From 4fd2e168ccd02d3d68a227e7063caec18709949a Mon Sep 17 00:00:00 2001 From: Alexey Gladkov Date: Mon, 28 Dec 2020 04:57:15 +0300 Subject: FEDORA: non-upstreamable patch adding file-is-digest option --- g10/gpg.c | 4 +++ g10/options.h | 1 + g10/sign.c | 93 ++++++++++++++++++++++++++++++++++++++++++++------- 3 files changed, 85 insertions(+), 13 deletions(-) diff --git a/g10/gpg.c b/g10/gpg.c index a0cc56d58..109444edd 100644 --- a/g10/gpg.c +++ b/g10/gpg.c @@ -398,6 +398,7 @@ enum cmd_and_opt_values oTTYtype, oLCctype, oLCmessages, + oFileIsDigest, oXauthority, oGroup, oUnGroup, @@ -659,6 +660,7 @@ static gpgrt_opt_t opts[] = { ARGPARSE_s_s (oTempDir, "temp-directory", "@"), ARGPARSE_s_s (oExecPath, "exec-path", "@"), ARGPARSE_s_n (oExpert, "expert", "@"), + ARGPARSE_s_n (oFileIsDigest, "file-is-digest", "@"), ARGPARSE_s_n (oNoExpert, "no-expert", "@"), ARGPARSE_s_n (oNoSecmemWarn, "no-secmem-warning", "@"), ARGPARSE_s_n (oRequireSecmem, "require-secmem", "@"), @@ -2491,6 +2493,7 @@ main (int argc, char **argv) opt.keyid_format = KF_NONE; opt.def_sig_expire = "0"; opt.def_cert_expire = "0"; + opt.file_is_digest = 0; opt.passphrase_repeat = 1; opt.emit_version = 0; opt.weak_digests = NULL; @@ -3122,6 +3125,7 @@ main (int argc, char **argv) case oPhotoViewer: opt.photo_viewer = pargs.r.ret_str; break; case oForceAEAD: opt.force_aead = 1; break; + case oFileIsDigest: opt.file_is_digest = 1; break; case oDisableSignerUID: opt.flags.disable_signer_uid = 1; break; case oIncludeKeyBlock: opt.flags.include_key_block = 1; break; diff --git a/g10/options.h b/g10/options.h index 914c24849..db2ed5b55 100644 --- a/g10/options.h +++ b/g10/options.h @@ -220,6 +220,7 @@ struct int no_auto_check_trustdb; int preserve_permissions; int no_homedir_creation; + int file_is_digest; struct groupitem *grouplist; int mangle_dos_filenames; int enable_progress_filter; diff --git a/g10/sign.c b/g10/sign.c index f9984f811..05ab5b757 100644 --- a/g10/sign.c +++ b/g10/sign.c @@ -40,6 +40,7 @@ #include "pkglue.h" #include "../common/sysutils.h" #include "call-agent.h" +#include "../common/host2net.h" #include "../common/mbox-util.h" #include "../common/compliance.h" @@ -944,6 +945,8 @@ write_signature_packets (ctrl_t ctrl, if (pk->version >= 5) sig->version = 5; /* Required for v5 keys. */ + else if (opt.file_is_digest) + sig->version = 3; else sig->version = 4; /* Required. */ @@ -961,14 +964,22 @@ write_signature_packets (ctrl_t ctrl, if (gcry_md_copy (&md, hash)) BUG (); - build_sig_subpkt_from_sig (sig, pk, 0); - mk_notation_policy_etc (ctrl, sig, NULL, pk); - if (opt.flags.include_key_block && IS_SIG (sig)) - err = mk_sig_subpkt_key_block (ctrl, sig, pk); - else - err = 0; - hash_sigversion_to_magic (md, sig, extrahash); - gcry_md_final (md); + if (!opt.file_is_digest) + { + build_sig_subpkt_from_sig (sig, pk, 0); + mk_notation_policy_etc (ctrl, sig, NULL, pk); + if (opt.flags.include_key_block && IS_SIG (sig)) + err = mk_sig_subpkt_key_block (ctrl, sig, pk); + else + err = 0; + + hash_sigversion_to_magic (md, sig, extrahash); + gcry_md_final (md); + } + else if (sig->version >= 4) + { + log_bug("file-is-digest doesn't work with v4 sigs\n"); + } if (!err) err = do_sign (ctrl, pk, sig, md, hash_for (pk), cache_nonce, 0); @@ -1033,6 +1044,8 @@ sign_file (ctrl_t ctrl, strlist_t filenames, int detached, strlist_t locusr, SK_LIST sk_rover = NULL; int multifile = 0; u32 duration=0; + int sigclass = 0x00; + u32 timestamp = 0; pt_extra_hash_data_t extrahash = NULL; char peekbuf[32]; int peekbuflen = 0; @@ -1055,7 +1068,16 @@ sign_file (ctrl_t ctrl, strlist_t filenames, int detached, strlist_t locusr, fname = NULL; if (fname && filenames->next && (!detached || encryptflag)) - log_bug ("multiple files can only be detached signed"); + log_bug ("multiple files can only be detached signed\n"); + + if (opt.file_is_digest && (multifile || !fname)) + log_bug ("file-is-digest only works with one file\n"); + if (opt.file_is_digest && !detached) + log_bug ("file-is-digest can only write detached signatures\n"); + if (opt.file_is_digest && !opt.def_digest_algo) + log_bug ("file-is-digest needs --digest-algo\n"); + if (opt.file_is_digest && opt.textmode) + log_bug ("file-is-digest doesn't work with --textmode\n"); if (encryptflag == 2 && (rc = setup_symkey (&efx.symkey_s2k, &efx.symkey_dek))) @@ -1076,7 +1098,7 @@ sign_file (ctrl_t ctrl, strlist_t filenames, int detached, strlist_t locusr, goto leave; /* Prepare iobufs. */ - if (multifile) /* have list of filenames */ + if (multifile || opt.file_is_digest) /* have list of filenames */ inp = NULL; /* we do it later */ else { @@ -1239,7 +1261,7 @@ sign_file (ctrl_t ctrl, strlist_t filenames, int detached, strlist_t locusr, for (sk_rover = sk_list; sk_rover; sk_rover = sk_rover->next) gcry_md_enable (mfx.md, hash_for (sk_rover->pk)); - if (!multifile) + if (!multifile && !opt.file_is_digest) iobuf_push_filter (inp, md_filter, &mfx); if (detached && !encryptflag) @@ -1305,6 +1327,8 @@ sign_file (ctrl_t ctrl, strlist_t filenames, int detached, strlist_t locusr, write_status_begin_signing (mfx.md); + sigclass = opt.textmode && !outfile? 0x01 : 0x00; + /* Setup the inner packet. */ if (detached) { @@ -1352,6 +1376,49 @@ sign_file (ctrl_t ctrl, strlist_t filenames, int detached, strlist_t locusr, if (opt.verbose) log_printf ("\n"); } + else if (opt.file_is_digest) + { + byte *mdb, ts[5] = {0}; + size_t mdlen; + const char *fp; + int c, d; + + gcry_md_final(mfx.md); + /* this assumes gcry_md_read returns the same buffer */ + mdb = gcry_md_read(mfx.md, opt.def_digest_algo); + mdlen = gcry_md_get_algo_dlen(opt.def_digest_algo); + if (strlen(fname) != mdlen * 2 + 11) + log_bug("digests must be %zu + '@' + 5 bytes\n", mdlen); + d = -1; + for (fp = fname ; *fp; ) + { + c = *fp++; + if (c >= '0' && c <= '9') + c -= '0'; + else if (c >= 'a' && c <= 'f') + c -= 'a' - 10; + else if (c >= 'A' && c <= 'F') + c -= 'A' - 10; + else + log_bug("filename is not hex\n"); + if (d >= 0) + { + *mdb++ = d << 4 | c; + c = -1; + if (--mdlen == 0) + { + mdb = ts; + if (*fp++ != '@') + log_bug("missing time separator\n"); + } + } + d = c; + } + sigclass = ts[0]; + if (sigclass != 0x00 && sigclass != 0x01) + log_bug("bad cipher class\n"); + timestamp = buf32_to_u32(ts + 1); + } else { /* Read, so that the filter can calculate the digest. */ @@ -1373,8 +1440,8 @@ sign_file (ctrl_t ctrl, strlist_t filenames, int detached, strlist_t locusr, /* Write the signatures. */ rc = write_signature_packets (ctrl, sk_list, out, mfx.md, extrahash, - opt.textmode && !outfile? 0x01 : 0x00, - 0, duration, detached ? 'D':'S', NULL); + sigclass, + timestamp, duration, detached ? 'D':'S', NULL); if (rc) goto leave; -- 2.25.4