// checkTrees checks that older (from olderNote) is contained in newer (from newerNote). // If an error occurs, such as malformed data or a network problem, checkTrees returns that error. // If on the other hand checkTrees finds evidence of misbehavior, it prepares a detailed // message and calls log.Fatal. func (c *Client) checkTrees(older tlog.Tree, olderNote []byte, newer tlog.Tree, newerNote []byte) error { thr := tlog.TileHashReader(newer, &c.tileReader) h, err := tlog.TreeHash(older.N, thr) if err != nil { if older.N == newer.N { return fmt.Errorf("checking tree#%d: %v", older.N, err) } return fmt.Errorf("checking tree#%d against tree#%d: %v", older.N, newer.N, err) } if h == older.Hash { return nil } // Detected a fork in the tree timeline. // Start by reporting the inconsistent signed tree notes. var buf bytes.Buffer fmt.Fprintf(&buf, "SECURITY ERROR\n") fmt.Fprintf(&buf, "go.sum database server misbehavior detected!\n\n") indent := func(b []byte) []byte { return bytes.Replace(b, []byte("\n"), []byte("\n\t"), -1) } fmt.Fprintf(&buf, "old database:\n\t%s\n", indent(olderNote)) fmt.Fprintf(&buf, "new database:\n\t%s\n", indent(newerNote)) // The notes alone are not enough to prove the inconsistency. // We also need to show that the newer note's tree hash for older.N // does not match older.Hash. The consumer of this report could // of course consult the server to try to verify the inconsistency, // but we are holding all the bits we need to prove it right now, // so we might as well print them and make the report not depend // on the continued availability of the misbehaving server. // Preparing this data only reuses the tiled hashes needed for // tlog.TreeHash(older.N, thr) above, so assuming thr is caching tiles, // there are no new access to the server here, and these operations cannot fail. fmt.Fprintf(&buf, "proof of misbehavior:\n\t%v", h) if p, err := tlog.ProveTree(newer.N, older.N, thr); err != nil { fmt.Fprintf(&buf, "\tinternal error: %v\n", err) } else if err := tlog.CheckTree(p, newer.N, newer.Hash, older.N, h); err != nil { fmt.Fprintf(&buf, "\tinternal error: generated inconsistent proof\n") } else { for _, h := range p { fmt.Fprintf(&buf, "\n\t%v", h) } } c.ops.SecurityError(buf.String()) return ErrSecurity }