Source code
Revision control
Copy as Markdown
Other Tools
/*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without modification,
* are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "config.h"
#include <sys/stat.h>
#include <stdlib.h>
#include <stdio.h>
#ifdef HAVE_UNISTD_H
#include <unistd.h>
#else
#include "uniwin.h"
#endif
#include <string.h>
#ifndef __STDC_FORMAT_MACROS
#define __STDC_FORMAT_MACROS
#endif
#include <cinttypes>
#include <rnp/rnp_def.h>
#include "types.h"
#include "crypto/mem.h"
#include "stream-packet.h"
#include "stream-key.h"
#include <algorithm>
size_t
write_packet_len(uint8_t *buf, size_t len)
{
if (len < 192) {
buf[0] = len;
return 1;
} else if (len < 8192 + 192) {
buf[0] = ((len - 192) >> 8) + 192;
buf[1] = (len - 192) & 0xff;
return 2;
} else {
buf[0] = 0xff;
write_uint32(&buf[1], len);
return 5;
}
}
int
get_packet_type(uint8_t ptag)
{
if (!(ptag & PGP_PTAG_ALWAYS_SET)) {
return -1;
}
if (ptag & PGP_PTAG_NEW_FORMAT) {
return (int) (ptag & PGP_PTAG_NF_CONTENT_TAG_MASK);
} else {
return (int) ((ptag & PGP_PTAG_OF_CONTENT_TAG_MASK) >> PGP_PTAG_OF_CONTENT_TAG_SHIFT);
}
}
int
stream_pkt_type(pgp_source_t &src)
{
if (src.eof()) {
return 0;
}
size_t hdrneed = 0;
if (!stream_pkt_hdr_len(src, hdrneed)) {
return -1;
}
uint8_t hdr[PGP_MAX_HEADER_SIZE];
if (!src.peek_eq(hdr, hdrneed)) {
return -1;
}
return get_packet_type(hdr[0]);
}
bool
stream_pkt_hdr_len(pgp_source_t &src, size_t &hdrlen)
{
uint8_t buf[2];
if (!src.peek_eq(buf, 2) || !(buf[0] & PGP_PTAG_ALWAYS_SET)) {
return false;
}
if (buf[0] & PGP_PTAG_NEW_FORMAT) {
if (buf[1] < 192) {
hdrlen = 2;
} else if (buf[1] < 224) {
hdrlen = 3;
} else if (buf[1] < 255) {
hdrlen = 2;
} else {
hdrlen = 6;
}
return true;
}
switch (buf[0] & PGP_PTAG_OF_LENGTH_TYPE_MASK) {
case PGP_PTAG_OLD_LEN_1:
hdrlen = 2;
return true;
case PGP_PTAG_OLD_LEN_2:
hdrlen = 3;
return true;
case PGP_PTAG_OLD_LEN_4:
hdrlen = 5;
return true;
case PGP_PTAG_OLD_LEN_INDETERMINATE:
hdrlen = 1;
return true;
default:
return false;
}
}
static bool
get_pkt_len(uint8_t *hdr, size_t *pktlen)
{
if (hdr[0] & PGP_PTAG_NEW_FORMAT) {
// 1-byte length
if (hdr[1] < 192) {
*pktlen = hdr[1];
return true;
}
// 2-byte length
if (hdr[1] < 224) {
*pktlen = ((size_t)(hdr[1] - 192) << 8) + (size_t) hdr[2] + 192;
return true;
}
// partial length - we do not allow it here
if (hdr[1] < 255) {
return false;
}
// 4-byte length
*pktlen = read_uint32(&hdr[2]);
return true;
}
switch (hdr[0] & PGP_PTAG_OF_LENGTH_TYPE_MASK) {
case PGP_PTAG_OLD_LEN_1:
*pktlen = hdr[1];
return true;
case PGP_PTAG_OLD_LEN_2:
*pktlen = read_uint16(&hdr[1]);
return true;
case PGP_PTAG_OLD_LEN_4:
*pktlen = read_uint32(&hdr[1]);
return true;
default:
return false;
}
}
bool
stream_read_pkt_len(pgp_source_t &src, size_t *pktlen)
{
uint8_t buf[6] = {};
size_t read = 0;
if (!stream_pkt_hdr_len(src, read)) {
return false;
}
if (!src.read_eq(buf, read)) {
return false;
}
return get_pkt_len(buf, pktlen);
}
bool
stream_read_partial_chunk_len(pgp_source_t *src, size_t *clen, bool *last)
{
uint8_t hdr[5] = {};
size_t read = 0;
if (!src->read(hdr, 1, &read)) {
RNP_LOG("failed to read header");
return false;
}
if (read < 1) {
RNP_LOG("wrong eof");
return false;
}
*last = true;
// partial length
if ((hdr[0] >= 224) && (hdr[0] < 255)) {
*last = false;
*clen = get_partial_pkt_len(hdr[0]);
return true;
}
// 1-byte length
if (hdr[0] < 192) {
*clen = hdr[0];
return true;
}
// 2-byte length
if (hdr[0] < 224) {
if (!src->read_eq(&hdr[1], 1)) {
RNP_LOG("wrong 2-byte length");
return false;
}
*clen = ((size_t)(hdr[0] - 192) << 8) + (size_t) hdr[1] + 192;
return true;
}
// 4-byte length
if (!src->read_eq(&hdr[1], 4)) {
RNP_LOG("wrong 4-byte length");
return false;
}
*clen = ((size_t) hdr[1] << 24) | ((size_t) hdr[2] << 16) | ((size_t) hdr[3] << 8) |
(size_t) hdr[4];
return true;
}
bool
stream_old_indeterminate_pkt_len(pgp_source_t *src)
{
uint8_t ptag = 0;
if (!src->peek_eq(&ptag, 1)) {
return false;
}
return !(ptag & PGP_PTAG_NEW_FORMAT) &&
((ptag & PGP_PTAG_OF_LENGTH_TYPE_MASK) == PGP_PTAG_OLD_LEN_INDETERMINATE);
}
bool
stream_partial_pkt_len(pgp_source_t *src)
{
uint8_t hdr[2] = {};
if (!src->peek_eq(hdr, 2)) {
return false;
}
return (hdr[0] & PGP_PTAG_NEW_FORMAT) && (hdr[1] >= 224) && (hdr[1] < 255);
}
size_t
get_partial_pkt_len(uint8_t blen)
{
return 1 << (blen & 0x1f);
}
rnp_result_t
stream_peek_packet_hdr(pgp_source_t *src, pgp_packet_hdr_t *hdr)
{
size_t hlen = 0;
memset(hdr, 0, sizeof(*hdr));
if (!stream_pkt_hdr_len(*src, hlen)) {
uint8_t hdr2[2] = {0};
if (!src->peek_eq(hdr2, 2)) {
RNP_LOG("pkt header read failed");
return RNP_ERROR_READ;
}
RNP_LOG("bad packet header: 0x%02x%02x", hdr2[0], hdr2[1]);
return RNP_ERROR_BAD_FORMAT;
}
if (!src->peek_eq(hdr->hdr, hlen)) {
RNP_LOG("failed to read pkt header");
return RNP_ERROR_READ;
}
hdr->hdr_len = hlen;
hdr->tag = (pgp_pkt_type_t) get_packet_type(hdr->hdr[0]);
if (stream_partial_pkt_len(src)) {
hdr->partial = true;
} else if (stream_old_indeterminate_pkt_len(src)) {
hdr->indeterminate = true;
} else {
(void) get_pkt_len(hdr->hdr, &hdr->pkt_len);
}
return RNP_SUCCESS;
}
static rnp_result_t
stream_read_packet_partial(pgp_source_t *src, pgp_dest_t *dst)
{
uint8_t hdr = 0;
if (!src->read_eq(&hdr, 1)) {
return RNP_ERROR_READ;
}
bool last = false;
size_t partlen = 0;
if (!stream_read_partial_chunk_len(src, &partlen, &last)) {
return RNP_ERROR_BAD_FORMAT;
}
uint8_t *buf = (uint8_t *) malloc(PGP_INPUT_CACHE_SIZE);
if (!buf) {
return RNP_ERROR_OUT_OF_MEMORY;
}
while (partlen > 0) {
size_t read = std::min(partlen, (size_t) PGP_INPUT_CACHE_SIZE);
if (!src->read_eq(buf, read)) {
free(buf);
return RNP_ERROR_READ;
}
if (dst) {
dst_write(dst, buf, read);
}
partlen -= read;
if (partlen > 0) {
continue;
}
if (last) {
break;
}
if (!stream_read_partial_chunk_len(src, &partlen, &last)) {
free(buf);
return RNP_ERROR_BAD_FORMAT;
}
}
free(buf);
return RNP_SUCCESS;
}
rnp_result_t
stream_read_packet(pgp_source_t *src, pgp_dest_t *dst)
{
if (stream_old_indeterminate_pkt_len(src)) {
return dst_write_src(src, dst, PGP_MAX_OLD_LEN_INDETERMINATE_PKT_SIZE);
}
if (stream_partial_pkt_len(src)) {
return stream_read_packet_partial(src, dst);
}
try {
pgp_packet_body_t body(PGP_PKT_RESERVED);
rnp_result_t ret = body.read(*src);
if (dst) {
body.write(*dst, false);
}
return ret;
} catch (const std::exception &e) {
RNP_LOG("%s", e.what());
return RNP_ERROR_GENERIC;
}
}
rnp_result_t
stream_skip_packet(pgp_source_t *src)
{
return stream_read_packet(src, NULL);
}
rnp_result_t
stream_parse_marker(pgp_source_t &src)
{
try {
pgp_packet_body_t pkt(PGP_PKT_MARKER);
rnp_result_t res = pkt.read(src);
if (res) {
return res;
}
if ((pkt.size() != PGP_MARKER_LEN) ||
memcmp(pkt.data(), PGP_MARKER_CONTENTS, PGP_MARKER_LEN)) {
return RNP_ERROR_BAD_FORMAT;
}
return RNP_SUCCESS;
} catch (const std::exception &e) {
RNP_LOG("%s", e.what());
return RNP_ERROR_OUT_OF_MEMORY;
}
}
bool
is_key_pkt(int tag)
{
switch (tag) {
case PGP_PKT_PUBLIC_KEY:
case PGP_PKT_PUBLIC_SUBKEY:
case PGP_PKT_SECRET_KEY:
case PGP_PKT_SECRET_SUBKEY:
return true;
default:
return false;
}
}
bool
is_subkey_pkt(int tag)
{
return (tag == PGP_PKT_PUBLIC_SUBKEY) || (tag == PGP_PKT_SECRET_SUBKEY);
}
bool
is_primary_key_pkt(int tag)
{
return (tag == PGP_PKT_PUBLIC_KEY) || (tag == PGP_PKT_SECRET_KEY);
}
bool
is_public_key_pkt(int tag)
{
switch (tag) {
case PGP_PKT_PUBLIC_KEY:
case PGP_PKT_PUBLIC_SUBKEY:
return true;
default:
return false;
}
}
bool
is_secret_key_pkt(int tag)
{
switch (tag) {
case PGP_PKT_SECRET_KEY:
case PGP_PKT_SECRET_SUBKEY:
return true;
default:
return false;
}
}
bool
is_rsa_key_alg(pgp_pubkey_alg_t alg)
{
switch (alg) {
case PGP_PKA_RSA:
case PGP_PKA_RSA_ENCRYPT_ONLY:
case PGP_PKA_RSA_SIGN_ONLY:
return true;
default:
return false;
}
}
pgp_packet_body_t::pgp_packet_body_t(pgp_pkt_type_t tag)
{
data_.reserve(16);
tag_ = tag;
secure_ = is_secret_key_pkt(tag);
}
pgp_packet_body_t::pgp_packet_body_t(const uint8_t *data, size_t len)
{
data_.assign(data, data + len);
tag_ = PGP_PKT_RESERVED;
secure_ = false;
}
pgp_packet_body_t::pgp_packet_body_t(const std::vector<uint8_t> &data)
: pgp_packet_body_t(data.data(), data.size())
{
}
pgp_packet_body_t::~pgp_packet_body_t()
{
if (secure_) {
secure_clear(data_.data(), data_.size());
}
}
uint8_t *
pgp_packet_body_t::data() noexcept
{
return data_.data();
}
uint8_t *
pgp_packet_body_t::cur() noexcept
{
return data_.data() + pos_;
}
size_t
pgp_packet_body_t::size() const noexcept
{
return data_.size();
}
size_t
pgp_packet_body_t::left() const noexcept
{
return data_.size() - pos_;
}
void
pgp_packet_body_t::skip(size_t bt) noexcept
{
pos_ += bt;
}
void
pgp_packet_body_t::skip_back(size_t bt) noexcept
{
pos_ = bt > pos_ ? 0 : pos_ - bt;
}
bool
pgp_packet_body_t::get(uint8_t &val) noexcept
{
if (pos_ >= data_.size()) {
return false;
}
val = data_[pos_++];
return true;
}
bool
pgp_packet_body_t::get(uint16_t &val) noexcept
{
if (pos_ + 2 > data_.size()) {
return false;
}
val = read_uint16(data_.data() + pos_);
pos_ += 2;
return true;
}
bool
pgp_packet_body_t::get(uint32_t &val) noexcept
{
if (pos_ + 4 > data_.size()) {
return false;
}
val = read_uint32(data_.data() + pos_);
pos_ += 4;
return true;
}
bool
pgp_packet_body_t::get(uint8_t *val, size_t len) noexcept
{
if (pos_ + len > data_.size()) {
return false;
}
memcpy(val, data_.data() + pos_, len);
pos_ += len;
return true;
}
bool
pgp_packet_body_t::get(std::vector<uint8_t> &val, size_t len)
{
if (pos_ + len > data_.size()) {
return false;
}
val.assign(data_.data() + pos_, data_.data() + pos_ + len);
pos_ += len;
return true;
}
bool
pgp_packet_body_t::get(pgp::KeyID &val) noexcept
{
static_assert(std::tuple_size<pgp::KeyID>::value == PGP_KEY_ID_SIZE,
"pgp::KeyID size mismatch");
return get(val.data(), val.size());
}
bool
pgp_packet_body_t::get(pgp::mpi &val) noexcept
{
uint16_t bits = 0;
if (!get(bits)) {
return false;
}
size_t len = (bits + 7) >> 3;
if (len > PGP_MPINT_SIZE) {
RNP_LOG("too large mpi");
return false;
}
if (!len) {
RNP_LOG("0 mpi");
return false;
}
val.resize(len);
if (!get(val.data(), len)) {
RNP_LOG("failed to read mpi body");
return false;
}
/* check the mpi bit count */
size_t mbits = val.bits();
if (mbits != bits) {
RNP_LOG(
"Warning! Wrong mpi bit count: got %" PRIu16 ", but actual is %zu", bits, mbits);
}
return true;
}
bool
pgp_packet_body_t::get(pgp_curve_t &val) noexcept
{
uint8_t oidlen = 0;
if (!get(oidlen)) {
return false;
}
if (!oidlen || (oidlen == 0xff)) {
RNP_LOG("unsupported curve oid len: %" PRIu8, oidlen);
return false;
}
std::vector<uint8_t> oid(oidlen, 0);
if (!get(oid, oidlen)) {
return false;
}
pgp_curve_t res = pgp::ec::Curve::by_OID(oid);
if (res == PGP_CURVE_MAX) {
RNP_LOG("unsupported curve");
return false;
}
val = res;
return true;
}
bool
pgp_packet_body_t::get(pgp_s2k_t &s2k) noexcept
{
uint8_t spec = 0, halg = 0;
if (!get(spec)) {
return false;
}
s2k.specifier = (pgp_s2k_specifier_t) spec;
#if defined(ENABLE_CRYPTO_REFRESH)
if (s2k.specifier != PGP_S2KS_ARGON2)
#endif
{
if (!get(halg)) {
return false;
}
s2k.hash_alg = (pgp_hash_alg_t) halg;
}
switch (s2k.specifier) {
case PGP_S2KS_SIMPLE:
return true;
case PGP_S2KS_SALTED:
return get(s2k.salt, s2k.salt_size(s2k.specifier));
case PGP_S2KS_ITERATED_AND_SALTED: {
uint8_t iter = 0;
if (!get(s2k.salt, s2k.salt_size(s2k.specifier)) || !get(iter)) {
return false;
}
s2k.iterations = iter;
return true;
}
#if defined(ENABLE_CRYPTO_REFRESH)
case PGP_S2KS_ARGON2:
if (!get(s2k.salt, s2k.salt_size(s2k.specifier))) {
return false;
}
if (!get(s2k.argon2_t)) {
return false;
}
if (!get(s2k.argon2_p)) {
return false;
}
if (!get(s2k.argon2_encoded_m)) {
return false;
}
return true;
#endif
case PGP_S2KS_EXPERIMENTAL: {
try {
s2k.experimental = {data_.begin() + pos_, data_.end()};
} catch (const std::exception &e) {
RNP_LOG("%s", e.what());
return false;
}
uint8_t gnu[3] = {0};
if (!get(gnu, 3) || memcmp(gnu, "GNU", 3)) {
RNP_LOG("Unknown experimental s2k. Skipping.");
pos_ = data_.size();
s2k.gpg_ext_num = PGP_S2K_GPG_NONE;
return true;
}
uint8_t ext_num = 0;
if (!get(ext_num)) {
return false;
}
if ((ext_num != PGP_S2K_GPG_NO_SECRET) && (ext_num != PGP_S2K_GPG_SMARTCARD)) {
RNP_LOG("Unsupported gpg extension num: %" PRIu8 ", skipping", ext_num);
pos_ = data_.size();
s2k.gpg_ext_num = PGP_S2K_GPG_NONE;
return true;
}
s2k.gpg_ext_num = (pgp_s2k_gpg_extension_t) ext_num;
if (s2k.gpg_ext_num == PGP_S2K_GPG_NO_SECRET) {
return true;
}
if (!get(s2k.gpg_serial_len)) {
RNP_LOG("Failed to get GPG serial len");
return false;
}
size_t len = s2k.gpg_serial_len;
if (s2k.gpg_serial_len > 16) {
RNP_LOG("Warning: gpg_serial_len is %d", (int) len);
len = 16;
}
if (!get(s2k.gpg_serial, len)) {
RNP_LOG("Failed to get GPG serial");
return false;
}
return true;
}
default:
RNP_LOG("unknown s2k specifier: %d", (int) s2k.specifier);
return false;
}
}
void
pgp_packet_body_t::add(const void *data, size_t len)
{
data_.insert(data_.end(), (uint8_t *) data, (uint8_t *) data + len);
}
void
pgp_packet_body_t::add(const std::vector<uint8_t> &data)
{
add(data.data(), data.size());
}
void
pgp_packet_body_t::add_byte(uint8_t bt)
{
data_.push_back(bt);
}
void
pgp_packet_body_t::add_uint16(uint16_t val)
{
uint8_t bytes[2];
write_uint16(bytes, val);
add(bytes, 2);
}
void
pgp_packet_body_t::add_uint32(uint32_t val)
{
uint8_t bytes[4];
write_uint32(bytes, val);
add(bytes, 4);
}
void
pgp_packet_body_t::add(const pgp::KeyID &val)
{
add(val.data(), val.size());
}
void
pgp_packet_body_t::add(const pgp::mpi &val)
{
if (!val.size()) {
throw rnp::rnp_exception(RNP_ERROR_BAD_PARAMETERS);
}
size_t idx = 0;
while ((idx < val.size() - 1) && (!val[idx])) {
idx++;
}
size_t bits = (val.size() - idx - 1) << 3;
uint8_t hibyte = val[idx];
while (hibyte) {
bits++;
hibyte = hibyte >> 1;
}
uint8_t hdr[2] = {(uint8_t)(bits >> 8), (uint8_t)(bits & 0xff)};
add(hdr, 2);
add(val.data() + idx, val.size() - idx);
}
void
pgp_packet_body_t::add_subpackets(const pgp::pkt::Signature &sig, bool hashed)
{
pgp_packet_body_t spbody(PGP_PKT_RESERVED);
for (auto &subpkt : sig.subpkts) {
if (subpkt->hashed() != hashed) {
continue;
}
uint8_t splen[6];
size_t lenlen = write_packet_len(splen, subpkt->data().size() + 1);
spbody.add(splen, lenlen);
spbody.add_byte(subpkt->raw_type() | (subpkt->critical() << 7));
spbody.add(subpkt->data().data(), subpkt->data().size());
}
if (spbody.data_.size() > 0xffff) {
throw rnp::rnp_exception(RNP_ERROR_BAD_PARAMETERS);
}
switch (sig.version) {
case PGP_V4:
case PGP_V5:
add_uint16(spbody.data_.size());
break;
#if defined(ENABLE_CRYPTO_REFRESH)
case PGP_V6:
add_uint32(spbody.data_.size());
break;
#endif
default:
RNP_LOG("should not reach this code");
throw rnp::rnp_exception(RNP_ERROR_BAD_STATE);
}
add(spbody.data_.data(), spbody.data_.size());
}
void
pgp_packet_body_t::add(const pgp_curve_t curve)
{
auto desc = pgp::ec::Curve::get(curve);
if (!desc) {
throw rnp::rnp_exception(RNP_ERROR_BAD_PARAMETERS);
}
add_byte((uint8_t) desc->OID.size());
add(desc->OID.data(), desc->OID.size());
}
void
pgp_packet_body_t::add(const pgp_s2k_t &s2k, pgp_version_t version)
{
#if defined(ENABLE_CRYPTO_REFRESH)
if (version == PGP_V6 && s2k.usage != PGP_S2KU_NONE) {
add_byte(pgp_s2k_t::specifier_len(s2k.specifier));
}
#endif
add_byte(s2k.specifier);
switch (s2k.specifier) {
case PGP_S2KS_SIMPLE:
add_byte(s2k.hash_alg);
return;
case PGP_S2KS_SALTED:
add_byte(s2k.hash_alg);
add(s2k.salt, s2k.salt_size(s2k.specifier));
return;
case PGP_S2KS_ITERATED_AND_SALTED: {
add_byte(s2k.hash_alg);
unsigned iter = s2k.iterations;
if (iter > 255) {
iter = pgp_s2k_encode_iterations(iter);
}
add(s2k.salt, s2k.salt_size(s2k.specifier));
add_byte(iter);
return;
}
#if defined(ENABLE_CRYPTO_REFRESH)
case PGP_S2KS_ARGON2:
add(s2k.salt, s2k.salt_size(s2k.specifier));
add_byte(s2k.argon2_t);
add_byte(s2k.argon2_p);
add_byte(s2k.argon2_encoded_m);
return;
#endif
case PGP_S2KS_EXPERIMENTAL: {
add_byte(s2k.hash_alg);
if ((s2k.gpg_ext_num != PGP_S2K_GPG_NO_SECRET) &&
(s2k.gpg_ext_num != PGP_S2K_GPG_SMARTCARD)) {
RNP_LOG("Unknown experimental s2k.");
add(s2k.experimental.data(), s2k.experimental.size());
return;
}
add("GNU", 3);
add_byte(s2k.gpg_ext_num);
if (s2k.gpg_ext_num == PGP_S2K_GPG_SMARTCARD) {
static_assert(sizeof(s2k.gpg_serial) == 16, "invalid gpg serial length");
size_t slen = s2k.gpg_serial_len > 16 ? 16 : s2k.gpg_serial_len;
add_byte(s2k.gpg_serial_len);
add(s2k.gpg_serial, slen);
}
return;
}
default:
RNP_LOG("unknown s2k specifier");
throw rnp::rnp_exception(RNP_ERROR_BAD_PARAMETERS);
}
}
rnp_result_t
pgp_packet_body_t::read(pgp_source_t &src) noexcept
{
/* Make sure we have enough data for packet header */
if (!src.peek_eq(hdr_, 2)) {
return RNP_ERROR_READ;
}
/* Read the packet header and length */
size_t len = 0;
if (!stream_pkt_hdr_len(src, len)) {
return RNP_ERROR_BAD_FORMAT;
}
if (!src.peek_eq(hdr_, len)) {
return RNP_ERROR_READ;
}
hdr_len_ = len;
int ptag = get_packet_type(hdr_[0]);
if ((ptag < 0) || ((tag_ != PGP_PKT_RESERVED) && (tag_ != ptag))) {
RNP_LOG("tag mismatch: %d vs %d", (int) tag_, ptag);
return RNP_ERROR_BAD_FORMAT;
}
tag_ = (pgp_pkt_type_t) ptag;
if (!stream_read_pkt_len(src, &len)) {
return RNP_ERROR_READ;
}
/* early exit for the empty packet */
if (!len) {
return RNP_SUCCESS;
}
if (len > PGP_MAX_PKT_SIZE) {
RNP_LOG("too large packet");
return RNP_ERROR_BAD_FORMAT;
}
/* Read the packet contents */
try {
data_.resize(len);
} catch (const std::exception &e) {
RNP_LOG("malloc of %d bytes failed, %s", (int) len, e.what());
return RNP_ERROR_OUT_OF_MEMORY;
}
size_t read = 0;
if (!src.read(data_.data(), len, &read) || (read != len)) {
RNP_LOG("read %d instead of %d", (int) read, (int) len);
return RNP_ERROR_READ;
}
pos_ = 0;
return RNP_SUCCESS;
}
void
pgp_packet_body_t::write(pgp_dest_t &dst, bool hdr) noexcept
{
if (hdr) {
uint8_t hdrbt[6] = {
(uint8_t)(tag_ | PGP_PTAG_ALWAYS_SET | PGP_PTAG_NEW_FORMAT), 0, 0, 0, 0, 0};
size_t hlen = 1 + write_packet_len(&hdrbt[1], data_.size());
dst_write(&dst, hdrbt, hlen);
}
dst_write(&dst, data_.data(), data_.size());
}
void
pgp_packet_body_t::mark_secure(bool secure) noexcept
{
secure_ = secure;
}
void
pgp_sk_sesskey_t::write(pgp_dest_t &dst) const
{
pgp_packet_body_t pktbody(PGP_PKT_SK_SESSION_KEY);
/* version and algorithm fields */
pktbody.add_byte(version);
#if defined(ENABLE_CRYPTO_REFRESH)
uint8_t s2k_len;
/* A one-octet scalar octet count for the 5 fields following this octet. */
if (version == PGP_SKSK_V6) {
s2k_len = pgp_s2k_t::specifier_len(s2k.specifier);
pktbody.add_byte(3 + s2k_len + ivlen);
}
#endif
pktbody.add_byte(alg);
if (version == PGP_SKSK_V5
#if defined(ENABLE_CRYPTO_REFRESH)
|| version == PGP_SKSK_V6
#endif
) {
pktbody.add_byte(aalg);
}
/* S2K specifier */
#if defined(ENABLE_CRYPTO_REFRESH)
/* A one-octet scalar octet count of the following field. */
if (version == PGP_SKSK_V6) {
pktbody.add_byte(s2k_len);
}
#endif
pktbody.add_byte(s2k.specifier);
#if defined(ENABLE_CRYPTO_REFRESH)
if (s2k.specifier != PGP_S2KS_ARGON2)
#endif
{
pktbody.add_byte(s2k.hash_alg);
}
switch (s2k.specifier) {
case PGP_S2KS_SIMPLE:
break;
case PGP_S2KS_SALTED:
pktbody.add(s2k.salt, s2k.salt_size(s2k.specifier));
break;
case PGP_S2KS_ITERATED_AND_SALTED:
pktbody.add(s2k.salt, s2k.salt_size(s2k.specifier));
pktbody.add_byte(s2k.iterations);
break;
#if defined(ENABLE_CRYPTO_REFRESH)
case PGP_S2KS_ARGON2:
pktbody.add(s2k.salt, s2k.salt_size(s2k.specifier));
pktbody.add_byte(s2k.argon2_t);
pktbody.add_byte(s2k.argon2_p);
pktbody.add_byte(s2k.argon2_encoded_m);
break;
#endif
default:
RNP_LOG("Unexpected s2k specifier: %d", (int) s2k.specifier);
throw rnp::rnp_exception(RNP_ERROR_BAD_PARAMETERS);
}
/* v5 : iv */
if (version == PGP_SKSK_V5
#if defined(ENABLE_CRYPTO_REFRESH)
|| version == PGP_SKSK_V6
#endif
) {
pktbody.add(iv, ivlen);
}
/* encrypted key and auth tag for v5 */
if (enckeylen) {
pktbody.add(enckey, enckeylen);
}
/* write packet */
pktbody.write(dst);
}
#if defined(ENABLE_CRYPTO_REFRESH)
rnp_result_t
pgp_sk_sesskey_t::parse_v6(pgp_packet_body_t &pkt)
{
uint8_t bt;
uint8_t octet_count;
uint8_t s2k_len;
/* A one-octet scalar octet count for the 5 fields following this octet. */
/* TODO: do we need to check octet_count? */
if (!pkt.get(octet_count)) {
RNP_LOG("failed to get octet count of next 5 fields");
return RNP_ERROR_BAD_FORMAT;
}
/* symmetric algorithm */
if (!pkt.get(bt)) {
RNP_LOG("failed to get symm alg");
return RNP_ERROR_BAD_FORMAT;
}
alg = (pgp_symm_alg_t) bt;
/* aead algorithm */
if (!pkt.get(bt)) {
RNP_LOG("failed to get aead alg");
return RNP_ERROR_BAD_FORMAT;
}
aalg = (pgp_aead_alg_t) bt;
if ((aalg != PGP_AEAD_EAX) && (aalg != PGP_AEAD_OCB)) {
RNP_LOG("unsupported AEAD algorithm : %d", (int) aalg);
return RNP_ERROR_BAD_PARAMETERS;
}
/* A one-octet scalar octet count of the following field. */
/* TODO: do we need to check s2k_len? */
if (!pkt.get(s2k_len)) {
RNP_LOG("failed to get octet count of next 5 fields");
return RNP_ERROR_BAD_FORMAT;
}
/* s2k */
if (!pkt.get(s2k)) {
RNP_LOG("failed to parse s2k");
return RNP_ERROR_BAD_FORMAT;
}
size_t noncelen = pgp_cipher_aead_nonce_len(aalg);
size_t taglen = pgp_cipher_aead_tag_len(aalg);
size_t keylen = 0;
if (pkt.left() > noncelen + taglen + PGP_MAX_KEY_SIZE) {
RNP_LOG("too long esk");
return RNP_ERROR_BAD_FORMAT;
}
if (pkt.left() < noncelen + taglen + 8) {
RNP_LOG("too short esk");
return RNP_ERROR_BAD_FORMAT;
}
/* iv */
if (!pkt.get(iv, noncelen)) {
RNP_LOG("failed to get iv");
return RNP_ERROR_BAD_FORMAT;
}
ivlen = noncelen;
/* key */
keylen = pkt.left();
if (!pkt.get(enckey, keylen)) {
RNP_LOG("failed to get key");
return RNP_ERROR_BAD_FORMAT;
}
enckeylen = keylen;
return RNP_SUCCESS;
}
#endif
rnp_result_t
pgp_sk_sesskey_t::parse(pgp_source_t &src)
{
pgp_packet_body_t pkt(PGP_PKT_SK_SESSION_KEY);
rnp_result_t res = pkt.read(src);
if (res) {
return res;
}
/* version */
uint8_t bt;
if (!pkt.get(bt) || ((bt != PGP_SKSK_V4) && (bt != PGP_SKSK_V5))) {
#if defined(ENABLE_CRYPTO_REFRESH)
if (bt == PGP_SKSK_V6) {
version = bt;
return parse_v6(pkt);
}
#endif
RNP_LOG("wrong packet version");
return RNP_ERROR_BAD_FORMAT;
}
version = bt;
/* symmetric algorithm */
if (!pkt.get(bt)) {
RNP_LOG("failed to get symm alg");
return RNP_ERROR_BAD_FORMAT;
}
alg = (pgp_symm_alg_t) bt;
if (version == PGP_SKSK_V5) {
/* aead algorithm */
if (!pkt.get(bt)) {
RNP_LOG("failed to get aead alg");
return RNP_ERROR_BAD_FORMAT;
}
aalg = (pgp_aead_alg_t) bt;
if ((aalg != PGP_AEAD_EAX) && (aalg != PGP_AEAD_OCB)) {
RNP_LOG("unsupported AEAD algorithm : %d", (int) aalg);
return RNP_ERROR_BAD_PARAMETERS;
}
}
/* s2k */
if (!pkt.get(s2k)) {
RNP_LOG("failed to parse s2k");
return RNP_ERROR_BAD_FORMAT;
}
/* v4 key */
if (version == PGP_SKSK_V4) {
/* encrypted session key if present */
size_t keylen = pkt.left();
if (keylen) {
if (keylen > PGP_MAX_KEY_SIZE + 1) {
RNP_LOG("too long esk");
return RNP_ERROR_BAD_FORMAT;
}
if (!pkt.get(enckey, keylen)) {
RNP_LOG("failed to get key");
return RNP_ERROR_BAD_FORMAT;
}
}
enckeylen = keylen;
return RNP_SUCCESS;
}
/* v5: iv + esk + tag. For both EAX and OCB ivlen and taglen are 16 octets */
size_t noncelen = pgp_cipher_aead_nonce_len(aalg);
size_t taglen = pgp_cipher_aead_tag_len(aalg);
size_t keylen = 0;
if (pkt.left() > noncelen + taglen + PGP_MAX_KEY_SIZE) {
RNP_LOG("too long esk");
return RNP_ERROR_BAD_FORMAT;
}
if (pkt.left() < noncelen + taglen + 8) {
RNP_LOG("too short esk");
return RNP_ERROR_BAD_FORMAT;
}
/* iv */
if (!pkt.get(iv, noncelen)) {
RNP_LOG("failed to get iv");
return RNP_ERROR_BAD_FORMAT;
}
ivlen = noncelen;
/* key */
keylen = pkt.left();
if (!pkt.get(enckey, keylen)) {
RNP_LOG("failed to get key");
return RNP_ERROR_BAD_FORMAT;
}
enckeylen = keylen;
return RNP_SUCCESS;
}
void
pgp_pk_sesskey_t::write(pgp_dest_t &dst) const
{
pgp_packet_body_t pktbody(PGP_PKT_PK_SESSION_KEY);
pktbody.add_byte(version);
#if defined(ENABLE_CRYPTO_REFRESH)
if (version == PGP_PKSK_V3) {
#endif
pktbody.add(key_id);
#if defined(ENABLE_CRYPTO_REFRESH)
} else { // PGP_PKSK_V6
pktbody.add_byte(1 + fp.size()); // A one-octet size of the following two fields.
pktbody.add_byte((fp.size() == PGP_FINGERPRINT_V6_SIZE) ? PGP_V6 : PGP_V4);
pktbody.add(fp.vec());
}
#endif
pktbody.add_byte(alg);
pktbody.add(material_buf.data(), material_buf.size());
pktbody.write(dst);
}
rnp_result_t
pgp_pk_sesskey_t::parse(pgp_source_t &src)
{
pgp_packet_body_t pkt(PGP_PKT_PK_SESSION_KEY);
rnp_result_t res = pkt.read(src);
if (res) {
return res;
}
/* version */
uint8_t bt = 0;
if (!pkt.get(bt)) {
RNP_LOG("Error when reading packet version");
return RNP_ERROR_BAD_FORMAT;
}
#if defined(ENABLE_CRYPTO_REFRESH)
if ((bt != PGP_PKSK_V3) && (bt != PGP_PKSK_V6)) {
#else
if ((bt != PGP_PKSK_V3)) {
#endif
RNP_LOG("wrong packet version");
return RNP_ERROR_BAD_FORMAT;
}
version = (pgp_pkesk_version_t) bt;
#if defined(ENABLE_CRYPTO_REFRESH)
if (version == PGP_PKSK_V3)
#endif
{
/* key id */
if (!pkt.get(key_id)) {
RNP_LOG("failed to get key id");
return RNP_ERROR_BAD_FORMAT;
}
}
#if defined(ENABLE_CRYPTO_REFRESH)
else { // PGP_PKSK_V6
uint8_t fp_and_key_ver_len; // A one-octet size of the following two fields.
if (!pkt.get(fp_and_key_ver_len)) {
RNP_LOG("Error when reading length of next two fields");
return RNP_ERROR_BAD_FORMAT;
}
if ((fp_and_key_ver_len != 1 + PGP_FINGERPRINT_V4_SIZE) &&
(fp_and_key_ver_len != 1 + PGP_FINGERPRINT_V6_SIZE)) {
RNP_LOG("Invalid size for key version + length field");
return RNP_ERROR_BAD_FORMAT;
}
size_t fp_len;
uint8_t fp_key_version;
if (!pkt.get(fp_key_version)) {
RNP_LOG("Error when reading key version");
return RNP_ERROR_BAD_FORMAT;
}
switch (fp_key_version) {
case 0: // anonymous
fp_len = 0;
break;
case PGP_V4:
fp_len = PGP_FINGERPRINT_V4_SIZE;
break;
case PGP_V6:
fp_len = PGP_FINGERPRINT_V6_SIZE;
break;
default:
RNP_LOG("wrong key version used with PKESK v6");
return RNP_ERROR_BAD_FORMAT;
}
if (fp_len && (fp_len + 1 != fp_and_key_ver_len)) {
RNP_LOG("size mismatch (fingerprint size and fp+key version length field)");
return RNP_ERROR_BAD_FORMAT;
}
std::vector<uint8_t> vec(fp_len, 0);
if (!pkt.get(vec.data(), vec.size())) {
RNP_LOG("Error when reading fingerprint");
return RNP_ERROR_BAD_FORMAT;
}
fp = pgp::Fingerprint(vec.data(), vec.size());
}
#endif
/* public key algorithm */
if (!pkt.get(bt)) {
RNP_LOG("failed to get palg");
return RNP_ERROR_BAD_FORMAT;
}
alg = (pgp_pubkey_alg_t) bt;
/* symmetric algorithm */
salg = PGP_SA_UNKNOWN;
/* raw encrypted material */
if (!pkt.left()) {
RNP_LOG("No encrypted material");
return RNP_ERROR_BAD_FORMAT;
}
try {
material_buf.resize(pkt.left());
} catch (const std::exception &e) {
RNP_LOG("%s", e.what());
return RNP_ERROR_OUT_OF_MEMORY;
}
/* we cannot fail here */
pkt.get(material_buf.data(), material_buf.size());
/* check whether it can be parsed */
if (!parse_material()) {
return RNP_ERROR_BAD_FORMAT;
}
return RNP_SUCCESS;
}
std::unique_ptr<pgp::EncMaterial>
pgp_pk_sesskey_t::parse_material() const
{
auto enc = pgp::EncMaterial::create(alg);
if (!enc) {
return nullptr;
}
#if defined(ENABLE_CRYPTO_REFRESH)
enc->version = version;
#endif
pgp_packet_body_t pkt(material_buf);
if (!enc->parse(pkt)) {
return nullptr;
}
if (pkt.left()) {
RNP_LOG("extra %zu bytes in pk packet", pkt.left());
return nullptr;
}
return enc;
}
void
pgp_pk_sesskey_t::write_material(const pgp::EncMaterial &material)
{
pgp_packet_body_t pktbody(PGP_PKT_PK_SESSION_KEY);
material.write(pktbody);
material_buf.assign(pktbody.data(), pktbody.data() + pktbody.size());
}
void
pgp_one_pass_sig_t::write(pgp_dest_t &dst) const
{
pgp_packet_body_t pktbody(PGP_PKT_ONE_PASS_SIG);
pktbody.add_byte(version);
pktbody.add_byte(type);
pktbody.add_byte(halg);
pktbody.add_byte(palg);
#if defined(ENABLE_CRYPTO_REFRESH)
if (version == PGP_OPS_V6) {
pktbody.add_byte(salt.size());
pktbody.add(salt);
}
#endif
if (version == PGP_OPS_V3) {
pktbody.add(keyid);
}
#if defined(ENABLE_CRYPTO_REFRESH)
if (version == PGP_OPS_V6) {
pktbody.add(fp.vec());
}
#endif
pktbody.add_byte(nested);
pktbody.write(dst);
}
rnp_result_t
pgp_one_pass_sig_t::parse(pgp_source_t &src)
{
pgp_packet_body_t pkt(PGP_PKT_ONE_PASS_SIG);
/* Read the packet into memory */
rnp_result_t res = pkt.read(src);
if (res) {
return res;
}
/* version */
if ((pkt.size() < 1) || !pkt.get(version)) {
return RNP_ERROR_BAD_FORMAT;
}
switch ((pgp_ops_version_t) version) {
case PGP_OPS_V3:
return parse_v3(pkt);
#if defined(ENABLE_CRYPTO_REFRESH)
case PGP_OPS_V6:
return parse_v6(pkt);
#endif
default:
RNP_LOG("wrong packet version");
return RNP_ERROR_BAD_FORMAT;
}
}
#if defined(ENABLE_CRYPTO_REFRESH)
rnp_result_t
pgp_one_pass_sig_t::parse_v6(pgp_packet_body_t &pkt)
{
uint8_t buf[4];
uint8_t salt_size;
/* packet can't be smaller for v6 */
const size_t min_size = 54;
if ((pkt.size() < min_size)) {
return RNP_ERROR_BAD_FORMAT;
}
/* version */
version = PGP_OPS_V6;
if (!pkt.get(buf, 4)) {
return RNP_ERROR_BAD_FORMAT;
}
/* signature type */
type = (pgp_sig_type_t) buf[0];
/* hash algorithm */
halg = (pgp_hash_alg_t) buf[1];
/* pk algorithm */
palg = (pgp_pubkey_alg_t) buf[2];
/* salt */
salt_size = buf[3];
size_t expect_salt_size;
if (!pgp::pkt::Signature::v6_salt_size(halg, &expect_salt_size)) {
RNP_LOG("invalid halg");
return RNP_ERROR_BAD_FORMAT;
}
if (salt_size != expect_salt_size) {
RNP_LOG("invalid salt size");
return RNP_ERROR_BAD_FORMAT;
}
salt.resize(salt_size);
if (!pkt.get(salt.data(), salt.size())) {
RNP_LOG("failed to get salt");
return RNP_ERROR_BAD_FORMAT;
}
/* fingerprint */
std::vector<uint8_t> fp_vec;
fp_vec.resize(PGP_FINGERPRINT_V6_SIZE);
if (!pkt.get(fp_vec.data(), fp_vec.size())) {
RNP_LOG("failed to get fingerprint");
return RNP_ERROR_BAD_FORMAT;
}
fp = pgp::Fingerprint(fp_vec.data(), fp_vec.size());
/* nested flag */
if (!pkt.get(buf, 1)) {
RNP_LOG("failed to get nested flag");
return RNP_ERROR_BAD_FORMAT;
}
nested = buf[0];
if (pkt.left()) {
RNP_LOG("trailing bytes in V6 OPS packet.");
return RNP_ERROR_BAD_FORMAT;
}
return RNP_SUCCESS;
}
#endif
rnp_result_t
pgp_one_pass_sig_t::parse_v3(pgp_packet_body_t &pkt)
{
uint8_t buf[12] = {0};
if ((pkt.size() != 13) || !pkt.get(buf, 12)) {
return RNP_ERROR_BAD_FORMAT;
}
/* signature type */
type = (pgp_sig_type_t) buf[0];
/* hash algorithm */
halg = (pgp_hash_alg_t) buf[1];
/* pk algorithm */
palg = (pgp_pubkey_alg_t) buf[2];
/* key id */
static_assert(std::tuple_size<decltype(keyid)>::value == PGP_KEY_ID_SIZE,
"pgp_one_pass_sig_t.keyid size mismatch");
memcpy(keyid.data(), &buf[3], PGP_KEY_ID_SIZE);
/* nested flag */
nested = buf[11];
return RNP_SUCCESS;
}