GCC Code Coverage Report

Directory: cvmfs/
File: cvmfs/whitelist.cc
Date: 2025-08-31 02:39:21
Exec Total Coverage
Lines: 191 284 67.3%
Branches: 119 286 41.6%
Line Branch Exec Source
1 /**
2 * This file is part of the CernVM File System.
3 */
4
5
6 #include "whitelist.h"
7
8 #include <algorithm>
9 #include <cassert>
10 #include <cstring>
11 #include <ctime>
12
13 #include "crypto/signature.h"
14 #include "network/download.h"
15 #include "util/logging.h"
16 #include "util/smalloc.h"
17 #include "util/string.h"
18
19 using namespace std; // NOLINT
20
21 namespace whitelist {
22
23 const int Whitelist::kFlagVerifyRsa = 0x01;
24 const int Whitelist::kFlagVerifyPkcs7 = 0x02;
25 const int Whitelist::kFlagVerifyCaChain = 0x04;
26
27
28 233 void Whitelist::CopyBuffers(unsigned *plain_size, unsigned char **plain_buf,
29 unsigned *pkcs7_size,
30 unsigned char **pkcs7_buf) const {
31 233 *plain_size = plain_size_;
32 233 *pkcs7_size = pkcs7_size_;
33 233 *plain_buf = NULL;
34 233 *pkcs7_buf = NULL;
35
1/2
✓ Branch 0 taken 233 times.
✗ Branch 1 not taken.
 233 if (plain_size_ > 0) {
36 233 *plain_buf = reinterpret_cast<unsigned char *>(smalloc(plain_size_));
37 233 memcpy(*plain_buf, plain_buf_, plain_size_);
38 }
39
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 233 times.
 233 if (pkcs7_size_ > 0) {
40 ✗ *pkcs7_buf = reinterpret_cast<unsigned char *>(smalloc(pkcs7_size_));
41 ✗ memcpy(*pkcs7_buf, pkcs7_buf_, pkcs7_size_);
42 }
43 233 }
44
45
46 9 std::string Whitelist::CreateString(
47 const std::string &fqrn,
48 int validity_days,
49 shash::Algorithms hash_algorithm,
50 signature::SignatureManager *signature_manager) {
51
3/6
✓ Branch 2 taken 9 times.
✗ Branch 3 not taken.
✓ Branch 5 taken 9 times.
✗ Branch 6 not taken.
✓ Branch 8 taken 9 times.
✗ Branch 9 not taken.
 18 const std::string to_sign = WhitelistTimestamp(time(NULL)) + "\n" + "E"
52
1/2
✓ Branch 2 taken 9 times.
✗ Branch 3 not taken.
 36 + WhitelistTimestamp(time(NULL)
53
1/2
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
 9 + validity_days * 24 * 3600)
54
4/8
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
✓ Branch 4 taken 9 times.
✗ Branch 5 not taken.
✓ Branch 7 taken 9 times.
✗ Branch 8 not taken.
✓ Branch 10 taken 9 times.
✗ Branch 11 not taken.
 18 + "\n" + "N" + fqrn + "\n"
55
2/4
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
✓ Branch 4 taken 9 times.
✗ Branch 5 not taken.
 27 + signature_manager->FingerprintCertificate(
56 hash_algorithm)
57
1/2
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
 9 + "\n";
58
1/2
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
 9 shash::Any hash(hash_algorithm);
59
1/2
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
 9 shash::HashString(to_sign, &hash);
60
1/2
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
 9 std::string hash_str = hash.ToString();
61
62
1/2
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
 9 std::string whitelist(to_sign);
63
3/6
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
✓ Branch 4 taken 9 times.
✗ Branch 5 not taken.
✓ Branch 7 taken 9 times.
✗ Branch 8 not taken.
 9 whitelist += "--\n" + hash_str + "\n";
64 unsigned char *signature;
65 unsigned signature_size;
66
1/2
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
 9 const bool retval = signature_manager->SignRsa(
67 9 reinterpret_cast<const unsigned char *>(hash_str.data()),
68 9 hash_str.length(), &signature, &signature_size);
69
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 9 times.
 9 assert(retval);
70
2/4
✓ Branch 2 taken 9 times.
✗ Branch 3 not taken.
✓ Branch 5 taken 9 times.
✗ Branch 6 not taken.
 9 whitelist += std::string(reinterpret_cast<char *>(signature), signature_size);
71 9 free(signature);
72
73 18 return whitelist;
74 9 }
75
76
77 3 std::string Whitelist::ExportString() const {
78
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
 3 if (plain_buf_ == NULL)
79 ✗ return "";
80
1/2
✓ Branch 2 taken 3 times.
✗ Branch 3 not taken.
 3 return std::string(reinterpret_cast<char *>(plain_buf_), plain_size_);
81 }
82
83
84 ✗ time_t Whitelist::expires() const {
85 ✗ assert(status_ == kStAvailable);
86 ✗ return expires_;
87 }
88
89
90 ✗ bool Whitelist::IsExpired() const {
91 ✗ assert(status_ == kStAvailable);
92 ✗ return time(NULL) > expires_;
93 }
94
95
96 239 Failures Whitelist::VerifyLoadedCertificate() const {
97
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 239 times.
 239 assert(status_ == kStAvailable);
98
99
1/2
✓ Branch 1 taken 239 times.
✗ Branch 2 not taken.
 239 vector<string> blacklist = signature_manager_->GetBlacklist();
100
2/2
✓ Branch 1 taken 9 times.
✓ Branch 2 taken 233 times.
 242 for (unsigned i = 0; i < blacklist.size(); ++i) {
101
1/2
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
 9 const shash::Any this_hash = signature::SignatureManager::MkFromFingerprint(
102 9 blacklist[i]);
103
2/2
✓ Branch 1 taken 3 times.
✓ Branch 2 taken 6 times.
 9 if (this_hash.IsNull())
104 3 continue;
105
106 6 const shash::Algorithms algorithm = this_hash.algorithm;
107
2/5
✓ Branch 1 taken 6 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✓ Branch 4 taken 6 times.
✗ Branch 5 not taken.
 6 if (this_hash == signature_manager_->HashCertificate(algorithm))
108 6 return kFailBlacklisted;
109 }
110
111
1/2
✓ Branch 1 taken 233 times.
✗ Branch 2 not taken.
 233 for (unsigned i = 0; i < fingerprints_.size(); ++i) {
112 233 const shash::Algorithms algorithm = fingerprints_[i].algorithm;
113
2/5
✓ Branch 2 taken 233 times.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✓ Branch 5 taken 233 times.
✗ Branch 6 not taken.
 233 if (signature_manager_->HashCertificate(algorithm) == fingerprints_[i]) {
114
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 233 times.
 233 if (verification_flags_ & kFlagVerifyCaChain) {
115 ✗ const bool retval = signature_manager_->VerifyCaChain();
116 ✗ if (!retval)
117 ✗ return kFailBadCaChain;
118 }
119 233 return kFailOk;
120 }
121 }
122 ✗ return kFailNotListed;
123 239 }
124
125
126 /**
127 * Expects whitelist to be loaded into plain_buf_ / plain_size_ and already
128 * parsed so that verification_flags_ is set
129 */
130 245 Failures Whitelist::VerifyWhitelist() {
131 bool retval_b;
132 whitelist::Failures retval_wl;
133
134
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 245 times.
 245 assert(verification_flags_ != 0);
135
136
1/2
✓ Branch 0 taken 245 times.
✗ Branch 1 not taken.
 245 if (verification_flags_ & kFlagVerifyRsa) {
137 245 retval_b = signature_manager_->VerifyLetter(plain_buf_, plain_size_, true);
138
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 245 times.
 245 if (!retval_b) {
139 ✗ LogCvmfs(kLogCvmfs, kLogDebug, "failed to verify repository whitelist");
140 ✗ return kFailBadSignature;
141 }
142 }
143
144
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 245 times.
 245 if (verification_flags_ & kFlagVerifyPkcs7) {
145 unsigned char *extracted_whitelist;
146 unsigned extracted_whitelist_size;
147 ✗ vector<string> alt_uris;
148 ✗ retval_b = signature_manager_->VerifyPkcs7(
149 ✗ pkcs7_buf_, pkcs7_size_, &extracted_whitelist,
150 &extracted_whitelist_size, &alt_uris);
151 ✗ if (!retval_b) {
152 ✗ LogCvmfs(kLogCvmfs, kLogDebug,
153 "failed to verify repository whitelist (pkcs#7): %s",
154 ✗ signature_manager_->GetCryptoError().c_str());
155 ✗ return kFailBadPkcs7;
156 }
157
158 // Check for subject alternative name matching the repository name
159 ✗ bool found_uri = false;
160 ✗ for (unsigned i = 0; i < alt_uris.size(); ++i) {
161 ✗ LogCvmfs(kLogSignature, kLogDebug, "found pkcs#7 signer uri %s",
162 ✗ alt_uris[i].c_str());
163 ✗ if (alt_uris[i] == "cvmfs:" + fqrn_) {
164 ✗ found_uri = true;
165 ✗ break;
166 }
167 }
168 ✗ if (!found_uri) {
169 ✗ LogCvmfs(kLogCvmfs, kLogDebug,
170 "failed to find whitelist signer with SAN/URI cvmfs:%s",
171 fqrn_.c_str());
172 ✗ free(extracted_whitelist);
173 ✗ return kFailBadSignaturePkcs7;
174 }
175
176 // Check once again the extracted whitelist
177 ✗ Reset();
178 ✗ LogCvmfs(kLogCvmfs, kLogDebug, "Extracted pkcs#7 whitelist:\n%s",
179 ✗ string(reinterpret_cast<char *>(extracted_whitelist),
180 extracted_whitelist_size)
181 .c_str());
182 ✗ retval_wl = ParseWhitelist(extracted_whitelist, extracted_whitelist_size);
183 ✗ if (retval_wl != kFailOk) {
184 ✗ LogCvmfs(kLogCvmfs, kLogDebug,
185 "failed to verify repository certificate against pkcs#7 "
186 "whitelist");
187 ✗ return kFailMalformedPkcs7;
188 }
189 }
190
191 245 status_ = kStAvailable;
192 245 return kFailOk;
193 }
194
195
196 12 Failures Whitelist::LoadMem(const std::string &whitelist) {
197 Failures retval_wl;
198
199 12 Reset();
200
201 12 plain_size_ = whitelist.length();
202 12 plain_buf_ = reinterpret_cast<unsigned char *>(smalloc(plain_size_));
203 12 memcpy(plain_buf_, whitelist.data(), plain_size_);
204
205 12 retval_wl = ParseWhitelist(plain_buf_, plain_size_);
206
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 6 times.
 12 if (retval_wl != kFailOk)
207 6 return retval_wl;
208 // TODO(jblomer): PKCS7 verification unsupported when loading from memory
209
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 6 times.
 6 if (verification_flags_ & kFlagVerifyPkcs7)
210 ✗ return kFailLoadPkcs7;
211
212 6 return VerifyWhitelist();
213 }
214
215
216 239 Failures Whitelist::LoadUrl(const std::string &base_url) {
217 239 const bool probe_hosts = base_url == "";
218 download::Failures retval_dl;
219 Failures retval_wl;
220
221 239 Reset();
222
223
2/4
✓ Branch 2 taken 239 times.
✗ Branch 3 not taken.
✓ Branch 5 taken 239 times.
✗ Branch 6 not taken.
 478 const string whitelist_url = base_url + string("/.cvmfswhitelist");
224 239 cvmfs::MemSink whitelist_memsink;
225 download::JobInfo download_whitelist(&whitelist_url, false, probe_hosts, NULL,
226
1/2
✓ Branch 1 taken 239 times.
✗ Branch 2 not taken.
 239 &whitelist_memsink);
227
1/2
✓ Branch 1 taken 239 times.
✗ Branch 2 not taken.
 239 retval_dl = download_manager_->Fetch(&download_whitelist);
228
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 239 times.
 239 if (retval_dl != download::kFailOk)
229 ✗ return kFailLoad;
230 239 plain_size_ = whitelist_memsink.pos();
231
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 239 times.
 239 if (plain_size_ == 0)
232 ✗ return kFailEmpty;
233 239 whitelist_memsink.Release();
234 239 plain_buf_ = whitelist_memsink.data();
235
236
1/2
✓ Branch 1 taken 239 times.
✗ Branch 2 not taken.
 239 retval_wl = ParseWhitelist(plain_buf_, plain_size_);
237
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 239 times.
 239 if (retval_wl != kFailOk)
238 ✗ return retval_wl;
239
240
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 239 times.
 239 if (verification_flags_ & kFlagVerifyPkcs7) {
241 // Load the separate whitelist pkcs7 structure
242 const string whitelist_pkcs7_url = base_url
243 ✗ + string("cvmfswhitelist.pkcs7");
244 ✗ cvmfs::MemSink pkcs7_memsink;
245 download::JobInfo download_whitelist_pkcs7(
246 ✗ &whitelist_pkcs7_url, false, probe_hosts, NULL, &pkcs7_memsink);
247 ✗ retval_dl = download_manager_->Fetch(&download_whitelist_pkcs7);
248 ✗ if (retval_dl != download::kFailOk)
249 ✗ return kFailLoadPkcs7;
250 ✗ pkcs7_size_ = pkcs7_memsink.pos();
251 ✗ if (pkcs7_size_ == 0)
252 ✗ return kFailEmptyPkcs7;
253 ✗ pkcs7_memsink.Release();
254 ✗ pkcs7_buf_ = pkcs7_memsink.data();
255 }
256
257
1/2
✓ Branch 1 taken 239 times.
✗ Branch 2 not taken.
 239 return VerifyWhitelist();
258 239 }
259
260
261 /**
262 * Helps for the time being with whitelists valid until after Y2038 on 32 bit
263 * systems.
264 */
265 263 bool Whitelist::IsBefore(time_t now, const struct tm &t_whitelist) {
266 struct tm t_local;
267
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 263 times.
 263 if (gmtime_r(&now, &t_local) == NULL)
268 ✗ return false;
269
2/2
✓ Branch 0 taken 141 times.
✓ Branch 1 taken 122 times.
 263 if (t_local.tm_year < t_whitelist.tm_year)
270 141 return true;
271
2/2
✓ Branch 0 taken 3 times.
✓ Branch 1 taken 119 times.
 122 if (t_local.tm_year > t_whitelist.tm_year)
272 3 return false;
273
2/2
✓ Branch 0 taken 107 times.
✓ Branch 1 taken 12 times.
 119 if (t_local.tm_mon < t_whitelist.tm_mon)
274 107 return true;
275
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12 times.
 12 if (t_local.tm_mon > t_whitelist.tm_mon)
276 ✗ return false;
277
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12 times.
 12 if (t_local.tm_mday < t_whitelist.tm_mday)
278 ✗ return true;
279
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 6 times.
 12 if (t_local.tm_mday > t_whitelist.tm_mday)
280 6 return false;
281
1/2
✓ Branch 0 taken 6 times.
✗ Branch 1 not taken.
 6 if (t_local.tm_hour < t_whitelist.tm_hour)
282 6 return true;
283 ✗ return false;
284 }
285
286
287 269 Failures Whitelist::ParseWhitelist(const unsigned char *whitelist,
288 const unsigned whitelist_size) {
289 269 const time_t local_timestamp = time(NULL);
290 269 string line;
291 269 unsigned payload_bytes = 0;
292 269 bool verify_pkcs7 = false;
293 269 bool verify_cachain = false;
294
295 // Check timestamp (UTC), ignore issue date (legacy)
296
1/2
✓ Branch 1 taken 269 times.
✗ Branch 2 not taken.
 269 line = GetLineMem(reinterpret_cast<const char *>(whitelist), whitelist_size);
297
2/2
✓ Branch 1 taken 3 times.
✓ Branch 2 taken 266 times.
 269 if (line.length() != 14) {
298
1/2
✓ Branch 1 taken 3 times.
✗ Branch 2 not taken.
 3 LogCvmfs(kLogSignature, kLogDebug, "invalid timestamp format");
299 3 return kFailMalformed;
300 }
301 266 payload_bytes += 15;
302
303 // Expiry date
304 266 line = GetLineMem(reinterpret_cast<const char *>(whitelist) + payload_bytes,
305
1/2
✓ Branch 1 taken 266 times.
✗ Branch 2 not taken.
 266 whitelist_size - payload_bytes);
306
2/2
✓ Branch 1 taken 3 times.
✓ Branch 2 taken 263 times.
 266 if (line.length() != 15) {
307
1/2
✓ Branch 1 taken 3 times.
✗ Branch 2 not taken.
 3 LogCvmfs(kLogSignature, kLogDebug, "invalid timestamp format");
308 3 return kFailMalformed;
309 }
310 struct tm tm_wl;
311 263 memset(&tm_wl, 0, sizeof(struct tm));
312
2/4
✓ Branch 1 taken 263 times.
✗ Branch 2 not taken.
✓ Branch 4 taken 263 times.
✗ Branch 5 not taken.
 263 tm_wl.tm_year = String2Int64(line.substr(1, 4)) - 1900;
313
2/4
✓ Branch 1 taken 263 times.
✗ Branch 2 not taken.
✓ Branch 4 taken 263 times.
✗ Branch 5 not taken.
 263 tm_wl.tm_mon = String2Int64(line.substr(5, 2)) - 1;
314
2/4
✓ Branch 1 taken 263 times.
✗ Branch 2 not taken.
✓ Branch 4 taken 263 times.
✗ Branch 5 not taken.
 263 tm_wl.tm_mday = String2Int64(line.substr(7, 2));
315
2/4
✓ Branch 1 taken 263 times.
✗ Branch 2 not taken.
✓ Branch 4 taken 263 times.
✗ Branch 5 not taken.
 263 tm_wl.tm_hour = String2Int64(line.substr(9, 2));
316 263 tm_wl.tm_min = tm_wl.tm_sec = 0; // exact on hours level
317 263 const time_t timestamp = timegm(&tm_wl);
318
1/2
✓ Branch 2 taken 263 times.
✗ Branch 3 not taken.
 263 LogCvmfs(kLogSignature, kLogDebug,
319 "whitelist UTC expiry timestamp in localtime: %s",
320
1/2
✓ Branch 1 taken 263 times.
✗ Branch 2 not taken.
 526 StringifyTime(timestamp, false).c_str());
321
1/2
✓ Branch 2 taken 263 times.
✗ Branch 3 not taken.
 263 LogCvmfs(kLogSignature, kLogDebug, "local time: %s",
322
1/2
✓ Branch 1 taken 263 times.
✗ Branch 2 not taken.
 526 StringifyTime(local_timestamp, true).c_str());
323 // Makeshift solution to deal with whitelists valid after Y2038 on 32bit
324 // machines. Still unclear how glibc is going to treat the problem.
325
2/2
✓ Branch 1 taken 9 times.
✓ Branch 2 taken 254 times.
 263 if (!IsBefore(local_timestamp, tm_wl)) {
326
1/2
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
 9 LogCvmfs(kLogSignature, kLogDebug | kLogSyslogErr,
327 "whitelist lifetime verification failed, expired");
328 9 return kFailExpired;
329 }
330 // if (timestamp < 0) {
331 // LogCvmfs(kLogSignature, kLogDebug, "invalid timestamp");
332 // return kFailMalformed;
333 // }
334 // if (local_timestamp > timestamp) {
335 // LogCvmfs(kLogSignature, kLogDebug | kLogSyslogErr,
336 // "whitelist lifetime verification failed, expired");
337 // return kFailExpired;
338 // }
339 254 expires_ = timestamp;
340 254 payload_bytes += 16;
341
342 // Check repository name
343 254 line = GetLineMem(reinterpret_cast<const char *>(whitelist) + payload_bytes,
344
1/2
✓ Branch 1 taken 254 times.
✗ Branch 2 not taken.
 254 whitelist_size - payload_bytes);
345
7/14
✓ Branch 1 taken 254 times.
✗ Branch 2 not taken.
✓ Branch 4 taken 254 times.
✗ Branch 5 not taken.
✗ Branch 6 not taken.
✓ Branch 7 taken 6 times.
✓ Branch 8 taken 248 times.
✓ Branch 9 taken 254 times.
✗ Branch 10 not taken.
✗ Branch 11 not taken.
✓ Branch 12 taken 6 times.
✓ Branch 13 taken 248 times.
✗ Branch 14 not taken.
✗ Branch 15 not taken.
 254 if ((fqrn_ != "") && ("N" + fqrn_ != line)) {
346
1/2
✓ Branch 3 taken 6 times.
✗ Branch 4 not taken.
 6 LogCvmfs(kLogSignature, kLogDebug,
347 "repository name on the whitelist does not match "
348 "(found %s, expected %s)",
349 line.c_str(), fqrn_.c_str());
350 6 return kFailNameMismatch;
351 }
352 248 payload_bytes += line.length() + 1;
353
354 // Check for PKCS7
355 248 line = GetLineMem(reinterpret_cast<const char *>(whitelist) + payload_bytes,
356
1/2
✓ Branch 1 taken 248 times.
✗ Branch 2 not taken.
 248 whitelist_size - payload_bytes);
357
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 248 times.
 248 if (line == "Vpkcs7") {
358 ✗ LogCvmfs(kLogSignature, kLogDebug, "whitelist verification: pkcs#7");
359 ✗ verify_pkcs7 = true;
360 ✗ payload_bytes += line.length() + 1;
361 ✗ line = GetLineMem(reinterpret_cast<const char *>(whitelist) + payload_bytes,
362 ✗ whitelist_size - payload_bytes);
363 }
364
365 // Check for CA chain verification
366 248 line = GetLineMem(reinterpret_cast<const char *>(whitelist) + payload_bytes,
367
1/2
✓ Branch 1 taken 248 times.
✗ Branch 2 not taken.
 248 whitelist_size - payload_bytes);
368
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 248 times.
 248 if (line == "Wcachain") {
369 ✗ LogCvmfs(kLogSignature, kLogDebug,
370 "whitelist imposes ca chain verification of manifest signature");
371 ✗ verify_cachain = true;
372 ✗ payload_bytes += line.length() + 1;
373 ✗ line = GetLineMem(reinterpret_cast<const char *>(whitelist) + payload_bytes,
374 ✗ whitelist_size - payload_bytes);
375 }
376
377 do {
378
2/2
✓ Branch 1 taken 245 times.
✓ Branch 2 taken 248 times.
 493 if (line == "--")
379 245 break;
380
1/2
✓ Branch 1 taken 248 times.
✗ Branch 2 not taken.
 248 const shash::Any this_hash = signature::SignatureManager::MkFromFingerprint(
381 line);
382
2/2
✓ Branch 1 taken 245 times.
✓ Branch 2 taken 3 times.
 248 if (!this_hash.IsNull())
383
1/2
✓ Branch 1 taken 245 times.
✗ Branch 2 not taken.
 245 fingerprints_.push_back(this_hash);
384
385 248 payload_bytes += line.length() + 1;
386 248 line = GetLineMem(reinterpret_cast<const char *>(whitelist) + payload_bytes,
387
1/2
✓ Branch 1 taken 248 times.
✗ Branch 2 not taken.
 248 whitelist_size - payload_bytes);
388
2/2
✓ Branch 0 taken 245 times.
✓ Branch 1 taken 3 times.
 248 } while (payload_bytes < whitelist_size);
389
390
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 248 times.
 248 verification_flags_ = verify_pkcs7 ? kFlagVerifyPkcs7 : kFlagVerifyRsa;
391
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 248 times.
 248 if (verify_cachain)
392 ✗ verification_flags_ |= kFlagVerifyCaChain;
393 248 return kFailOk;
394 269 }
395
396
397 826 void Whitelist::Reset() {
398 826 status_ = kStNone;
399 826 fingerprints_.clear();
400 826 expires_ = 0;
401 826 verification_flags_ = 0;
402
2/2
✓ Branch 0 taken 251 times.
✓ Branch 1 taken 575 times.
 826 if (plain_buf_)
403 251 free(plain_buf_);
404
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 826 times.
 826 if (pkcs7_buf_)
405 ✗ free(pkcs7_buf_);
406 826 plain_buf_ = NULL;
407 826 pkcs7_buf_ = NULL;
408 826 plain_size_ = 0;
409 826 pkcs7_size_ = 0;
410 826 }
411
412
413 286 Whitelist::Whitelist(const string &fqrn,
414 download::DownloadManager *download_manager,
415 286 signature::SignatureManager *signature_manager)
416 286 : fqrn_(fqrn)
417 286 , download_manager_(download_manager)
418 286 , signature_manager_(signature_manager)
419 286 , plain_buf_(NULL)
420 286 , plain_size_(0)
421 286 , pkcs7_buf_(NULL)
422 286 , pkcs7_size_(0) {
423 286 Reset();
424 286 }
425
426
427 ✗ Whitelist::Whitelist(const Whitelist &other)
428 ✗ : fqrn_(other.fqrn_)
429 ✗ , download_manager_(other.download_manager_)
430 ✗ , signature_manager_(other.signature_manager_)
431 ✗ , status_(other.status_)
432 ✗ , fingerprints_(other.fingerprints_)
433 ✗ , expires_(other.expires_)
434 ✗ , verification_flags_(other.verification_flags_) {
435 ✗ other.CopyBuffers(&plain_size_, &plain_buf_, &pkcs7_size_, &pkcs7_buf_);
436 }
437
438
439 // Testing only
440 3 Whitelist::Whitelist()
441 3 : download_manager_(NULL)
442 3 , signature_manager_(NULL)
443 3 , status_(kStNone)
444 3 , expires_(0)
445 3 , verification_flags_(0)
446 3 , plain_buf_(NULL)
447 3 , plain_size_(0)
448 3 , pkcs7_buf_(NULL)
449 3 , pkcs7_size_(0) { }
450
451 ✗ Whitelist &Whitelist::operator=(const Whitelist &other) {
452 ✗ if (&other == this)
453 ✗ return *this;
454
455 ✗ Reset();
456 ✗ fqrn_ = other.fqrn_;
457 ✗ download_manager_ = other.download_manager_;
458 ✗ signature_manager_ = other.signature_manager_;
459 ✗ status_ = other.status_;
460 ✗ fingerprints_ = other.fingerprints_;
461 ✗ expires_ = other.expires_;
462 ✗ verification_flags_ = other.verification_flags_;
463 ✗ other.CopyBuffers(&plain_size_, &plain_buf_, &pkcs7_size_, &pkcs7_buf_);
464
465 ✗ return *this;
466 }
467
468
469 289 Whitelist::~Whitelist() { Reset(); }
470
471 } // namespace whitelist
472