/* mainproc.c - handle packets
- * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
- * 2008, 2009 Free Software Foundation, Inc.
- * Copyright (C) 2013, 2014 Werner Koch
+ * Copyright (C) 1998-2009 Free Software Foundation, Inc.
+ * Copyright (C) 2013-2014 Werner Koch
+ * Copyright (C) 2020 g10 Code GmbH
*
* This file is part of GnuPG.
*
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ * along with this program; if not, see <https://www.gnu.org/licenses/>.
*/
#include <config.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
-#include <assert.h>
#include <time.h>
#include "gpg.h"
-#include "util.h"
+#include "../common/util.h"
#include "packet.h"
-#include "iobuf.h"
+#include "../common/iobuf.h"
#include "options.h"
#include "keydb.h"
#include "filter.h"
#include "main.h"
-#include "status.h"
-#include "i18n.h"
+#include "../common/status.h"
+#include "../common/i18n.h"
#include "trustdb.h"
#include "keyserver-internal.h"
#include "photoid.h"
-#include "pka.h"
-
+#include "../common/mbox-util.h"
+#include "call-dirmngr.h"
+#include "../common/compliance.h"
/* Put an upper limit on nested packets. The 32 is an arbitrary
value, a much lower should actually be sufficient. */
#define MAX_NESTING_DEPTH 32
-struct kidlist_item {
- struct kidlist_item *next;
- u32 kid[2];
- int pubkey_algo;
- int reason;
-};
-
-
-/****************
- * Structure to hold the context
+/*
+ * Object to hold the processing context.
*/
typedef struct mainproc_context *CTX;
struct mainproc_context
signature. */
struct
{
- /* A file descriptor of the the signed data. Only used if not -1. */
+ /* A file descriptor of the signed data. Only used if not -1. */
int data_fd;
/* A list of filenames with the data files or NULL. This is only
used if DATA_FD is -1. */
DEK *dek;
int last_was_session_key;
- KBNODE list; /* The current list of packets. */
- IOBUF iobuf; /* Used to get the filename etc. */
+ kbnode_t list; /* The current list of packets. */
+ iobuf_t iobuf; /* Used to get the filename etc. */
int trustletter; /* Temporary usage in list_node. */
- ulong symkeys;
- struct kidlist_item *pkenc_list; /* List of encryption packets. */
+ ulong symkeys; /* Number of symmetrically encrypted session keys. */
+ struct pubkey_enc_list *pkenc_list; /* List of encryption packets. */
+ int seen_pkt_encrypted_aead; /* PKT_ENCRYPTED_AEAD packet seen. */
struct {
unsigned int sig_seen:1; /* Set to true if a signature packet
has been seen. */
};
-static int do_proc_packets( CTX c, IOBUF a );
-static void list_node( CTX c, KBNODE node );
-static void proc_tree( CTX c, KBNODE node );
+/* Counter with the number of literal data packets seen. Note that
+ * this is also bumped at the end of an encryption. This counter is
+ * used for a basic consistency check of a received PGP message. */
static int literals_seen;
+
+/*** Local prototypes. ***/
+static int do_proc_packets (CTX c, iobuf_t a);
+static void list_node (CTX c, kbnode_t node);
+static void proc_tree (CTX c, kbnode_t node);
+
+
+/*** Functions. ***/
+
+/* Reset the literal data counter. This is required to setup a new
+ * decryption or verification context. */
void
reset_literals_seen(void)
{
- literals_seen=0;
+ literals_seen = 0;
}
+
static void
release_list( CTX c )
{
- if( !c->list )
- return;
- proc_tree(c, c->list );
- release_kbnode( c->list );
- while( c->pkenc_list ) {
- struct kidlist_item *tmp = c->pkenc_list->next;
- xfree( c->pkenc_list );
- c->pkenc_list = tmp;
- }
- c->pkenc_list = NULL;
- c->list = NULL;
- c->any.data = 0;
- c->any.uncompress_failed = 0;
- c->last_was_session_key = 0;
- xfree(c->dek); c->dek = NULL;
+ proc_tree (c, c->list);
+ release_kbnode (c->list);
+ while (c->pkenc_list)
+ {
+ struct pubkey_enc_list *tmp = c->pkenc_list->next;
+
+ mpi_release (c->pkenc_list->data[0]);
+ mpi_release (c->pkenc_list->data[1]);
+ xfree (c->pkenc_list);
+ c->pkenc_list = tmp;
+ }
+ c->pkenc_list = NULL;
+ c->list = NULL;
+ c->any.data = 0;
+ c->any.uncompress_failed = 0;
+ c->last_was_session_key = 0;
+ c->seen_pkt_encrypted_aead = 0;
+ xfree (c->dek);
+ c->dek = NULL;
}
static int
-add_onepass_sig( CTX c, PACKET *pkt )
+add_onepass_sig (CTX c, PACKET *pkt)
{
- KBNODE node;
+ kbnode_t node;
- if ( c->list ) /* add another packet */
- add_kbnode( c->list, new_kbnode( pkt ));
- else /* insert the first one */
- c->list = node = new_kbnode( pkt );
+ if (c->list) /* Add another packet. */
+ add_kbnode (c->list, new_kbnode (pkt));
+ else /* Insert the first one. */
+ c->list = node = new_kbnode (pkt);
return 1;
}
static int
-add_gpg_control( CTX c, PACKET *pkt )
+add_gpg_control (CTX c, PACKET *pkt)
{
- if ( pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START ) {
- /* New clear text signature.
- * Process the last one and reset everything */
- release_list(c);
+ if ( pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START )
+ {
+ /* New clear text signature.
+ * Process the last one and reset everything */
+ release_list(c);
}
- if( c->list ) /* add another packet */
- add_kbnode( c->list, new_kbnode( pkt ));
- else /* insert the first one */
- c->list = new_kbnode( pkt );
+ if (c->list) /* Add another packet. */
+ add_kbnode (c->list, new_kbnode (pkt));
+ else /* Insert the first one. */
+ c->list = new_kbnode (pkt);
- return 1;
+ return 1;
}
-
static int
-add_user_id( CTX c, PACKET *pkt )
+add_user_id (CTX c, PACKET *pkt)
{
- if( !c->list ) {
- log_error("orphaned user ID\n" );
- return 0;
+ if (!c->list)
+ {
+ log_error ("orphaned user ID\n");
+ return 0;
}
- add_kbnode( c->list, new_kbnode( pkt ) );
- return 1;
+ add_kbnode (c->list, new_kbnode (pkt));
+ return 1;
}
+
static int
-add_subkey( CTX c, PACKET *pkt )
+add_subkey (CTX c, PACKET *pkt)
{
- if( !c->list ) {
- log_error("subkey w/o mainkey\n" );
- return 0;
+ if (!c->list)
+ {
+ log_error ("subkey w/o mainkey\n");
+ return 0;
}
- add_kbnode( c->list, new_kbnode( pkt ) );
- return 1;
+ add_kbnode (c->list, new_kbnode (pkt));
+ return 1;
}
+
static int
-add_ring_trust( CTX c, PACKET *pkt )
+add_ring_trust (CTX c, PACKET *pkt)
{
- if( !c->list ) {
- log_error("ring trust w/o key\n" );
- return 0;
+ if (!c->list)
+ {
+ log_error ("ring trust w/o key\n");
+ return 0;
}
- add_kbnode( c->list, new_kbnode( pkt ) );
- return 1;
+ add_kbnode (c->list, new_kbnode (pkt));
+ return 1;
}
static int
-add_signature( CTX c, PACKET *pkt )
+add_signature (CTX c, PACKET *pkt)
{
- KBNODE node;
-
- c->any.sig_seen = 1;
- if( pkt->pkttype == PKT_SIGNATURE && !c->list ) {
- /* This is the first signature for the following datafile.
- * GPG does not write such packets; instead it always uses
- * onepass-sig packets. The drawback of PGP's method
- * of prepending the signature to the data is
- * that it is not possible to make a signature from data read
- * from stdin. (GPG is able to read PGP stuff anyway.) */
- node = new_kbnode( pkt );
- c->list = node;
- return 1;
+ kbnode_t node;
+
+ c->any.sig_seen = 1;
+ if (pkt->pkttype == PKT_SIGNATURE && !c->list)
+ {
+ /* This is the first signature for the following datafile.
+ * GPG does not write such packets; instead it always uses
+ * onepass-sig packets. The drawback of PGP's method
+ * of prepending the signature to the data is
+ * that it is not possible to make a signature from data read
+ * from stdin. (GPG is able to read PGP stuff anyway.) */
+ node = new_kbnode (pkt);
+ c->list = node;
+ return 1;
}
- else if( !c->list )
- return 0; /* oops (invalid packet sequence)*/
- else if( !c->list->pkt )
- BUG(); /* so nicht */
+ else if (!c->list)
+ return 0; /* oops (invalid packet sequence)*/
+ else if (!c->list->pkt)
+ BUG(); /* so nicht */
- /* add a new signature node id at the end */
- node = new_kbnode( pkt );
- add_kbnode( c->list, node );
- return 1;
+ /* Add a new signature node item at the end. */
+ node = new_kbnode (pkt);
+ add_kbnode (c->list, node);
+
+ return 1;
}
-static int
-symkey_decrypt_seskey( DEK *dek, byte *seskey, size_t slen )
+static gpg_error_t
+symkey_decrypt_seskey (DEK *dek, byte *seskey, size_t slen)
{
+ gpg_error_t err;
gcry_cipher_hd_t hd;
+ unsigned int noncelen, keylen;
+ enum gcry_cipher_modes ciphermode;
+
+ if (dek->use_aead)
+ {
+ err = openpgp_aead_algo_info (dek->use_aead, &ciphermode, &noncelen);
+ if (err)
+ return err;
+ }
+ else
+ {
+ ciphermode = GCRY_CIPHER_MODE_CFB;
+ noncelen = 0;
+ }
- if(slen < 17 || slen > 33)
+ /* Check that the session key has a size of 16 to 32 bytes. */
+ if ((dek->use_aead && (slen < (noncelen + 16 + 16)
+ || slen > (noncelen + 32 + 16)))
+ || (!dek->use_aead && (slen < 17 || slen > 33)))
{
log_error ( _("weird size for an encrypted session key (%d)\n"),
(int)slen);
- return G10ERR_BAD_KEY;
+ return gpg_error (GPG_ERR_BAD_KEY);
}
- if (openpgp_cipher_open (&hd, dek->algo, GCRY_CIPHER_MODE_CFB, 1))
- BUG ();
- if (gcry_cipher_setkey ( hd, dek->key, dek->keylen ))
- BUG ();
- gcry_cipher_setiv ( hd, NULL, 0 );
- gcry_cipher_decrypt ( hd, seskey, slen, NULL, 0 );
- gcry_cipher_close ( hd );
-
- /* Now we replace the dek components with the real session key to
- decrypt the contents of the sequencing packet. */
-
- dek->keylen=slen-1;
- dek->algo=seskey[0];
+ err = openpgp_cipher_open (&hd, dek->algo, ciphermode, GCRY_CIPHER_SECURE);
+ if (!err)
+ err = gcry_cipher_setkey (hd, dek->key, dek->keylen);
+ if (!err)
+ err = gcry_cipher_setiv (hd, noncelen? seskey : NULL, noncelen);
+ if (err)
+ goto leave;
- if(dek->keylen > DIM(dek->key))
- BUG ();
+ if (dek->use_aead)
+ {
+ byte ad[4];
+
+ ad[0] = (0xc0 | PKT_SYMKEY_ENC);
+ ad[1] = 5;
+ ad[2] = dek->algo;
+ ad[3] = dek->use_aead;
+ err = gcry_cipher_authenticate (hd, ad, 4);
+ if (err)
+ goto leave;
+ gcry_cipher_final (hd);
+ keylen = slen - noncelen - 16;
+ err = gcry_cipher_decrypt (hd, seskey+noncelen, keylen, NULL, 0);
+ if (err)
+ goto leave;
+ err = gcry_cipher_checktag (hd, seskey+noncelen+keylen, 16);
+ if (err)
+ goto leave;
+ /* Now we replace the dek components with the real session key to
+ * decrypt the contents of the sequencing packet. */
+ if (keylen > DIM(dek->key))
+ {
+ err = gpg_error (GPG_ERR_TOO_LARGE);
+ goto leave;
+ }
+ dek->keylen = keylen;
+ memcpy (dek->key, seskey + noncelen, dek->keylen);
+ }
+ else
+ {
+ gcry_cipher_decrypt (hd, seskey, slen, NULL, 0 );
+ /* Here we can only test whether the algo given in decrypted
+ * session key is a valid OpenPGP algo. With 11 defined
+ * symmetric algorithms we will miss 4.3% of wrong passphrases
+ * here. The actual checking is done later during bulk
+ * decryption; we can't bring this check forward easily. We
+ * need to use the GPG_ERR_CHECKSUM so that we won't run into
+ * the gnupg < 2.2 bug compatible case which would terminate the
+ * process on GPG_ERR_CIPHER_ALGO. Note that with AEAD (above)
+ * we will have a reliable test here. */
+ if (openpgp_cipher_test_algo (seskey[0])
+ || openpgp_cipher_get_algo_keylen (seskey[0]) != slen - 1)
+ {
+ err = gpg_error (GPG_ERR_CHECKSUM);
+ goto leave;
+ }
- memcpy(dek->key, seskey + 1, dek->keylen);
+ /* Now we replace the dek components with the real session key to
+ * decrypt the contents of the sequencing packet. */
+ keylen = slen-1;
+ if (keylen > DIM(dek->key))
+ {
+ err = gpg_error (GPG_ERR_TOO_LARGE);
+ goto leave;
+ }
+ dek->algo = seskey[0];
+ dek->keylen = keylen;
+ memcpy (dek->key, seskey + 1, dek->keylen);
+ }
/*log_hexdump( "thekey", dek->key, dek->keylen );*/
- return 0;
+ leave:
+ gcry_cipher_close (hd);
+ return err;
}
+
static void
-proc_symkey_enc( CTX c, PACKET *pkt )
+proc_symkey_enc (CTX c, PACKET *pkt)
{
- PKT_symkey_enc *enc;
+ gpg_error_t err;
+ PKT_symkey_enc *enc;
- enc = pkt->pkt.symkey_enc;
- if (!enc)
- log_error ("invalid symkey encrypted packet\n");
- else if(!c->dek)
- {
- int algo = enc->cipher_algo;
- const char *s = openpgp_cipher_algo_name (algo);
-
- if (!openpgp_cipher_test_algo (algo))
- {
- if(!opt.quiet)
- {
- if(enc->seskeylen)
- log_info(_("%s encrypted session key\n"), s );
- else
- log_info(_("%s encrypted data\n"), s );
- }
- }
- else
- log_error(_("encrypted with unknown algorithm %d\n"), algo );
-
- if(openpgp_md_test_algo (enc->s2k.hash_algo))
- {
- log_error(_("passphrase generated with unknown digest"
- " algorithm %d\n"),enc->s2k.hash_algo);
- s=NULL;
- }
-
- c->last_was_session_key = 2;
- if(!s || opt.list_only)
- goto leave;
-
- if(opt.override_session_key)
- {
- c->dek = xmalloc_clear( sizeof *c->dek );
- if(get_override_session_key(c->dek, opt.override_session_key))
- {
- xfree(c->dek);
- c->dek = NULL;
- }
- }
- else
- {
- c->dek = passphrase_to_dek (NULL, 0, algo, &enc->s2k, 3,
- NULL, NULL);
- if(c->dek)
- {
- c->dek->symmetric=1;
-
- /* FIXME: This doesn't work perfectly if a symmetric
- key comes before a public key in the message - if
- the user doesn't know the passphrase, then there is
- a chance that the "decrypted" algorithm will happen
- to be a valid one, which will make the returned dek
- appear valid, so we won't try any public keys that
- come later. */
- if(enc->seskeylen)
- {
- if(symkey_decrypt_seskey(c->dek, enc->seskey,
- enc->seskeylen))
- {
- xfree(c->dek);
- c->dek=NULL;
- }
- }
- else
- c->dek->algo_info_printed = 1;
- }
- }
- }
+ enc = pkt->pkt.symkey_enc;
+ if (!enc)
+ log_error ("invalid symkey encrypted packet\n");
+ else if(!c->dek)
+ {
+ int algo = enc->cipher_algo;
+ const char *s = openpgp_cipher_algo_name (algo);
+ const char *a = (enc->aead_algo ? openpgp_aead_algo_name (enc->aead_algo)
+ /**/ : "CFB");
+
+ if (!openpgp_cipher_test_algo (algo))
+ {
+ if (!opt.quiet)
+ {
+ if (enc->seskeylen)
+ log_info (_("%s.%s encrypted session key\n"), s, a );
+ else
+ log_info (_("%s.%s encrypted data\n"), s, a );
+ }
+ }
+ else
+ {
+ log_error (_("encrypted with unknown algorithm %d.%s\n"), algo, a);
+ s = NULL; /* Force a goto leave. */
+ }
+
+ if (openpgp_md_test_algo (enc->s2k.hash_algo))
+ {
+ log_error(_("passphrase generated with unknown digest"
+ " algorithm %d\n"),enc->s2k.hash_algo);
+ s = NULL;
+ }
+
+ c->last_was_session_key = 2;
+ if (!s || opt.list_only)
+ goto leave;
+
+ if (opt.override_session_key)
+ {
+ c->dek = xmalloc_clear (sizeof *c->dek);
+ if (get_override_session_key (c->dek, opt.override_session_key))
+ {
+ xfree (c->dek);
+ c->dek = NULL;
+ }
+ }
+ else
+ {
+ c->dek = passphrase_to_dek (algo, &enc->s2k, 0, 0, NULL, NULL);
+ if (c->dek)
+ {
+ c->dek->symmetric = 1;
+ c->dek->use_aead = enc->aead_algo;
+
+ /* FIXME: This doesn't work perfectly if a symmetric key
+ comes before a public key in the message - if the
+ user doesn't know the passphrase, then there is a
+ chance that the "decrypted" algorithm will happen to
+ be a valid one, which will make the returned dek
+ appear valid, so we won't try any public keys that
+ come later. */
+ if (enc->seskeylen)
+ {
+ err = symkey_decrypt_seskey (c->dek,
+ enc->seskey, enc->seskeylen);
+ if (err)
+ {
+ log_info ("decryption of the symmetrically encrypted"
+ " session key failed: %s\n",
+ gpg_strerror (err));
+ if (gpg_err_code (err) != GPG_ERR_BAD_KEY
+ && gpg_err_code (err) != GPG_ERR_CHECKSUM)
+ log_fatal ("process terminated to be bug compatible"
+ " with GnuPG <= 2.2\n");
+ if (c->dek->s2k_cacheid[0])
+ {
+ if (opt.debug)
+ log_debug ("cleared passphrase cached with ID:"
+ " %s\n", c->dek->s2k_cacheid);
+ passphrase_clear_cache (c->dek->s2k_cacheid);
+ }
+ xfree (c->dek);
+ c->dek = NULL;
+ }
+ }
+ else
+ c->dek->algo_info_printed = 1;
+ }
+ }
+ }
leave:
- c->symkeys++;
- free_packet(pkt);
+ c->symkeys++;
+ free_packet (pkt, NULL);
}
+
static void
-proc_pubkey_enc( CTX c, PACKET *pkt )
+proc_pubkey_enc (CTX c, PACKET *pkt)
{
- PKT_pubkey_enc *enc;
- int result = 0;
-
- /* check whether the secret key is available and store in this case */
- c->last_was_session_key = 1;
- enc = pkt->pkt.pubkey_enc;
- /*printf("enc: encrypted by a pubkey with keyid %08lX\n", enc->keyid[1] );*/
- /* Hmmm: why do I have this algo check here - anyway there is
- * function to check it. */
- if( opt.verbose )
- log_info(_("public key is %s\n"), keystr(enc->keyid) );
-
- if( is_status_enabled() ) {
- char buf[50];
- /* FIXME: For ECC support we need to map the OpenPGP algo
- number to the Libgcrypt definef one. This is due a
- chicken-egg problem: We need to have code in libgcrypt for
- a new algorithm so to implement a proposed new algorithm
- before the IANA will finally assign an OpenPGP
- indentifier. */
- snprintf (buf, sizeof buf, "%08lX%08lX %d 0",
- (ulong)enc->keyid[0], (ulong)enc->keyid[1], enc->pubkey_algo );
- write_status_text( STATUS_ENC_TO, buf );
- }
-
- if( !opt.list_only && opt.override_session_key ) {
- /* It does not make much sense to store the session key in
- * secure memory because it has already been passed on the
- * command line and the GCHQ knows about it. */
- c->dek = xmalloc_clear( sizeof *c->dek );
- result = get_override_session_key ( c->dek, opt.override_session_key );
- if ( result ) {
- xfree(c->dek); c->dek = NULL;
- }
- }
- else if( is_ELGAMAL(enc->pubkey_algo)
- || enc->pubkey_algo == PUBKEY_ALGO_DSA
- || enc->pubkey_algo == PUBKEY_ALGO_ECDSA
- || enc->pubkey_algo == PUBKEY_ALGO_EDDSA
- || enc->pubkey_algo == PUBKEY_ALGO_ECDH
- || is_RSA(enc->pubkey_algo)
- || enc->pubkey_algo == PUBKEY_ALGO_ELGAMAL) {
- /* Note that we also allow type 20 Elgamal keys for decryption.
- There are still a couple of those keys in active use as a
- subkey. */
-
- /* FIXME: Store this all in a list and process it later so that
- we can prioritize what key to use. This gives a better user
- experience if wildcard keyids are used. */
- if ( !c->dek && ((!enc->keyid[0] && !enc->keyid[1])
- || opt.try_all_secrets
- || have_secret_key_with_kid (enc->keyid)) ) {
- if( opt.list_only )
- result = -1;
- else {
- c->dek = xmalloc_secure_clear( sizeof *c->dek );
- if( (result = get_session_key( enc, c->dek )) ) {
- /* error: delete the DEK */
- xfree(c->dek); c->dek = NULL;
- }
- }
- }
- else
- result = G10ERR_NO_SECKEY;
+ PKT_pubkey_enc *enc;
+
+ /* Check whether the secret key is available and store in this case. */
+ c->last_was_session_key = 1;
+ enc = pkt->pkt.pubkey_enc;
+ /*printf("enc: encrypted by a pubkey with keyid %08lX\n", enc->keyid[1] );*/
+ /* Hmmm: why do I have this algo check here - anyway there is
+ * function to check it. */
+ if (opt.verbose)
+ log_info (_("public key is %s\n"), keystr (enc->keyid));
+
+ if (is_status_enabled ())
+ {
+ char buf[50];
+ snprintf (buf, sizeof buf, "%08lX%08lX %d 0",
+ (ulong)enc->keyid[0], (ulong)enc->keyid[1], enc->pubkey_algo);
+ write_status_text (STATUS_ENC_TO, buf);
}
- else
- result = G10ERR_PUBKEY_ALGO;
- if( result == -1 )
- ;
- else
- {
- /* store it for later display */
- struct kidlist_item *x = xmalloc( sizeof *x );
- x->kid[0] = enc->keyid[0];
- x->kid[1] = enc->keyid[1];
- x->pubkey_algo = enc->pubkey_algo;
- x->reason = result;
- x->next = c->pkenc_list;
- c->pkenc_list = x;
-
- if( !result && opt.verbose > 1 )
- log_info( _("public key encrypted data: good DEK\n") );
- }
+ if (!opt.list_only && !opt.override_session_key)
+ {
+ struct pubkey_enc_list *x = xmalloc (sizeof *x);
+
+ x->keyid[0] = enc->keyid[0];
+ x->keyid[1] = enc->keyid[1];
+ x->pubkey_algo = enc->pubkey_algo;
+ x->result = -1;
+ x->data[0] = x->data[1] = NULL;
+ if (enc->data[0])
+ {
+ x->data[0] = mpi_copy (enc->data[0]);
+ x->data[1] = mpi_copy (enc->data[1]);
+ }
+ x->next = c->pkenc_list;
+ c->pkenc_list = x;
+ }
- free_packet(pkt);
+ free_packet(pkt, NULL);
}
-
-/****************
+/*
* Print the list of public key encrypted packets which we could
* not decrypt.
*/
static void
-print_pkenc_list( struct kidlist_item *list, int failed )
+print_pkenc_list (ctrl_t ctrl, struct pubkey_enc_list *list)
{
- for( ; list; list = list->next ) {
- PKT_public_key *pk;
- const char *algstr;
+ for (; list; list = list->next)
+ {
+ PKT_public_key *pk;
+ char pkstrbuf[PUBKEY_STRING_SIZE];
+ char *p;
- if ( failed && !list->reason )
- continue;
- if ( !failed && list->reason )
- continue;
+ pk = xmalloc_clear (sizeof *pk);
- algstr = openpgp_pk_algo_name ( list->pubkey_algo );
- pk = xmalloc_clear( sizeof *pk );
-
- if( !algstr )
- algstr = "[?]";
- pk->pubkey_algo = list->pubkey_algo;
- if( !get_pubkey( pk, list->kid ) )
- {
- char *p;
- log_info( _("encrypted with %u-bit %s key, ID %s, created %s\n"),
- nbits_from_pk( pk ), algstr, keystr_from_pk(pk),
- strtimestamp(pk->timestamp) );
- p=get_user_id_native(list->kid);
- log_printf (_(" \"%s\"\n"),p);
- xfree(p);
- }
- else
- log_info(_("encrypted with %s key, ID %s\n"),
- algstr,keystr(list->kid));
-
- free_public_key( pk );
-
- if( list->reason == G10ERR_NO_SECKEY ) {
- if( is_status_enabled() ) {
- char buf[20];
- snprintf (buf, sizeof buf, "%08lX%08lX",
- (ulong)list->kid[0], (ulong)list->kid[1]);
- write_status_text( STATUS_NO_SECKEY, buf );
- }
- }
- else if (list->reason)
- {
- log_info(_("public key decryption failed: %s\n"),
- g10_errstr(list->reason));
- write_status_error ("pkdecrypt_failed", list->reason);
- }
+ pk->pubkey_algo = list->pubkey_algo;
+ if (!get_pubkey (ctrl, pk, list->keyid))
+ {
+ pubkey_string (pk, pkstrbuf, sizeof pkstrbuf);
+
+ log_info (_("encrypted with %s key, ID %s, created %s\n"),
+ pkstrbuf, keystr_from_pk (pk),
+ strtimestamp (pk->timestamp));
+ p = get_user_id_native (ctrl, list->keyid);
+ log_printf (_(" \"%s\"\n"), p);
+ xfree (p);
+ }
+ else
+ log_info (_("encrypted with %s key, ID %s\n"),
+ openpgp_pk_algo_name (list->pubkey_algo),
+ keystr(list->keyid));
+
+ free_public_key (pk);
}
}
static void
-proc_encrypted( CTX c, PACKET *pkt )
+proc_encrypted (CTX c, PACKET *pkt)
{
- int result = 0;
+ int result = 0;
+ int early_plaintext = literals_seen;
- if (!opt.quiet)
- {
- if(c->symkeys>1)
- log_info(_("encrypted with %lu passphrases\n"),c->symkeys);
- else if(c->symkeys==1)
- log_info(_("encrypted with 1 passphrase\n"));
- print_pkenc_list ( c->pkenc_list, 1 );
- print_pkenc_list ( c->pkenc_list, 0 );
- }
+ if (pkt->pkttype == PKT_ENCRYPTED_AEAD)
+ c->seen_pkt_encrypted_aead = 1;
+
+ if (early_plaintext)
+ {
+ log_info (_("WARNING: multiple plaintexts seen\n"));
+ write_status_errcode ("decryption.early_plaintext", GPG_ERR_BAD_DATA);
+ /* We fail only later so that we can print some more info first. */
+ }
+
+ if (!opt.quiet)
+ {
+ if (c->symkeys>1)
+ log_info (_("encrypted with %lu passphrases\n"), c->symkeys);
+ else if (c->symkeys == 1)
+ log_info (_("encrypted with 1 passphrase\n"));
+ print_pkenc_list (c->ctrl, c->pkenc_list);
+ }
+
+ /* Figure out the session key by looking at all pkenc packets. */
+ if (opt.list_only || c->dek)
+ ;
+ else if (opt.override_session_key)
+ {
+ c->dek = xmalloc_clear (sizeof *c->dek);
+ result = get_override_session_key (c->dek, opt.override_session_key);
+ if (result)
+ {
+ xfree (c->dek);
+ c->dek = NULL;
+ log_info (_("public key decryption failed: %s\n"),
+ gpg_strerror (result));
+ write_status_error ("pkdecrypt_failed", result);
+ }
+ }
+ else if (c->pkenc_list)
+ {
+ c->dek = xmalloc_secure_clear (sizeof *c->dek);
+ result = get_session_key (c->ctrl, c->pkenc_list, c->dek);
+ if (is_status_enabled ())
+ {
+ struct pubkey_enc_list *list;
+
+ for (list = c->pkenc_list; list; list = list->next)
+ if (list->result && list->result != -1)
+ {
+ char buf[20];
+ snprintf (buf, sizeof buf, "%08lX%08lX",
+ (ulong)list->keyid[0], (ulong)list->keyid[1]);
+ write_status_text (STATUS_NO_SECKEY, buf);
+ }
+ }
+
+ if (result)
+ {
+ log_info (_("public key decryption failed: %s\n"),
+ gpg_strerror (result));
+ write_status_error ("pkdecrypt_failed", result);
- /* FIXME: Figure out the session key by looking at all pkenc packets. */
-
-
- write_status( STATUS_BEGIN_DECRYPTION );
-
- /*log_debug("dat: %sencrypted data\n", c->dek?"":"conventional ");*/
- if( opt.list_only )
- result = -1;
- else if( !c->dek && !c->last_was_session_key ) {
- int algo;
- STRING2KEY s2kbuf, *s2k = NULL;
-
- if(opt.override_session_key)
- {
- c->dek = xmalloc_clear( sizeof *c->dek );
- result=get_override_session_key(c->dek, opt.override_session_key);
- if(result)
- {
- xfree(c->dek);
- c->dek = NULL;
- }
- }
- else
- {
- /* Assume this is old style conventional encrypted data. */
- algo = opt.def_cipher_algo;
- if ( algo )
- log_info (_("assuming %s encrypted data\n"),
+ /* Error: Delete the DEK. */
+ xfree (c->dek);
+ c->dek = NULL;
+ }
+ }
+
+ if (c->dek && opt.verbose > 1)
+ log_info (_("public key encrypted data: good DEK\n"));
+
+ write_status (STATUS_BEGIN_DECRYPTION);
+
+ /*log_debug("dat: %sencrypted data\n", c->dek?"":"conventional ");*/
+ if (opt.list_only)
+ result = -1;
+ else if (!c->dek && !c->last_was_session_key)
+ {
+ int algo;
+ STRING2KEY s2kbuf;
+ STRING2KEY *s2k = NULL;
+ int canceled;
+
+ if (opt.override_session_key)
+ {
+ c->dek = xmalloc_clear (sizeof *c->dek);
+ result = get_override_session_key (c->dek, opt.override_session_key);
+ if (result)
+ {
+ xfree (c->dek);
+ c->dek = NULL;
+ }
+ }
+ else
+ {
+ /* Assume this is old style conventional encrypted data. */
+ algo = opt.def_cipher_algo;
+ if (algo)
+ log_info (_("assuming %s encrypted data\n"),
+ openpgp_cipher_algo_name (algo));
+ else if (openpgp_cipher_test_algo (CIPHER_ALGO_IDEA))
+ {
+ algo = opt.def_cipher_algo;
+ if (!algo)
+ algo = opt.s2k_cipher_algo;
+ log_info (_("IDEA cipher unavailable, "
+ "optimistically attempting to use %s instead\n"),
openpgp_cipher_algo_name (algo));
- else if ( openpgp_cipher_test_algo (CIPHER_ALGO_IDEA) )
- {
- algo = opt.def_cipher_algo;
- if (!algo)
- algo = opt.s2k_cipher_algo;
- log_info (_("IDEA cipher unavailable, "
- "optimistically attempting to use %s instead\n"),
- openpgp_cipher_algo_name (algo));
- }
- else
- {
- algo = CIPHER_ALGO_IDEA;
- if (!opt.s2k_digest_algo)
- {
- /* If no digest is given we assume MD5 */
- s2kbuf.mode = 0;
- s2kbuf.hash_algo = DIGEST_ALGO_MD5;
- s2k = &s2kbuf;
- }
- log_info (_("assuming %s encrypted data\n"), "IDEA");
- }
-
- c->dek = passphrase_to_dek ( NULL, 0, algo, s2k, 3, NULL, NULL );
- if (c->dek)
- c->dek->algo_info_printed = 1;
- }
- }
- else if( !c->dek )
- result = G10ERR_NO_SECKEY;
-
- if (!result)
- result = decrypt_data (c->ctrl, c, pkt->pkt.encrypted, c->dek );
-
- if( result == -1 )
- ;
- else if( !result || (gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE
- && opt.ignore_mdc_error)) {
- write_status( STATUS_DECRYPTION_OKAY );
- if( opt.verbose > 1 )
- log_info(_("decryption okay\n"));
- if( pkt->pkt.encrypted->mdc_method && !result )
- write_status( STATUS_GOODMDC );
- else if(!opt.no_mdc_warn)
- log_info (_("WARNING: message was not integrity protected\n"));
- }
- else if( result == G10ERR_BAD_SIGN ) {
- glo_ctrl.lasterr = result;
- log_error(_("WARNING: encrypted message has been manipulated!\n"));
- write_status( STATUS_BADMDC );
- write_status( STATUS_DECRYPTION_FAILED );
- }
- else {
- if (gpg_err_code (result) == GPG_ERR_BAD_KEY
- && *c->dek->s2k_cacheid != '\0')
- {
- log_debug(_("cleared passphrase cached with ID: %s\n"),
- c->dek->s2k_cacheid);
- passphrase_clear_cache (NULL, c->dek->s2k_cacheid, 0);
- }
- glo_ctrl.lasterr = result;
- write_status( STATUS_DECRYPTION_FAILED );
- log_error(_("decryption failed: %s\n"), g10_errstr(result));
- /* Hmmm: does this work when we have encrypted using multiple
- * ways to specify the session key (symmmetric and PK)*/
- }
- xfree(c->dek); c->dek = NULL;
- free_packet(pkt);
- c->last_was_session_key = 0;
- write_status( STATUS_END_DECRYPTION );
+ }
+ else
+ {
+ algo = CIPHER_ALGO_IDEA;
+ if (!opt.s2k_digest_algo)
+ {
+ /* If no digest is given we assume SHA-1. */
+ s2kbuf.mode = 0;
+ s2kbuf.hash_algo = DIGEST_ALGO_SHA1;
+ s2k = &s2kbuf;
+ }
+ log_info (_("assuming %s encrypted data\n"), "IDEA");
+ }
+
+ c->dek = passphrase_to_dek (algo, s2k, 0, 0, NULL, &canceled);
+ if (c->dek)
+ c->dek->algo_info_printed = 1;
+ else if (canceled)
+ result = gpg_error (GPG_ERR_CANCELED);
+ else
+ result = gpg_error (GPG_ERR_INV_PASSPHRASE);
+ }
+ }
+ else if (!c->dek)
+ {
+ if (c->symkeys && !c->pkenc_list)
+ result = gpg_error (GPG_ERR_BAD_KEY);
+
+ if (!result)
+ result = gpg_error (GPG_ERR_NO_SECKEY);
+ }
+
+ /* Compute compliance with CO_DE_VS. */
+ if (!result && is_status_enabled ()
+ /* Symmetric encryption and asymmetric encryption voids compliance. */
+ && (c->symkeys != !!c->pkenc_list )
+ /* Overriding session key voids compliance. */
+ && !opt.override_session_key
+ /* Check symmetric cipher. */
+ && gnupg_gcrypt_is_compliant (CO_DE_VS)
+ && gnupg_cipher_is_compliant (CO_DE_VS, c->dek->algo,
+ GCRY_CIPHER_MODE_CFB))
+ {
+ struct pubkey_enc_list *i;
+ int compliant = 1;
+ PKT_public_key *pk = xmalloc (sizeof *pk);
+
+ if ( !(c->pkenc_list || c->symkeys) )
+ log_debug ("%s: where else did the session key come from?\n", __func__);
+
+ /* Now check that every key used to encrypt the session key is
+ * compliant. */
+ for (i = c->pkenc_list; i && compliant; i = i->next)
+ {
+ memset (pk, 0, sizeof *pk);
+ pk->pubkey_algo = i->pubkey_algo;
+ if (get_pubkey (c->ctrl, pk, i->keyid) != 0
+ || ! gnupg_pk_is_compliant (CO_DE_VS, pk->pubkey_algo, 0,
+ pk->pkey, nbits_from_pk (pk), NULL))
+ compliant = 0;
+ release_public_key_parts (pk);
+ }
+
+ xfree (pk);
+
+ if (compliant)
+ write_status_strings (STATUS_DECRYPTION_COMPLIANCE_MODE,
+ gnupg_status_compliance_flag (CO_DE_VS),
+ NULL);
+
+ }
+
+ if (!result)
+ result = decrypt_data (c->ctrl, c, pkt->pkt.encrypted, c->dek );
+
+ /* Trigger the deferred error. */
+ if (!result && early_plaintext)
+ result = gpg_error (GPG_ERR_BAD_DATA);
+
+ if (result == -1)
+ ;
+ else if (!result
+ && !opt.ignore_mdc_error
+ && !pkt->pkt.encrypted->mdc_method
+ && !pkt->pkt.encrypted->aead_algo)
+ {
+ /* The message has been decrypted but does not carry an MDC or
+ * uses AEAD encryption. --ignore-mdc-error has also not been
+ * used. To avoid attacks changing an MDC message to a non-MDC
+ * message, we fail here. */
+ log_error (_("WARNING: message was not integrity protected\n"));
+ if (!pkt->pkt.encrypted->mdc_method
+ && (openpgp_cipher_get_algo_blklen (c->dek->algo) == 8
+ || c->dek->algo == CIPHER_ALGO_TWOFISH))
+ {
+ /* Before 2.2.8 we did not fail hard for a missing MDC if
+ * one of the old ciphers where used. Although these cases
+ * are rare in practice we print a hint on how to decrypt
+ * such messages. */
+ log_string
+ (GPGRT_LOGLVL_INFO,
+ _("Hint: If this message was created before the year 2003 it is\n"
+ "likely that this message is legitimate. This is because back\n"
+ "then integrity protection was not widely used.\n"));
+ log_info (_("Use the option '%s' to decrypt anyway.\n"),
+ "--ignore-mdc-error");
+ write_status_errcode ("nomdc_with_legacy_cipher",
+ GPG_ERR_DECRYPT_FAILED);
+ }
+ log_info (_("decryption forced to fail!\n"));
+ write_status (STATUS_DECRYPTION_FAILED);
+ }
+ else if (!result || (gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE
+ && !pkt->pkt.encrypted->aead_algo
+ && opt.ignore_mdc_error))
+ {
+ /* All is fine or for an MDC message the MDC failed but the
+ * --ignore-mdc-error option is active. For compatibility
+ * reasons we issue GOODMDC also for AEAD messages. */
+ write_status (STATUS_DECRYPTION_OKAY);
+ if (opt.verbose > 1)
+ log_info(_("decryption okay\n"));
+
+ if (pkt->pkt.encrypted->aead_algo)
+ write_status (STATUS_GOODMDC);
+ else if (pkt->pkt.encrypted->mdc_method && !result)
+ write_status (STATUS_GOODMDC);
+ else
+ log_info (_("WARNING: message was not integrity protected\n"));
+ }
+ else if (gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE
+ || gpg_err_code (result) == GPG_ERR_TRUNCATED)
+ {
+ glo_ctrl.lasterr = result;
+ log_error (_("WARNING: encrypted message has been manipulated!\n"));
+ write_status (STATUS_BADMDC);
+ write_status (STATUS_DECRYPTION_FAILED);
+ }
+ else
+ {
+ if ((gpg_err_code (result) == GPG_ERR_BAD_KEY
+ || gpg_err_code (result) == GPG_ERR_CHECKSUM
+ || gpg_err_code (result) == GPG_ERR_CIPHER_ALGO)
+ && c->dek && *c->dek->s2k_cacheid != '\0')
+ {
+ if (opt.debug)
+ log_debug ("cleared passphrase cached with ID: %s\n",
+ c->dek->s2k_cacheid);
+ passphrase_clear_cache (c->dek->s2k_cacheid);
+ }
+ glo_ctrl.lasterr = result;
+ write_status (STATUS_DECRYPTION_FAILED);
+ log_error (_("decryption failed: %s\n"), gpg_strerror (result));
+ /* Hmmm: does this work when we have encrypted using multiple
+ * ways to specify the session key (symmmetric and PK). */
+ }
+
+ xfree (c->dek);
+ c->dek = NULL;
+ free_packet (pkt, NULL);
+ c->last_was_session_key = 0;
+ write_status (STATUS_END_DECRYPTION);
+
+ /* Bump the counter even if we have not seen a literal data packet
+ * inside an encryption container. This acts as a sentinel in case
+ * a misplace extra literal data packets follows after this
+ * encrypted packet. */
+ literals_seen++;
+}
+
+
+static int
+have_seen_pkt_encrypted_aead( CTX c )
+{
+ CTX cc;
+
+ for (cc = c; cc; cc = cc->anchor)
+ {
+ if (cc->seen_pkt_encrypted_aead)
+ return 1;
+ }
+
+ return 0;
}
static void
proc_plaintext( CTX c, PACKET *pkt )
{
- PKT_plaintext *pt = pkt->pkt.plaintext;
- int any, clearsig, only_md5, rc;
- KBNODE n;
-
- literals_seen++;
-
- if( pt->namelen == 8 && !memcmp( pt->name, "_CONSOLE", 8 ) )
- log_info(_("Note: sender requested \"for-your-eyes-only\"\n"));
- else if( opt.verbose )
- log_info(_("original file name='%.*s'\n"), pt->namelen, pt->name);
- free_md_filter_context( &c->mfx );
- if (gcry_md_open (&c->mfx.md, 0, 0))
- BUG ();
- /* fixme: we may need to push the textfilter if we have sigclass 1
- * and no armoring - Not yet tested
- * Hmmm, why don't we need it at all if we have sigclass 1
- * Should we assume that plaintext in mode 't' has always sigclass 1??
- * See: Russ Allbery's mail 1999-02-09
- */
- any = clearsig = only_md5 = 0;
- for(n=c->list; n; n = n->next )
- {
- if( n->pkt->pkttype == PKT_ONEPASS_SIG )
- {
- /* For the onepass signature case */
- if( n->pkt->pkt.onepass_sig->digest_algo )
- {
- gcry_md_enable (c->mfx.md,
+ PKT_plaintext *pt = pkt->pkt.plaintext;
+ int any, clearsig, rc;
+ kbnode_t n;
+ unsigned char *extrahash;
+ size_t extrahashlen;
+
+ /* This is a literal data packet. Bump a counter for later checks. */
+ literals_seen++;
+
+ if (pt->namelen == 8 && !memcmp( pt->name, "_CONSOLE", 8))
+ log_info (_("Note: sender requested \"for-your-eyes-only\"\n"));
+ else if (opt.verbose)
+ {
+ /* We don't use print_utf8_buffer because that would require a
+ * string change which we don't want in 2.2. It is also not
+ * clear whether the filename is always utf-8 encoded. */
+ char *tmp = make_printable_string (pt->name, pt->namelen, 0);
+ log_info (_("original file name='%.*s'\n"), (int)strlen (tmp), tmp);
+ xfree (tmp);
+ }
+
+ free_md_filter_context (&c->mfx);
+ if (gcry_md_open (&c->mfx.md, 0, 0))
+ BUG ();
+ /* fixme: we may need to push the textfilter if we have sigclass 1
+ * and no armoring - Not yet tested
+ * Hmmm, why don't we need it at all if we have sigclass 1
+ * Should we assume that plaintext in mode 't' has always sigclass 1??
+ * See: Russ Allbery's mail 1999-02-09
+ */
+ any = clearsig = 0;
+ for (n=c->list; n; n = n->next )
+ {
+ if (n->pkt->pkttype == PKT_ONEPASS_SIG)
+ {
+ /* The onepass signature case. */
+ if (n->pkt->pkt.onepass_sig->digest_algo)
+ {
+ if (!opt.skip_verify)
+ gcry_md_enable (c->mfx.md,
n->pkt->pkt.onepass_sig->digest_algo);
- if( !any && n->pkt->pkt.onepass_sig->digest_algo
- == DIGEST_ALGO_MD5 )
- only_md5 = 1;
- else
- only_md5 = 0;
- any = 1;
- }
- if( n->pkt->pkt.onepass_sig->sig_class != 0x01 )
- only_md5 = 0;
- }
- else if( n->pkt->pkttype == PKT_GPG_CONTROL
- && n->pkt->pkt.gpg_control->control
- == CTRLPKT_CLEARSIGN_START )
- {
- /* For the clearsigned message case */
- size_t datalen = n->pkt->pkt.gpg_control->datalen;
- const byte *data = n->pkt->pkt.gpg_control->data;
-
- /* check that we have at least the sigclass and one hash */
- if ( datalen < 2 )
- log_fatal("invalid control packet CTRLPKT_CLEARSIGN_START\n");
- /* Note that we don't set the clearsig flag for not-dash-escaped
- * documents */
- clearsig = (*data == 0x01);
- for( data++, datalen--; datalen; datalen--, data++ )
- gcry_md_enable (c->mfx.md, *data);
- any = 1;
- break; /* Stop here as one-pass signature packets are not
- expected. */
- }
- else if(n->pkt->pkttype==PKT_SIGNATURE)
- {
- /* For the SIG+LITERAL case that PGP used to use. */
- gcry_md_enable ( c->mfx.md, n->pkt->pkt.signature->digest_algo );
- any=1;
- }
- }
- if( !any && !opt.skip_verify )
- {
- /* This is for the old GPG LITERAL+SIG case. It's not legal
- according to 2440, so hopefully it won't come up that
- often. There is no good way to specify what algorithms to
- use in that case, so these three are the historical
- answer. */
- gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 );
- gcry_md_enable( c->mfx.md, DIGEST_ALGO_SHA1 );
- gcry_md_enable( c->mfx.md, DIGEST_ALGO_MD5 );
- }
- if (opt.pgp2_workarounds && only_md5 && !opt.skip_verify
- && opt.flags.allow_weak_digest_algos) {
- /* This is a kludge to work around a bug in pgp2. It does only
- * catch those mails which are armored. To catch the non-armored
- * pgp mails we could see whether there is the signature packet
- * in front of the plaintext. If someone needs this, send me a patch.
- */
- if ( gcry_md_open (&c->mfx.md2, DIGEST_ALGO_MD5, 0) )
- BUG ();
+ any = 1;
+ }
+ }
+ else if (n->pkt->pkttype == PKT_GPG_CONTROL
+ && n->pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START)
+ {
+ /* The clearsigned message case. */
+ size_t datalen = n->pkt->pkt.gpg_control->datalen;
+ const byte *data = n->pkt->pkt.gpg_control->data;
+
+ /* Check that we have at least the sigclass and one hash. */
+ if (datalen < 2)
+ log_fatal ("invalid control packet CTRLPKT_CLEARSIGN_START\n");
+ /* Note that we don't set the clearsig flag for not-dash-escaped
+ * documents. */
+ clearsig = (*data == 0x01);
+ for (data++, datalen--; datalen; datalen--, data++)
+ if (!opt.skip_verify)
+ gcry_md_enable (c->mfx.md, *data);
+ any = 1;
+ break; /* Stop here as one-pass signature packets are not
+ expected. */
+ }
+ else if (n->pkt->pkttype == PKT_SIGNATURE)
+ {
+ /* The SIG+LITERAL case that PGP used to use. */
+ if (!opt.skip_verify)
+ gcry_md_enable (c->mfx.md, n->pkt->pkt.signature->digest_algo);
+ any = 1;
+ }
}
- if ( DBG_HASHING ) {
- gcry_md_debug ( c->mfx.md, "verify" );
- if ( c->mfx.md2 )
- gcry_md_debug ( c->mfx.md2, "verify2" );
+
+ if (!any && !opt.skip_verify && !have_seen_pkt_encrypted_aead(c))
+ {
+ /* This is for the old GPG LITERAL+SIG case. It's not legal
+ according to 2440, so hopefully it won't come up that often.
+ There is no good way to specify what algorithms to use in
+ that case, so these there are the historical answer. */
+ gcry_md_enable (c->mfx.md, DIGEST_ALGO_RMD160);
+ gcry_md_enable (c->mfx.md, DIGEST_ALGO_SHA1);
+ }
+ if (DBG_HASHING)
+ {
+ gcry_md_debug (c->mfx.md, "verify");
+ if (c->mfx.md2)
+ gcry_md_debug (c->mfx.md2, "verify2");
}
- rc=0;
+ rc=0;
- if (literals_seen>1)
- {
- log_info (_("WARNING: multiple plaintexts seen\n"));
-
- if (!opt.flags.allow_multiple_messages)
- {
- write_status_text (STATUS_ERROR, "proc_pkt.plaintext 89_BAD_DATA");
- log_inc_errorcount ();
- rc = gpg_error (GPG_ERR_UNEXPECTED);
- }
- }
+ if (literals_seen > 1)
+ {
+ log_info (_("WARNING: multiple plaintexts seen\n"));
- if(!rc)
- {
- rc = handle_plaintext( pt, &c->mfx, c->sigs_only, clearsig );
- if ( gpg_err_code (rc) == GPG_ERR_EACCES && !c->sigs_only )
- {
- /* Can't write output but we hash it anyway to check the
- signature. */
- rc = handle_plaintext( pt, &c->mfx, 1, clearsig );
- }
- }
+ write_status_text (STATUS_ERROR, "proc_pkt.plaintext 89_BAD_DATA");
+ log_inc_errorcount ();
+ rc = gpg_error (GPG_ERR_UNEXPECTED);
+ }
- if( rc )
- log_error( "handle plaintext failed: %s\n", g10_errstr(rc));
- free_packet(pkt);
- c->last_was_session_key = 0;
-
- /* We add a marker control packet instead of the plaintext packet.
- * This is so that we can later detect invalid packet sequences.
- */
- n = new_kbnode (create_gpg_control (CTRLPKT_PLAINTEXT_MARK, NULL, 0));
- if (c->list)
- add_kbnode (c->list, n);
- else
- c->list = n;
+ if (!rc)
+ {
+ /* It we are in --verify mode, we do not want to output the
+ * signed text. However, if --output is also used we do what
+ * has been requested and write out the signed data. */
+ rc = handle_plaintext (pt, &c->mfx,
+ (opt.outfp || opt.outfile)? 0 : c->sigs_only,
+ clearsig);
+ if (gpg_err_code (rc) == GPG_ERR_EACCES && !c->sigs_only)
+ {
+ /* Can't write output but we hash it anyway to check the
+ signature. */
+ rc = handle_plaintext( pt, &c->mfx, 1, clearsig );
+ }
+ }
+
+ if (rc)
+ log_error ("handle plaintext failed: %s\n", gpg_strerror (rc));
+
+ /* We add a marker control packet instead of the plaintext packet.
+ * This is so that we can later detect invalid packet sequences.
+ * The packet is further used to convey extra data from the
+ * plaintext packet to the signature verification. */
+ extrahash = xtrymalloc (6 + pt->namelen);
+ if (!extrahash)
+ {
+ /* No way to return an error. */
+ rc = gpg_error_from_syserror ();
+ log_error ("malloc failed in %s: %s\n", __func__, gpg_strerror (rc));
+ extrahashlen = 0;
+ }
+ else
+ {
+ extrahash[0] = pt->mode;
+ extrahash[1] = pt->namelen;
+ if (pt->namelen)
+ memcpy (extrahash+2, pt->name, pt->namelen);
+ extrahashlen = 2 + pt->namelen;
+ extrahash[extrahashlen++] = pt->timestamp >> 24;
+ extrahash[extrahashlen++] = pt->timestamp >> 16;
+ extrahash[extrahashlen++] = pt->timestamp >> 8;
+ extrahash[extrahashlen++] = pt->timestamp ;
+ }
+
+ free_packet (pkt, NULL);
+ c->last_was_session_key = 0;
+
+ n = new_kbnode (create_gpg_control (CTRLPKT_PLAINTEXT_MARK,
+ extrahash, extrahashlen));
+ xfree (extrahash);
+ if (c->list)
+ add_kbnode (c->list, n);
+ else
+ c->list = n;
}
static int
-proc_compressed_cb( IOBUF a, void *info )
+proc_compressed_cb (iobuf_t a, void *info)
{
if ( ((CTX)info)->signed_data.used
&& ((CTX)info)->signed_data.data_fd != -1)
((CTX)info)->sigfilename );
}
+
static int
-proc_encrypt_cb (IOBUF a, void *info )
+proc_encrypt_cb (iobuf_t a, void *info )
{
CTX c = info;
return proc_encryption_packets (c->ctrl, info, a );
}
+
static int
-proc_compressed( CTX c, PACKET *pkt )
+proc_compressed (CTX c, PACKET *pkt)
{
PKT_compressed *zd = pkt->pkt.compressed;
int rc;
else if (rc)
log_error ("uncompressing failed: %s\n", gpg_strerror (rc));
- free_packet(pkt);
+ free_packet (pkt, NULL);
c->last_was_session_key = 0;
return rc;
}
-/****************
- * check the signature
- * Returns: 0 = valid signature or an error code
+
+/*
+ * Check the signature. If R_PK is not NULL a copy of the public key
+ * used to verify the signature will be stored there, or NULL if not
+ * found. If FORCED_PK is not NULL, this public key is used to verify
+ * _data signatures_ and no key lookup is done. Returns: 0 = valid
+ * signature or an error code
*/
static int
-do_check_sig( CTX c, KBNODE node, int *is_selfsig,
- int *is_expkey, int *is_revkey )
+do_check_sig (CTX c, kbnode_t node, const void *extrahash, size_t extrahashlen,
+ PKT_public_key *forced_pk, int *is_selfsig,
+ int *is_expkey, int *is_revkey, PKT_public_key **r_pk)
{
- PKT_signature *sig;
- gcry_md_hd_t md = NULL, md2 = NULL;
- int algo, rc;
-
- assert( node->pkt->pkttype == PKT_SIGNATURE );
- if( is_selfsig )
- *is_selfsig = 0;
- sig = node->pkt->pkt.signature;
-
- algo = sig->digest_algo;
- rc = openpgp_md_test_algo(algo);
- if (rc)
- return rc;
-
- if( sig->sig_class == 0x00 ) {
- if( c->mfx.md )
- {
- if (gcry_md_copy (&md, c->mfx.md ))
- BUG ();
- }
- else /* detached signature */
- {
- /* signature_check() will enable the md*/
- if (gcry_md_open (&md, 0, 0 ))
- BUG ();
- }
+ PKT_signature *sig;
+ gcry_md_hd_t md = NULL;
+ gcry_md_hd_t md2 = NULL;
+ gcry_md_hd_t md_good = NULL;
+ int algo, rc;
+
+ if (r_pk)
+ *r_pk = NULL;
+
+ log_assert (node->pkt->pkttype == PKT_SIGNATURE);
+ if (is_selfsig)
+ *is_selfsig = 0;
+ sig = node->pkt->pkt.signature;
+
+ algo = sig->digest_algo;
+ rc = openpgp_md_test_algo (algo);
+ if (rc)
+ return rc;
+
+ if (sig->sig_class == 0x00)
+ {
+ if (c->mfx.md)
+ {
+ if (gcry_md_copy (&md, c->mfx.md ))
+ BUG ();
+ }
+ else /* detached signature */
+ {
+ /* check_signature() will enable the md. */
+ if (gcry_md_open (&md, 0, 0 ))
+ BUG ();
+ }
}
- else if( sig->sig_class == 0x01 ) {
- /* how do we know that we have to hash the (already hashed) text
- * in canonical mode ??? (calculating both modes???) */
- if( c->mfx.md ) {
- if (gcry_md_copy (&md, c->mfx.md ))
- BUG ();
- if( c->mfx.md2 && gcry_md_copy (&md2, c->mfx.md2 ))
- BUG ();
+ else if (sig->sig_class == 0x01)
+ {
+ /* How do we know that we have to hash the (already hashed) text
+ in canonical mode ??? (calculating both modes???) */
+ if (c->mfx.md)
+ {
+ if (gcry_md_copy (&md, c->mfx.md ))
+ BUG ();
+ if (c->mfx.md2 && gcry_md_copy (&md2, c->mfx.md2))
+ BUG ();
}
- else { /* detached signature */
- log_debug("Do we really need this here?");
- /* signature_check() will enable the md*/
- if (gcry_md_open (&md, 0, 0 ))
- BUG ();
- if (gcry_md_open (&md2, 0, 0 ))
- BUG ();
+ else /* detached signature */
+ {
+ log_debug ("Do we really need this here?");
+ /* check_signature() will enable the md*/
+ if (gcry_md_open (&md, 0, 0 ))
+ BUG ();
+ if (gcry_md_open (&md2, 0, 0 ))
+ BUG ();
}
}
- else if( (sig->sig_class&~3) == 0x10
- || sig->sig_class == 0x18
- || sig->sig_class == 0x1f
- || sig->sig_class == 0x20
- || sig->sig_class == 0x28
- || sig->sig_class == 0x30 ) {
- if( c->list->pkt->pkttype == PKT_PUBLIC_KEY
- || c->list->pkt->pkttype == PKT_PUBLIC_SUBKEY ) {
- return check_key_signature( c->list, node, is_selfsig );
+ else if ((sig->sig_class&~3) == 0x10
+ || sig->sig_class == 0x18
+ || sig->sig_class == 0x1f
+ || sig->sig_class == 0x20
+ || sig->sig_class == 0x28
+ || sig->sig_class == 0x30)
+ {
+ if (c->list->pkt->pkttype == PKT_PUBLIC_KEY
+ || c->list->pkt->pkttype == PKT_PUBLIC_SUBKEY)
+ {
+ return check_key_signature (c->ctrl, c->list, node, is_selfsig);
}
- else if( sig->sig_class == 0x20 ) {
- log_error (_("standalone revocation - "
- "use \"gpg --import\" to apply\n"));
- return G10ERR_NOT_PROCESSED;
+ else if (sig->sig_class == 0x20)
+ {
+ log_error (_("standalone revocation - "
+ "use \"gpg --import\" to apply\n"));
+ return GPG_ERR_NOT_PROCESSED;
}
- else {
- log_error("invalid root packet for sigclass %02x\n",
- sig->sig_class);
- return G10ERR_SIG_CLASS;
+ else
+ {
+ log_error ("invalid root packet for sigclass %02x\n", sig->sig_class);
+ return GPG_ERR_SIG_CLASS;
}
}
- else
- return G10ERR_SIG_CLASS;
- rc = signature_check2( sig, md, NULL, is_expkey, is_revkey, NULL );
- if( gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE && md2 )
- rc = signature_check2( sig, md2, NULL, is_expkey, is_revkey, NULL );
- gcry_md_close(md);
- gcry_md_close(md2);
+ else
+ return GPG_ERR_SIG_CLASS;
+
+ /* We only get here if we are checking the signature of a binary
+ (0x00) or text document (0x01). */
+ rc = check_signature2 (c->ctrl, sig, md, extrahash, extrahashlen,
+ forced_pk,
+ NULL, is_expkey, is_revkey, r_pk);
+ if (! rc)
+ md_good = md;
+ else if (gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE && md2)
+ {
+ PKT_public_key *pk2;
- return rc;
+ rc = check_signature2 (c->ctrl, sig, md2, extrahash, extrahashlen,
+ forced_pk,
+ NULL, is_expkey, is_revkey,
+ r_pk? &pk2 : NULL);
+ if (!rc)
+ {
+ md_good = md2;
+ if (r_pk)
+ {
+ free_public_key (*r_pk);
+ *r_pk = pk2;
+ }
+ }
+ }
+
+ if (md_good)
+ {
+ unsigned char *buffer = gcry_md_read (md_good, sig->digest_algo);
+ sig->digest_len = gcry_md_get_algo_dlen (map_md_openpgp_to_gcry (algo));
+ memcpy (sig->digest, buffer, sig->digest_len);
+ }
+
+ gcry_md_close (md);
+ gcry_md_close (md2);
+
+ return rc;
}
static void
-print_userid( PACKET *pkt )
+print_userid (PACKET *pkt)
{
- if( !pkt )
- BUG();
- if( pkt->pkttype != PKT_USER_ID ) {
- printf("ERROR: unexpected packet type %d", pkt->pkttype );
- return;
+ if (!pkt)
+ BUG();
+
+ if (pkt->pkttype != PKT_USER_ID)
+ {
+ es_printf ("ERROR: unexpected packet type %d", pkt->pkttype );
+ return;
}
- if( opt.with_colons )
- {
- if(pkt->pkt.user_id->attrib_data)
- printf("%u %lu",
- pkt->pkt.user_id->numattribs,
- pkt->pkt.user_id->attrib_len);
- else
- es_write_sanitized (es_stdout, pkt->pkt.user_id->name,
- pkt->pkt.user_id->len, ":", NULL);
- }
- else
- print_utf8_buffer (es_stdout, pkt->pkt.user_id->name,
- pkt->pkt.user_id->len );
+ if (opt.with_colons)
+ {
+ if (pkt->pkt.user_id->attrib_data)
+ es_printf("%u %lu",
+ pkt->pkt.user_id->numattribs,
+ pkt->pkt.user_id->attrib_len);
+ else
+ es_write_sanitized (es_stdout, pkt->pkt.user_id->name,
+ pkt->pkt.user_id->len, ":", NULL);
+ }
+ else
+ print_utf8_buffer (es_stdout, pkt->pkt.user_id->name,
+ pkt->pkt.user_id->len );
}
-/****************
- * List the certificate in a user friendly way
+/*
+ * List the keyblock in a user friendly way
*/
-
static void
-list_node( CTX c, KBNODE node )
+list_node (CTX c, kbnode_t node)
{
- int mainkey;
- char pkstrbuf[PUBKEY_STRING_SIZE];
-
if (!node)
;
- else if ((mainkey = (node->pkt->pkttype == PKT_PUBLIC_KEY))
- || node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
+ else if (node->pkt->pkttype == PKT_PUBLIC_KEY
+ || node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
{
PKT_public_key *pk = node->pkt->pkt.public_key;
u32 keyid[2];
keyid_from_pk( pk, keyid );
- if (mainkey)
- c->trustletter = (opt.fast_list_mode?
- 0 : get_validity_info( pk, NULL));
- es_printf ("%s:", mainkey? "pub":"sub" );
+ if (pk->flags.primary)
+ c->trustletter = (opt.fast_list_mode
+ ? 0
+ : get_validity_info
+ (c->ctrl,
+ node->pkt->pkttype == PKT_PUBLIC_KEY
+ ? node : NULL,
+ pk, NULL));
+ es_printf ("%s:", pk->flags.primary? "pub":"sub" );
if (c->trustletter)
es_putc (c->trustletter, es_stdout);
es_printf (":%u:%d:%08lX%08lX:%s:%s::",
(ulong)keyid[0],(ulong)keyid[1],
colon_datestr_from_pk( pk ),
colon_strtime (pk->expiredate) );
- if (mainkey && !opt.fast_list_mode)
- es_putc (get_ownertrust_info (pk), es_stdout);
+ if (pk->flags.primary && !opt.fast_list_mode)
+ es_putc (get_ownertrust_info (c->ctrl, pk, 1), es_stdout);
es_putc (':', es_stdout);
+ es_putc ('\n', es_stdout);
}
else
- es_printf ("%s %s/%s %s",
- mainkey? "pub":"sub",
- pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),
- keystr_from_pk (pk),
- datestr_from_pk (pk));
-
- if (pk->flags.revoked)
- {
- es_printf (" [");
- es_printf (_("revoked: %s"), revokestr_from_pk (pk));
- es_printf ("]\n");
- }
- else if( pk->expiredate && !opt.with_colons)
{
- es_printf (" [");
- es_printf (_("expires: %s"), expirestr_from_pk (pk));
- es_printf ("]\n");
+ print_key_line (c->ctrl, es_stdout, pk, 0);
}
- else
- es_putc ('\n', es_stdout);
- if ((mainkey && opt.fingerprint) || opt.fingerprint > 1)
- print_fingerprint (NULL, pk, 0);
+ if (opt.keyid_format == KF_NONE && !opt.with_colons)
+ ; /* Already printed. */
+ else if ((pk->flags.primary && opt.fingerprint) || opt.fingerprint > 1)
+ print_fingerprint (c->ctrl, NULL, pk, 0);
- if (opt.with_colons)
+ if (pk->flags.primary)
{
- if (node->next && node->next->pkt->pkttype == PKT_RING_TRUST)
- es_printf ("rtv:1:%u:\n",
- node->next->pkt->pkt.ring_trust->trustval);
- }
+ int kl = opt.keyid_format == KF_NONE? 0 : keystrlen ();
- if (mainkey)
- {
/* Now list all userids with their signatures. */
for (node = node->next; node; node = node->next)
{
es_printf ("%s:::::::::",
node->pkt->pkt.user_id->attrib_data?"uat":"uid");
else
- es_printf ("uid%*s", 28, "" );
+ es_printf ("uid%*s",
+ kl + (opt.legacy_list_mode? 9:11),
+ "" );
print_userid (node->pkt);
if (opt.with_colons)
es_putc (':', es_stdout);
es_putc ('\n', es_stdout);
- if (opt.with_colons
- && node->next
- && node->next->pkt->pkttype == PKT_RING_TRUST)
- {
- es_printf ("rtv:2:%u:\n",
- node->next->pkt->pkt.ring_trust?
- node->next->pkt->pkt.ring_trust->trustval : 0);
- }
}
else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
{
}
}
}
- else if ((mainkey = (node->pkt->pkttype == PKT_SECRET_KEY) )
+ else if (node->pkt->pkttype == PKT_SECRET_KEY
|| node->pkt->pkttype == PKT_SECRET_SUBKEY)
{
log_debug ("FIXME: No way to print secret key packets here\n");
- /* fixme: We may use a fucntion to turn a secret key packet into
+ /* fixme: We may use a function to turn a secret key packet into
a public key one and use that here. */
}
else if (node->pkt->pkttype == PKT_SIGNATURE)
if (opt.check_sigs)
{
fflush (stdout);
- rc2 = do_check_sig (c, node, &is_selfsig, NULL, NULL);
+ rc2 = do_check_sig (c, node, NULL, 0, NULL,
+ &is_selfsig, NULL, NULL, NULL);
switch (gpg_err_code (rc2))
{
case 0: sigrc = '!'; break;
es_printf ("%c %s %s ",
sigrc, keystr (sig->keyid), datestr_from_sig(sig));
if (sigrc == '%')
- es_printf ("[%s] ", g10_errstr(rc2) );
+ es_printf ("[%s] ", gpg_strerror (rc2) );
else if (sigrc == '?')
;
else if (is_selfsig)
}
else if (!opt.fast_list_mode)
{
- p = get_user_id (sig->keyid, &n);
+ p = get_user_id (c->ctrl, sig->keyid, &n, NULL);
es_write_sanitized (es_stdout, p, n,
opt.with_colons?":":NULL, NULL );
xfree (p);
}
-
int
-proc_packets (ctrl_t ctrl, void *anchor, IOBUF a )
+proc_packets (ctrl_t ctrl, void *anchor, iobuf_t a )
{
- int rc;
- CTX c = xmalloc_clear( sizeof *c );
+ int rc;
+ CTX c = xmalloc_clear (sizeof *c);
- c->ctrl = ctrl;
- c->anchor = anchor;
- rc = do_proc_packets( c, a );
- xfree( c );
- return rc;
-}
+ c->ctrl = ctrl;
+ c->anchor = anchor;
+ rc = do_proc_packets (c, a);
+ xfree (c);
+ return rc;
+}
int
-proc_signature_packets (ctrl_t ctrl, void *anchor, IOBUF a,
+proc_signature_packets (ctrl_t ctrl, void *anchor, iobuf_t a,
strlist_t signedfiles, const char *sigfilename )
{
- CTX c = xmalloc_clear( sizeof *c );
- int rc;
-
- c->ctrl = ctrl;
- c->anchor = anchor;
- c->sigs_only = 1;
-
- c->signed_data.data_fd = -1;
- c->signed_data.data_names = signedfiles;
- c->signed_data.used = !!signedfiles;
-
- c->sigfilename = sigfilename;
- rc = do_proc_packets( c, a );
-
- /* If we have not encountered any signature we print an error
- messages, send a NODATA status back and return an error code.
- Using log_error is required because verify_files does not check
- error codes for each file but we want to terminate the process
- with an error. */
- if (!rc && !c->any.sig_seen)
- {
- write_status_text (STATUS_NODATA, "4");
- log_error (_("no signature found\n"));
- rc = G10ERR_NO_DATA;
- }
+ CTX c = xmalloc_clear (sizeof *c);
+ int rc;
- /* Propagate the signature seen flag upward. Do this only on
- success so that we won't issue the nodata status several
- times. */
- if (!rc && c->anchor && c->any.sig_seen)
- c->anchor->any.sig_seen = 1;
+ c->ctrl = ctrl;
+ c->anchor = anchor;
+ c->sigs_only = 1;
- xfree( c );
- return rc;
+ c->signed_data.data_fd = -1;
+ c->signed_data.data_names = signedfiles;
+ c->signed_data.used = !!signedfiles;
+
+ c->sigfilename = sigfilename;
+ rc = do_proc_packets (c, a);
+
+ /* If we have not encountered any signature we print an error
+ messages, send a NODATA status back and return an error code.
+ Using log_error is required because verify_files does not check
+ error codes for each file but we want to terminate the process
+ with an error. */
+ if (!rc && !c->any.sig_seen)
+ {
+ write_status_text (STATUS_NODATA, "4");
+ log_error (_("no signature found\n"));
+ rc = GPG_ERR_NO_DATA;
+ }
+
+ /* Propagate the signature seen flag upward. Do this only on success
+ so that we won't issue the nodata status several times. */
+ if (!rc && c->anchor && c->any.sig_seen)
+ c->anchor->any.sig_seen = 1;
+
+ xfree (c);
+ return rc;
}
int
proc_signature_packets_by_fd (ctrl_t ctrl,
- void *anchor, IOBUF a, int signed_data_fd )
+ void *anchor, iobuf_t a, int signed_data_fd )
{
int rc;
CTX c;
c->signed_data.data_names = NULL;
c->signed_data.used = (signed_data_fd != -1);
- rc = do_proc_packets ( c, a );
+ rc = do_proc_packets (c, a);
/* If we have not encountered any signature we print an error
messages, send a NODATA status back and return an error code.
int
-proc_encryption_packets (ctrl_t ctrl, void *anchor, IOBUF a )
+proc_encryption_packets (ctrl_t ctrl, void *anchor, iobuf_t a )
{
- CTX c = xmalloc_clear( sizeof *c );
- int rc;
-
- c->ctrl = ctrl;
- c->anchor = anchor;
- c->encrypt_only = 1;
- rc = do_proc_packets( c, a );
- xfree( c );
- return rc;
+ CTX c = xmalloc_clear (sizeof *c);
+ int rc;
+
+ c->ctrl = ctrl;
+ c->anchor = anchor;
+ c->encrypt_only = 1;
+ rc = do_proc_packets (c, a);
+ xfree (c);
+ return rc;
}
write_status_text (STATUS_UNEXPECTED, "1");
return GPG_ERR_BAD_DATA;
}
+
return 0;
}
static int
-do_proc_packets( CTX c, IOBUF a )
+do_proc_packets (CTX c, iobuf_t a)
{
- PACKET *pkt;
- int rc = 0;
- int any_data = 0;
- int newpkt;
-
- rc = check_nesting (c);
- if (rc)
- return rc;
-
- pkt = xmalloc( sizeof *pkt );
- c->iobuf = a;
- init_packet(pkt);
- while( (rc=parse_packet(a, pkt)) != -1 ) {
- any_data = 1;
- if( rc ) {
- free_packet(pkt);
- /* stop processing when an invalid packet has been encountered
- * but don't do so when we are doing a --list-packets. */
- if (gpg_err_code (rc) == GPG_ERR_INV_PACKET
- && opt.list_packets != 2 )
- break;
- continue;
+ PACKET *pkt;
+ struct parse_packet_ctx_s parsectx;
+ int rc = 0;
+ int any_data = 0;
+ int newpkt;
+
+ rc = check_nesting (c);
+ if (rc)
+ return rc;
+
+ pkt = xmalloc( sizeof *pkt );
+ c->iobuf = a;
+ init_packet(pkt);
+ init_parse_packet (&parsectx, a);
+ while ((rc=parse_packet (&parsectx, pkt)) != -1)
+ {
+ any_data = 1;
+ if (rc)
+ {
+ free_packet (pkt, &parsectx);
+ /* Stop processing when an invalid packet has been encountered
+ * but don't do so when we are doing a --list-packets. */
+ if (gpg_err_code (rc) == GPG_ERR_INV_PACKET
+ && opt.list_packets == 0)
+ break;
+ continue;
}
- newpkt = -1;
- if( opt.list_packets ) {
- switch( pkt->pkttype ) {
- case PKT_PUBKEY_ENC: proc_pubkey_enc( c, pkt ); break;
- case PKT_SYMKEY_ENC: proc_symkey_enc( c, pkt ); break;
- case PKT_ENCRYPTED:
- case PKT_ENCRYPTED_MDC: proc_encrypted( c, pkt ); break;
- case PKT_COMPRESSED: rc = proc_compressed( c, pkt ); break;
- default: newpkt = 0; break;
+ newpkt = -1;
+ if (opt.list_packets)
+ {
+ switch (pkt->pkttype)
+ {
+ case PKT_PUBKEY_ENC: proc_pubkey_enc (c, pkt); break;
+ case PKT_SYMKEY_ENC: proc_symkey_enc (c, pkt); break;
+ case PKT_ENCRYPTED:
+ case PKT_ENCRYPTED_MDC:
+ case PKT_ENCRYPTED_AEAD:proc_encrypted (c, pkt); break;
+ case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
+ default: newpkt = 0; break;
}
}
- else if( c->sigs_only ) {
- switch( pkt->pkttype ) {
- case PKT_PUBLIC_KEY:
- case PKT_SECRET_KEY:
- case PKT_USER_ID:
- case PKT_SYMKEY_ENC:
- case PKT_PUBKEY_ENC:
- case PKT_ENCRYPTED:
- case PKT_ENCRYPTED_MDC:
- write_status_text( STATUS_UNEXPECTED, "0" );
- rc = G10ERR_UNEXPECTED;
- goto leave;
- case PKT_SIGNATURE: newpkt = add_signature( c, pkt ); break;
- case PKT_PLAINTEXT: proc_plaintext( c, pkt ); break;
- case PKT_COMPRESSED: rc = proc_compressed( c, pkt ); break;
- case PKT_ONEPASS_SIG: newpkt = add_onepass_sig( c, pkt ); break;
- case PKT_GPG_CONTROL: newpkt = add_gpg_control(c, pkt); break;
- default: newpkt = 0; break;
+ else if (c->sigs_only)
+ {
+ switch (pkt->pkttype)
+ {
+ case PKT_PUBLIC_KEY:
+ case PKT_SECRET_KEY:
+ case PKT_USER_ID:
+ case PKT_SYMKEY_ENC:
+ case PKT_PUBKEY_ENC:
+ case PKT_ENCRYPTED:
+ case PKT_ENCRYPTED_MDC:
+ case PKT_ENCRYPTED_AEAD:
+ write_status_text( STATUS_UNEXPECTED, "0" );
+ rc = GPG_ERR_UNEXPECTED;
+ goto leave;
+
+ case PKT_SIGNATURE: newpkt = add_signature (c, pkt); break;
+ case PKT_PLAINTEXT: proc_plaintext (c, pkt); break;
+ case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
+ case PKT_ONEPASS_SIG: newpkt = add_onepass_sig (c, pkt); break;
+ case PKT_GPG_CONTROL: newpkt = add_gpg_control (c, pkt); break;
+ default: newpkt = 0; break;
}
}
- else if( c->encrypt_only ) {
- switch( pkt->pkttype ) {
- case PKT_PUBLIC_KEY:
- case PKT_SECRET_KEY:
- case PKT_USER_ID:
- write_status_text( STATUS_UNEXPECTED, "0" );
- rc = G10ERR_UNEXPECTED;
- goto leave;
- case PKT_SIGNATURE: newpkt = add_signature( c, pkt ); break;
- case PKT_SYMKEY_ENC: proc_symkey_enc( c, pkt ); break;
- case PKT_PUBKEY_ENC: proc_pubkey_enc( c, pkt ); break;
- case PKT_ENCRYPTED:
- case PKT_ENCRYPTED_MDC: proc_encrypted( c, pkt ); break;
- case PKT_PLAINTEXT: proc_plaintext( c, pkt ); break;
- case PKT_COMPRESSED: rc = proc_compressed( c, pkt ); break;
- case PKT_ONEPASS_SIG: newpkt = add_onepass_sig( c, pkt ); break;
- case PKT_GPG_CONTROL: newpkt = add_gpg_control(c, pkt); break;
- default: newpkt = 0; break;
+ else if (c->encrypt_only)
+ {
+ switch (pkt->pkttype)
+ {
+ case PKT_PUBLIC_KEY:
+ case PKT_SECRET_KEY:
+ case PKT_USER_ID:
+ write_status_text (STATUS_UNEXPECTED, "0");
+ rc = GPG_ERR_UNEXPECTED;
+ goto leave;
+
+ case PKT_SIGNATURE: newpkt = add_signature (c, pkt); break;
+ case PKT_SYMKEY_ENC: proc_symkey_enc (c, pkt); break;
+ case PKT_PUBKEY_ENC: proc_pubkey_enc (c, pkt); break;
+ case PKT_ENCRYPTED:
+ case PKT_ENCRYPTED_MDC:
+ case PKT_ENCRYPTED_AEAD: proc_encrypted (c, pkt); break;
+ case PKT_PLAINTEXT: proc_plaintext (c, pkt); break;
+ case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
+ case PKT_ONEPASS_SIG: newpkt = add_onepass_sig (c, pkt); break;
+ case PKT_GPG_CONTROL: newpkt = add_gpg_control (c, pkt); break;
+ default: newpkt = 0; break;
}
}
- else {
- switch( pkt->pkttype ) {
- case PKT_PUBLIC_KEY:
- case PKT_SECRET_KEY:
- release_list( c );
- c->list = new_kbnode( pkt );
- newpkt = 1;
- break;
- case PKT_PUBLIC_SUBKEY:
- case PKT_SECRET_SUBKEY:
- newpkt = add_subkey( c, pkt );
- break;
- case PKT_USER_ID: newpkt = add_user_id( c, pkt ); break;
- case PKT_SIGNATURE: newpkt = add_signature( c, pkt ); break;
- case PKT_PUBKEY_ENC: proc_pubkey_enc( c, pkt ); break;
- case PKT_SYMKEY_ENC: proc_symkey_enc( c, pkt ); break;
- case PKT_ENCRYPTED:
- case PKT_ENCRYPTED_MDC: proc_encrypted( c, pkt ); break;
- case PKT_PLAINTEXT: proc_plaintext( c, pkt ); break;
- case PKT_COMPRESSED: rc = proc_compressed( c, pkt ); break;
- case PKT_ONEPASS_SIG: newpkt = add_onepass_sig( c, pkt ); break;
- case PKT_GPG_CONTROL: newpkt = add_gpg_control(c, pkt); break;
- case PKT_RING_TRUST: newpkt = add_ring_trust( c, pkt ); break;
- default: newpkt = 0; break;
+ else
+ {
+ switch (pkt->pkttype)
+ {
+ case PKT_PUBLIC_KEY:
+ case PKT_SECRET_KEY:
+ release_list (c);
+ c->list = new_kbnode (pkt);
+ newpkt = 1;
+ break;
+ case PKT_PUBLIC_SUBKEY:
+ case PKT_SECRET_SUBKEY:
+ newpkt = add_subkey (c, pkt);
+ break;
+ case PKT_USER_ID: newpkt = add_user_id (c, pkt); break;
+ case PKT_SIGNATURE: newpkt = add_signature (c, pkt); break;
+ case PKT_PUBKEY_ENC: proc_pubkey_enc (c, pkt); break;
+ case PKT_SYMKEY_ENC: proc_symkey_enc (c, pkt); break;
+ case PKT_ENCRYPTED:
+ case PKT_ENCRYPTED_MDC:
+ case PKT_ENCRYPTED_AEAD: proc_encrypted (c, pkt); break;
+ case PKT_PLAINTEXT: proc_plaintext (c, pkt); break;
+ case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
+ case PKT_ONEPASS_SIG: newpkt = add_onepass_sig (c, pkt); break;
+ case PKT_GPG_CONTROL: newpkt = add_gpg_control(c, pkt); break;
+ case PKT_RING_TRUST: newpkt = add_ring_trust (c, pkt); break;
+ default: newpkt = 0; break;
}
}
- if (rc)
- goto leave;
-
- /* This is a very ugly construct and frankly, I don't remember why
- * I used it. Adding the MDC check here is a hack.
- * The right solution is to initiate another context for encrypted
- * packet and not to reuse the current one ... It works right
- * when there is a compression packet inbetween which adds just
- * an extra layer.
- * Hmmm: Rewrite this whole module here??
- */
- if( pkt->pkttype != PKT_SIGNATURE && pkt->pkttype != PKT_MDC )
- c->any.data = (pkt->pkttype == PKT_PLAINTEXT);
-
- if( newpkt == -1 )
- ;
- else if( newpkt ) {
- pkt = xmalloc( sizeof *pkt );
- init_packet(pkt);
+ if (rc)
+ goto leave;
+
+ /* This is a very ugly construct and frankly, I don't remember why
+ * I used it. Adding the MDC check here is a hack.
+ * The right solution is to initiate another context for encrypted
+ * packet and not to reuse the current one ... It works right
+ * when there is a compression packet between which adds just
+ * an extra layer.
+ * Hmmm: Rewrite this whole module here??
+ */
+ if (pkt->pkttype != PKT_SIGNATURE && pkt->pkttype != PKT_MDC)
+ c->any.data = (pkt->pkttype == PKT_PLAINTEXT);
+
+ if (newpkt == -1)
+ ;
+ else if (newpkt)
+ {
+ pkt = xmalloc (sizeof *pkt);
+ init_packet (pkt);
}
- else
- free_packet(pkt);
- }
- if( rc == G10ERR_INVALID_PACKET )
- write_status_text( STATUS_NODATA, "3" );
- if( any_data )
- rc = 0;
- else if( rc == -1 )
- write_status_text( STATUS_NODATA, "2" );
-
-
- leave:
- release_list( c );
- xfree(c->dek);
- free_packet( pkt );
- xfree( pkt );
- free_md_filter_context( &c->mfx );
- return rc;
+ else
+ free_packet (pkt, &parsectx);
+ }
+
+ if (rc == GPG_ERR_INV_PACKET)
+ write_status_text (STATUS_NODATA, "3");
+
+ if (any_data)
+ rc = 0;
+ else if (rc == -1)
+ write_status_text (STATUS_NODATA, "2");
+
+
+ leave:
+ release_list (c);
+ xfree(c->dek);
+ free_packet (pkt, &parsectx);
+ deinit_parse_packet (&parsectx);
+ xfree (pkt);
+ free_md_filter_context (&c->mfx);
+ return rc;
}
-/* Helper for pka_uri_from_sig to parse the to-be-verified address out
- of the notation data. */
-static pka_info_t *
-get_pka_address (PKT_signature *sig)
+/* Return true if the AKL has the WKD method specified. */
+static int
+akl_has_wkd_method (void)
{
- pka_info_t *pka = NULL;
- struct notation *nd,*notation;
-
- notation=sig_to_notation(sig);
-
- for(nd=notation;nd;nd=nd->next)
- {
- if(strcmp(nd->name,"pka-address@gnupg.org")!=0)
- continue; /* Not the notation we want. */
-
- /* For now we only use the first valid PKA notation. In future
- we might want to keep additional PKA notations in a linked
- list. */
- if (is_valid_mailbox (nd->value))
- {
- pka = xmalloc (sizeof *pka + strlen(nd->value));
- pka->valid = 0;
- pka->checked = 0;
- pka->uri = NULL;
- strcpy (pka->email, nd->value);
- break;
- }
- }
-
- free_notation(notation);
+ struct akl *akl;
- return pka;
+ for (akl = opt.auto_key_locate; akl; akl = akl->next)
+ if (akl->type == AKL_WKD)
+ return 1;
+ return 0;
}
-/* Return the URI from a DNS PKA record. If this record has already
- be retrieved for the signature we merely return it; if not we go
- out and try to get that DNS record. */
-static const char *
-pka_uri_from_sig (PKT_signature *sig)
+/* Return the ISSUER fingerprint buffer and its length at R_LEN.
+ * Returns NULL if not available. The returned buffer is valid as
+ * long as SIG is not modified. */
+const byte *
+issuer_fpr_raw (PKT_signature *sig, size_t *r_len)
{
- if (!sig->flags.pka_tried)
- {
- assert (!sig->pka_info);
- sig->flags.pka_tried = 1;
- sig->pka_info = get_pka_address (sig);
- if (sig->pka_info)
- {
- char *uri;
+ const byte *p;
+ size_t n;
- uri = get_pka_info (sig->pka_info->email, sig->pka_info->fpr);
- if (uri)
- {
- sig->pka_info->valid = 1;
- if (!*uri)
- xfree (uri);
- else
- sig->pka_info->uri = uri;
- }
- }
+ p = parse_sig_subpkt (sig, 1, SIGSUBPKT_ISSUER_FPR, &n);
+ if (p && ((n == 21 && p[0] == 4) || (n == 33 && p[0] == 5)))
+ {
+ *r_len = n - 1;
+ return p+1;
}
- return sig->pka_info? sig->pka_info->uri : NULL;
+ *r_len = 0;
+ return NULL;
+}
+
+
+/* Return the ISSUER fingerprint string in human readable format if
+ * available. Caller must release the string. */
+/* FIXME: Move to another file. */
+char *
+issuer_fpr_string (PKT_signature *sig)
+{
+ const byte *p;
+ size_t n;
+
+ p = issuer_fpr_raw (sig, &n);
+ return p? bin2hex (p, n, NULL) : NULL;
}
static int
-check_sig_and_print (CTX c, KBNODE node)
+check_sig_and_print (CTX c, kbnode_t node)
{
PKT_signature *sig = node->pkt->pkt.signature;
const char *astr;
- int rc;
+ gpg_error_t rc;
int is_expkey = 0;
int is_revkey = 0;
- char pkstrbuf[PUBKEY_STRING_SIZE];
-
- *pkstrbuf = 0;
+ char *issuer_fpr = NULL;
+ PKT_public_key *pk = NULL; /* The public key for the signature or NULL. */
+ const void *extrahash = NULL;
+ size_t extrahashlen = 0;
+ kbnode_t included_keyblock = NULL;
if (opt.skip_verify)
{
}
/* Check that the message composition is valid.
-
- Per RFC-2440bis (-15) allowed:
-
- S{1,n} -- detached signature.
- S{1,n} P -- old style PGP2 signature
- O{1,n} P S{1,n} -- standard OpenPGP signature.
- C P S{1,n} -- cleartext signature.
-
-
- O = One-Pass Signature packet.
- S = Signature packet.
- P = OpenPGP Message packet (Encrypted | Compressed | Literal)
- (Note that the current rfc2440bis draft also allows
- for a signed message but that does not work as it
- introduces ambiguities.)
- We keep track of these packages using the marker packet
- CTRLPKT_PLAINTEXT_MARK.
- C = Marker packet for cleartext signatures.
-
- We reject all other messages.
-
- Actually we are calling this too often, i.e. for verification of
- each message but better have some duplicate work than to silently
- introduce a bug here.
- */
+ *
+ * Per RFC-2440bis (-15) allowed:
+ *
+ * S{1,n} -- detached signature.
+ * S{1,n} P -- old style PGP2 signature
+ * O{1,n} P S{1,n} -- standard OpenPGP signature.
+ * C P S{1,n} -- cleartext signature.
+ *
+ *
+ * O = One-Pass Signature packet.
+ * S = Signature packet.
+ * P = OpenPGP Message packet (Encrypted | Compressed | Literal)
+ * (Note that the current rfc2440bis draft also allows
+ * for a signed message but that does not work as it
+ * introduces ambiguities.)
+ * We keep track of these packages using the marker packet
+ * CTRLPKT_PLAINTEXT_MARK.
+ * C = Marker packet for cleartext signatures.
+ *
+ * We reject all other messages.
+ *
+ * Actually we are calling this too often, i.e. for verification of
+ * each message but better have some duplicate work than to silently
+ * introduce a bug here.
+ */
{
- KBNODE n;
+ kbnode_t n;
int n_onepass, n_sig;
/* log_debug ("checking signature packet composition\n"); */
/* dump_kbnode (c->list); */
n = c->list;
- assert (n);
+ log_assert (n);
if ( n->pkt->pkttype == PKT_SIGNATURE )
{
/* This is either "S{1,n}" case (detached signature) or
{
if (n->next)
goto ambiguous; /* We only allow one P packet. */
+ extrahash = n->pkt->pkt.gpg_control->data;
+ extrahashlen = n->pkt->pkt.gpg_control->datalen;
}
else
goto ambiguous;
&& (n->pkt->pkt.gpg_control->control
== CTRLPKT_PLAINTEXT_MARK)))
goto ambiguous;
+ extrahash = n->pkt->pkt.gpg_control->data;
+ extrahashlen = n->pkt->pkt.gpg_control->datalen;
+
for (n_sig=0, n = n->next;
n && n->pkt->pkttype == PKT_SIGNATURE; n = n->next)
n_sig++;
goto ambiguous;
/* If we wanted to disallow multiple sig verification, we'd do
- something like this:
-
- if (n && !opt.allow_multisig_verification)
- goto ambiguous;
-
- However, now that we have --allow-multiple-messages, this
- can stay allowable as we can't get here unless multiple
- messages (i.e. multiple literals) are allowed. */
+ * something like this:
+ *
+ * if (n)
+ * goto ambiguous;
+ *
+ * However, this can stay allowable as we can't get here. */
if (n_onepass != n_sig)
{
&& (n->pkt->pkt.gpg_control->control
== CTRLPKT_PLAINTEXT_MARK)))
goto ambiguous;
+ extrahash = n->pkt->pkt.gpg_control->data;
+ extrahashlen = n->pkt->pkt.gpg_control->datalen;
for (n_sig=0, n = n->next;
n && n->pkt->pkttype == PKT_SIGNATURE; n = n->next)
n_sig++;
log_error(_("can't handle this ambiguous signature data\n"));
return 0;
}
- }
+ } /* End checking signature packet composition. */
+
+ if (sig->signers_uid)
+ write_status_buffer (STATUS_NEWSIG,
+ sig->signers_uid, strlen (sig->signers_uid), 0);
+ else
+ write_status_text (STATUS_NEWSIG, NULL);
astr = openpgp_pk_algo_name ( sig->pubkey_algo );
- if (keystrlen () > 8)
+ issuer_fpr = issuer_fpr_string (sig);
+
+ if (issuer_fpr)
+ {
+ log_info (_("Signature made %s\n"), asctimestamp(sig->timestamp));
+ log_info (_(" using %s key %s\n"),
+ astr? astr: "?", issuer_fpr);
+
+ }
+ else if (!keystrlen () || keystrlen () > 8)
{
log_info (_("Signature made %s\n"), asctimestamp(sig->timestamp));
log_info (_(" using %s key %s\n"),
- astr? astr: "?",keystr(sig->keyid));
+ astr? astr: "?", keystr(sig->keyid));
}
- else
+ else /* Legacy format. */
log_info (_("Signature made %s using %s key ID %s\n"),
asctimestamp(sig->timestamp), astr? astr: "?",
keystr(sig->keyid));
- rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey );
+ /* In verbose mode print the signers UID. */
+ if (sig->signers_uid)
+ log_info (_(" issuer \"%s\"\n"), sig->signers_uid);
+
+ rc = do_check_sig (c, node, extrahash, extrahashlen, NULL,
+ NULL, &is_expkey, &is_revkey, &pk);
+
+ /* If the key is not found but the signature includes a key block we
+ * use that key block for verification and on success import it. */
+ if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
+ && sig->flags.key_block
+ && opt.flags.auto_key_import)
+ {
+ PKT_public_key *included_pk;
+ const byte *kblock;
+ size_t kblock_len;
+
+ included_pk = xcalloc (1, sizeof *included_pk);
+ kblock = parse_sig_subpkt (sig, 1, SIGSUBPKT_KEY_BLOCK, &kblock_len);
+ if (kblock && kblock_len > 1
+ && !get_pubkey_from_buffer (c->ctrl, included_pk,
+ kblock+1, kblock_len-1,
+ sig->keyid, &included_keyblock))
+ {
+ rc = do_check_sig (c, node, extrahash, extrahashlen, included_pk,
+ NULL, &is_expkey, &is_revkey, &pk);
+ if (opt.verbose)
+ log_debug ("checked signature using included key block: %s\n",
+ gpg_strerror (rc));
+ if (!rc)
+ {
+ /* The keyblock has been verified, we now import it. */
+ rc = import_included_key_block (c->ctrl, included_keyblock);
+ }
- /* If the key isn't found, check for a preferred keyserver */
+ }
+ free_public_key (included_pk);
+ }
- if (gpg_err_code (rc) == G10ERR_NO_PUBKEY && sig->flags.pref_ks)
+ /* If the key isn't found, check for a preferred keyserver. Note
+ * that this is only done if honor-keyserver-url has been set. We
+ * test for this in the loop so that we can show info about the
+ * preferred keyservers. */
+ if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
+ && sig->flags.pref_ks)
{
const byte *p;
int seq = 0;
size_t n;
+ int any_pref_ks = 0;
- while ((p=enum_sig_subpkt (sig->hashed,SIGSUBPKT_PREF_KS,&n,&seq,NULL)))
+ while ((p=enum_sig_subpkt (sig, 1, SIGSUBPKT_PREF_KS, &n, &seq, NULL)))
{
/* According to my favorite copy editor, in English grammar,
you say "at" if the key is located on a web page, but
log_info(_("Key available at: ") );
print_utf8_buffer (log_get_stream(), p, n);
log_printf ("\n");
+ any_pref_ks = 1;
- if (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE
- && opt.keyserver_options.options&KEYSERVER_HONOR_KEYSERVER_URL)
+ if ((opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE)
+ && (opt.keyserver_options.options&KEYSERVER_HONOR_KEYSERVER_URL))
{
struct keyserver_spec *spec;
{
int res;
+ if (DBG_LOOKUP)
+ log_debug ("trying auto-key-retrieve method %s\n",
+ "Pref-KS");
+
+ free_public_key (pk);
+ pk = NULL;
glo_ctrl.in_auto_key_retrieve++;
- res = keyserver_import_keyid (c->ctrl, sig->keyid,spec);
+ res = keyserver_import_keyid (c->ctrl, sig->keyid,spec,
+ KEYSERVER_IMPORT_FLAG_QUICK);
glo_ctrl.in_auto_key_retrieve--;
if (!res)
- rc = do_check_sig(c, node, NULL, &is_expkey, &is_revkey );
+ rc = do_check_sig (c, node, extrahash, extrahashlen, NULL,
+ NULL, &is_expkey, &is_revkey, &pk);
+ else if (DBG_LOOKUP)
+ log_debug ("lookup via %s failed: %s\n", "Pref-KS",
+ gpg_strerror (res));
free_keyserver_spec (spec);
if (!rc)
}
}
}
+
+ if (any_pref_ks
+ && (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE)
+ && !(opt.keyserver_options.options&KEYSERVER_HONOR_KEYSERVER_URL))
+ log_info (_("Note: Use '%s' to make use of this info\n"),
+ "--keyserver-option honor-keyserver-url");
}
- /* If the preferred keyserver thing above didn't work, our second
- try is to use the URI from a DNS PKA record. */
- if (gpg_err_code (rc) == G10ERR_NO_PUBKEY
+ /* If the above methods didn't work, our next try is to retrieve the
+ * key from the WKD. This requires that WKD is in the AKL and the
+ * Signer's UID is in the signature. */
+ if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
&& (opt.keyserver_options.options & KEYSERVER_AUTO_KEY_RETRIEVE)
- && (opt.keyserver_options.options & KEYSERVER_HONOR_PKA_RECORD))
+ && !opt.flags.disable_signer_uid
+ && akl_has_wkd_method ()
+ && sig->signers_uid)
{
- const char *uri = pka_uri_from_sig (sig);
-
- if (uri)
- {
- /* FIXME: We might want to locate the key using the
- fingerprint instead of the keyid. */
- int res;
- struct keyserver_spec *spec;
+ int res;
- spec = parse_keyserver_uri (uri, 1, NULL, 0);
- if (spec)
- {
- glo_ctrl.in_auto_key_retrieve++;
- res = keyserver_import_keyid (c->ctrl, sig->keyid, spec);
- glo_ctrl.in_auto_key_retrieve--;
- free_keyserver_spec (spec);
- if (!res)
- rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey );
- }
- }
+ if (DBG_LOOKUP)
+ log_debug ("trying auto-key-retrieve method %s\n", "WKD");
+ free_public_key (pk);
+ pk = NULL;
+ glo_ctrl.in_auto_key_retrieve++;
+ res = keyserver_import_wkd (c->ctrl, sig->signers_uid,
+ KEYSERVER_IMPORT_FLAG_QUICK, NULL, NULL);
+ glo_ctrl.in_auto_key_retrieve--;
+ /* Fixme: If the fingerprint is embedded in the signature,
+ * compare it to the fingerprint of the returned key. */
+ if (!res)
+ rc = do_check_sig (c, node, extrahash, extrahashlen, NULL,
+ NULL, &is_expkey, &is_revkey, &pk);
+ else if (DBG_LOOKUP)
+ log_debug ("lookup via %s failed: %s\n", "WKD", gpg_strerror (res));
}
- /* If the preferred keyserver thing above didn't work and we got
- no information from the DNS PKA, this is a third try. */
-
- if (gpg_err_code (rc) == G10ERR_NO_PUBKEY
- && opt.keyserver
- && (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE))
+ /* If the above methods didn't work, our next try is to locate
+ * the key via its fingerprint from a keyserver. This requires
+ * that the signers fingerprint is encoded in the signature. */
+ if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
+ && (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE)
+ && keyserver_any_configured (c->ctrl))
{
int res;
+ const byte *p;
+ size_t n;
- glo_ctrl.in_auto_key_retrieve++;
- res=keyserver_import_keyid (c->ctrl, sig->keyid, opt.keyserver );
- glo_ctrl.in_auto_key_retrieve--;
- if (!res)
- rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey );
+ p = issuer_fpr_raw (sig, &n);
+ if (p)
+ {
+ if (DBG_LOOKUP)
+ log_debug ("trying auto-key-retrieve method %s\n", "KS");
+
+ /* v4 or v5 packet with a SHA-1/256 fingerprint. */
+ free_public_key (pk);
+ pk = NULL;
+ glo_ctrl.in_auto_key_retrieve++;
+ res = keyserver_import_fprint (c->ctrl, p, n, opt.keyserver,
+ KEYSERVER_IMPORT_FLAG_QUICK);
+ glo_ctrl.in_auto_key_retrieve--;
+ if (!res)
+ rc = do_check_sig (c, node, extrahash, extrahashlen, NULL,
+ NULL, &is_expkey, &is_revkey, &pk);
+ else if (DBG_LOOKUP)
+ log_debug ("lookup via %s failed: %s\n", "KS", gpg_strerror (res));
+ }
}
+ /* Do do something with the result of the signature checking. */
if (!rc || gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE)
{
+ /* We have checked the signature and the result is either a good
+ * signature or a bad signature. Further examination follows. */
kbnode_t un, keyblock;
int count = 0;
+ int keyblock_has_pk = 0; /* For failsafe check. */
int statno;
char keyid_str[50];
- PKT_public_key *pk = NULL;
+ PKT_public_key *mainpk = NULL;
if (rc)
statno = STATUS_BADSIG;
else
statno = STATUS_GOODSIG;
- keyblock = get_pubkeyblock (sig->keyid);
+ /* FIXME: We should have the public key in PK and thus the
+ * keyblock has already been fetched. Thus we could use the
+ * fingerprint or PK itself to lookup the entire keyblock. That
+ * would best be done with a cache. */
+ if (included_keyblock)
+ {
+ keyblock = included_keyblock;
+ included_keyblock = NULL;
+ }
+ else
+ keyblock = get_pubkeyblock_for_sig (c->ctrl, sig);
snprintf (keyid_str, sizeof keyid_str, "%08lX%08lX [uncertain] ",
(ulong)sig->keyid[0], (ulong)sig->keyid[1]);
- /* Find and print the primary user ID. */
+ /* Find and print the primary user ID along with the
+ "Good|Expired|Bad signature" line. */
for (un=keyblock; un; un = un->next)
{
int valid;
- if (un->pkt->pkttype==PKT_PUBLIC_KEY)
+ if (!keyblock_has_pk
+ && (un->pkt->pkttype == PKT_PUBLIC_KEY
+ || un->pkt->pkttype == PKT_PUBLIC_SUBKEY)
+ && !cmp_public_keys (un->pkt->pkt.public_key, pk))
+ {
+ keyblock_has_pk = 1;
+ }
+ if (un->pkt->pkttype == PKT_PUBLIC_KEY)
{
- pk=un->pkt->pkt.public_key;
+ mainpk = un->pkt->pkt.public_key;
continue;
}
if (un->pkt->pkttype != PKT_USER_ID)
continue;
if (!un->pkt->pkt.user_id->created)
continue;
- if (un->pkt->pkt.user_id->is_revoked)
+ if (un->pkt->pkt.user_id->flags.revoked)
continue;
- if (un->pkt->pkt.user_id->is_expired)
+ if (un->pkt->pkt.user_id->flags.expired)
continue;
- if (!un->pkt->pkt.user_id->is_primary)
+ if (!un->pkt->pkt.user_id->flags.primary)
continue;
/* We want the textual primary user ID here */
if (un->pkt->pkt.user_id->attrib_data)
continue;
- assert (pk);
+ log_assert (mainpk);
- /* Get it before we print anything to avoid interrupting the
- output with the "please do a --check-trustdb" line. */
- valid = get_validity (pk, un->pkt->pkt.user_id);
+ /* Since this is just informational, don't actually ask the
+ user to update any trust information. (Note: we register
+ the signature later.) Because print_good_bad_signature
+ does not print a LF we need to compute the validity
+ before calling that function. */
+ if ((opt.verify_options & VERIFY_SHOW_UID_VALIDITY))
+ valid = get_validity (c->ctrl, keyblock, mainpk,
+ un->pkt->pkt.user_id, NULL, 0);
+ else
+ valid = 0; /* Not used. */
keyid_str[17] = 0; /* cut off the "[uncertain]" part */
else
log_printf ("\n");
- pubkey_string (pk, pkstrbuf, sizeof pkstrbuf);
count++;
+ /* At this point we could in theory stop because the primary
+ * UID flag is never set for more than one User ID per
+ * keyblock. However, we use this loop also for a failsafe
+ * check that the public key used to create the signature is
+ * contained in the keyring.*/
}
- if (!count) /* Just in case that we have no valid textual userid */
+ log_assert (mainpk);
+ if (!keyblock_has_pk)
+ {
+ log_error ("signature key lost from keyblock\n");
+ rc = gpg_error (GPG_ERR_INTERNAL);
+ }
+
+ /* In case we did not found a valid textual userid above
+ we print the first user id packet or a "[?]" instead along
+ with the "Good|Expired|Bad signature" line. */
+ if (!count)
{
/* Try for an invalid textual userid */
for (un=keyblock; un; un = un->next)
{
if (un->pkt->pkttype != PKT_USER_ID)
continue;
- if ((un->pkt->pkt.user_id->is_revoked
- || un->pkt->pkt.user_id->is_expired)
+ if ((un->pkt->pkt.user_id->flags.revoked
+ || un->pkt->pkt.user_id->flags.expired)
&& !(opt.verify_options & VERIFY_SHOW_UNUSABLE_UIDS))
continue;
- /* Only skip textual primaries */
- if (un->pkt->pkt.user_id->is_primary
+ /* Skip textual primary user ids which we printed above. */
+ if (un->pkt->pkt.user_id->flags.primary
&& !un->pkt->pkt.user_id->attrib_data )
continue;
+ /* If this user id has attribute data, print that. */
if (un->pkt->pkt.user_id->attrib_data)
{
- dump_attribs (un->pkt->pkt.user_id, pk);
+ dump_attribs (un->pkt->pkt.user_id, mainpk);
if (opt.verify_options&VERIFY_SHOW_PHOTOS)
- show_photos (un->pkt->pkt.user_id->attribs,
+ show_photos (c->ctrl,
+ un->pkt->pkt.user_id->attribs,
un->pkt->pkt.user_id->numattribs,
- pk ,un->pkt->pkt.user_id);
+ mainpk ,un->pkt->pkt.user_id);
}
p = utf8_to_native (un->pkt->pkt.user_id->name,
{
const char *valid;
- if (un->pkt->pkt.user_id->is_revoked)
+ if (un->pkt->pkt.user_id->flags.revoked)
valid = _("revoked");
- else if (un->pkt->pkt.user_id->is_expired)
+ else if (un->pkt->pkt.user_id->flags.expired)
valid = _("expired");
else
+ /* Since this is just informational, don't
+ actually ask the user to update any trust
+ information. */
valid = (trust_value_to_string
- (get_validity (pk, un->pkt->pkt.user_id)));
+ (get_validity (c->ctrl, keyblock, mainpk,
+ un->pkt->pkt.user_id, NULL, 0)));
log_printf (" [%s]\n",valid);
}
else
log_printf ("\n");
}
}
- release_kbnode( keyblock );
+ /* For good signatures print notation data. */
if (!rc)
{
if ((opt.verify_options & VERIFY_SHOW_POLICY_URLS))
show_notation (sig, 0, 2, 0);
}
- if (!rc && is_status_enabled ())
+ /* For good signatures print the VALIDSIG status line. */
+ if (!rc && is_status_enabled () && pk)
{
- /* Print a status response with the fingerprint. */
- PKT_public_key *vpk = xmalloc_clear (sizeof *vpk);
-
- if (!get_pubkey (vpk, sig->keyid))
- {
- byte array[MAX_FINGERPRINT_LEN], *p;
- char buf[MAX_FINGERPRINT_LEN*4+90], *bufp;
- size_t i, n;
-
- bufp = buf;
- fingerprint_from_pk (vpk, array, &n);
- p = array;
- for(i=0; i < n ; i++, p++, bufp += 2)
- sprintf (bufp, "%02X", *p );
- /* TODO: Replace the reserved '0' in the field below
- with bits for status flags (policy url, notation,
- etc.). Remember to make the buffer larger to match! */
- sprintf (bufp, " %s %lu %lu %d 0 %d %d %02X ",
- strtimestamp( sig->timestamp ),
- (ulong)sig->timestamp,(ulong)sig->expiredate,
- sig->version,sig->pubkey_algo,sig->digest_algo,
- sig->sig_class);
- bufp = bufp + strlen (bufp);
- if (!vpk->flags.primary)
- {
- u32 akid[2];
-
- akid[0] = vpk->main_keyid[0];
- akid[1] = vpk->main_keyid[1];
- free_public_key (vpk);
- vpk = xmalloc_clear (sizeof *vpk);
- if (get_pubkey (vpk, akid))
- {
- /* Impossible error, we simply return a zeroed out fpr */
- n = MAX_FINGERPRINT_LEN < 20? MAX_FINGERPRINT_LEN : 20;
- memset (array, 0, n);
- }
- else
- fingerprint_from_pk( vpk, array, &n );
- }
- p = array;
- for (i=0; i < n ; i++, p++, bufp += 2)
- sprintf(bufp, "%02X", *p );
- write_status_text (STATUS_VALIDSIG, buf);
- }
- free_public_key (vpk);
+ char pkhex[MAX_FINGERPRINT_LEN*2+1];
+ char mainpkhex[MAX_FINGERPRINT_LEN*2+1];
+
+ hexfingerprint (pk, pkhex, sizeof pkhex);
+ hexfingerprint (mainpk, mainpkhex, sizeof mainpkhex);
+
+ /* TODO: Replace the reserved '0' in the field below with
+ bits for status flags (policy url, notation, etc.). */
+ write_status_printf (STATUS_VALIDSIG,
+ "%s %s %lu %lu %d 0 %d %d %02X %s",
+ pkhex,
+ strtimestamp (sig->timestamp),
+ (ulong)sig->timestamp,
+ (ulong)sig->expiredate,
+ sig->version, sig->pubkey_algo,
+ sig->digest_algo,
+ sig->sig_class,
+ mainpkhex);
}
+ /* Print compliance warning for Good signatures. */
+ if (!rc && pk && !opt.quiet
+ && !gnupg_pk_is_compliant (opt.compliance, pk->pubkey_algo, 0,
+ pk->pkey, nbits_from_pk (pk), NULL))
+ {
+ log_info (_("WARNING: This key is not suitable for signing"
+ " in %s mode\n"),
+ gnupg_compliance_option_string (opt.compliance));
+ }
+
+ /* For good signatures compute and print the trust information.
+ Note that in the Tofu trust model this may ask the user on
+ how to resolve a conflict. */
if (!rc)
{
- if ((opt.verify_options & VERIFY_PKA_LOOKUPS))
- pka_uri_from_sig (sig); /* Make sure PKA info is available. */
- rc = check_signatures_trust (sig);
+ rc = check_signatures_trust (c->ctrl, keyblock, pk, sig);
}
+ /* Print extra information about the signature. */
if (sig->flags.expired)
{
log_info (_("Signature expired %s\n"), asctimestamp(sig->expiredate));
- rc = G10ERR_GENERAL; /* need a better error here? */
+ if (!rc)
+ rc = gpg_error (GPG_ERR_GENERAL); /* Need a better error here? */
}
else if (sig->expiredate)
log_info (_("Signature expires %s\n"), asctimestamp(sig->expiredate));
if (opt.verbose)
- log_info (_("%s signature, digest algorithm %s%s%s\n"),
- sig->sig_class==0x00?_("binary"):
- sig->sig_class==0x01?_("textmode"):_("unknown"),
- gcry_md_algo_name (sig->digest_algo),
- *pkstrbuf?_(", key algorithm "):"",
- pkstrbuf);
+ {
+ char pkstrbuf[PUBKEY_STRING_SIZE];
+
+ if (pk)
+ pubkey_string (pk, pkstrbuf, sizeof pkstrbuf);
+ else
+ *pkstrbuf = 0;
+
+ log_info (_("%s signature, digest algorithm %s%s%s\n"),
+ sig->sig_class==0x00?_("binary"):
+ sig->sig_class==0x01?_("textmode"):_("unknown"),
+ gcry_md_algo_name (sig->digest_algo),
+ *pkstrbuf?_(", key algorithm "):"", pkstrbuf);
+ }
+
+ /* Print final warnings. */
+ if (!rc && !c->signed_data.used)
+ {
+ /* Signature is basically good but we test whether the
+ deprecated command
+ gpg --verify FILE.sig
+ was used instead of
+ gpg --verify FILE.sig FILE
+ to verify a detached signature. If we figure out that a
+ data file with a matching name exists, we print a warning.
+
+ The problem is that the first form would also verify a
+ standard signature. This behavior could be used to
+ create a made up .sig file for a tarball by creating a
+ standard signature from a valid detached signature packet
+ (for example from a signed git tag). Then replace the
+ sig file on the FTP server along with a changed tarball.
+ Using the first form the verify command would correctly
+ verify the signature but don't even consider the tarball. */
+ kbnode_t n;
+ char *dfile;
+
+ dfile = get_matching_datafile (c->sigfilename);
+ if (dfile)
+ {
+ for (n = c->list; n; n = n->next)
+ if (n->pkt->pkttype != PKT_SIGNATURE)
+ break;
+ if (n)
+ {
+ /* Not only signature packets in the tree thus this
+ is not a detached signature. */
+ log_info (_("WARNING: not a detached signature; "
+ "file '%s' was NOT verified!\n"), dfile);
+ }
+ xfree (dfile);
+ }
+ }
+ /* Compute compliance with CO_DE_VS. */
+ if (pk && is_status_enabled ()
+ && gnupg_gcrypt_is_compliant (CO_DE_VS)
+ && gnupg_pk_is_compliant (CO_DE_VS, pk->pubkey_algo, 0, pk->pkey,
+ nbits_from_pk (pk), NULL)
+ && gnupg_digest_is_compliant (CO_DE_VS, sig->digest_algo))
+ write_status_strings (STATUS_VERIFICATION_COMPLIANCE_MODE,
+ gnupg_status_compliance_flag (CO_DE_VS),
+ NULL);
+
+ free_public_key (pk);
+ pk = NULL;
+ release_kbnode( keyblock );
if (rc)
g10_errors_seen = 1;
if (opt.batch && rc)
g10_exit (1);
}
- else
+ else /* Error checking the signature. (neither Good nor Bad). */
{
- char buf[50];
-
- snprintf (buf, sizeof buf, "%08lX%08lX %d %d %02x %lu %d",
- (ulong)sig->keyid[0], (ulong)sig->keyid[1],
- sig->pubkey_algo, sig->digest_algo,
- sig->sig_class, (ulong)sig->timestamp, rc);
- write_status_text (STATUS_ERRSIG, buf);
- if (gpg_err_code (rc) == G10ERR_NO_PUBKEY)
+ write_status_printf (STATUS_ERRSIG, "%08lX%08lX %d %d %02x %lu %d %s",
+ (ulong)sig->keyid[0], (ulong)sig->keyid[1],
+ sig->pubkey_algo, sig->digest_algo,
+ sig->sig_class, (ulong)sig->timestamp,
+ gpg_err_code (rc),
+ issuer_fpr? issuer_fpr:"-");
+ if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY)
{
- buf[16] = 0;
- write_status_text (STATUS_NO_PUBKEY, buf);
+ write_status_printf (STATUS_NO_PUBKEY, "%08lX%08lX",
+ (ulong)sig->keyid[0], (ulong)sig->keyid[1]);
}
- if (gpg_err_code (rc) != G10ERR_NOT_PROCESSED)
- log_error (_("Can't check signature: %s\n"), g10_errstr(rc));
+ if (gpg_err_code (rc) != GPG_ERR_NOT_PROCESSED)
+ log_error (_("Can't check signature: %s\n"), gpg_strerror (rc));
}
+ free_public_key (pk);
+ release_kbnode (included_keyblock);
+ xfree (issuer_fpr);
return rc;
}
-/****************
+/*
* Process the tree which starts at node
*/
static void
-proc_tree( CTX c, KBNODE node )
+proc_tree (CTX c, kbnode_t node)
{
- KBNODE n1;
- int rc;
-
- if( opt.list_packets || opt.list_only )
- return;
-
- /* we must skip our special plaintext marker packets here becuase
- they may be the root packet. These packets are only used in
- addionla checks and skipping them here doesn't matter */
- while ( node
- && node->pkt->pkttype == PKT_GPG_CONTROL
- && node->pkt->pkt.gpg_control->control
- == CTRLPKT_PLAINTEXT_MARK ) {
- node = node->next;
- }
- if (!node)
- return;
+ kbnode_t n1;
+ int rc;
- c->trustletter = ' ';
- if( node->pkt->pkttype == PKT_PUBLIC_KEY
- || node->pkt->pkttype == PKT_PUBLIC_SUBKEY ) {
- merge_keys_and_selfsig( node );
- list_node( c, node );
- }
- else if( node->pkt->pkttype == PKT_SECRET_KEY ) {
- merge_keys_and_selfsig( node );
- list_node( c, node );
- }
- else if( node->pkt->pkttype == PKT_ONEPASS_SIG ) {
- /* check all signatures */
- if( !c->any.data ) {
- int use_textmode = 0;
-
- free_md_filter_context( &c->mfx );
- /* prepare to create all requested message digests */
- if (gcry_md_open (&c->mfx.md, 0, 0))
- BUG ();
-
- /* fixme: why looking for the signature packet and not the
- one-pass packet? */
- for ( n1 = node; (n1 = find_next_kbnode(n1, PKT_SIGNATURE )); )
- {
- gcry_md_enable (c->mfx.md,
- n1->pkt->pkt.signature->digest_algo);
- }
+ if (opt.list_packets || opt.list_only)
+ return;
- if (n1 && n1->pkt->pkt.onepass_sig->sig_class == 0x01)
- use_textmode = 1;
+ /* We must skip our special plaintext marker packets here because
+ they may be the root packet. These packets are only used in
+ additional checks and skipping them here doesn't matter. */
+ while (node
+ && node->pkt->pkttype == PKT_GPG_CONTROL
+ && node->pkt->pkt.gpg_control->control == CTRLPKT_PLAINTEXT_MARK)
+ {
+ node = node->next;
+ }
+ if (!node)
+ return;
- /* Ask for file and hash it. */
- if( c->sigs_only ) {
- if (c->signed_data.used && c->signed_data.data_fd != -1)
- rc = hash_datafile_by_fd (c->mfx.md, NULL,
- c->signed_data.data_fd,
- use_textmode);
- else
- rc = hash_datafiles (c->mfx.md, NULL,
- c->signed_data.data_names,
- c->sigfilename,
- use_textmode );
+ c->trustletter = ' ';
+ if (node->pkt->pkttype == PKT_PUBLIC_KEY
+ || node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
+ {
+ merge_keys_and_selfsig (c->ctrl, node);
+ list_node (c, node);
+ }
+ else if (node->pkt->pkttype == PKT_SECRET_KEY)
+ {
+ merge_keys_and_selfsig (c->ctrl, node);
+ list_node (c, node);
+ }
+ else if (node->pkt->pkttype == PKT_ONEPASS_SIG)
+ {
+ /* Check all signatures. */
+ if (!c->any.data)
+ {
+ int use_textmode = 0;
+
+ free_md_filter_context (&c->mfx);
+ /* Prepare to create all requested message digests. */
+ rc = gcry_md_open (&c->mfx.md, 0, 0);
+ if (rc)
+ goto hash_err;
+
+ /* Fixme: why looking for the signature packet and not the
+ one-pass packet? */
+ for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE));)
+ gcry_md_enable (c->mfx.md, n1->pkt->pkt.signature->digest_algo);
+
+ if (n1 && n1->pkt->pkt.onepass_sig->sig_class == 0x01)
+ use_textmode = 1;
+
+ /* Ask for file and hash it. */
+ if (c->sigs_only)
+ {
+ if (c->signed_data.used && c->signed_data.data_fd != -1)
+ rc = hash_datafile_by_fd (c->mfx.md, NULL,
+ c->signed_data.data_fd,
+ use_textmode);
+ else
+ rc = hash_datafiles (c->mfx.md, NULL,
+ c->signed_data.data_names,
+ c->sigfilename,
+ use_textmode);
}
- else {
- rc = ask_for_detached_datafile (c->mfx.md, c->mfx.md2,
- iobuf_get_real_fname(c->iobuf),
- use_textmode );
+ else
+ {
+ rc = ask_for_detached_datafile (c->mfx.md, c->mfx.md2,
+ iobuf_get_real_fname (c->iobuf),
+ use_textmode);
}
- if( rc ) {
- log_error("can't hash datafile: %s\n", g10_errstr(rc));
- return;
+
+ hash_err:
+ if (rc)
+ {
+ log_error ("can't hash datafile: %s\n", gpg_strerror (rc));
+ return;
}
}
- else if ( c->signed_data.used ) {
- log_error (_("not a detached signature\n") );
- return;
+ else if (c->signed_data.used)
+ {
+ log_error (_("not a detached signature\n"));
+ return;
}
- for( n1 = node; (n1 = find_next_kbnode(n1, PKT_SIGNATURE )); )
- check_sig_and_print( c, n1 );
+ for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE));)
+ check_sig_and_print (c, n1);
+
}
- else if( node->pkt->pkttype == PKT_GPG_CONTROL
- && node->pkt->pkt.gpg_control->control
- == CTRLPKT_CLEARSIGN_START ) {
- /* clear text signed message */
- if( !c->any.data ) {
- log_error("cleartext signature without data\n" );
- return;
+ else if (node->pkt->pkttype == PKT_GPG_CONTROL
+ && node->pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START)
+ {
+ /* Clear text signed message. */
+ if (!c->any.data)
+ {
+ log_error ("cleartext signature without data\n");
+ return;
}
- else if ( c->signed_data.used ) {
- log_error (_("not a detached signature\n") );
- return;
+ else if (c->signed_data.used)
+ {
+ log_error (_("not a detached signature\n"));
+ return;
}
- for( n1 = node; (n1 = find_next_kbnode(n1, PKT_SIGNATURE )); )
- check_sig_and_print( c, n1 );
- }
- else if( node->pkt->pkttype == PKT_SIGNATURE ) {
- PKT_signature *sig = node->pkt->pkt.signature;
- int multiple_ok=1;
-
- n1=find_next_kbnode(node, PKT_SIGNATURE);
- if(n1)
- {
- byte class=sig->sig_class;
- byte hash=sig->digest_algo;
-
- for(; n1; (n1 = find_next_kbnode(n1, PKT_SIGNATURE)))
- {
- /* We can't currently handle multiple signatures of
- different classes or digests (we'd pretty much have
- to run a different hash context for each), but if
- they are all the same, make an exception. */
- if(n1->pkt->pkt.signature->sig_class!=class
- || n1->pkt->pkt.signature->digest_algo!=hash)
- {
- multiple_ok=0;
- log_info(_("WARNING: multiple signatures detected. "
- "Only the first will be checked.\n"));
- break;
- }
- }
- }
-
- if( sig->sig_class != 0x00 && sig->sig_class != 0x01 )
- log_info(_("standalone signature of class 0x%02x\n"),
- sig->sig_class);
- else if( !c->any.data ) {
- /* detached signature */
- free_md_filter_context( &c->mfx );
- if (gcry_md_open (&c->mfx.md, sig->digest_algo, 0))
- BUG ();
-
- if( !opt.pgp2_workarounds )
- ;
- else if( sig->digest_algo == DIGEST_ALGO_MD5
- && is_RSA( sig->pubkey_algo)
- && opt.flags.allow_weak_digest_algos) {
- /* enable a workaround for a pgp2 bug */
- if (gcry_md_open (&c->mfx.md2, DIGEST_ALGO_MD5, 0))
- BUG ();
- }
- else if( sig->digest_algo == DIGEST_ALGO_SHA1
- && sig->pubkey_algo == PUBKEY_ALGO_DSA
- && sig->sig_class == 0x01 ) {
- /* enable the workaround also for pgp5 when the detached
- * signature has been created in textmode */
- if (gcry_md_open (&c->mfx.md2, sig->digest_algo, 0 ))
- BUG ();
+ for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE));)
+ check_sig_and_print (c, n1);
+
+ }
+ else if (node->pkt->pkttype == PKT_SIGNATURE)
+ {
+ PKT_signature *sig = node->pkt->pkt.signature;
+ int multiple_ok = 1;
+
+ n1 = find_next_kbnode (node, PKT_SIGNATURE);
+ if (n1)
+ {
+ byte class = sig->sig_class;
+ byte hash = sig->digest_algo;
+
+ for (; n1; (n1 = find_next_kbnode(n1, PKT_SIGNATURE)))
+ {
+ /* We can't currently handle multiple signatures of
+ * different classes (we'd pretty much have to run a
+ * different hash context for each), but if they are all
+ * the same and it is detached signature, we make an
+ * exception. Note that the old code also disallowed
+ * multiple signatures if the digest algorithms are
+ * different. We softened this restriction only for
+ * detached signatures, to be on the safe side. */
+ if (n1->pkt->pkt.signature->sig_class != class
+ || (c->any.data
+ && n1->pkt->pkt.signature->digest_algo != hash))
+ {
+ multiple_ok = 0;
+ log_info (_("WARNING: multiple signatures detected. "
+ "Only the first will be checked.\n"));
+ break;
+ }
+ }
+ }
+
+ if (sig->sig_class != 0x00 && sig->sig_class != 0x01)
+ {
+ log_info(_("standalone signature of class 0x%02x\n"), sig->sig_class);
+ }
+ else if (!c->any.data)
+ {
+ /* Detached signature */
+ free_md_filter_context (&c->mfx);
+ rc = gcry_md_open (&c->mfx.md, sig->digest_algo, 0);
+ if (rc)
+ goto detached_hash_err;
+
+ if (multiple_ok)
+ {
+ /* If we have and want to handle multiple signatures we
+ * need to enable all hash algorithms for the context. */
+ for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE)); )
+ if (!openpgp_md_test_algo (n1->pkt->pkt.signature->digest_algo))
+ gcry_md_enable (c->mfx.md,
+ map_md_openpgp_to_gcry
+ (n1->pkt->pkt.signature->digest_algo));
+ }
+
+ if (RFC2440 || RFC4880)
+ ; /* Strict RFC mode. */
+ else if (sig->digest_algo == DIGEST_ALGO_SHA1
+ && sig->pubkey_algo == PUBKEY_ALGO_DSA
+ && sig->sig_class == 0x01)
+ {
+ /* Enable a workaround for a pgp5 bug when the detached
+ * signature has been created in textmode. Note that we
+ * do not implement this for multiple signatures with
+ * different hash algorithms. */
+ rc = gcry_md_open (&c->mfx.md2, sig->digest_algo, 0);
+ if (rc)
+ goto detached_hash_err;
}
- /* Here we used to have another hack to work around a pgp
- * 2 bug: It worked by not using the textmode for detached
- * signatures; this would let the first signature check
- * (on md) fail but the second one (on md2), which adds an
- * extra CR would then have produced the "correct" hash.
- * This is very, very ugly hack but it may haved help in
- * some cases (and break others).
- * c->mfx.md2? 0 :(sig->sig_class == 0x01)
- */
-
- if ( DBG_HASHING ) {
- gcry_md_debug( c->mfx.md, "verify" );
- if ( c->mfx.md2 )
- gcry_md_debug( c->mfx.md2, "verify2" );
+ /* Here we used to have another hack to work around a pgp
+ * 2 bug: It worked by not using the textmode for detached
+ * signatures; this would let the first signature check
+ * (on md) fail but the second one (on md2), which adds an
+ * extra CR would then have produced the "correct" hash.
+ * This is very, very ugly hack but it may haved help in
+ * some cases (and break others).
+ * c->mfx.md2? 0 :(sig->sig_class == 0x01)
+ */
+
+ if (DBG_HASHING)
+ {
+ gcry_md_debug (c->mfx.md, "verify");
+ if (c->mfx.md2)
+ gcry_md_debug (c->mfx.md2, "verify2");
}
- if( c->sigs_only ) {
- if (c->signed_data.used && c->signed_data.data_fd != -1)
- rc = hash_datafile_by_fd (c->mfx.md, c->mfx.md2,
- c->signed_data.data_fd,
- (sig->sig_class == 0x01));
- else
- rc = hash_datafiles (c->mfx.md, c->mfx.md2,
- c->signed_data.data_names,
- c->sigfilename,
- (sig->sig_class == 0x01));
+
+ if (c->sigs_only)
+ {
+ if (c->signed_data.used && c->signed_data.data_fd != -1)
+ rc = hash_datafile_by_fd (c->mfx.md, c->mfx.md2,
+ c->signed_data.data_fd,
+ (sig->sig_class == 0x01));
+ else
+ rc = hash_datafiles (c->mfx.md, c->mfx.md2,
+ c->signed_data.data_names,
+ c->sigfilename,
+ (sig->sig_class == 0x01));
}
- else {
- rc = ask_for_detached_datafile( c->mfx.md, c->mfx.md2,
- iobuf_get_real_fname(c->iobuf),
- (sig->sig_class == 0x01) );
+ else
+ {
+ rc = ask_for_detached_datafile (c->mfx.md, c->mfx.md2,
+ iobuf_get_real_fname(c->iobuf),
+ (sig->sig_class == 0x01));
}
- if( rc ) {
- log_error("can't hash datafile: %s\n", g10_errstr(rc));
- return;
+
+ detached_hash_err:
+ if (rc)
+ {
+ log_error ("can't hash datafile: %s\n", gpg_strerror (rc));
+ return;
}
}
- else if ( c->signed_data.used ) {
- log_error (_("not a detached signature\n") );
- return;
+ else if (c->signed_data.used)
+ {
+ log_error (_("not a detached signature\n"));
+ return;
}
- else if (!opt.quiet)
- log_info(_("old style (PGP 2.x) signature\n"));
-
- if(multiple_ok)
- for( n1 = node; n1; (n1 = find_next_kbnode(n1, PKT_SIGNATURE )) )
- check_sig_and_print( c, n1 );
- else
- check_sig_and_print( c, node );
- }
- else {
- dump_kbnode (c->list);
- log_error(_("invalid root packet detected in proc_tree()\n"));
- dump_kbnode (node);
+ else if (!opt.quiet)
+ log_info (_("old style (PGP 2.x) signature\n"));
+
+ if (multiple_ok)
+ {
+ for (n1 = node; n1; (n1 = find_next_kbnode(n1, PKT_SIGNATURE)))
+ check_sig_and_print (c, n1);
+ }
+ else
+ check_sig_and_print (c, node);
+
+ }
+ else
+ {
+ dump_kbnode (c->list);
+ log_error ("invalid root packet detected in proc_tree()\n");
+ dump_kbnode (node);
}
}
projects / platform / upstream / gpg2.git / blobdiff