mirror of
https://github.com/ethereum/go-ethereum.git
synced 2026-02-26 07:37:20 +00:00
cmd/geth: remove deprecated vulnerability check command (#33498)
This PR removes the version-check command and its associated logic as discussed in issue #31222. Removed versionCheckCommand from misccmd.go and main.go. Deleted version_check.go and its corresponding tests. Cleaned up testdata/vcheck directory (~800 lines of JSON/signatures removed). Verified build with make geth
This commit is contained in:
Rim Dinov
GitHub
parent
d9aaab13d3
commit
52ae75afcd
16 changed files with 0 additions and 815 deletions
|
|
@ -21,7 +21,6 @@ Audit reports are published in the `docs` folder: https://github.com/ethereum/go
|
|||
|
||||
To find out how to disclose a vulnerability in Ethereum visit [https://bounty.ethereum.org](https://bounty.ethereum.org) or email bounty@ethereum.org. Please read the [disclosure page](https://github.com/ethereum/go-ethereum/security/advisories?state=published) for more information about publicly disclosed security vulnerabilities.
|
||||
|
||||
Use the built-in `geth version-check` feature to check whether the software is affected by any known vulnerability. This command will fetch the latest [`vulnerabilities.json`](https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities.json) file which contains known security vulnerabilities concerning `geth`, and cross-check the data against its own version number.
|
||||
|
||||
The following key may be used to communicate sensitive information to developers.
|
||||
|
||||
|
|
|
|||
|
|
@ -241,7 +241,6 @@ func init() {
|
|||
javascriptCommand,
|
||||
// See misccmd.go:
|
||||
versionCommand,
|
||||
versionCheckCommand,
|
||||
licenseCommand,
|
||||
// See config.go
|
||||
dumpConfigCommand,
|
||||
|
|
|
|||
|
|
@ -27,16 +27,6 @@ import (
|
|||
)
|
||||
|
||||
var (
|
||||
VersionCheckUrlFlag = &cli.StringFlag{
|
||||
Name: "check.url",
|
||||
Usage: "URL to use when checking vulnerabilities",
|
||||
Value: "https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities.json",
|
||||
}
|
||||
VersionCheckVersionFlag = &cli.StringFlag{
|
||||
Name: "check.version",
|
||||
Usage: "Version to check",
|
||||
Value: version.ClientName(clientIdentifier),
|
||||
}
|
||||
versionCommand = &cli.Command{
|
||||
Action: printVersion,
|
||||
Name: "version",
|
||||
|
|
@ -44,20 +34,6 @@ var (
|
|||
ArgsUsage: " ",
|
||||
Description: `
|
||||
The output of this command is supposed to be machine-readable.
|
||||
`,
|
||||
}
|
||||
versionCheckCommand = &cli.Command{
|
||||
Action: versionCheck,
|
||||
Flags: []cli.Flag{
|
||||
VersionCheckUrlFlag,
|
||||
VersionCheckVersionFlag,
|
||||
},
|
||||
Name: "version-check",
|
||||
Usage: "Checks (online) for known Geth security vulnerabilities",
|
||||
ArgsUsage: "<versionstring (optional)>",
|
||||
Description: `
|
||||
The version-check command fetches vulnerability-information from https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities.json,
|
||||
and displays information about any security vulnerabilities that affect the currently executing version.
|
||||
`,
|
||||
}
|
||||
licenseCommand = &cli.Command{
|
||||
|
|
|
|||
202
cmd/geth/testdata/vcheck/data.json
vendored
202
cmd/geth/testdata/vcheck/data.json
vendored
|
|
@ -1,202 +0,0 @@
|
|||
[
|
||||
{
|
||||
"name": "CorruptedDAG",
|
||||
"uid": "GETH-2020-01",
|
||||
"summary": "Mining nodes will generate erroneous PoW on epochs > `385`.",
|
||||
"description": "A mining flaw could cause miners to erroneously calculate PoW, due to an index overflow, if DAG size is exceeding the maximum 32 bit unsigned value.\n\nThis occurred on the ETC chain on 2020-11-06. This is likely to trigger for ETH mainnet around block `11550000`/epoch `385`, slated to occur early January 2021.\n\nThis issue is relevant only for miners, non-mining nodes are unaffected, since non-mining nodes use a smaller verification cache instead of a full DAG.",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/pull/21793",
|
||||
"https://blog.ethereum.org/2020/11/12/geth-security-release",
|
||||
"https://github.com/ethereum/go-ethereum/commit/567d41d9363706b4b13ce0903804e8acf214af49",
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p"
|
||||
],
|
||||
"introduced": "v1.6.0",
|
||||
"fixed": "v1.9.24",
|
||||
"published": "2020-11-12",
|
||||
"severity": "Medium",
|
||||
"CVE": "CVE-2020-26240",
|
||||
"check": "Geth\\/v1\\.(6|7|8)\\..*|Geth\\/v1\\.9\\.\\d-.*|Geth\\/v1\\.9\\.1.*|Geth\\/v1\\.9\\.2(0|1|2|3)-.*"
|
||||
},
|
||||
{
|
||||
"name": "Denial of service due to Go CVE-2020-28362",
|
||||
"uid": "GETH-2020-02",
|
||||
"summary": "A denial-of-service issue can be used to crash Geth nodes during block processing, due to an underlying bug in Go (CVE-2020-28362) versions < `1.15.5`, or `<1.14.12`",
|
||||
"description": "The DoS issue can be used to crash all Geth nodes during block processing, the effects of which would be that a major part of the Ethereum network went offline.\n\nOutside of Go-Ethereum, the issue is most likely relevant for all forks of Geth (such as TurboGeth or ETC’s core-geth) which is built with versions of Go which contains the vulnerability.",
|
||||
"links": [
|
||||
"https://blog.ethereum.org/2020/11/12/geth-security-release",
|
||||
"https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM",
|
||||
"https://github.com/golang/go/issues/42552",
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6gx-rhvj-fh52"
|
||||
],
|
||||
"introduced": "v0.0.0",
|
||||
"fixed": "v1.9.24",
|
||||
"published": "2020-11-12",
|
||||
"severity": "Critical",
|
||||
"CVE": "CVE-2020-28362",
|
||||
"check": "Geth.*\\/go1\\.(11(.*)|12(.*)|13(.*)|14|14\\.(\\d|10|11|)|15|15\\.[0-4])$"
|
||||
},
|
||||
{
|
||||
"name": "ShallowCopy",
|
||||
"uid": "GETH-2020-03",
|
||||
"summary": "A consensus flaw in Geth, related to `datacopy` precompile",
|
||||
"description": "Geth erroneously performed a 'shallow' copy when the precompiled `datacopy` (at `0x00...04`) was invoked. An attacker could deploy a contract that uses the shallow copy to corrupt the contents of the `RETURNDATA`, thus causing a consensus failure.",
|
||||
"links": [
|
||||
"https://blog.ethereum.org/2020/11/12/geth-security-release",
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-69v6-xc2j-r2jf"
|
||||
],
|
||||
"introduced": "v1.9.7",
|
||||
"fixed": "v1.9.17",
|
||||
"published": "2020-11-12",
|
||||
"severity": "Critical",
|
||||
"CVE": "CVE-2020-26241",
|
||||
"check": "Geth\\/v1\\.9\\.(7|8|9|10|11|12|13|14|15|16).*$"
|
||||
},
|
||||
{
|
||||
"name": "Geth DoS via MULMOD",
|
||||
"uid": "GETH-2020-04",
|
||||
"summary": "A denial-of-service issue can be used to crash Geth nodes during block processing",
|
||||
"description": "Affected versions suffer from a vulnerability which can be exploited through the `MULMOD` operation, by specifying a modulo of `0`: `mulmod(a,b,0)`, causing a `panic` in the underlying library. \nThe crash was in the `uint256` library, where a buffer [underflowed](https://github.com/holiman/uint256/blob/4ce82e695c10ddad57215bdbeafb68b8c5df2c30/uint256.go#L442).\n\n\tif `d == 0`, `dLen` remains `0`\n\nand https://github.com/holiman/uint256/blob/4ce82e695c10ddad57215bdbeafb68b8c5df2c30/uint256.go#L451 will try to access index `[-1]`.\n\nThe `uint256` library was first merged in this [commit](https://github.com/ethereum/go-ethereum/commit/cf6674539c589f80031f3371a71c6a80addbe454), on 2020-06-08. \nExploiting this vulnerabilty would cause all vulnerable nodes to drop off the network. \n\nThe issue was brought to our attention through a [bug report](https://github.com/ethereum/go-ethereum/issues/21367), showing a `panic` occurring on sync from genesis on the Ropsten network.\n \nIt was estimated that the least obvious way to fix this would be to merge the fix into `uint256`, make a new release of that library and then update the geth-dependency.\n",
|
||||
"links": [
|
||||
"https://blog.ethereum.org/2020/11/12/geth-security-release",
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-jm5c-rv3w-w83m",
|
||||
"https://github.com/holiman/uint256/releases/tag/v1.1.1",
|
||||
"https://github.com/holiman/uint256/pull/80",
|
||||
"https://github.com/ethereum/go-ethereum/pull/21368"
|
||||
],
|
||||
"introduced": "v1.9.16",
|
||||
"fixed": "v1.9.18",
|
||||
"published": "2020-11-12",
|
||||
"severity": "Critical",
|
||||
"CVE": "CVE-2020-26242",
|
||||
"check": "Geth\\/v1\\.9.(16|17).*$"
|
||||
},
|
||||
{
|
||||
"name": "LES Server DoS via GetProofsV2",
|
||||
"uid": "GETH-2020-05",
|
||||
"summary": "A DoS vulnerability can make a LES server crash.",
|
||||
"description": "A DoS vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client.\n\nThe vulnerability was patched in #21896.\n\nThis vulnerability only concern users explicitly running geth as a light server",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-r33q-22hv-j29q",
|
||||
"https://github.com/ethereum/go-ethereum/pull/21896"
|
||||
],
|
||||
"introduced": "v1.8.0",
|
||||
"fixed": "v1.9.25",
|
||||
"published": "2020-12-10",
|
||||
"severity": "Medium",
|
||||
"CVE": "CVE-2020-26264",
|
||||
"check": "(Geth\\/v1\\.8\\.*)|(Geth\\/v1\\.9\\.\\d-.*)|(Geth\\/v1\\.9\\.1\\d-.*)|(Geth\\/v1\\.9\\.(20|21|22|23|24)-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "SELFDESTRUCT-recreate consensus flaw",
|
||||
"uid": "GETH-2020-06",
|
||||
"introduced": "v1.9.4",
|
||||
"fixed": "v1.9.20",
|
||||
"summary": "A consensus-vulnerability in Geth could cause a chain split, where vulnerable versions refuse to accept the canonical chain.",
|
||||
"description": "A flaw was repoted at 2020-08-11 by John Youngseok Yang (Software Platform Lab), where a particular sequence of transactions could cause a consensus failure.\n\n- Tx 1:\n - `sender` invokes `caller`.\n - `caller` invokes `0xaa`. `0xaa` has 3 wei, does a self-destruct-to-self\n - `caller` does a `1 wei` -call to `0xaa`, who thereby has 1 wei (the code in `0xaa` still executed, since the tx is still ongoing, but doesn't redo the selfdestruct, it takes a different path if callvalue is non-zero)\n\n-Tx 2:\n - `sender` does a 5-wei call to 0xaa. No exec (since no code). \n\nIn geth, the result would be that `0xaa` had `6 wei`, whereas OE reported (correctly) `5` wei. Furthermore, in geth, if the second tx was not executed, the `0xaa` would be destructed, resulting in `0 wei`. Thus obviously wrong. \n\nIt was determined that the root cause was this [commit](https://github.com/ethereum/go-ethereum/commit/223b950944f494a5b4e0957fd9f92c48b09037ad) from [this PR](https://github.com/ethereum/go-ethereum/pull/19953). The semantics of `createObject` was subtly changd, into returning a non-nil object (with `deleted=true`) where it previously did not if the account had been destructed. This return value caused the new object to inherit the old `balance`.\n",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-xw37-57qp-9mm4"
|
||||
],
|
||||
"published": "2020-12-10",
|
||||
"severity": "High",
|
||||
"CVE": "CVE-2020-26265",
|
||||
"check": "(Geth\\/v1\\.9\\.(4|5|6|7|8|9)-.*)|(Geth\\/v1\\.9\\.1\\d-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "Not ready for London upgrade",
|
||||
"uid": "GETH-2021-01",
|
||||
"summary": "The client is not ready for the 'London' technical upgrade, and will deviate from the canonical chain when the London upgrade occurs (at block '12965000' around August 4, 2021.",
|
||||
"description": "At (or around) August 4, Ethereum will undergo a technical upgrade called 'London'. Clients not upgraded will fail to progress on the canonical chain.",
|
||||
"links": [
|
||||
"https://github.com/ethereum/eth1.0-specs/blob/master/network-upgrades/mainnet-upgrades/london.md",
|
||||
"https://notes.ethereum.org/@timbeiko/ropsten-postmortem"
|
||||
],
|
||||
"introduced": "v1.10.1",
|
||||
"fixed": "v1.10.6",
|
||||
"published": "2021-07-22",
|
||||
"severity": "High",
|
||||
"check": "(Geth\\/v1\\.10\\.(1|2|3|4|5)-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "RETURNDATA corruption via datacopy",
|
||||
"uid": "GETH-2021-02",
|
||||
"summary": "A consensus-flaw in the Geth EVM could cause a node to deviate from the canonical chain.",
|
||||
"description": "A memory-corruption bug within the EVM can cause a consensus error, where vulnerable nodes obtain a different `stateRoot` when processing a maliciously crafted transaction. This, in turn, would lead to the chain being split: mainnet splitting in two forks.\n\nAll Geth versions supporting the London hard fork are vulnerable (the bug is older than London), so all users should update.\n\nThis bug was exploited on Mainnet at block 13107518.\n\nCredits for the discovery go to @guidovranken (working for Sentnl during an audit of the Telos EVM) and reported via bounty@ethereum.org.",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/blob/master/docs/postmortems/2021-08-22-split-postmortem.md",
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-9856-9gg9-qcmq",
|
||||
"https://github.com/ethereum/go-ethereum/releases/tag/v1.10.8"
|
||||
],
|
||||
"introduced": "v1.10.0",
|
||||
"fixed": "v1.10.8",
|
||||
"published": "2021-08-24",
|
||||
"severity": "High",
|
||||
"CVE": "CVE-2021-39137",
|
||||
"check": "(Geth\\/v1\\.10\\.(0|1|2|3|4|5|6|7)-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "DoS via malicious `snap/1` request",
|
||||
"uid": "GETH-2021-03",
|
||||
"summary": "A vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer, via the snap/1 protocol. The crash can be triggered by sending a malicious snap/1 GetTrieNodes package.",
|
||||
"description": "The `snap/1` protocol handler contains two vulnerabilities related to the `GetTrieNodes` packet, which can be exploited to crash the node. Full details are available at the Github security [advisory](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59hh-656j-3p7v)",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59hh-656j-3p7v",
|
||||
"https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities",
|
||||
"https://github.com/ethereum/go-ethereum/pull/23657"
|
||||
],
|
||||
"introduced": "v1.10.0",
|
||||
"fixed": "v1.10.9",
|
||||
"published": "2021-10-24",
|
||||
"severity": "Medium",
|
||||
"CVE": "CVE-2021-41173",
|
||||
"check": "(Geth\\/v1\\.10\\.(0|1|2|3|4|5|6|7|8)-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "DoS via malicious p2p message",
|
||||
"uid": "GETH-2022-01",
|
||||
"summary": "A vulnerable node can crash via p2p messages sent from an attacker node, if running with non-default log options.",
|
||||
"description": "A vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Full details are available at the Github security [advisory](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5)",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5",
|
||||
"https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities",
|
||||
"https://github.com/ethereum/go-ethereum/pull/24507"
|
||||
],
|
||||
"introduced": "v1.10.0",
|
||||
"fixed": "v1.10.17",
|
||||
"published": "2022-05-11",
|
||||
"severity": "Low",
|
||||
"CVE": "CVE-2022-29177",
|
||||
"check": "(Geth\\/v1\\.10\\.(0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16)-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "DoS via malicious p2p message",
|
||||
"uid": "GETH-2023-01",
|
||||
"summary": "A vulnerable node can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node.",
|
||||
"description": "The p2p handler spawned a new goroutine to respond to ping requests. By flooding a node with ping requests, an unbounded number of goroutines can be created, leading to resource exhaustion and potentially crash due to OOM.",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm",
|
||||
"https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities"
|
||||
],
|
||||
"introduced": "v1.10.0",
|
||||
"fixed": "v1.12.1",
|
||||
"published": "2023-09-06",
|
||||
"severity": "High",
|
||||
"CVE": "CVE-2023-40591",
|
||||
"check": "(Geth\\/v1\\.(10|11)\\..*)|(Geth\\/v1\\.12\\.0-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "DoS via malicious p2p message",
|
||||
"uid": "GETH-2024-01",
|
||||
"summary": "A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node.",
|
||||
"description": "A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. Full details will be available at the Github security [advisory](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-4xc9-8hmq-j652)",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-4xc9-8hmq-j652",
|
||||
"https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities"
|
||||
],
|
||||
"introduced": "v1.10.0",
|
||||
"fixed": "v1.13.15",
|
||||
"published": "2024-05-06",
|
||||
"severity": "High",
|
||||
"CVE": "CVE-2024-32972",
|
||||
"check": "(Geth\\/v1\\.(10|11|12)\\..*)|(Geth\\/v1\\.13\\.\\d-.*)|(Geth\\/v1\\.13\\.1(0|1|2|3|4)-.*)$"
|
||||
}
|
||||
]
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
untrusted comment: signature from minisign secret key
|
||||
RUQkliYstQBOKHklFEYCUjepz81dyUuDmIAxjAvXa+icjGuKcjtVfV06G7qfOMSpplS5EcntU12n+AnGNyuOM8zIctaIWcfG2w0=
|
||||
trusted comment: timestamp:1752094689 file:data.json hashed
|
||||
u2e4wo4HBTU6viQTSY/NVBHoWoPFJnnTvLZS0FYl3JdvSOYi6+qpbEsDhAIFqq/n8VmlS/fPqqf7vKCNiAgjAA==
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
untrusted comment: signature from minisign secret key
|
||||
RWQkliYstQBOKNoyq2O98hPmeVJQ6ShQLM58+4n0gkY0y0trFMDAsHuN/l4IyHfh8dDQ1ry0+IuZVrf/i8M/P3YFzFfAymDYCQ0=
|
||||
trusted comment: timestamp:1752094703 file:data.json
|
||||
cNyq3ZGlqo785HtWODb9ejWqF0HhSeXuLGXzC7z1IhnDrBObWBJngYd3qBG1dQcYlHQ+bgB/On5mSyMFn4UoCQ==
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
untrusted comment: Here's a comment
|
||||
RWQkliYstQBOKNoyq2O98hPmeVJQ6ShQLM58+4n0gkY0y0trFMDAsHuN/l4IyHfh8dDQ1ry0+IuZVrf/i8M/P3YFzFfAymDYCQ0=
|
||||
trusted comment: Here's a trusted comment
|
||||
dL7lO8sqFFCOXJO/u8SgoDk2nlXGWPRDbOTJkChMbmtUp9PB7sG831basXkZ/0CQ/l/vG7AbPyMNEVZyJn5NCg==
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
untrusted comment: One more (untrusted™) comment
|
||||
RWQkliYstQBOKNoyq2O98hPmeVJQ6ShQLM58+4n0gkY0y0trFMDAsHuN/l4IyHfh8dDQ1ry0+IuZVrf/i8M/P3YFzFfAymDYCQ0=
|
||||
trusted comment: Here's a trusted comment
|
||||
dL7lO8sqFFCOXJO/u8SgoDk2nlXGWPRDbOTJkChMbmtUp9PB7sG831basXkZ/0CQ/l/vG7AbPyMNEVZyJn5NCg==
|
||||
2
cmd/geth/testdata/vcheck/minisign.pub
vendored
2
cmd/geth/testdata/vcheck/minisign.pub
vendored
|
|
@ -1,2 +0,0 @@
|
|||
untrusted comment: minisign public key 284E00B52C269624
|
||||
RWQkliYstQBOKOdtClfgC3IypIPX6TAmoEi7beZ4gyR3wsaezvqOMWsp
|
||||
2
cmd/geth/testdata/vcheck/minisign.sec
vendored
2
cmd/geth/testdata/vcheck/minisign.sec
vendored
|
|
@ -1,2 +0,0 @@
|
|||
untrusted comment: minisign encrypted secret key
|
||||
RWRTY0Iyz8kmPMKrqk6DCtlO9a33akKiaOQG1aLolqDxs52qvPoAAAACAAAAAAAAAEAAAAAArEiggdvyn6+WzTprirLtgiYQoU+ihz/HyGgjhuF+Pz2ddMduyCO+xjCHeq+vgVVW039fbsI8hW6LRGJZLBKV5/jdxCXAVVQE7qTQ6xpEdO0z8Z731/pV1hlspQXG2PNd16NMtwd9dWw=
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
untrusted comment: verify with signifykey.pub
|
||||
RWSKLNhZb0KdARbMcGN40hbHzKQYZDgDOFhEUT1YpzMnqre/mbKJ8td/HVlG03Am1YCszATiI0DbnljjTy4iNHYwqBfzrFUqUg0=
|
||||
2
cmd/geth/testdata/vcheck/signifykey.pub
vendored
2
cmd/geth/testdata/vcheck/signifykey.pub
vendored
|
|
@ -1,2 +0,0 @@
|
|||
untrusted comment: signify public key
|
||||
RWSKLNhZb0KdATtRT7mZC/bybI3t3+Hv/O2i3ye04Dq9fnT9slpZ1a2/
|
||||
2
cmd/geth/testdata/vcheck/signifykey.sec
vendored
2
cmd/geth/testdata/vcheck/signifykey.sec
vendored
|
|
@ -1,2 +0,0 @@
|
|||
untrusted comment: signify secret key
|
||||
RWRCSwAAACpLQDLawSQCtI7eAVIvaiHzjTsTyJsfV5aKLNhZb0KdAWeICXJGa93/bHAcsY6jUh9I8RdEcDWEoGxmaXZC+IdVBPxDpkix9fBRGEUdKWHi3dOfqME0YRzErWI5AVg3cRw=
|
||||
202
cmd/geth/testdata/vcheck/vulnerabilities.json
vendored
202
cmd/geth/testdata/vcheck/vulnerabilities.json
vendored
|
|
@ -1,202 +0,0 @@
|
|||
[
|
||||
{
|
||||
"name": "CorruptedDAG",
|
||||
"uid": "GETH-2020-01",
|
||||
"summary": "Mining nodes will generate erroneous PoW on epochs > `385`.",
|
||||
"description": "A mining flaw could cause miners to erroneously calculate PoW, due to an index overflow, if DAG size is exceeding the maximum 32 bit unsigned value.\n\nThis occurred on the ETC chain on 2020-11-06. This is likely to trigger for ETH mainnet around block `11550000`/epoch `385`, slated to occur early January 2021.\n\nThis issue is relevant only for miners, non-mining nodes are unaffected, since non-mining nodes use a smaller verification cache instead of a full DAG.",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/pull/21793",
|
||||
"https://blog.ethereum.org/2020/11/12/geth-security-release",
|
||||
"https://github.com/ethereum/go-ethereum/commit/567d41d9363706b4b13ce0903804e8acf214af49",
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p"
|
||||
],
|
||||
"introduced": "v1.6.0",
|
||||
"fixed": "v1.9.24",
|
||||
"published": "2020-11-12",
|
||||
"severity": "Medium",
|
||||
"CVE": "CVE-2020-26240",
|
||||
"check": "Geth\\/v1\\.(6|7|8)\\..*|Geth\\/v1\\.9\\.\\d-.*|Geth\\/v1\\.9\\.1.*|Geth\\/v1\\.9\\.2(0|1|2|3)-.*"
|
||||
},
|
||||
{
|
||||
"name": "Denial of service due to Go CVE-2020-28362",
|
||||
"uid": "GETH-2020-02",
|
||||
"summary": "A denial-of-service issue can be used to crash Geth nodes during block processing, due to an underlying bug in Go (CVE-2020-28362) versions < `1.15.5`, or `<1.14.12`",
|
||||
"description": "The DoS issue can be used to crash all Geth nodes during block processing, the effects of which would be that a major part of the Ethereum network went offline.\n\nOutside of Go-Ethereum, the issue is most likely relevant for all forks of Geth (such as TurboGeth or ETC’s core-geth) which is built with versions of Go which contains the vulnerability.",
|
||||
"links": [
|
||||
"https://blog.ethereum.org/2020/11/12/geth-security-release",
|
||||
"https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM",
|
||||
"https://github.com/golang/go/issues/42552",
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6gx-rhvj-fh52"
|
||||
],
|
||||
"introduced": "v0.0.0",
|
||||
"fixed": "v1.9.24",
|
||||
"published": "2020-11-12",
|
||||
"severity": "Critical",
|
||||
"CVE": "CVE-2020-28362",
|
||||
"check": "Geth.*\\/go1\\.(11(.*)|12(.*)|13(.*)|14|14\\.(\\d|10|11|)|15|15\\.[0-4])$"
|
||||
},
|
||||
{
|
||||
"name": "ShallowCopy",
|
||||
"uid": "GETH-2020-03",
|
||||
"summary": "A consensus flaw in Geth, related to `datacopy` precompile",
|
||||
"description": "Geth erroneously performed a 'shallow' copy when the precompiled `datacopy` (at `0x00...04`) was invoked. An attacker could deploy a contract that uses the shallow copy to corrupt the contents of the `RETURNDATA`, thus causing a consensus failure.",
|
||||
"links": [
|
||||
"https://blog.ethereum.org/2020/11/12/geth-security-release",
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-69v6-xc2j-r2jf"
|
||||
],
|
||||
"introduced": "v1.9.7",
|
||||
"fixed": "v1.9.17",
|
||||
"published": "2020-11-12",
|
||||
"severity": "Critical",
|
||||
"CVE": "CVE-2020-26241",
|
||||
"check": "Geth\\/v1\\.9\\.(7|8|9|10|11|12|13|14|15|16).*$"
|
||||
},
|
||||
{
|
||||
"name": "Geth DoS via MULMOD",
|
||||
"uid": "GETH-2020-04",
|
||||
"summary": "A denial-of-service issue can be used to crash Geth nodes during block processing",
|
||||
"description": "Affected versions suffer from a vulnerability which can be exploited through the `MULMOD` operation, by specifying a modulo of `0`: `mulmod(a,b,0)`, causing a `panic` in the underlying library. \nThe crash was in the `uint256` library, where a buffer [underflowed](https://github.com/holiman/uint256/blob/4ce82e695c10ddad57215bdbeafb68b8c5df2c30/uint256.go#L442).\n\n\tif `d == 0`, `dLen` remains `0`\n\nand https://github.com/holiman/uint256/blob/4ce82e695c10ddad57215bdbeafb68b8c5df2c30/uint256.go#L451 will try to access index `[-1]`.\n\nThe `uint256` library was first merged in this [commit](https://github.com/ethereum/go-ethereum/commit/cf6674539c589f80031f3371a71c6a80addbe454), on 2020-06-08. \nExploiting this vulnerabilty would cause all vulnerable nodes to drop off the network. \n\nThe issue was brought to our attention through a [bug report](https://github.com/ethereum/go-ethereum/issues/21367), showing a `panic` occurring on sync from genesis on the Ropsten network.\n \nIt was estimated that the least obvious way to fix this would be to merge the fix into `uint256`, make a new release of that library and then update the geth-dependency.\n",
|
||||
"links": [
|
||||
"https://blog.ethereum.org/2020/11/12/geth-security-release",
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-jm5c-rv3w-w83m",
|
||||
"https://github.com/holiman/uint256/releases/tag/v1.1.1",
|
||||
"https://github.com/holiman/uint256/pull/80",
|
||||
"https://github.com/ethereum/go-ethereum/pull/21368"
|
||||
],
|
||||
"introduced": "v1.9.16",
|
||||
"fixed": "v1.9.18",
|
||||
"published": "2020-11-12",
|
||||
"severity": "Critical",
|
||||
"CVE": "CVE-2020-26242",
|
||||
"check": "Geth\\/v1\\.9.(16|17).*$"
|
||||
},
|
||||
{
|
||||
"name": "LES Server DoS via GetProofsV2",
|
||||
"uid": "GETH-2020-05",
|
||||
"summary": "A DoS vulnerability can make a LES server crash.",
|
||||
"description": "A DoS vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client.\n\nThe vulnerability was patched in #21896.\n\nThis vulnerability only concern users explicitly running geth as a light server",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-r33q-22hv-j29q",
|
||||
"https://github.com/ethereum/go-ethereum/pull/21896"
|
||||
],
|
||||
"introduced": "v1.8.0",
|
||||
"fixed": "v1.9.25",
|
||||
"published": "2020-12-10",
|
||||
"severity": "Medium",
|
||||
"CVE": "CVE-2020-26264",
|
||||
"check": "(Geth\\/v1\\.8\\.*)|(Geth\\/v1\\.9\\.\\d-.*)|(Geth\\/v1\\.9\\.1\\d-.*)|(Geth\\/v1\\.9\\.(20|21|22|23|24)-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "SELFDESTRUCT-recreate consensus flaw",
|
||||
"uid": "GETH-2020-06",
|
||||
"introduced": "v1.9.4",
|
||||
"fixed": "v1.9.20",
|
||||
"summary": "A consensus-vulnerability in Geth could cause a chain split, where vulnerable versions refuse to accept the canonical chain.",
|
||||
"description": "A flaw was repoted at 2020-08-11 by John Youngseok Yang (Software Platform Lab), where a particular sequence of transactions could cause a consensus failure.\n\n- Tx 1:\n - `sender` invokes `caller`.\n - `caller` invokes `0xaa`. `0xaa` has 3 wei, does a self-destruct-to-self\n - `caller` does a `1 wei` -call to `0xaa`, who thereby has 1 wei (the code in `0xaa` still executed, since the tx is still ongoing, but doesn't redo the selfdestruct, it takes a different path if callvalue is non-zero)\n\n-Tx 2:\n - `sender` does a 5-wei call to 0xaa. No exec (since no code). \n\nIn geth, the result would be that `0xaa` had `6 wei`, whereas OE reported (correctly) `5` wei. Furthermore, in geth, if the second tx was not executed, the `0xaa` would be destructed, resulting in `0 wei`. Thus obviously wrong. \n\nIt was determined that the root cause was this [commit](https://github.com/ethereum/go-ethereum/commit/223b950944f494a5b4e0957fd9f92c48b09037ad) from [this PR](https://github.com/ethereum/go-ethereum/pull/19953). The semantics of `createObject` was subtly changd, into returning a non-nil object (with `deleted=true`) where it previously did not if the account had been destructed. This return value caused the new object to inherit the old `balance`.\n",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-xw37-57qp-9mm4"
|
||||
],
|
||||
"published": "2020-12-10",
|
||||
"severity": "High",
|
||||
"CVE": "CVE-2020-26265",
|
||||
"check": "(Geth\\/v1\\.9\\.(4|5|6|7|8|9)-.*)|(Geth\\/v1\\.9\\.1\\d-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "Not ready for London upgrade",
|
||||
"uid": "GETH-2021-01",
|
||||
"summary": "The client is not ready for the 'London' technical upgrade, and will deviate from the canonical chain when the London upgrade occurs (at block '12965000' around August 4, 2021.",
|
||||
"description": "At (or around) August 4, Ethereum will undergo a technical upgrade called 'London'. Clients not upgraded will fail to progress on the canonical chain.",
|
||||
"links": [
|
||||
"https://github.com/ethereum/eth1.0-specs/blob/master/network-upgrades/mainnet-upgrades/london.md",
|
||||
"https://notes.ethereum.org/@timbeiko/ropsten-postmortem"
|
||||
],
|
||||
"introduced": "v1.10.1",
|
||||
"fixed": "v1.10.6",
|
||||
"published": "2021-07-22",
|
||||
"severity": "High",
|
||||
"check": "(Geth\\/v1\\.10\\.(1|2|3|4|5)-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "RETURNDATA corruption via datacopy",
|
||||
"uid": "GETH-2021-02",
|
||||
"summary": "A consensus-flaw in the Geth EVM could cause a node to deviate from the canonical chain.",
|
||||
"description": "A memory-corruption bug within the EVM can cause a consensus error, where vulnerable nodes obtain a different `stateRoot` when processing a maliciously crafted transaction. This, in turn, would lead to the chain being split: mainnet splitting in two forks.\n\nAll Geth versions supporting the London hard fork are vulnerable (the bug is older than London), so all users should update.\n\nThis bug was exploited on Mainnet at block 13107518.\n\nCredits for the discovery go to @guidovranken (working for Sentnl during an audit of the Telos EVM) and reported via bounty@ethereum.org.",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/blob/master/docs/postmortems/2021-08-22-split-postmortem.md",
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-9856-9gg9-qcmq",
|
||||
"https://github.com/ethereum/go-ethereum/releases/tag/v1.10.8"
|
||||
],
|
||||
"introduced": "v1.10.0",
|
||||
"fixed": "v1.10.8",
|
||||
"published": "2021-08-24",
|
||||
"severity": "High",
|
||||
"CVE": "CVE-2021-39137",
|
||||
"check": "(Geth\\/v1\\.10\\.(0|1|2|3|4|5|6|7)-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "DoS via malicious `snap/1` request",
|
||||
"uid": "GETH-2021-03",
|
||||
"summary": "A vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer, via the snap/1 protocol. The crash can be triggered by sending a malicious snap/1 GetTrieNodes package.",
|
||||
"description": "The `snap/1` protocol handler contains two vulnerabilities related to the `GetTrieNodes` packet, which can be exploited to crash the node. Full details are available at the Github security [advisory](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59hh-656j-3p7v)",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59hh-656j-3p7v",
|
||||
"https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities",
|
||||
"https://github.com/ethereum/go-ethereum/pull/23657"
|
||||
],
|
||||
"introduced": "v1.10.0",
|
||||
"fixed": "v1.10.9",
|
||||
"published": "2021-10-24",
|
||||
"severity": "Medium",
|
||||
"CVE": "CVE-2021-41173",
|
||||
"check": "(Geth\\/v1\\.10\\.(0|1|2|3|4|5|6|7|8)-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "DoS via malicious p2p message",
|
||||
"uid": "GETH-2022-01",
|
||||
"summary": "A vulnerable node can crash via p2p messages sent from an attacker node, if running with non-default log options.",
|
||||
"description": "A vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Full details are available at the Github security [advisory](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5)",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5",
|
||||
"https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities",
|
||||
"https://github.com/ethereum/go-ethereum/pull/24507"
|
||||
],
|
||||
"introduced": "v1.10.0",
|
||||
"fixed": "v1.10.17",
|
||||
"published": "2022-05-11",
|
||||
"severity": "Low",
|
||||
"CVE": "CVE-2022-29177",
|
||||
"check": "(Geth\\/v1\\.10\\.(0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16)-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "DoS via malicious p2p message",
|
||||
"uid": "GETH-2023-01",
|
||||
"summary": "A vulnerable node can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node.",
|
||||
"description": "The p2p handler spawned a new goroutine to respond to ping requests. By flooding a node with ping requests, an unbounded number of goroutines can be created, leading to resource exhaustion and potentially crash due to OOM.",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm",
|
||||
"https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities"
|
||||
],
|
||||
"introduced": "v1.10.0",
|
||||
"fixed": "v1.12.1",
|
||||
"published": "2023-09-06",
|
||||
"severity": "High",
|
||||
"CVE": "CVE-2023-40591",
|
||||
"check": "(Geth\\/v1\\.(10|11)\\..*)|(Geth\\/v1\\.12\\.0-.*)$"
|
||||
},
|
||||
{
|
||||
"name": "DoS via malicious p2p message",
|
||||
"uid": "GETH-2024-01",
|
||||
"summary": "A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node.",
|
||||
"description": "A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. Full details will be available at the Github security [advisory](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-4xc9-8hmq-j652)",
|
||||
"links": [
|
||||
"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-4xc9-8hmq-j652",
|
||||
"https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities"
|
||||
],
|
||||
"introduced": "v1.10.0",
|
||||
"fixed": "v1.13.15",
|
||||
"published": "2024-05-06",
|
||||
"severity": "High",
|
||||
"CVE": "CVE-2024-32972",
|
||||
"check": "(Geth\\/v1\\.(10|11|12)\\..*)|(Geth\\/v1\\.13\\.\\d-.*)|(Geth\\/v1\\.13\\.1(0|1|2|3|4)-.*)$"
|
||||
}
|
||||
]
|
||||
|
|
@ -1,170 +0,0 @@
|
|||
// Copyright 2020 The go-ethereum Authors
|
||||
// This file is part of go-ethereum.
|
||||
//
|
||||
// go-ethereum is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// go-ethereum is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License
|
||||
// along with go-ethereum. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"os"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/ethereum/go-ethereum/log"
|
||||
"github.com/jedisct1/go-minisign"
|
||||
"github.com/urfave/cli/v2"
|
||||
)
|
||||
|
||||
var gethPubKeys []string = []string{
|
||||
//@holiman, minisign public key FB1D084D39BAEC24
|
||||
"RWQk7Lo5TQgd+wxBNZM+Zoy+7UhhMHaWKzqoes9tvSbFLJYZhNTbrIjx",
|
||||
//minisign public key 138B1CA303E51687
|
||||
"RWSHFuUDoxyLEzjszuWZI1xStS66QTyXFFZG18uDfO26CuCsbckX1e9J",
|
||||
//minisign public key FD9813B2D2098484
|
||||
"RWSEhAnSshOY/b+GmaiDkObbCWefsAoavjoLcPjBo1xn71yuOH5I+Lts",
|
||||
}
|
||||
|
||||
type vulnJson struct {
|
||||
Name string
|
||||
Uid string
|
||||
Summary string
|
||||
Description string
|
||||
Links []string
|
||||
Introduced string
|
||||
Fixed string
|
||||
Published string
|
||||
Severity string
|
||||
Check string
|
||||
CVE string
|
||||
}
|
||||
|
||||
func versionCheck(ctx *cli.Context) error {
|
||||
url := ctx.String(VersionCheckUrlFlag.Name)
|
||||
version := ctx.String(VersionCheckVersionFlag.Name)
|
||||
log.Info("Checking vulnerabilities", "version", version, "url", url)
|
||||
return checkCurrent(url, version)
|
||||
}
|
||||
|
||||
func checkCurrent(url, current string) error {
|
||||
var (
|
||||
data []byte
|
||||
sig []byte
|
||||
err error
|
||||
)
|
||||
if data, err = fetch(url); err != nil {
|
||||
return fmt.Errorf("could not retrieve data: %w", err)
|
||||
}
|
||||
if sig, err = fetch(fmt.Sprintf("%v.minisig", url)); err != nil {
|
||||
return fmt.Errorf("could not retrieve signature: %w", err)
|
||||
}
|
||||
if err = verifySignature(gethPubKeys, data, sig); err != nil {
|
||||
return err
|
||||
}
|
||||
var vulns []vulnJson
|
||||
if err = json.Unmarshal(data, &vulns); err != nil {
|
||||
return err
|
||||
}
|
||||
allOk := true
|
||||
for _, vuln := range vulns {
|
||||
r, err := regexp.Compile(vuln.Check)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if r.MatchString(current) {
|
||||
allOk = false
|
||||
fmt.Printf("## Vulnerable to %v (%v)\n\n", vuln.Uid, vuln.Name)
|
||||
fmt.Printf("Severity: %v\n", vuln.Severity)
|
||||
fmt.Printf("Summary : %v\n", vuln.Summary)
|
||||
fmt.Printf("Fixed in: %v\n", vuln.Fixed)
|
||||
if len(vuln.CVE) > 0 {
|
||||
fmt.Printf("CVE: %v\n", vuln.CVE)
|
||||
}
|
||||
if len(vuln.Links) > 0 {
|
||||
fmt.Printf("References:\n")
|
||||
for _, ref := range vuln.Links {
|
||||
fmt.Printf("\t- %v\n", ref)
|
||||
}
|
||||
}
|
||||
fmt.Println()
|
||||
}
|
||||
}
|
||||
if allOk {
|
||||
fmt.Println("No vulnerabilities found")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// fetch makes an HTTP request to the given url and returns the response body
|
||||
func fetch(url string) ([]byte, error) {
|
||||
if filep := strings.TrimPrefix(url, "file://"); filep != url {
|
||||
return os.ReadFile(filep)
|
||||
}
|
||||
res, err := http.Get(url)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer res.Body.Close()
|
||||
body, err := io.ReadAll(res.Body)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return body, nil
|
||||
}
|
||||
|
||||
// verifySignature checks that the sigData is a valid signature of the given
|
||||
// data, for pubkey GethPubkey
|
||||
func verifySignature(pubkeys []string, data, sigdata []byte) error {
|
||||
sig, err := minisign.DecodeSignature(string(sigdata))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
// find the used key
|
||||
var key *minisign.PublicKey
|
||||
for _, pubkey := range pubkeys {
|
||||
pub, err := minisign.NewPublicKey(pubkey)
|
||||
if err != nil {
|
||||
// our pubkeys should be parseable
|
||||
return err
|
||||
}
|
||||
if pub.KeyId != sig.KeyId {
|
||||
continue
|
||||
}
|
||||
key = &pub
|
||||
break
|
||||
}
|
||||
if key == nil {
|
||||
log.Info("Signing key not trusted", "keyid", keyID(sig.KeyId), "error", err)
|
||||
return errors.New("signature could not be verified")
|
||||
}
|
||||
if ok, err := key.Verify(data, sig); !ok || err != nil {
|
||||
log.Info("Verification failed error", "keyid", keyID(key.KeyId), "error", err)
|
||||
return errors.New("signature could not be verified")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// keyID turns a binary minisign key ID into a hex string.
|
||||
// Note: key IDs are printed in reverse byte order.
|
||||
func keyID(id [8]byte) string {
|
||||
var rev [8]byte
|
||||
for i := range id {
|
||||
rev[len(rev)-1-i] = id[i]
|
||||
}
|
||||
return fmt.Sprintf("%X", rev)
|
||||
}
|
||||
|
|
@ -1,189 +0,0 @@
|
|||
// Copyright 2020 The go-ethereum Authors
|
||||
// This file is part of go-ethereum.
|
||||
//
|
||||
// go-ethereum is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// go-ethereum is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License
|
||||
// along with go-ethereum. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/jedisct1/go-minisign"
|
||||
)
|
||||
|
||||
func TestVerification(t *testing.T) {
|
||||
t.Parallel()
|
||||
// Signatures generated with `minisign`. Legacy format, not pre-hashed file.
|
||||
t.Run("minisig-legacy", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
// For this test, the pubkey is in testdata/vcheck/minisign.pub
|
||||
// (the privkey is `minisign.sec`, if we want to expand this test. Password 'test' )
|
||||
// 1. `minisign -S -l -s ./minisign.sec -m data.json -x ./minisig-sigs/vulnerabilities.json.minisig.1 -c "signature from minisign secret key"`
|
||||
// 2. `minisign -S -l -s ./minisign.sec -m vulnerabilities.json -x ./minisig-sigs/vulnerabilities.json.minisig.2 -c "Here's a comment" -t "Here's a trusted comment"`
|
||||
// 3. minisign -S -l -s ./minisign.sec -m vulnerabilities.json -x ./minisig-sigs/vulnerabilities.json.minisig.3 -c "One more (untrusted™) comment" -t "Here's a trusted comment"
|
||||
pub := "RWQkliYstQBOKOdtClfgC3IypIPX6TAmoEi7beZ4gyR3wsaezvqOMWsp"
|
||||
testVerification(t, pub, "./testdata/vcheck/minisig-sigs/")
|
||||
})
|
||||
t.Run("minisig-new", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
// For this test, the pubkey is in testdata/vcheck/minisign.pub
|
||||
// (the privkey is `minisign.sec`, if we want to expand this test. Password 'test' )
|
||||
// `minisign -S -s ./minisign.sec -m data.json -x ./minisig-sigs-new/data.json.minisig`
|
||||
pub := "RWQkliYstQBOKOdtClfgC3IypIPX6TAmoEi7beZ4gyR3wsaezvqOMWsp"
|
||||
testVerification(t, pub, "./testdata/vcheck/minisig-sigs-new/")
|
||||
})
|
||||
// Signatures generated with `signify-openbsd`
|
||||
t.Run("signify-openbsd", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
t.Skip("This currently fails, minisign expects 4 lines of data, signify provides only 2")
|
||||
// For this test, the pubkey is in testdata/vcheck/signifykey.pub
|
||||
// (the privkey is `signifykey.sec`, if we want to expand this test. Password 'test' )
|
||||
// `signify -S -s signifykey.sec -m data.json -x ./signify-sigs/data.json.sig`
|
||||
pub := "RWSKLNhZb0KdATtRT7mZC/bybI3t3+Hv/O2i3ye04Dq9fnT9slpZ1a2/"
|
||||
testVerification(t, pub, "./testdata/vcheck/signify-sigs/")
|
||||
})
|
||||
}
|
||||
|
||||
func testVerification(t *testing.T, pubkey, sigdir string) {
|
||||
// Data to verify
|
||||
data, err := os.ReadFile("./testdata/vcheck/data.json")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
// Signatures, with and without comments, both trusted and untrusted
|
||||
files, err := os.ReadDir(sigdir)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(files) == 0 {
|
||||
t.Fatal("Missing tests")
|
||||
}
|
||||
for _, f := range files {
|
||||
sig, err := os.ReadFile(filepath.Join(sigdir, f.Name()))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
err = verifySignature([]string{pubkey}, data, sig)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func versionUint(v string) int {
|
||||
mustInt := func(s string) int {
|
||||
a, err := strconv.Atoi(s)
|
||||
if err != nil {
|
||||
panic(v)
|
||||
}
|
||||
return a
|
||||
}
|
||||
components := strings.Split(strings.TrimPrefix(v, "v"), ".")
|
||||
a := mustInt(components[0])
|
||||
b := mustInt(components[1])
|
||||
c := mustInt(components[2])
|
||||
return a*100*100 + b*100 + c
|
||||
}
|
||||
|
||||
// TestMatching can be used to check that the regexps are correct
|
||||
func TestMatching(t *testing.T) {
|
||||
t.Parallel()
|
||||
data, _ := os.ReadFile("./testdata/vcheck/vulnerabilities.json")
|
||||
var vulns []vulnJson
|
||||
if err := json.Unmarshal(data, &vulns); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
check := func(version string) {
|
||||
vFull := fmt.Sprintf("Geth/%v-unstable-15339cf1-20201204/linux-amd64/go1.15.4", version)
|
||||
for _, vuln := range vulns {
|
||||
r, err := regexp.Compile(vuln.Check)
|
||||
vulnIntro := versionUint(vuln.Introduced)
|
||||
vulnFixed := versionUint(vuln.Fixed)
|
||||
current := versionUint(version)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if vuln.Name == "Denial of service due to Go CVE-2020-28362" {
|
||||
// this one is not tied to geth-versions
|
||||
continue
|
||||
}
|
||||
if vulnIntro <= current && vulnFixed > current {
|
||||
// Should be vulnerable
|
||||
if !r.MatchString(vFull) {
|
||||
t.Errorf("Should be vulnerable, version %v, intro: %v, fixed: %v %v %v",
|
||||
version, vuln.Introduced, vuln.Fixed, vuln.Name, vuln.Check)
|
||||
}
|
||||
} else {
|
||||
if r.MatchString(vFull) {
|
||||
t.Errorf("Should not be flagged vulnerable, version %v, intro: %v, fixed: %v %v %d %d %d",
|
||||
version, vuln.Introduced, vuln.Fixed, vuln.Name, vulnIntro, current, vulnFixed)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
for major := 1; major < 2; major++ {
|
||||
for minor := 0; minor < 30; minor++ {
|
||||
for patch := 0; patch < 30; patch++ {
|
||||
vShort := fmt.Sprintf("v%d.%d.%d", major, minor, patch)
|
||||
check(vShort)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestGethPubKeysParseable(t *testing.T) {
|
||||
t.Parallel()
|
||||
for _, pubkey := range gethPubKeys {
|
||||
_, err := minisign.NewPublicKey(pubkey)
|
||||
if err != nil {
|
||||
t.Errorf("Should be parseable")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestKeyID(t *testing.T) {
|
||||
t.Parallel()
|
||||
type args struct {
|
||||
id [8]byte
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
args args
|
||||
want string
|
||||
}{
|
||||
{"@holiman key", args{id: extractKeyId(gethPubKeys[0])}, "FB1D084D39BAEC24"},
|
||||
{"second key", args{id: extractKeyId(gethPubKeys[1])}, "138B1CA303E51687"},
|
||||
{"third key", args{id: extractKeyId(gethPubKeys[2])}, "FD9813B2D2098484"},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
if got := keyID(tt.args.id); got != tt.want {
|
||||
t.Errorf("keyID() = %v, want %v", got, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func extractKeyId(pubkey string) [8]byte {
|
||||
p, _ := minisign.NewPublicKey(pubkey)
|
||||
return p.KeyId
|
||||
}
|
||||
Loading…
Reference in a new issue