homelab/sigtool
2
0
Fork 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions

Minor cleanups and one bugfix:

Browse source 
* bugfix: use os.IsNotExist() instead of comparing errors for equality;
  this fixes incorrect handling of missing authorized_keys file.
* move die() and warn() into die.go - and make them public functions.
* teach die.go to also provide atexit() like functionality
* teach all callers of sign.SafeFile{} to use AtExit() to delete
  temporary artifacts
* symbol renaming: die->Die, warn->Warn.
This commit is contained in:
Sudhi Herle 2022-05-12 16:53:27 -07:00
parent 42bbe5ddeb
commit 0ddf48c92f
5 changed files with 126 additions and 75 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
.gitignore vendored
View file

@ -24,12 +24,11 @@ _testmain.go
*.prof *.prof
vendor/* vendor/*
# vendor management
vendor/src/*
vendor/pkg/*
bin/* bin/*
sigtool
.??*.sw? .??*.sw?
*.pub *.pub
*.key *.key
*.sig *.sig

81
crypt.go
View file

@ -48,7 +48,7 @@ func encrypt(args []string) {
err := fs.Parse(args) err := fs.Parse(args)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
var pws, infile string var pws, infile string
@ -64,19 +64,19 @@ func encrypt(args []string) {
} else { } else {
pws, err = utils.Askpass("Enter passphrase for private key", false) pws, err = utils.Askpass("Enter passphrase for private key", false)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
} }
return []byte(pws), nil return []byte(pws), nil
}) })
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
} }
args = fs.Args() args = fs.Args()
if len(args) < 2 { if len(args) < 2 {
die("Insufficient args. Try '%s --help'", os.Args[0]) Die("Insufficient args. Try '%s --help'", os.Args[0])
} }
var infd io.Reader = os.Stdin var infd io.Reader = os.Stdin
@ -96,14 +96,14 @@ func encrypt(args []string) {
// Lets try to read the authorized files // Lets try to read the authorized files
home, err := os.UserHomeDir() home, err := os.UserHomeDir()
if err != nil { if err != nil {
die("can't find homedir for this user") Die("can't find homedir for this user")
} }
authkeys := fmt.Sprintf("%s/.ssh/authorized_keys", home) authkeys := fmt.Sprintf("%s/.ssh/authorized_keys", home)
authdata, err := ioutil.ReadFile(authkeys) authdata, err := ioutil.ReadFile(authkeys)
if err != nil { if err != nil {
if err != os.ErrNotExist { if !os.IsNotExist(err) {
die("can't open %s: %s", authkeys, err) Die("can't open %s: %s", authkeys, err)
} }
} }
@ -122,30 +122,32 @@ func encrypt(args []string) {
var ist, ost os.FileInfo var ist, ost os.FileInfo
if ost, err = os.Stat(outfile); err != nil { if ost, err = os.Stat(outfile); err != nil {
die("can't stat %s: %s", outfile, err) Die("can't stat %s: %s", outfile, err)
} }
if ist, err = inf.Stat(); err != nil { if ist, err = inf.Stat(); err != nil {
die("can't stat %s: %s", infile, err) Die("can't stat %s: %s", infile, err)
} }
if os.SameFile(ist, ost) { if os.SameFile(ist, ost) {
die("won't create output file: same as input file!") Die("won't create output file: same as input file!")
} }
mode = ist.Mode() mode = ist.Mode()
} }
sf, err := sign.NewSafeFile(outfile, force, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, mode) sf, err := sign.NewSafeFile(outfile, force, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, mode)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
AtExit(sf.Abort)
defer sf.Abort() defer sf.Abort()
outfd = sf outfd = sf
} }
en, err := sign.NewEncryptor(sk, blksize) en, err := sign.NewEncryptor(sk, blksize)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
errs := 0 errs := 0
@ -158,14 +160,14 @@ func encrypt(args []string) {
var ok bool var ok bool
pk, ok = keymap[fn] pk, ok = keymap[fn]
if !ok { if !ok {
warn("can't find user %s in %s", fn, authkeys) Warn("can't find user %s in %s", fn, authkeys)
errs += 1 errs += 1
continue continue
} }
} else { } else {
pk, err = sign.ReadPublicKey(fn) pk, err = sign.ReadPublicKey(fn)
if err != nil { if err != nil {
warn("%s", err) Warn("%s", err)
errs += 1 errs += 1
continue continue
} }
@ -173,17 +175,17 @@ func encrypt(args []string) {
err = en.AddRecipient(pk) err = en.AddRecipient(pk)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
} }
if errs > 0 { if errs > 0 {
die("Too many errors!") Die("Too many errors!")
} }
err = en.Encrypt(infd, outfd) err = en.Encrypt(infd, outfd)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
outfd.Close() outfd.Close()
} }
@ -221,12 +223,12 @@ func decrypt(args []string) {
err := fs.Parse(args) err := fs.Parse(args)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
args = fs.Args() args = fs.Args()
if len(args) < 1 { if len(args) < 1 {
die("Insufficient args. Try '%s --help'", os.Args[0]) Die("Insufficient args. Try '%s --help'", os.Args[0])
} }
var infd io.Reader = os.Stdin var infd io.Reader = os.Stdin
@ -246,13 +248,13 @@ func decrypt(args []string) {
} else { } else {
pws, err = utils.Askpass("Enter passphrase for private key", false) pws, err = utils.Askpass("Enter passphrase for private key", false)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
} }
return []byte(pws), nil return []byte(pws), nil
}) })
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
var pk *sign.PublicKey var pk *sign.PublicKey
@ -260,7 +262,7 @@ func decrypt(args []string) {
if len(pubkey) > 0 { if len(pubkey) > 0 {
pk, err = sign.ReadPublicKey(pubkey) pk, err = sign.ReadPublicKey(pubkey)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
} }
@ -284,33 +286,35 @@ func decrypt(args []string) {
var err error var err error
if ost, err = os.Stat(outfile); err != nil { if ost, err = os.Stat(outfile); err != nil {
die("can't stat %s: %s", outfile, err) Die("can't stat %s: %s", outfile, err)
} }
if ist, err = inf.Stat(); err != nil { if ist, err = inf.Stat(); err != nil {
die("can't stat %s: %s", infile, err) Die("can't stat %s: %s", infile, err)
} }
if os.SameFile(ist, ost) { if os.SameFile(ist, ost) {
die("won't create output file: same as input file!") Die("won't create output file: same as input file!")
} }
mode = ist.Mode() mode = ist.Mode()
} }
sf, err := sign.NewSafeFile(outfile, force, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, mode) sf, err := sign.NewSafeFile(outfile, force, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, mode)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
AtExit(sf.Abort)
defer sf.Abort() defer sf.Abort()
outfd = sf outfd = sf
} }
d, err := sign.NewDecryptor(infd) d, err := sign.NewDecryptor(infd)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
err = d.SetPrivateKey(sk, pk) err = d.SetPrivateKey(sk, pk)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
if pk == nil && d.AuthenticatedSender() { if pk == nil && d.AuthenticatedSender() {
@ -318,17 +322,17 @@ func decrypt(args []string) {
if len(fn) == 0 || fn == "-" { if len(fn) == 0 || fn == "-" {
fn = "<stdin>" fn = "<stdin>"
} }
warn("%s: Missing sender Public Key; can't authenticate sender ..", fn) Warn("%s: Missing sender Public Key; can't authenticate sender ..", fn)
} }
if err = d.Decrypt(outfd); err != nil { if err = d.Decrypt(outfd); err != nil {
die("%s", err) Die("%s", err)
} }
outfd.Close() outfd.Close()
if test { if test {
warn("Enc file OK") Warn("Enc file OK")
} }
} }
@ -338,9 +342,16 @@ func encryptUsage(fs *flag.FlagSet) {
Usage: %s encrypt [options] to [to ...] infile|- Usage: %s encrypt [options] to [to ...] infile|-
Where TO is the public key of the recipient and INFILE is an input file. Where TO is the public key of the recipient; it can be one of:
If the input file is '-' then %s reads from STDIN. Unless '-o' is used,
%s writes the encrypted output to STDOUT. - a file referring to an SSH or sigtool public key.
- string of the form 'a@b' - in which case the user's default
ssh/authorized_keys is consulted to find the comment matching
'a@b' - in which case the user's ssh authorized_keys file is consulted to
find the comment matching the string.
INFILE is an input file to be encrypted. If the input file is '-' then %s
reads from STDIN. Unless '-o' is used, %s writes the encrypted output to STDOUT.
Options: Options:
`, Z, Z, Z, Z) `, Z, Z, Z, Z)
@ -368,7 +379,7 @@ Options:
func mustOpen(fn string, flag int) *os.File { func mustOpen(fn string, flag int) *os.File {
fdk, err := os.OpenFile(fn, flag, 0600) fdk, err := os.OpenFile(fn, flag, 0600)
if err != nil { if err != nil {
die("can't open file %s: %s", fn, err) Die("can't open file %s: %s", fn, err)
} }
return fdk return fdk
} }

55
die.go Normal file
View file

@ -0,0 +1,55 @@
// die.go -- die() and warn()
//
// (c) 2016 Sudhi Herle <sudhi@herle.net>
//
// Licensing Terms: GPLv2
//
// If you need a commercial license for this work, please contact
// the author.
//
// This software does not come with any express or implied
// warranty; it is provided "as is". No claim is made to its
// suitability for any purpose.
package main
import (
"fmt"
"os"
)
var atExit []func()
// Die prints an error message to stderr
// and exits the program after calling all the registered
// at-exit functions.
func Die(f string, v ...interface{}) {
Warn(f, v...)
Exit(1)
}
// Warn prints an error message to stderr
func Warn(f string, v ...interface{}) {
z := fmt.Sprintf("%s: %s", os.Args[0], f)
s := fmt.Sprintf(z, v...)
if n := len(s); s[n-1] != '\n' {
s += "\n"
}
os.Stderr.WriteString(s)
os.Stderr.Sync()
}
// AtExit registers a function to be called before the program exits.
func AtExit(f func()) {
atExit = append(atExit, f)
}
// Exit invokes the registered atexit handlers and exits with the
// given code.
func Exit(v int) {
for _, f := range atExit {
f()
}
os.Exit(v)
}

60
sigtool.go
View file

@ -49,8 +49,7 @@ func main() {
args := mf.Args() args := mf.Args()
if len(args) < 1 { if len(args) < 1 {
warn("Insufficient arguments. Try '%s -h'", Z) Die("Insufficient arguments. Try '%s -h'", Z)
os.Exit(1)
} }
cmds := map[string]func(args []string){ cmds := map[string]func(args []string){
@ -73,15 +72,18 @@ func main() {
ab := utils.Abbrev(words) ab := utils.Abbrev(words)
canon, ok := ab[strings.ToLower(args[0])] canon, ok := ab[strings.ToLower(args[0])]
if !ok { if !ok {
die("Unknown command %s", args[0]) Die("Unknown command %s", args[0])
} }
cmd := cmds[canon] cmd := cmds[canon]
if cmd == nil { if cmd == nil {
die("can't map command %s", canon) Die("can't map command %s", canon)
} }
cmd(args[1:]) cmd(args[1:])
// always call Exit so that at-exit handlers are called.
Exit(0)
} }
// Run the generate command // Run the generate command
@ -115,7 +117,7 @@ Options:
args = fs.Args() args = fs.Args()
if len(args) < 1 { if len(args) < 1 {
die("Insufficient arguments to 'generate'. Try '%s generate -h' ..", Z) Die("Insufficient arguments to 'generate'. Try '%s generate -h' ..", Z)
} }
bn := args[0] bn := args[0]
@ -125,7 +127,7 @@ Options:
if !force { if !force {
if exists(pkn) || exists(skn) { if exists(pkn) || exists(skn) {
die("Public/Private key files (%s, %s) exist. won't overwrite!", skn, pkn) Die("Public/Private key files (%s, %s) exist. won't overwrite!", skn, pkn)
} }
} }
@ -139,7 +141,7 @@ Options:
} else { } else {
pws, err = utils.Askpass("Enter passphrase for private key", true) pws, err = utils.Askpass("Enter passphrase for private key", true)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
} }
@ -148,16 +150,16 @@ Options:
sk, err := sign.NewPrivateKey() sk, err := sign.NewPrivateKey()
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
if err = sk.Serialize(skn, comment, force, pw); err != nil { if err = sk.Serialize(skn, comment, force, pw); err != nil {
die("%s", err) Die("%s", err)
} }
pk := sk.PublicKey() pk := sk.PublicKey()
if err = pk.Serialize(pkn, comment, force); err != nil { if err = pk.Serialize(pkn, comment, force); err != nil {
die("%s", err) Die("%s", err)
} }
} }
@ -190,7 +192,7 @@ Options:
args = fs.Args() args = fs.Args()
if len(args) < 2 { if len(args) < 2 {
die("Insufficient arguments to 'sign'. Try '%s sign -h' ..", Z) Die("Insufficient arguments to 'sign'. Try '%s sign -h' ..", Z)
} }
kn := args[0] kn := args[0]
@ -208,10 +210,11 @@ Options:
if outf != "-" { if outf != "-" {
sf, err := sign.NewSafeFile(outf, force, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644) sf, err := sign.NewSafeFile(outf, force, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644)
if err != nil { if err != nil {
die("can't create sig file: %s", err) Die("can't create sig file: %s", err)
} }
// we unlink and remove temp on any error // we unlink and remove temp on any error
AtExit(sf.Abort)
defer sf.Abort() defer sf.Abort()
fd = sf fd = sf
} }
@ -227,19 +230,19 @@ Options:
} else { } else {
pws, err = utils.Askpass("Enter passphrase for private key", false) pws, err = utils.Askpass("Enter passphrase for private key", false)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
} }
return []byte(pws), nil return []byte(pws), nil
}) })
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
sig, err := sk.SignFile(fn) sig, err := sk.SignFile(fn)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
sigbytes, err := sig.MarshalBinary(fmt.Sprintf("input=%s", fn)) sigbytes, err := sig.MarshalBinary(fmt.Sprintf("input=%s", fn))
@ -271,7 +274,7 @@ Options:
args = fs.Args() args = fs.Args()
if len(args) < 3 { if len(args) < 3 {
die("Insufficient arguments to 'verify'. Try '%s verify -h' ..", Z) Die("Insufficient arguments to 'verify'. Try '%s verify -h' ..", Z)
} }
pn := args[0] pn := args[0]
@ -280,21 +283,21 @@ Options:
sig, err := sign.ReadSignature(sn) sig, err := sign.ReadSignature(sn)
if err != nil { if err != nil {
die("Can't read signature '%s': %s", sn, err) Die("Can't read signature '%s': %s", sn, err)
} }
pk, err := sign.ReadPublicKey(pn) pk, err := sign.ReadPublicKey(pn)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
if !sig.IsPKMatch(pk) { if !sig.IsPKMatch(pk) {
die("Wrong public key '%s' for verifying '%s'", pn, sn) Die("Wrong public key '%s' for verifying '%s'", pn, sn)
} }
ok, err := pk.VerifyFile(fn, sig) ok, err := pk.VerifyFile(fn, sig)
if err != nil { if err != nil {
die("%s", err) Die("%s", err)
} }
exit := 0 exit := 0
@ -343,23 +346,6 @@ func exists(nm string) bool {
return false return false
} }
// die with error
func die(f string, v ...interface{}) {
warn(f, v...)
os.Exit(1)
}
func warn(f string, v ...interface{}) {
z := fmt.Sprintf("%s: %s", os.Args[0], f)
s := fmt.Sprintf(z, v...)
if n := len(s); s[n-1] != '\n' {
s += "\n"
}
os.Stderr.WriteString(s)
os.Stderr.Sync()
}
// This will be filled in by "build" // This will be filled in by "build"
var RepoVersion string = "UNDEFINED" var RepoVersion string = "UNDEFINED"
var Buildtime string = "UNDEFINED" var Buildtime string = "UNDEFINED"

0
tests.sh Normal file → Executable file
View file