputStream armorStream) {
this.inputStream = wrapped;
this.options = options;
this.resultBuilder = resultBuilder;
this.integrityProtectedInputStreamList = integrityProtectedInputStreamList;
this.armorStream = armorStream;
@ -99,6 +104,7 @@ public class DecryptionStream extends InputStream {
private void maybeVerifyDetachedSignatures() {
for (DetachedSignature s : resultBuilder.getDetachedSignatures()) {
try {
verifySignatureCreationTimeIsInBounds(options.getVerifyNotBefore(), options.getVerifyNotAfter()).verify(s.getSignature());
boolean verified = SignatureChainValidator.validateSignature(s.getSignature(), (PGPPublicKeyRing) s.getSigningKeyRing(), PGPainless.getPolicy());
s.setVerified(verified);
} catch (SignatureValidationException e) {

2
pgpainless-core/src/main/java/org/pgpainless/decryption_verification/DecryptionStreamFactory.java
View file

@ -143,7 +143,7 @@ public final class DecryptionStreamFactory {
}
}
return new DecryptionStream(inputStream, factory.resultBuilder, factory.integrityProtectedStreams,
return new DecryptionStream(inputStream, options, factory.resultBuilder, factory.integrityProtectedStreams,
(decoderStream instanceof ArmoredInputStream) ? decoderStream : null);
}

31
pgpainless-core/src/main/java/org/pgpainless/decryption_verification/SignatureVerifyingInputStream.java
View file

@ -15,8 +15,6 @@
*/
package org.pgpainless.decryption_verification;
import static org.pgpainless.signature.SignatureValidator.signatureIsEffective;
import static org.pgpainless.signature.SignatureValidator.signatureStructureIsAcceptable;
import static org.pgpainless.signature.SignatureValidator.verifySignatureCreationTimeIsInBounds;
import java.io.FilterInputStream;
@ -30,7 +28,6 @@ import javax.annotation.Nonnull;
import org.bouncycastle.openpgp.PGPException;
import org.bouncycastle.openpgp.PGPObjectFactory;
import org.bouncycastle.openpgp.PGPPublicKey;
import org.bouncycastle.openpgp.PGPSignature;
import org.bouncycastle.openpgp.PGPSignatureList;
import org.pgpainless.PGPainless;
@ -38,7 +35,6 @@ import org.pgpainless.key.OpenPgpV4Fingerprint;
import org.pgpainless.policy.Policy;
import org.pgpainless.signature.OnePassSignature;
import org.pgpainless.signature.SignatureChainValidator;
import org.pgpainless.exception.SignatureValidationException;
public class SignatureVerifyingInputStream extends FilterInputStream {
@ -97,8 +93,8 @@ public class SignatureVerifyingInputStream extends FilterInputStream {
private void validateOnePassSignatures() throws IOException {
PGPSignatureList signatureList = findPgpSignatureList();
try {
for (PGPSignature signature : signatureList) {
for (PGPSignature signature : signatureList) {
try {
OpenPgpV4Fingerprint fingerprint = findFingerprintForSignature(signature);
OnePassSignature onePassSignature = findOnePassSignature(fingerprint);
if (onePassSignature == null) {
@ -107,31 +103,18 @@ public class SignatureVerifyingInputStream extends FilterInputStream {
}
verifySignatureOrThrowSignatureException(signature, onePassSignature);
} catch (PGPException | SignatureException e) {
LOGGER.log(LEVEL, "One-pass-signature verification failed for signature made by key " +
Long.toHexString(signature.getKeyID()) + ": " + e.getMessage(), e);
}
} catch (PGPException | SignatureException e) {
throw new IOException(e.getMessage(), e);
}
}
private void verifySignatureOrThrowSignatureException(PGPSignature signature, OnePassSignature onePassSignature)
throws PGPException, SignatureException {
Policy policy = PGPainless.getPolicy();
try {
PGPPublicKey signingKey = onePassSignature.getVerificationKeys().getPublicKey(signature.getKeyID());
signatureStructureIsAcceptable(signingKey, policy).verify(signature);
verifySignatureCreationTimeIsInBounds(options.getVerifyNotBefore(), options.getVerifyNotAfter()).verify(signature);
signatureIsEffective().verify(signature);
SignatureChainValidator.validateSigningKey(signature, onePassSignature.getVerificationKeys(), PGPainless.getPolicy());
} catch (SignatureValidationException e) {
throw new SignatureException("Signature key is not valid.", e);
}
if (!onePassSignature.verify(signature)) {
throw new SignatureException("Bad Signature of key " + signature.getKeyID());
} else {
LOGGER.log(LEVEL, "Verified signature of key {}", Long.toHexString(signature.getKeyID()));
}
verifySignatureCreationTimeIsInBounds(options.getVerifyNotBefore(), options.getVerifyNotAfter()).verify(signature);
SignatureChainValidator.validateOnePassSignature(signature, onePassSignature, policy);
}
private OnePassSignature findOnePassSignature(OpenPgpV4Fingerprint fingerprint) {

28
pgpainless-core/src/main/java/org/pgpainless/signature/SignatureChainValidator.java
View file

@ -15,7 +15,12 @@
*/
package org.pgpainless.signature;
import static org.pgpainless.signature.SignatureValidator.signatureIsEffective;
import static org.pgpainless.signature.SignatureValidator.signatureStructureIsAcceptable;
import static org.pgpainless.signature.SignatureValidator.verifyWasPossiblyMadeByKey;
import java.io.InputStream;
import java.security.SignatureException;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Date;
@ -28,6 +33,7 @@ import java.util.logging.Logger;
import org.bouncycastle.bcpg.sig.KeyFlags;
import org.bouncycastle.bcpg.sig.SignerUserID;
import org.bouncycastle.openpgp.PGPException;
import org.bouncycastle.openpgp.PGPPublicKey;
import org.bouncycastle.openpgp.PGPPublicKeyRing;
import org.bouncycastle.openpgp.PGPSignature;
@ -263,4 +269,26 @@ public final class SignatureChainValidator {
SignatureValidator.verifyInitializedSignature(signature, signingKey, policy, signature.getCreationTime());
return true;
}
public static boolean validateOnePassSignature(PGPSignature signature, OnePassSignature onePassSignature, Policy policy) throws PGPException, SignatureException {
PGPPublicKey signingKey = onePassSignature.getVerificationKeys().getPublicKey(signature.getKeyID());
try {
verifyWasPossiblyMadeByKey(signingKey, signature);
signatureStructureIsAcceptable(signingKey, policy).verify(signature);
signatureIsEffective().verify(signature);
} catch (SignatureValidationException e) {
throw new SignatureException("Signature is not valid: " + e.getMessage(), e);
}
try {
validateSigningKey(signature, onePassSignature.getVerificationKeys(), policy);
} catch (SignatureValidationException e) {
throw new SignatureException("Signing key " + Long.toHexString(signingKey.getKeyID()) + " is not valid: " + e.getMessage(), e);
}
if (!onePassSignature.verify(signature)) {
throw new SignatureException("Bad signature of key " + Long.toHexString(signingKey.getKeyID()));
}
return true;
}
}