use libgcrypt instead of libssl by default

diff --git a/daemon/Makefile b/daemon/Makefile
index 92e589b..6737efe 100644 (file)
--- a/daemon/Makefile
+++ b/daemon/Makefile
@@ -1,4 +1,7 @@
-CFLAGS += -Wall -g3 -lssl
+CFLAGS += -Wall -g3
+
+#CFLAGS += -lssl
+CFLAGS += -lgcrypt
 
 all:   dump
 

diff --git a/daemon/dump.c b/daemon/dump.c
index 867dd6f..68d1ee9 100644 (file)
--- a/daemon/dump.c
+++ b/daemon/dump.c
@@ -12,15 +12,14 @@
 #define VERIFY_SIGNATURE       1
 
 #ifdef VERIFY_SIGNATURE
-#define USE_OPENSSL            1
+/*#define USE_OPENSSL          1*/
+#define USE_GCRYPT             1
 
 #ifdef USE_OPENSSL
 #include <openssl/objects.h>
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
 #include <openssl/sha.h>
-#endif
-
 /*
  * public key
  * generated using scripts/mk-openssl-bignum.sh
@@ -110,6 +109,101 @@ static struct pubkey keys[] = {
 };
 #endif
 
+#ifdef USE_GCRYPT
+#include <gcrypt.h>
+
+struct key_params {
+       __u8 *e, *n;
+       __u32 len_e, len_n;
+};
+
+#define KEYS(_e, _n) {                 \
+       .e = _e, .len_e = sizeof(_e),   \
+       .n = _n, .len_n = sizeof(_n),   \
+}
+
+
+/*
+ * public key
+ * generated using ./scripts/mk-gcrypt-mpi.sh
+ */
+static __u8 e_1[] = { 0, 1, 0, 1, };
+
+static __u8 n_1[] = {
+       0xb8,0xba,0x00,0x78,
+       0x1d,0x43,0x51,0xc7,
+       0x89,0x65,0xda,0x96,
+       0x67,0x93,0x99,0x18,
+       0xb5,0x9f,0xb8,0xcf,
+       0x4e,0xa1,0x7c,0xbe,
+       0x7a,0xd7,0x69,0xaf,
+       0x49,0xa0,0xbb,0xaf,
+       0x3d,0xa3,0x0a,0xde,
+       0xc6,0x2f,0x93,0x17,
+       0xb6,0x36,0x2b,0x65,
+       0x1f,0x5f,0x2c,0xaa,
+       0xf2,0x1a,0x19,0x12,
+       0x82,0x2c,0x42,0x5b,
+       0xa8,0x90,0x4b,0x63,
+       0x5c,0x91,0x8c,0xbe,
+       0xff,0xf8,0x1b,0x51,
+       0x25,0xea,0x96,0x55,
+       0xe0,0xdf,0x59,0xb0,
+       0x10,0x4a,0x88,0x4f,
+       0x9a,0x1f,0xe8,0x02,
+       0x6b,0x48,0x98,0xfa,
+       0xe7,0xc8,0xa3,0x92,
+       0xa2,0x20,0xe1,0x5f,
+       0xb4,0x43,0x57,0x90,
+       0x0d,0xc4,0x50,0xf3,
+       0xa9,0x56,0x26,0x50,
+       0xd8,0xe6,0xd1,0x15,
+       0x00,0x2a,0x4f,0xcc,
+       0x95,0x2d,0x00,0x39,
+       0xcb,0x23,0x07,0x27,
+       0x86,0xff,0x93,0xe1,
+       0xb1,0x66,0x02,0xc7,
+       0xfa,0x06,0x9e,0x17,
+       0x65,0x1d,0x4b,0xce,
+       0x45,0x02,0x82,0x23,
+       0x93,0x14,0x51,0x01,
+       0x32,0xf8,0xb6,0xa0,
+       0x6e,0x4b,0x68,0x56,
+       0xd5,0xa8,0xda,0x9c,
+       0x51,0x1c,0x44,0x1c,
+       0x99,0x98,0x74,0xc2,
+       0x5c,0xbf,0xd6,0xc3,
+       0x6b,0x8e,0x4c,0x6e,
+       0x91,0x3d,0x38,0xe3,
+       0x27,0xff,0x86,0xeb,
+       0x63,0x13,0x3e,0xa0,
+       0xf0,0x9a,0x0b,0x0b,
+       0xc8,0x6a,0x42,0xa1,
+       0xc3,0x97,0x04,0x20,
+       0x50,0x1f,0x94,0x19,
+       0x06,0x7f,0x3c,0x4c,
+       0x63,0xdc,0xde,0x0a,
+       0xde,0x51,0x84,0x41,
+       0xb1,0xd8,0xe9,0xd2,
+       0x8b,0xea,0xb5,0xd7,
+       0xa2,0x34,0x4f,0xa8,
+       0xd3,0x6a,0xdd,0x15,
+       0xcc,0xe6,0x7a,0x85,
+       0x58,0xda,0x64,0x6a,
+       0x9e,0xf6,0xf7,0x46,
+       0xc3,0x13,0xca,0x17,
+       0xed,0xdb,0x63,0x4f,
+       0xee,0x2c,0xc7,0x2d,
+};
+
+static struct key_params keys[] = {
+       KEYS(e_1, n_1),
+};
+
+#endif
+
+#endif
+
 static void *get_file_ptr(__u8 *db, int dblen, int structlen, __be32 ptr)
 {
        __u32 p = ntohl(ptr);
@@ -161,6 +255,12 @@ int main(int argc, char **argv)
        __u8 hash[SHA_DIGEST_LENGTH];
        int ok = 0;
 #endif
+#ifdef USE_GCRYPT
+       gcry_mpi_t mpi_e, mpi_n;
+       gcry_sexp_t rsa, signature, data;
+       __u8 hash[20];
+       int ok = 0;
+#endif
 
        if (argc != 2) {
                fprintf(stderr, "Usage: %s <filename>\n", argv[0]);
@@ -207,8 +307,8 @@ int main(int argc, char **argv)
                return 2;
        }
 
-#ifdef USE_OPENSSL
        /* verify signature */
+#ifdef USE_OPENSSL
        rsa = RSA_new();
        if (!rsa) {
                fprintf(stderr, "Failed to create RSA key\n");
@@ -241,6 +341,55 @@ int main(int argc, char **argv)
        rsa->e = NULL;
        rsa->n = NULL;
        RSA_free(rsa);
+
+       BN_print_fp(stdout, &keys[0].n);
+
+       return 0;
+#endif
+
+#ifdef USE_GCRYPT
+       /* hash the db */
+       gcry_md_hash_buffer(GCRY_MD_SHA1, hash, db, dblen);
+
+       if (gcry_sexp_build(&data, NULL, "(data (flags pkcs1) (hash sha1 %b))",
+                           20, hash)) {
+               fprintf(stderr, "failed to build data expression\n");
+               return 2;
+       }
+
+       if (gcry_sexp_build(&signature, NULL, "(sig-val (rsa (s %b)))",
+                           siglen, db + dblen)) {
+               fprintf(stderr, "failed to build signature expression\n");
+               return 2;
+       }
+
+       for (i = 0; i < sizeof(keys)/sizeof(keys[0]); i++) {
+               if (gcry_mpi_scan(&mpi_e, GCRYMPI_FMT_USG,
+                                 keys[0].e, keys[0].len_e, NULL) ||
+                   gcry_mpi_scan(&mpi_n, GCRYMPI_FMT_USG,
+                                 keys[0].n, keys[0].len_n, NULL)) {
+                       fprintf(stderr, "failed to convert numbers\n");
+                       return 2;
+               }
+
+               if (gcry_sexp_build(&rsa, NULL,
+                                   "(public-key (rsa (n %m) (e %m)))",
+                                   mpi_n, mpi_e)) {
+                       fprintf(stderr, "failed to build rsa key\n");
+                       return 2;
+               }
+
+               if (!gcry_pk_verify(signature, data, rsa)) {
+                       ok = 1;
+                       break;
+               }
+       }
+
+       if (!ok) {
+               fprintf(stderr, "Database signature wrong\n");
+               return 2;
+       }
+
 #endif
 
        num_countries = ntohl(header->reg_country_num);

diff --git a/scripts/mk-gcrypt-mpi.sh b/scripts/mk-gcrypt-mpi.sh
new file mode 100755 (executable)
index 0000000..767123c
--- /dev/null
+++ b/scripts/mk-gcrypt-mpi.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+openssl rsa -text -in key.priv.pem 2>/dev/null |\
+       sed 's/^Private//;T;d' |\
+       tr '\n' '\t' |\
+       sed 's/privateExponent:.*//' |\
+       sed 's/publicExponent:/\npublicExponent:/' |\
+       sed 's/\s*//g' |\
+       sed 's/publicExponent:\([^(]*\)(.*/\1/' |\
+       sed 's/^modulus://' |\
+       sed 's/://g' |\
+(
+       read modulus
+       read exponent
+       
+       echo 'static __u8 e_1[] = {' $((exponent>>24 & 0xFF)), $((exponent>>16 & 0xFF)), $((exponent>>8 & 0xFF)), $((exponent & 0xFF)), '};'
+       echo ''
+       echo -n 'static __u8 n_1[] = {'
+       modulus=$(echo $modulus | sed 's/^00//')
+       echo $modulus | sed 's/\(..\)\(..\)\(..\)\(..\)/0x\1,0x\2,0x\3,0x\4,\n/g'
+       echo '};'
+)