Verified Commit d36112a3 authored by Mattia Rizzolo's avatar Mattia Rizzolo
Browse files

Do not crash on invalid signatures



the code would crash while parsing a `gpg --check-sigs` output with
lines like:

sig:%::22:485E1BD3AE76CB72:1506259130::::[Invalid signature class] :10x::0064BBAEF91E13B2BCF21889485E1BD3AE76CB72:::8:

that, by their nature, would be first, before any uid.

This happened on process 124, causing the following crash in production:

|File "/usr/lib/python3/dist-packages/django/core/handlers/exception.py" in inner
|  42.             response = get_response(request)
|
|File "/usr/lib/python3/dist-packages/django/core/handlers/base.py" in _legacy_get_response
|  249.             response = self._get_response(request)
|
|File "/usr/lib/python3/dist-packages/django/core/handlers/base.py" in _get_response
|  217.                 response = self.process_exception_by_middleware(e, request)
|
|File "/usr/lib/python3/dist-packages/django/core/handlers/base.py" in _get_response
|  215.                 response = response.render()
|
|File "/usr/lib/python3/dist-packages/django/template/response.py" in render
|  109.             self.content = self.rendered_content
|
|File "/usr/lib/python3/dist-packages/django/template/response.py" in rendered_content
|  86.         content = template.render(context, self._request)
|
|File "/usr/lib/python3/dist-packages/django/template/backends/django.py" in render
|  66.             return self.template.render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in render
|  208.                     return self._render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in _render
|  199.         return self.nodelist.render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in render
|  994.                 bit = node.render_annotated(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in render_annotated
|  961.             return self.render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/loader_tags.py" in render
|  174.         return compiled_parent._render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in _render
|  199.         return self.nodelist.render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in render
|  994.                 bit = node.render_annotated(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in render_annotated
|  961.             return self.render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/loader_tags.py" in render
|  174.         return compiled_parent._render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in _render
|  199.         return self.nodelist.render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in render
|  994.                 bit = node.render_annotated(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in render_annotated
|  961.             return self.render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/loader_tags.py" in render
|  174.         return compiled_parent._render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in _render
|  199.         return self.nodelist.render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in render
|  994.                 bit = node.render_annotated(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in render_annotated
|  961.             return self.render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/loader_tags.py" in render
|  70.                 result = block.nodelist.render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in render
|  994.                 bit = node.render_annotated(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in render_annotated
|  961.             return self.render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/defaulttags.py" in render
|  209.                     nodelist.append(node.render_annotated(context))
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in render_annotated
|  961.             return self.render(context)
|
|File "/usr/lib/python3/dist-packages/django/template/defaulttags.py" in render
|  508.                   six.iteritems(self.extra_context)}
|
|File "/usr/lib/python3/dist-packages/django/template/defaulttags.py" in <dictcomp>
|  507.         values = {key: val.resolve(context) for key, val in
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in resolve
|  711.                 obj = self.var.resolve(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in resolve
|  852.             value = self._resolve_lookup(context)
|
|File "/usr/lib/python3/dist-packages/django/template/base.py" in _resolve_lookup
|  915.                             current = current()
|
|File "/srv/nm.debian.org/nm2/process/models.py" in compute_status
|  417.         return meth()
|
|File "/srv/nm.debian.org/nm2/process/models.py" in compute_status_keycheck
|  510.                     keycheck = key.keycheck()
|
|File "/srv/nm.debian.org/nm2/keyring/models.py" in keycheck
|  268.         keys = KeyData.read_from_gpg(self.check_sigs.splitlines())
|
|File "/srv/nm.debian.org/nm2/keyring/models.py" in read_from_gpg
|  509.                     raise Exception("gpg:{}: found sig line with no previous uid line".format(lineno))
|
|Exception Type: Exception at /process/124
|Exception Value: gpg:4: found sig line with no previous uid line

Signed-off-by: Mattia Rizzolo's avatarMattia Rizzolo <mattia@debian.org>
parent c6516688
Pipeline #17429 passed with stage
in 5 minutes and 3 seconds
......@@ -505,9 +505,13 @@ class KeyData(object):
raise Exception("gpg:{}: found uid line with no previous pub+fpr lines".format(lineno))
cur_uid = cur_key.get_uid(line.split(":"))
elif line.startswith("sig:"):
sig = line.split(":")
if sig[1] == "%":
log.debug("gpg:%s: Invalid signature: <%s>", lineno, line.strip())
continue
if cur_uid is None:
raise Exception("gpg:{}: found sig line with no previous uid line".format(lineno))
cur_uid.add_sig(line.split(":"))
cur_uid.add_sig(sig)
elif line.startswith("sub:"):
if cur_key is None:
raise Exception("gpg:{}: found sub line with no previous pub+fpr lines".format(lineno))
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment