comm-central/third_party/rnp_experimental/src/librepgp/stream-write.cpp

Source code

Revision control

Copy as Markdown

Other Tools

/*
* Copyright (c) 2017-2023, [Ribose Inc](https://www.ribose.com).
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without modification,
* are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "config.h"
#include "repgp/repgp_def.h"
#include <sys/stat.h>
#include <stdlib.h>
#include <stdio.h>
#include <cassert>
#ifdef HAVE_UNISTD_H
#include <sys/param.h>
#include <unistd.h>
#else
#include "uniwin.h"
#endif
#include <string.h>
#ifdef HAVE_ZLIB_H
#include <zlib.h>
#endif
#ifdef HAVE_BZLIB_H
#include <bzlib.h>
#endif
#include <rnp/rnp_def.h>
#include "stream-def.h"
#include "stream-ctx.h"
#include "stream-write.h"
#include "stream-packet.h"
#include "stream-armor.h"
#include "stream-sig.h"
#include "key.hpp"
#include "fingerprint.hpp"
#include "types.h"
#include "crypto/signatures.h"
#include "defaults.h"
#include <time.h>
#include <algorithm>
#ifdef ENABLE_CRYPTO_REFRESH
#include "v2_seipd.h"
#include "crypto/hkdf.hpp"
#endif
/* 8192 bytes, as GnuPG */
#define PGP_PARTIAL_PKT_SIZE_BITS (13)
#define PGP_PARTIAL_PKT_BLOCK_SIZE (1 << PGP_PARTIAL_PKT_SIZE_BITS)
/* common fields for encrypted, compressed and literal data */
typedef struct pgp_dest_packet_param_t {
pgp_dest_t *writedst; /* destination to write to, could be partial */
pgp_dest_t *origdst; /* original dest passed to init_*_dst */
bool partial; /* partial length packet */
bool indeterminate; /* indeterminate length packet */
int tag; /* packet tag */
uint8_t hdr[PGP_MAX_HEADER_SIZE]; /* header, including length, as it was written */
size_t hdrlen; /* number of bytes in hdr */
} pgp_dest_packet_param_t;
typedef struct pgp_dest_compressed_param_t {
pgp_dest_packet_param_t pkt;
pgp_compression_type_t alg;
union {
z_stream z;
#ifdef HAVE_BZLIB_H
bz_stream bz;
#endif
};
bool zstarted; /* whether we initialize zlib/bzip2 */
uint8_t cache[PGP_INPUT_CACHE_SIZE / 2]; /* pre-allocated cache for compression */
size_t len; /* number of bytes cached */
} pgp_dest_compressed_param_t;
typedef struct pgp_dest_encrypted_param_t {
pgp_dest_packet_param_t pkt{}; /* underlying packet-related params */
rnp_ctx_t & ctx; /* rnp operation context with additional parameters */
rnp::AuthType auth_type{}; /* Authentication type: MDC, AEAD or none */
pgp_crypt_t encrypt{}; /* encrypting crypto */
std::unique_ptr<rnp::Hash> mdc; /* mdc SHA1 hash */
pgp_aead_alg_t aalg; /* AEAD algorithm used */
uint8_t iv[PGP_AEAD_MAX_NONCE_LEN]{}; /* iv for AEAD mode */
uint8_t ad[PGP_AEAD_MAX_AD_LEN]{}; /* additional data for AEAD mode */
size_t adlen{}; /* length of additional data, including chunk idx */
size_t chunklen{}; /* length of the AEAD chunk in bytes */
size_t chunkout{}; /* how many bytes from the chunk were written out */
size_t chunkidx{}; /* index of the current AEAD chunk */
size_t cachelen{}; /* how many bytes are in cache, for AEAD */
uint8_t cache[PGP_AEAD_CACHE_LEN]{}; /* pre-allocated cache for encryption */
#ifdef ENABLE_CRYPTO_REFRESH
std::array<uint8_t, PGP_SEIPDV2_SALT_LEN> v2_seipd_salt; /* SEIPDv2 salt value */
#endif
std::list<pgp_sk_sesskey_t> skesks;
pgp_dest_encrypted_param_t(rnp_ctx_t &actx) : ctx(actx), aalg(PGP_AEAD_NONE)
{
}
bool
is_aead_auth()
{
switch (this->auth_type) {
case rnp::AuthType::AEADv1:
#ifdef ENABLE_CRYPTO_REFRESH
case rnp::AuthType::AEADv2:
#endif
return true;
default:
return false;
}
}
#ifdef ENABLE_CRYPTO_REFRESH
bool
is_v2_seipd() const
{
return this->auth_type == rnp::AuthType::AEADv2;
}
#endif
} pgp_dest_encrypted_param_t;
typedef struct pgp_dest_signer_info_t {
pgp_one_pass_sig_t onepass;
rnp::Key * key;
pgp_hash_alg_t halg;
int64_t sigcreate;
uint64_t sigexpire;
#if defined(ENABLE_CRYPTO_REFRESH)
std::vector<uint8_t> salt;
#endif
} pgp_dest_signer_info_t;
typedef struct pgp_dest_signed_param_t {
pgp_dest_t * writedst; /* destination to write to */
rnp_ctx_t * ctx; /* rnp operation context with additional parameters */
pgp_password_provider_t *password_provider; /* password provider from write handler */
std::vector<pgp_dest_signer_info_t> siginfos; /* list of pgp_dest_signer_info_t */
rnp::HashList hashes; /* hashes to pass raw data through and then sign */
bool clr_start; /* we are on the start of the line */
uint8_t clr_buf[CT_BUF_LEN]; /* buffer to hold partial line data */
size_t clr_buflen; /* number of bytes in buffer */
pgp_literal_hdr_t lhdr{}; /* literal packet header, needed for v5 sigs */
bool has_lhdr = false;
pgp_dest_signed_param_t() = default;
~pgp_dest_signed_param_t() = default;
} pgp_dest_signed_param_t;
typedef struct pgp_dest_partial_param_t {
pgp_dest_t *writedst;
uint8_t part[PGP_PARTIAL_PKT_BLOCK_SIZE];
uint8_t parthdr; /* header byte for the current part */
size_t partlen; /* length of the current part, up to PARTIAL_PKT_BLOCK_SIZE */
size_t len; /* bytes cached in part */
} pgp_dest_partial_param_t;
static rnp_result_t
partial_dst_write(pgp_dest_t *dst, const void *buf, size_t len)
{
pgp_dest_partial_param_t *param = (pgp_dest_partial_param_t *) dst->param;
if (!param) {
/* LCOV_EXCL_START */
RNP_LOG("wrong param");
return RNP_ERROR_BAD_PARAMETERS;
/* LCOV_EXCL_END */
}
if (len > param->partlen - param->len) {
/* we have full part - in block and in buf */
size_t wrlen = param->partlen - param->len;
dst_write(param->writedst, &param->parthdr, 1);
dst_write(param->writedst, param->part, param->len);
dst_write(param->writedst, buf, wrlen);
buf = (uint8_t *) buf + wrlen;
len -= wrlen;
param->len = 0;
/* writing all full parts directly from buf */
while (len >= param->partlen) {
dst_write(param->writedst, &param->parthdr, 1);
dst_write(param->writedst, buf, param->partlen);
buf = (uint8_t *) buf + param->partlen;
len -= param->partlen;
}
}
/* caching rest of the buf */
if (len > 0) {
memcpy(&param->part[param->len], buf, len);
param->len += len;
}
return RNP_SUCCESS;
}
static rnp_result_t
partial_dst_finish(pgp_dest_t *dst)
{
pgp_dest_partial_param_t *param = (pgp_dest_partial_param_t *) dst->param;
uint8_t hdr[5];
int lenlen;
lenlen = write_packet_len(hdr, param->len);
dst_write(param->writedst, hdr, lenlen);
dst_write(param->writedst, param->part, param->len);
return param->writedst->werr;
}
static void
partial_dst_close(pgp_dest_t *dst, bool discard)
{
pgp_dest_partial_param_t *param = (pgp_dest_partial_param_t *) dst->param;
free(param);
dst->param = NULL;
}
static rnp_result_t
init_partial_pkt_dst(pgp_dest_t &dst, pgp_dest_t &writedst)
{
pgp_dest_partial_param_t *param = NULL;
if (!init_dst_common(&dst, sizeof(*param))) {
return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
}
param = (pgp_dest_partial_param_t *) dst.param;
param->writedst = &writedst;
param->partlen = PGP_PARTIAL_PKT_BLOCK_SIZE;
param->parthdr = 0xE0 | PGP_PARTIAL_PKT_SIZE_BITS;
dst.param = param;
dst.write = partial_dst_write;
dst.finish = partial_dst_finish;
dst.close = partial_dst_close;
dst.type = PGP_STREAM_PARLEN_PACKET;
return RNP_SUCCESS;
}
/** @brief helper function for streamed packets (literal, encrypted and compressed).
* Allocates part len destination if needed and writes header
**/
static bool
init_streamed_packet(pgp_dest_packet_param_t &param, pgp_dest_t &dst)
{
rnp_result_t ret = RNP_ERROR_GENERIC;
if (param.partial) {
param.hdr[0] = param.tag | PGP_PTAG_ALWAYS_SET | PGP_PTAG_NEW_FORMAT;
dst_write(&dst, &param.hdr, 1);
if (!(param.writedst = new (std::nothrow) pgp_dest_t)) {
RNP_LOG("part len dest allocation failed");
return false;
}
ret = init_partial_pkt_dst(*param.writedst, dst);
if (ret) {
/* LCOV_EXCL_START */
delete param.writedst;
param.writedst = NULL;
return false;
/* LCOV_EXCL_END */
}
param.origdst = &dst;
param.hdr[1] = ((pgp_dest_partial_param_t *) param.writedst->param)->parthdr;
param.hdrlen = 2;
return true;
}
/* LCOV_EXCL_START this branch is not used at all */
if (param.indeterminate) {
if (param.tag > 0xf) {
RNP_LOG("indeterminate tag > 0xf");
}
param.hdr[0] = ((param.tag & 0xf) << PGP_PTAG_OF_CONTENT_TAG_SHIFT) |
PGP_PTAG_OLD_LEN_INDETERMINATE;
param.hdrlen = 1;
dst_write(&dst, &param.hdr, 1);
param.writedst = &dst;
param.origdst = &dst;
return true;
}
RNP_LOG("wrong call");
return false;
/* LCOV_EXCL_END */
}
static rnp_result_t
finish_streamed_packet(pgp_dest_packet_param_t *param)
{
if (param->partial) {
return dst_finish(param->writedst);
}
return RNP_SUCCESS;
}
static void
close_streamed_packet(pgp_dest_packet_param_t *param, bool discard)
{
if (param->partial) {
dst_close(param->writedst, discard);
delete param->writedst;
param->writedst = NULL;
}
}
static rnp_result_t
encrypted_dst_write_cfb(pgp_dest_t *dst, const void *buf, size_t len)
{
auto param = static_cast<pgp_dest_encrypted_param_t *>(dst->param);
if (!param) {
/* LCOV_EXCL_START */
RNP_LOG("wrong param");
return RNP_ERROR_BAD_PARAMETERS;
/* LCOV_EXCL_END */
}
if (param->auth_type == rnp::AuthType::MDC) {
try {
param->mdc->add(buf, len);
} catch (const std::exception &e) {
/* LCOV_EXCL_START */
RNP_LOG("%s", e.what());
return RNP_ERROR_BAD_STATE;
/* LCOV_EXCL_END */
}
}
while (len > 0) {
size_t sz = len > sizeof(param->cache) ? sizeof(param->cache) : len;
pgp_cipher_cfb_encrypt(&param->encrypt, param->cache, (const uint8_t *) buf, sz);
dst_write(param->pkt.writedst, param->cache, sz);
len -= sz;
buf = (uint8_t *) buf + sz;
}
return RNP_SUCCESS;
}
#if defined(ENABLE_AEAD)
static rnp_result_t
encrypted_start_aead_chunk(pgp_dest_encrypted_param_t *param, size_t idx, bool last)
{
uint8_t nonce[PGP_AEAD_MAX_NONCE_LEN];
size_t nlen;
size_t taglen;
bool res;
uint64_t total;
taglen = pgp_cipher_aead_tag_len(param->aalg);
/* finish the previous chunk if needed*/
if ((idx > 0) && (param->chunkout + param->cachelen > 0)) {
if (param->cachelen + taglen > sizeof(param->cache)) {
RNP_LOG("wrong state in aead");
return RNP_ERROR_BAD_STATE;
}
if (!pgp_cipher_aead_finish(
&param->encrypt, param->cache, param->cache, param->cachelen)) {
return RNP_ERROR_BAD_STATE;
}
dst_write(param->pkt.writedst, param->cache, param->cachelen + taglen);
}
/* set chunk index for additional data */
if (param->auth_type == rnp::AuthType::AEADv1) {
write_uint64(param->ad + param->adlen - 8, idx);
}
if (last) {
if (!(param->chunkout + param->cachelen)) {
/* we need to clearly reset it since cipher was initialized but not finished */
pgp_cipher_aead_reset(&param->encrypt);
}
total = idx * param->chunklen;
if (param->cachelen + param->chunkout) {
if (param->chunklen < (param->cachelen + param->chunkout)) {
RNP_LOG("wrong last chunk state in aead");
return RNP_ERROR_BAD_STATE;
}
total -= param->chunklen - param->cachelen - param->chunkout;
}
write_uint64(param->ad + param->adlen, total);
param->adlen += 8;
}
if (!pgp_cipher_aead_set_ad(&param->encrypt, param->ad, param->adlen)) {
RNP_LOG("failed to set ad");
return RNP_ERROR_BAD_STATE;
}
/* set chunk index for nonce */
nlen = pgp_cipher_aead_nonce(param->aalg, param->iv, nonce, idx);
if (!nlen) {
RNP_LOG(
"ERROR: when starting encrypted AEAD chunk: could not determine nonce length"); // LCOV_EXCL_LINE
}
/* start cipher */
res = pgp_cipher_aead_start(&param->encrypt, nonce, nlen);
/* write final authentication tag */
if (last) {
res = res && pgp_cipher_aead_finish(&param->encrypt, param->cache, param->cache, 0);
if (res) {
dst_write(param->pkt.writedst, param->cache, taglen);
}
}
param->chunkidx = idx;
param->chunkout = 0;
return res ? RNP_SUCCESS : RNP_ERROR_BAD_PARAMETERS;
}
#endif
static rnp_result_t
encrypted_dst_write_aead(pgp_dest_t *dst, const void *buf, size_t len)
{
#if !defined(ENABLE_AEAD)
RNP_LOG("AEAD is not enabled.");
return RNP_ERROR_WRITE;
#else
auto param = static_cast<pgp_dest_encrypted_param_t *>(dst->param);
size_t sz;
size_t gran;
rnp_result_t res;
if (!param) {
/* LCOV_EXCL_START */
RNP_LOG("wrong param");
return RNP_ERROR_BAD_PARAMETERS;
/* LCOV_EXCL_END */
}
if (!len) {
return RNP_SUCCESS;
}
/* because of botan's FFI granularity we need to make things a bit complicated */
gran = pgp_cipher_aead_granularity(&param->encrypt);
if (param->cachelen > param->chunklen - param->chunkout) {
RNP_LOG("wrong AEAD cache state");
return RNP_ERROR_BAD_STATE;
}
while (len > 0) {
/* 2 tags to align to the PGP_INPUT_CACHE_SIZE size */
sz = std::min(sizeof(param->cache) - 2 * PGP_AEAD_MAX_TAG_LEN - param->cachelen, len);
sz = std::min(sz, param->chunklen - param->chunkout - param->cachelen);
memcpy(param->cache + param->cachelen, buf, sz);
param->cachelen += sz;
if (param->cachelen == param->chunklen - param->chunkout) {
/* we have the tail of the chunk in cache */
if ((res = encrypted_start_aead_chunk(param, param->chunkidx + 1, false))) {
return res;
}
param->cachelen = 0;
} else if (param->cachelen >= gran) {
/* we have part of the chunk - so need to adjust it to the granularity */
size_t gransz = param->cachelen - param->cachelen % gran;
size_t inread = 0;
if (!pgp_cipher_aead_update(
param->encrypt, param->cache, param->cache, gransz, inread)) {
return RNP_ERROR_BAD_STATE;
}
if (inread != gransz) {
/* LCOV_EXCL_START */
RNP_LOG("Unexpected aead update: read %zu instead of %zu.", inread, gransz);
return RNP_ERROR_BAD_STATE;
/* LCOV_EXCL_END */
}
dst_write(param->pkt.writedst, param->cache, gransz);
memmove(param->cache, param->cache + gransz, param->cachelen - gransz);
param->cachelen -= gransz;
param->chunkout += gransz;
}
len -= sz;
buf = (uint8_t *) buf + sz;
}
return RNP_SUCCESS;
#endif
}
static rnp_result_t
encrypted_dst_finish(pgp_dest_t *dst)
{
auto param = static_cast<pgp_dest_encrypted_param_t *>(dst->param);
if (param->is_aead_auth()) {
#if !defined(ENABLE_AEAD)
RNP_LOG("AEAD is not enabled.");
rnp_result_t res = RNP_ERROR_NOT_IMPLEMENTED;
#else
size_t chunks = param->chunkidx;
/* if we didn't write anything in current chunk then discard it and restart */
if (param->chunkout || param->cachelen) {
chunks++;
}
rnp_result_t res = encrypted_start_aead_chunk(param, chunks, true);
pgp_cipher_aead_destroy(&param->encrypt);
#endif
if (res) {
finish_streamed_packet(&param->pkt);
return res;
}
} else if (param->auth_type == rnp::AuthType::MDC) {
uint8_t mdcbuf[MDC_V1_SIZE];
mdcbuf[0] = MDC_PKT_TAG;
mdcbuf[1] = MDC_V1_SIZE - 2;
try {
param->mdc->add(mdcbuf, 2);
param->mdc->finish(&mdcbuf[2]);
param->mdc = nullptr;
} catch (const std::exception &e) {
/* LCOV_EXCL_START */
RNP_LOG("%s", e.what());
return RNP_ERROR_BAD_STATE;
/* LCOV_EXCL_END */
}
pgp_cipher_cfb_encrypt(&param->encrypt, mdcbuf, mdcbuf, MDC_V1_SIZE);
dst_write(param->pkt.writedst, mdcbuf, MDC_V1_SIZE);
}
return finish_streamed_packet(&param->pkt);
}
static void
encrypted_dst_close(pgp_dest_t *dst, bool discard)
{
auto param = static_cast<pgp_dest_encrypted_param_t *>(dst->param);
if (!param) {
return; // LCOV_EXCL_LINE
}
if (param->is_aead_auth()) {
#if defined(ENABLE_AEAD)
pgp_cipher_aead_destroy(&param->encrypt);
#endif
} else {
pgp_cipher_cfb_finish(&param->encrypt);
}
close_streamed_packet(&param->pkt, discard);
delete param;
dst->param = NULL;
}
static rnp_result_t
encrypted_add_recipient(rnp_ctx_t & ctx,
pgp_dest_t & dst,
rnp::Key * userkey,
const rnp::secure_bytes &key,
pgp_pkesk_version_t pkesk_version)
{
auto param = static_cast<pgp_dest_encrypted_param_t *>(dst.param);
/* Use primary key if good for encryption, otherwise look in subkey list */
userkey = find_suitable_key(PGP_OP_ENCRYPT, userkey, &ctx.key_provider);
if (!userkey) {
return RNP_ERROR_NO_SUITABLE_KEY;
}
#if defined(ENABLE_CRYPTO_REFRESH)
/* Crypto Refresh: For X25519/X448 PKESKv3, AES is mandated */
/* PQC: AES is mandated for PKESKv3 */
if (!check_enforce_aes_v3_pkesk(userkey->alg(), param->ctx.ealg, pkesk_version)) {
RNP_LOG("attempting to use v3 PKESK with an unencrypted algorithm id in "
"combination with a symmetric "
"algorithm that is not AES.");
return RNP_ERROR_ENCRYPT_FAILED;
}
#endif
/* Fill pkey */
pgp_pk_sesskey_t pkey;
pkey.version = pkesk_version;
pkey.alg = userkey->alg();
pkey.salg = param->ctx.ealg;
/* set key_id (used for PKESK v3) and fingerprint (used for PKESK v6) */
pkey.key_id = userkey->keyid();
#if defined(ENABLE_CRYPTO_REFRESH)
if (pkey.version == (uint8_t) PGP_V6) {
pkey.fp = userkey->fp();
}
#endif
/* Encrypt the session key */
rnp::secure_bytes enckey;
#if defined(ENABLE_CRYPTO_REFRESH) || defined(ENABLE_PQC)
if ((pkey.version == PGP_PKSK_V3) && do_encrypt_pkesk_v3_alg_id(pkey.alg)) {
/* for pre-crypto-refresh algorithms, algorithm ID is part of the session key */
enckey.push_back(pkey.salg);
}
#else
enckey.push_back(pkey.salg);
#endif
enckey.insert(enckey.end(), key.begin(), key.end());
if (have_pkesk_checksum(pkey.alg)) {
/* Calculate checksum */
rnp::secure_array<uint16_t, 1> checksum;
for (size_t i = 0; i < key.size(); i++) {
checksum[0] += key[i];
}
enckey.push_back(checksum[0] >> 8);
enckey.push_back(checksum[0] & 0xff);
}
#if defined(ENABLE_PQC_DBG_LOG)
RNP_LOG_U8VEC("Key: %s", std::vector<uint8_t>(key.begin(), key.end()));
RNP_LOG_U8VEC("Session Key: %s", std::vector<uint8_t>(enckey.begin(), enckey.end()));
#endif
auto material = pgp::EncMaterial::create(pkey.alg);
#if defined(ENABLE_CRYPTO_REFRESH)
material->version = pkey.version;
#endif
#if defined(ENABLE_PQC) || defined(ENABLE_CRYPTO_REFRESH)
material->salg = pkey.salg;
#endif
if (userkey->alg() == PGP_PKA_ECDH) {
auto ecdh = dynamic_cast<pgp::ECDHEncMaterial *>(material.get());
assert(ecdh);
ecdh->enc.fp = userkey->fp().vec();
}
auto ret = userkey->pkt().material->encrypt(ctx.sec_ctx, *material, enckey);
if (ret) {
return ret;
}
/* Writing symmetric key encrypted session key packet */
try {
pkey.write_material(*material);
pkey.write(*param->pkt.origdst);
return param->pkt.origdst->werr;
} catch (const std::exception &e) {
return RNP_ERROR_WRITE; // LCOV_EXCL_LINE
}
}
static void
encrypted_add_password_v4_single(pgp_dest_encrypted_param_t &param,
rnp::secure_bytes & key,
size_t keylen)
{
assert(param.ctx.passwords.size() == 1);
pgp_sk_sesskey_t skey{};
auto & pass = param.ctx.passwords.front();
skey.version = PGP_SKSK_V4;
skey.s2k = pass.s2k;
/* if there are no public keys then we do not encrypt session key in the packet */
skey.alg = param.ctx.ealg;
skey.enckeylen = 0;
key.assign(pass.key.data(), pass.key.data() + keylen);
param.skesks.push_back(std::move(skey));
}
static bool
encrypted_add_password_v4(pgp_dest_encrypted_param_t & param,
const rnp_symmetric_pass_info_t &pass,
const rnp::secure_bytes & key)
{
pgp_sk_sesskey_t skey{};
skey.version = PGP_SKSK_V4;
skey.s2k = pass.s2k;
/* We may use different algo for CEK and KEK */
skey.enckeylen = key.size() + 1;
skey.enckey[0] = param.ctx.ealg;
memcpy(&skey.enckey[1], key.data(), key.size());
skey.alg = pass.s2k_cipher;
pgp_crypt_t kcrypt;
if (!pgp_cipher_cfb_start(&kcrypt, skey.alg, pass.key.data(), NULL)) {
RNP_LOG("key encryption failed");
return false;
}
pgp_cipher_cfb_encrypt(&kcrypt, skey.enckey, skey.enckey, skey.enckeylen);
pgp_cipher_cfb_finish(&kcrypt);
param.skesks.push_back(std::move(skey));
return true;
}
static bool
encrypted_add_password_v5(pgp_dest_encrypted_param_t & param,
const rnp_symmetric_pass_info_t &pass,
const rnp::secure_bytes & key)
{
#if !defined(ENABLE_AEAD)
RNP_LOG("AEAD support is not enabled.");
return RNP_ERROR_NOT_IMPLEMENTED;
#else
/* AEAD-encrypted v5 packet */
if ((param.ctx.aalg != PGP_AEAD_EAX) && (param.ctx.aalg != PGP_AEAD_OCB)) {
RNP_LOG("unsupported AEAD algorithm");
return false;
}
pgp_sk_sesskey_t skey{};
skey.version = PGP_SKSK_V5;
skey.s2k = pass.s2k;
skey.alg = pass.s2k_cipher;
skey.aalg = param.ctx.aalg;
skey.ivlen = pgp_cipher_aead_nonce_len(skey.aalg);
skey.enckeylen = key.size() + pgp_cipher_aead_tag_len(skey.aalg);
param.ctx.sec_ctx.rng.get(skey.iv, skey.ivlen);
/* initialize cipher */
pgp_crypt_t kcrypt;
if (!pgp_cipher_aead_init(&kcrypt, skey.alg, skey.aalg, pass.key.data(), false)) {
return false;
}
/* set additional data */
if (!encrypted_sesk_set_ad(kcrypt, skey)) {
return false; // LCOV_EXCL_LINE
}
/* calculate nonce */
uint8_t nonce[PGP_AEAD_MAX_NONCE_LEN];
size_t nlen = pgp_cipher_aead_nonce(skey.aalg, skey.iv, nonce, 0);
/* start cipher, encrypt key and get tag */
bool res = pgp_cipher_aead_start(&kcrypt, nonce, nlen) &&
pgp_cipher_aead_finish(&kcrypt, skey.enckey, key.data(), key.size());
pgp_cipher_aead_destroy(&kcrypt);
if (res) {
param.skesks.push_back(std::move(skey));
}
return res;
#endif
}
#if defined(ENABLE_CRYPTO_REFRESH)
static bool
encrypted_add_password_v6(pgp_dest_encrypted_param_t & param,
const rnp_symmetric_pass_info_t &pass,
const rnp::secure_bytes & key)
{
#if !defined(ENABLE_AEAD)
RNP_LOG("AEAD support is not enabled.");
return RNP_ERROR_NOT_IMPLEMENTED;
#else
if ((param.ctx.aalg != PGP_AEAD_EAX) && (param.ctx.aalg != PGP_AEAD_OCB)) {
RNP_LOG("unsupported AEAD algorithm");
return false;
}
pgp_sk_sesskey_t skey{};
skey.version = PGP_SKSK_V6;
skey.s2k = pass.s2k;
skey.alg = pass.s2k_cipher;
skey.aalg = param.ctx.aalg;
skey.ivlen = pgp_cipher_aead_nonce_len(skey.aalg);
skey.enckeylen = key.size() + pgp_cipher_aead_tag_len(skey.aalg);
auto kdf = rnp::Hkdf::create(PGP_HASH_SHA256);
std::vector<uint8_t> kdf_info;
kdf_info.push_back(PGP_PKT_SK_SESSION_KEY | PGP_PTAG_ALWAYS_SET | PGP_PTAG_NEW_FORMAT);
kdf_info.push_back(skey.version);
kdf_info.push_back(skey.alg);
kdf_info.push_back(skey.aalg);
std::vector<uint8_t> kdf_input(pass.key.data(), pass.key.data() + pgp_key_size(skey.alg));
std::vector<uint8_t> derived_key(pgp_key_size(skey.alg));
kdf->extract_expand(NULL,
0, // no salt
kdf_input.data(),
kdf_input.size(),
kdf_info.data(),
kdf_info.size(),
derived_key.data(),
derived_key.size());
param.ctx.sec_ctx.rng.get(skey.iv, skey.ivlen);
/* initialize cipher */
pgp_crypt_t kcrypt;
if (!pgp_cipher_aead_init(&kcrypt, skey.alg, skey.aalg, derived_key.data(), false)) {
return false;
}
/* set additional data */
if (!encrypted_sesk_set_ad(kcrypt, skey)) {
return false; // LCOV_EXCL_LINE
}
/* calculate nonce */
uint8_t nonce[PGP_AEAD_MAX_NONCE_LEN];
size_t nlen = pgp_cipher_aead_nonce(skey.aalg, skey.iv, nonce, 0);
/* start cipher, encrypt key and get tag */
bool res = pgp_cipher_aead_start(&kcrypt, nonce, nlen) &&
pgp_cipher_aead_finish(&kcrypt, skey.enckey, key.data(), key.size());
pgp_cipher_aead_destroy(&kcrypt);
if (res) {
param.skesks.push_back(std::move(skey));
}
return res;
#endif
}
#endif
static bool
encrypted_build_cek(pgp_dest_encrypted_param_t &param,
rnp::secure_bytes & key,
const size_t keylen)
{
auto &ctx = param.ctx;
if (ctx.passwords.empty()) {
ctx.sec_ctx.rng.get(key.data(), keylen);
return true;
}
/* v4 single-password encryption case */
if (ctx.recipients.empty() && (ctx.passwords.size() == 1) && !param.is_aead_auth()) {
encrypted_add_password_v4_single(param, key, keylen);
return true;
}
size_t attempts = 0;
gencek:
ctx.sec_ctx.rng.get(key.data(), keylen);
for (auto &pass : param.ctx.passwords) {
bool res = false;
if (param.auth_type == rnp::AuthType::AEADv1) {
res = encrypted_add_password_v5(param, pass, key);
}
#if defined(ENABLE_CRYPTO_REFRESH)
else if (param.auth_type == rnp::AuthType::AEADv2) {
res = encrypted_add_password_v6(param, pass, key);
}
#endif
else {
res = encrypted_add_password_v4(param, pass, key);
}
if (!res) {
return false;
}
}
if (param.is_aead_auth()) {
return true;
}
/* Workaround for GnuPG symmetric key validity check: if first byte of the decrypted data
* is a valid symmetric algorithm number then it uses password provided, producing an error
* afterwards. */
for (auto &pass : param.ctx.passwords) {
for (auto &skey : param.skesks) {
/* attempt to decrypt cek */
pgp_crypt_t crypt;
if (!pgp_cipher_cfb_start(&crypt, skey.alg, pass.key.data(), NULL)) {
return false;
}
assert(skey.enckeylen == keylen + 1);
rnp::secure_bytes dec(skey.enckeylen, 0);
pgp_cipher_cfb_decrypt(&crypt, dec.data(), skey.enckey, skey.enckeylen);
pgp_cipher_cfb_finish(&crypt);
/* using the correct key */
if (!memcmp(dec.data() + 1, key.data(), keylen)) {
continue;
}
/* check whether the first byte decrypts to valid alg name */
if (pgp_key_size(static_cast<pgp_symm_alg_t>(dec[0]))) {
/* Do not do too many attempts */
attempts++;
if (attempts >= 8) {
break;
}
/* re-generate CEK */
param.skesks.clear();
goto gencek;
}
}
}
return true;
}
static rnp_result_t
encrypted_start_cfb(pgp_dest_encrypted_param_t *param, uint8_t *enckey)
{
uint8_t mdcver = 1;
uint8_t enchdr[PGP_MAX_BLOCK_SIZE + 2]; /* encrypted header */
if (param->auth_type == rnp::AuthType::MDC) {
/* initializing the mdc */
dst_write(param->pkt.writedst, &mdcver, 1);
try {
param->mdc = rnp::Hash::create(PGP_HASH_SHA1);
} catch (const std::exception &e) {
/* LCOV_EXCL_START */
RNP_LOG("cannot create sha1 hash: %s", e.what());
return RNP_ERROR_GENERIC;
/* LCOV_EXCL_END */
}
}
/* initializing the crypto */
size_t blsize = pgp_block_size(param->ctx.ealg);
if (!blsize || !pgp_cipher_cfb_start(&param->encrypt, param->ctx.ealg, enckey, NULL)) {
return RNP_ERROR_BAD_PARAMETERS;
}
/* generating and writing iv/password check bytes */
try {
param->ctx.sec_ctx.rng.get(enchdr, blsize);
enchdr[blsize] = enchdr[blsize - 2];
enchdr[blsize + 1] = enchdr[blsize - 1];
if (param->auth_type == rnp::AuthType::MDC) {
param->mdc->add(enchdr, blsize + 2);
}
} catch (const std::exception &e) {
/* LCOV_EXCL_START */
RNP_LOG("%s", e.what());
return RNP_ERROR_BAD_STATE;
/* LCOV_EXCL_END */
}
pgp_cipher_cfb_encrypt(&param->encrypt, enchdr, enchdr, blsize + 2);
/* RFC 4880, 5.13: Unlike the Symmetrically Encrypted Data Packet, no special CFB
* resynchronization is done after encrypting this prefix data. */
if (param->auth_type == rnp::AuthType::None) {
pgp_cipher_cfb_resync(&param->encrypt, enchdr + 2);
}
dst_write(param->pkt.writedst, enchdr, blsize + 2);
return RNP_SUCCESS;
}
static rnp_result_t
encrypted_start_aead(pgp_dest_encrypted_param_t *param, uint8_t *enckey)
{
#if !defined(ENABLE_AEAD)
RNP_LOG("AEAD support is not enabled.");
return RNP_ERROR_NOT_IMPLEMENTED;
#else
uint8_t hdr[4 + PGP_AEAD_MAX_NONCE_OR_SALT_LEN];
size_t nlen;
if (pgp_block_size(param->ctx.ealg) != 16) {
return RNP_ERROR_BAD_PARAMETERS;
}
/* fill header */
#ifdef ENABLE_CRYPTO_REFRESH
hdr[0] = param->auth_type == rnp::AuthType::AEADv2 ? 2 : 1;
#else
hdr[0] = 1;
#endif
hdr[1] = param->ctx.ealg;
hdr[2] = param->ctx.aalg;
hdr[3] = param->ctx.abits;
/* generate iv */
nlen = pgp_cipher_aead_nonce_len(param->ctx.aalg);
uint8_t *iv_or_salt = param->iv;
size_t iv_or_salt_len = nlen;
#ifdef ENABLE_CRYPTO_REFRESH
if (param->auth_type == rnp::AuthType::AEADv2) {
iv_or_salt = param->v2_seipd_salt.data();
iv_or_salt_len = param->v2_seipd_salt.size();
}
#endif
try {
param->ctx.sec_ctx.rng.get(iv_or_salt, iv_or_salt_len);
} catch (const std::exception &e) {
return RNP_ERROR_RNG; // LCOV_EXCL_LINE
}
memcpy(hdr + 4, iv_or_salt, iv_or_salt_len);
/* output header */
dst_write(param->pkt.writedst, hdr, 4 + iv_or_salt_len);
/* initialize encryption */
param->chunklen = 1L << (hdr[3] + 6);
param->chunkout = 0;
/* fill additional/authenticated data */
uint8_t raw_packet_tag = PGP_PKT_AEAD_ENCRYPTED;
#ifdef ENABLE_CRYPTO_REFRESH
if (param->auth_type == rnp::AuthType::AEADv2) {
raw_packet_tag = PGP_PKT_SE_IP_DATA;
}
#endif
param->ad[0] = raw_packet_tag | PGP_PTAG_ALWAYS_SET | PGP_PTAG_NEW_FORMAT;
memcpy(param->ad + 1, hdr, 4);
#ifdef ENABLE_CRYPTO_REFRESH
if (param->auth_type == rnp::AuthType::AEADv2) {
param->adlen = 5;
} else {
#endif
memset(param->ad + 5, 0, 8);
param->adlen = 13;
#ifdef ENABLE_CRYPTO_REFRESH
}
seipd_v2_aead_fields_t s2_fields;
if (param->auth_type == rnp::AuthType::AEADv2) {
param->aalg = param->ctx.aalg;
pgp_seipdv2_hdr_t v2_seipd_hdr;
v2_seipd_hdr.cipher_alg = param->ctx.ealg;
v2_seipd_hdr.aead_alg = param->ctx.aalg;
v2_seipd_hdr.chunk_size_octet = param->ctx.abits;
v2_seipd_hdr.version = PGP_SE_IP_DATA_V2;
memcpy(v2_seipd_hdr.salt, iv_or_salt, PGP_SEIPDV2_SALT_LEN);
s2_fields = seipd_v2_key_and_nonce_derivation(v2_seipd_hdr, enckey);
enckey = s2_fields.key.data();
if (s2_fields.nonce.size() > sizeof(param->iv)) {
// would be better to indicate an error
s2_fields.nonce.resize(sizeof(param->iv));
}
std::memcpy(param->iv, s2_fields.nonce.data(), s2_fields.nonce.size());
}
#endif
/* initialize cipher */
if (!pgp_cipher_aead_init(
&param->encrypt, param->ctx.ealg, param->ctx.aalg, enckey, false)) {
return RNP_ERROR_BAD_PARAMETERS;
}
return encrypted_start_aead_chunk(param, 0, false);
#endif
}
static rnp_result_t
init_encrypted_dst(rnp_ctx_t &ctx, pgp_dest_t &dst, pgp_dest_t &writedst)
{
size_t keylen = pgp_key_size(ctx.ealg);
if (!keylen) {
RNP_LOG("unknown symmetric algorithm");
return RNP_ERROR_BAD_PARAMETERS;
}
if (ctx.aalg != PGP_AEAD_NONE) {
if ((ctx.aalg != PGP_AEAD_EAX) && (ctx.aalg != PGP_AEAD_OCB)) {
/* LCOV_EXCL_START */
RNP_LOG("unknown AEAD algorithm: %d", (int) ctx.aalg);
return RNP_ERROR_BAD_PARAMETERS;
/* LCOV_EXCL_END */
}
if ((pgp_block_size(ctx.ealg) != 16)) {
/* LCOV_EXCL_START */
RNP_LOG("wrong AEAD symmetric algorithm");
return RNP_ERROR_BAD_PARAMETERS;
/* LCOV_EXCL_END */
}
if ((ctx.abits < 0) || (ctx.abits > 16)) {
/* LCOV_EXCL_START */
RNP_LOG("wrong AEAD chunk bits: %d", ctx.abits);
return RNP_ERROR_BAD_PARAMETERS;
/* LCOV_EXCL_END */
}
}
if (ctx.recipients.empty() && ctx.passwords.empty()) {
RNP_LOG("no recipients");
return RNP_ERROR_BAD_PARAMETERS;
}
try {
dst = pgp_dest_t();
} catch (const std::exception &e) {
return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
}
auto param = new (std::nothrow) pgp_dest_encrypted_param_t(ctx);
if (!param) {
return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
}
dst.param = param;
param->auth_type = ctx.aalg == PGP_AEAD_NONE ? rnp::AuthType::MDC : rnp::AuthType::AEADv1;
#if defined(ENABLE_CRYPTO_REFRESH)
/* We use v6 PKESK/SKESK with v2 SEIPD if all recipients support it
and the variables enable_pkesk_v6 or enable_skesk_v6 are set. */
bool use_v6_pkesk =
ctx.enable_pkesk_v6 && !ctx.recipients.empty() && ctx.pkeskv6_capable(&ctx.key_provider);
bool use_v6_skesk = ctx.enable_skesk_v6 && (ctx.aalg != PGP_AEAD_NONE);
// check that if we have recipients/passwords, also pkesk/skesk v6 is enabled.
if ((use_v6_pkesk || ctx.recipients.empty()) && (use_v6_skesk || ctx.passwords.empty())) {
param->auth_type = rnp::AuthType::AEADv2;
}
#endif
param->aalg = ctx.aalg;
param->pkt.origdst = &writedst;
// the following assignment is covered for the v2 SEIPD case further below
dst.write = param->is_aead_auth() ? encrypted_dst_write_aead : encrypted_dst_write_cfb;
dst.finish = encrypted_dst_finish;
dst.close = encrypted_dst_close;
dst.type = PGP_STREAM_ENCRYPTED;
rnp::secure_bytes enckey(keylen, 0); /* content encryption key */
/* Build SKESK and generate CEK */
rnp_result_t ret = RNP_ERROR_BAD_PARAMETERS;
if (!encrypted_build_cek(*param, enckey, keylen)) {
goto finish;
}
/* Configuring and writing pk-encrypted session keys */
for (auto recipient : ctx.recipients) {
pgp_pkesk_version_t pkesk_version = PGP_PKSK_V3;
#if defined(ENABLE_CRYPTO_REFRESH)
if (param->auth_type == rnp::AuthType::AEADv2) {
pkesk_version = PGP_PKSK_V6;
}
if (param->is_aead_auth() && (param->ctx.aalg == PGP_AEAD_NONE)) {
// set default AEAD if not set
param->ctx.aalg = DEFAULT_AEAD_ALG;
}
#endif
ret = encrypted_add_recipient(ctx, dst, recipient, enckey, pkesk_version);
if (ret) {
goto finish;
}
}
/* Writing sk-encrypted session key(s) */
for (auto &skesk : param->skesks) {
skesk.write(*param->pkt.origdst);
}
/* Initializing partial packet writer */
param->pkt.partial = true;
param->pkt.indeterminate = false;
if (param->auth_type == rnp::AuthType::AEADv1) {
param->pkt.tag = PGP_PKT_AEAD_ENCRYPTED;
} else {
/* We do not generate PGP_PKT_SE_DATA, leaving this just in case */
param->pkt.tag =
param->auth_type == rnp::AuthType::MDC ? PGP_PKT_SE_IP_DATA : PGP_PKT_SE_DATA;
#ifdef ENABLE_CRYPTO_REFRESH
if (param->auth_type == rnp::AuthType::AEADv2) {
param->pkt.tag = PGP_PKT_SE_IP_DATA;
}
#endif
}
/* initializing partial data length writer */
/* we may use intederminate len packet here as well, for compatibility or so on */
if (!init_streamed_packet(param->pkt, writedst)) {
/* LCOV_EXCL_START */
RNP_LOG("failed to init streamed packet");
ret = RNP_ERROR_BAD_PARAMETERS;
goto finish;
/* LCOV_EXCL_END */
}
if (param->is_aead_auth()) {
/* initialize AEAD encryption */
ret = encrypted_start_aead(param, enckey.data());
} else {
/* initialize old CFB or CFB with MDC */
ret = encrypted_start_cfb(param, enckey.data());
}
finish:
ctx.passwords.clear();
if (ret) {
encrypted_dst_close(&dst, true);
}
return ret;
}
static rnp_result_t
signed_dst_write(pgp_dest_t *dst, const void *buf, size_t len)
{
pgp_dest_signed_param_t *param = (pgp_dest_signed_param_t *) dst->param;
dst_write(param->writedst, buf, len);
return RNP_SUCCESS;
}
static void
cleartext_dst_writeline(pgp_dest_signed_param_t *param,
const uint8_t * buf,
size_t len,
bool eol)
{
const uint8_t *ptr;
/* dash-escaping line if needed */
if (param->clr_start && len &&
((buf[0] == CH_DASH) || ((len >= 4) && !strncmp((const char *) buf, ST_FROM, 4)))) {
dst_write(param->writedst, ST_DASHSP, 2);
}
/* output data */
dst_write(param->writedst, buf, len);
try {
if (eol) {
bool hashcrlf = false;
ptr = buf + len - 1;
/* skipping trailing characters - space, tab, carriage return, line feed */
while ((ptr >= buf) && ((*ptr == CH_SPACE) || (*ptr == CH_TAB) ||
(*ptr == CH_CR) || (*ptr == CH_LF))) {
if (*ptr == CH_LF) {
hashcrlf = true;
}
ptr--;
}
/* hashing line body and \r\n */
param->hashes.add(buf, ptr + 1 - buf);
if (hashcrlf) {
param->hashes.add(ST_CRLF, 2);
}
param->clr_start = hashcrlf;
} else if (len > 0) {
/* hashing just line's data */
param->hashes.add(buf, len);
param->clr_start = false;
}
} catch (const std::exception &e) {
RNP_LOG("failed to hash data: %s", e.what()); // LCOV_EXCL_LINE
}
}
static size_t
cleartext_dst_scanline(const uint8_t *buf, size_t len, bool *eol)
{
for (const uint8_t *ptr = buf, *end = buf + len; ptr < end; ptr++) {
if (*ptr == CH_LF) {
if (eol) {
*eol = true;
}
return ptr - buf + 1;
}
}
if (eol) {
*eol = false;
}
return len;
}
static rnp_result_t
cleartext_dst_write(pgp_dest_t *dst, const void *buf, size_t len)
{
const uint8_t * linebg = (const uint8_t *) buf;
size_t linelen;
size_t cplen;
bool eol;
pgp_dest_signed_param_t *param = (pgp_dest_signed_param_t *) dst->param;
if (param->clr_buflen > 0) {
/* number of edge cases may happen here */
linelen = cleartext_dst_scanline(linebg, len, &eol);
if (param->clr_buflen + linelen < sizeof(param->clr_buf)) {
/* fits into buffer */
memcpy(param->clr_buf + param->clr_buflen, linebg, linelen);
param->clr_buflen += linelen;
if (!eol) {
/* do not write the line if we don't have whole */
return RNP_SUCCESS;
}
cleartext_dst_writeline(param, param->clr_buf, param->clr_buflen, true);
param->clr_buflen = 0;
} else {
/* we have line longer than 4k */
cplen = sizeof(param->clr_buf) - param->clr_buflen;
memcpy(param->clr_buf + param->clr_buflen, linebg, cplen);
cleartext_dst_writeline(param, param->clr_buf, sizeof(param->clr_buf), false);
if (eol || (linelen >= sizeof(param->clr_buf))) {
cleartext_dst_writeline(param, linebg + cplen, linelen - cplen, eol);
param->clr_buflen = 0;
} else {
param->clr_buflen = linelen - cplen;
memcpy(param->clr_buf, linebg + cplen, param->clr_buflen);
return RNP_SUCCESS;
}
}
linebg += linelen;
len -= linelen;
}
/* if we get here then we don't have data in param->clr_buf */
while (len > 0) {
linelen = cleartext_dst_scanline(linebg, len, &eol);
if (!eol && (linelen < sizeof(param->clr_buf))) {
memcpy(param->clr_buf, linebg, linelen);
param->clr_buflen = linelen;
return RNP_SUCCESS;
}
cleartext_dst_writeline(param, linebg, linelen, eol);
linebg += linelen;
len -= linelen;
}
return RNP_SUCCESS;
}
static void
signed_fill_signature(pgp_dest_signed_param_t &param,
pgp::pkt::Signature & sig,
pgp_dest_signer_info_t & signer)
{
/* fill signature fields, assuming sign_init was called on it */
if (signer.sigcreate) {
sig.set_creation(signer.sigcreate);
}
sig.set_expiration(signer.sigexpire);
sig.fill_hashed_data();
const rnp::Hash *listh = NULL;
#if defined(ENABLE_CRYPTO_REFRESH)
if (sig.version == PGP_V6) {
listh = param.hashes.get(sig.halg, sig.salt);
} else
#endif
{
listh = param.hashes.get(sig.halg);
}
if (!listh) {
/* LCOV_EXCL_START */
RNP_LOG("failed to obtain hash");
throw rnp::rnp_exception(RNP_ERROR_BAD_STATE);
/* LCOV_EXCL_END */
}
/* decrypt the secret key if needed */
rnp::KeyLocker keylock(*signer.key);
if (signer.key->encrypted() &&
!signer.key->unlock(*param.password_provider, PGP_OP_SIGN)) {
RNP_LOG("wrong secret key password");
throw rnp::rnp_exception(RNP_ERROR_BAD_PASSWORD);
}
/* calculate the signature */
auto hdr = param.has_lhdr ? &param.lhdr : NULL;
signature_calculate(
sig, *signer.key->pkt().material, *listh->clone(), param.ctx->sec_ctx, hdr);
}
static rnp_result_t
signed_write_signature(pgp_dest_signed_param_t *param,
pgp_dest_signer_info_t * signer,
pgp_dest_t * writedst)
{
try {
pgp::pkt::Signature sig;
#if defined(ENABLE_CRYPTO_REFRESH)
if (signer->key->version() == PGP_V6) {
// set salt
sig.salt = signer->salt;
}
#endif
if (signer->onepass.version) {
signer->key->sign_init(param->ctx->sec_ctx.rng,
sig,
signer->onepass.halg,
param->ctx->sec_ctx.time(),
signer->key->version());
sig.palg = signer->onepass.palg;
sig.set_type(signer->onepass.type);
} else {
signer->key->sign_init(param->ctx->sec_ctx.rng,
sig,
signer->halg,
param->ctx->sec_ctx.time(),
signer->key->version());
/* line below should be checked */
sig.set_type(param->ctx->detached ? PGP_SIG_BINARY : PGP_SIG_TEXT);
}
signed_fill_signature(*param, sig, *signer);
sig.write(*writedst);
return writedst->werr;
} catch (const rnp::rnp_exception &e) {
return e.code();
} catch (const std::exception &e) {
/* LCOV_EXCL_START */
RNP_LOG("Failed to write signature: %s", e.what());
return RNP_ERROR_WRITE;
/* LCOV_EXCL_END */
}
}
static rnp_result_t
signed_dst_finish(pgp_dest_t *dst)
{
rnp_result_t ret;
pgp_dest_signed_param_t *param = (pgp_dest_signed_param_t *) dst->param;
/* attached signature, we keep onepasses in order of signatures */
for (auto &sinfo : param->siginfos) {
if ((ret = signed_write_signature(param, &sinfo, param->writedst))) {
RNP_LOG("failed to calculate signature");
return ret;
}
}
return RNP_SUCCESS;
}
static rnp_result_t
signed_detached_dst_finish(pgp_dest_t *dst)
{
rnp_result_t ret;
pgp_dest_signed_param_t *param = (pgp_dest_signed_param_t *) dst->param;
/* just calculating and writing signatures to the output */
for (auto &sinfo : param->siginfos) {
if ((ret = signed_write_signature(param, &sinfo, param->writedst))) {
RNP_LOG("failed to calculate detached signature");
return ret;
}
}
return RNP_SUCCESS;
}
static rnp_result_t
cleartext_dst_finish(pgp_dest_t *dst)
{
pgp_dest_signed_param_t *param = (pgp_dest_signed_param_t *) dst->param;
/* writing cached line if any */
if (param->clr_buflen > 0) {
cleartext_dst_writeline(param, param->clr_buf, param->clr_buflen, true);
}
/* trailing \r\n which is not hashed */
dst_write(param->writedst, ST_CRLF, 2);
/* writing signatures to the armored stream, which outputs to param->writedst */
try {
rnp::ArmoredDest armor(*param->writedst, PGP_ARMORED_SIGNATURE);
armor.set_discard(true);
for (auto &sinfo : param->siginfos) {
auto ret = signed_write_signature(param, &sinfo, &armor.dst());
if (ret) {
return ret;
}
}
armor.set_discard(false);
return RNP_SUCCESS;
} catch (const std::exception &e) {
/* LCOV_EXCL_START */
RNP_LOG("Failed to write armored signature: %s", e.what());
return RNP_ERROR_WRITE;
/* LCOV_EXCL_END */
}
}
static void
signed_dst_close(pgp_dest_t *dst, bool discard)
{
pgp_dest_signed_param_t *param = (pgp_dest_signed_param_t *) dst->param;
delete param;
dst->param = NULL;
}
static void
signed_dst_update(pgp_dest_t *dst, const void *buf, size_t len)
{
pgp_dest_signed_param_t *param = (pgp_dest_signed_param_t *) dst->param;
param->hashes.add(buf, len);
}
static void
signed_dst_set_literal_hdr(pgp_dest_t &src, const pgp_literal_hdr_t &hdr)
{
auto param = static_cast<pgp_dest_signed_param_t *>(src.param);
param->lhdr = hdr;
param->has_lhdr = true;
}
static rnp_result_t
signed_add_signer(pgp_dest_signed_param_t &param,
rnp_signer_info_t & signer,
rnp::RNG & rng,
bool last)
{
pgp_dest_signer_info_t sinfo = {};
if (!signer.key->material() || !signer.key->is_secret()) {
RNP_LOG("secret key required for signing");
return RNP_ERROR_BAD_PARAMETERS;
}
/* validate signing key material if didn't before */
signer.key->material()->validate(param.ctx->sec_ctx, false);
if (!signer.key->pkt().material->valid()) {
RNP_LOG("attempt to sign to the key with invalid material");
return RNP_ERROR_NO_SUITABLE_KEY;
}
/* copy fields */
sinfo.key = signer.key;
sinfo.sigcreate = signer.sigcreate;
sinfo.sigexpire = signer.sigexpire;
/* Add hash to the list */
sinfo.halg = signer.key->material()->adjust_hash(signer.halg);
try {
#if defined(ENABLE_CRYPTO_REFRESH)
if (sinfo.key->version() == PGP_V6) {
size_t salt_size;
if (!pgp::pkt::Signature::v6_salt_size(sinfo.halg, &salt_size)) {
RNP_LOG("can't get signature salt size");
return RNP_ERROR_BAD_STATE;
}
sinfo.salt.resize(salt_size);
rng.get(sinfo.salt.data(), salt_size);
param.hashes.add_alg(sinfo.halg, sinfo.salt);
} else
#endif
{
param.hashes.add_alg(sinfo.halg);
}
} catch (const std::exception &e) {
/* LCOV_EXCL_START */
RNP_LOG("%s", e.what());
return RNP_ERROR_BAD_PARAMETERS;
/* LCOV_EXCL_END */
}
// Do not add onepass for detached/clearsign
if (param.ctx->detached || param.ctx->clearsign) {
sinfo.onepass.version = 0;
try {
param.siginfos.push_back(sinfo);
return RNP_SUCCESS;
} catch (const std::exception &e) {
/* LCOV_EXCL_START */
RNP_LOG("%s", e.what());
return RNP_ERROR_OUT_OF_MEMORY;
/* LCOV_EXCL_END */
}
}
// Setup and add onepass
sinfo.onepass.version = 3;
sinfo.onepass.type = PGP_SIG_BINARY;
sinfo.onepass.halg = sinfo.halg;
sinfo.onepass.palg = sinfo.key->alg();
sinfo.onepass.keyid = sinfo.key->keyid();
sinfo.onepass.nested = false;
#if defined(ENABLE_CRYPTO_REFRESH)
if (sinfo.key->version() == PGP_V6) {
// set version and fingerprint for v6
// salt already set above
sinfo.onepass.version = (uint8_t) PGP_OPS_V6;
sinfo.onepass.salt = sinfo.salt;
sinfo.onepass.fp = sinfo.key->fp();
}
#endif
try {
param.siginfos.push_back(sinfo);
} catch (const std::exception &e) {
/* LCOV_EXCL_START */
RNP_LOG("%s", e.what());
return RNP_ERROR_OUT_OF_MEMORY;
/* LCOV_EXCL_END */
}
// write onepasses in reverse order so signature order will match signers list
if (!last) {
return RNP_SUCCESS;
}
try {
for (auto it = param.siginfos.rbegin(); it != param.siginfos.rend(); it++) {
pgp_dest_signer_info_t &sinfo = *it;
sinfo.onepass.nested = &sinfo == &param.siginfos.front();
sinfo.onepass.write(*param.writedst);
}
return param.writedst->werr;
} catch (const std::exception &e) {
return RNP_ERROR_WRITE; // LCOV_EXCL_LINE
}
}
static rnp_result_t
init_signed_dst(rnp_ctx_t &ctx, pgp_dest_t &dst, pgp_dest_t &writedst)
{
pgp_dest_signed_param_t *param = NULL;
rnp_result_t ret = RNP_ERROR_GENERIC;
try {
dst = pgp_dest_t();
} catch (const std::exception &e) {
return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
}
try {
param = new pgp_dest_signed_param_t();
} catch (const std::exception &e) {
/* LCOV_EXCL_START */
RNP_LOG("%s", e.what());
return RNP_ERROR_OUT_OF_MEMORY;
/* LCOV_EXCL_END */
}
dst.param = param;
param->writedst = &writedst;
param->ctx = &ctx;
param->password_provider = &ctx.pass_provider;
if (param->ctx->clearsign) {
dst.type = PGP_STREAM_CLEARTEXT;
dst.write = cleartext_dst_write;
dst.finish = cleartext_dst_finish;
param->clr_start = true;
} else {
dst.type = PGP_STREAM_SIGNED;
dst.write = signed_dst_write;
dst.finish = param->ctx->detached ? signed_detached_dst_finish : signed_dst_finish;
}
dst.close = signed_dst_close;
/* Getting signer's infos, writing one-pass signatures if needed */
for (auto &sg : ctx.signers) {
ret =
signed_add_signer(*param, sg, param->ctx->sec_ctx.rng, &sg == &ctx.signers.back());
if (ret) {
RNP_LOG("failed to add one-pass signature for signer");
goto finish;
}
}
/* Do we have any signatures? */
if (param->hashes.hashes.empty()) {
ret = RNP_ERROR_BAD_PARAMETERS;
goto finish;
}
/* Writing headers for cleartext signed document */
if (param->ctx->clearsign) {
dst_write(param->writedst, ST_CLEAR_BEGIN, strlen(ST_CLEAR_BEGIN));
dst_write(param->writedst, ST_CRLF, strlen(ST_CRLF));
dst_write(param->writedst, ST_HEADER_HASH, strlen(ST_HEADER_HASH));
auto halg_list = param->hashes.hash_algs();
for (pgp_hash_alg_t halg : halg_list) {
auto hname = rnp::Hash::name(halg);
dst_write(param->writedst, hname, strlen(hname));
if (halg != halg_list.back()) {
dst_write(param->writedst, ST_COMMA, 1);
}
}
dst_write(param->writedst, ST_CRLFCRLF, strlen(ST_CRLFCRLF));
}
ret = RNP_SUCCESS;
finish:
if (ret != RNP_SUCCESS) {
signed_dst_close(&dst, true);
}
return ret;
}
static rnp_result_t
compressed_dst_write(pgp_dest_t *dst, const void *buf, size_t len)
{
pgp_dest_compressed_param_t *param = (pgp_dest_compressed_param_t *) dst->param;
if (!param) {
RNP_LOG("wrong param");
return RNP_ERROR_BAD_PARAMETERS;
}
if ((param->alg == PGP_C_ZIP) || (param->alg == PGP_C_ZLIB)) {
param->z.next_in = (unsigned char *) buf;
param->z.avail_in = len;
param->z.next_out = param->cache + param->len;
param->z.avail_out = sizeof(param->cache) - param->len;
while (param->z.avail_in > 0) {
int zret = deflate(&param->z, Z_NO_FLUSH);
/* Z_OK, Z_BUF_ERROR are ok for us, Z_STREAM_END will not happen here */
if (zret == Z_STREAM_ERROR) {
RNP_LOG("wrong deflate state");
return RNP_ERROR_BAD_STATE;
}
/* writing only full blocks, the rest will be written in close */
if (param->z.avail_out == 0) {
dst_write(param->pkt.writedst, param->cache, sizeof(param->cache));
param->len = 0;
param->z.next_out = param->cache;
param->z.avail_out = sizeof(param->cache);
}
}
param->len = sizeof(param->cache) - param->z.avail_out;
return RNP_SUCCESS;
} else if (param->alg == PGP_C_BZIP2) {
#ifdef HAVE_BZLIB_H
param->bz.next_in = (char *) buf;
param->bz.avail_in = len;
param->bz.next_out = (char *) (param->cache + param->len);
param->bz.avail_out = sizeof(param->cache) - param->len;
while (param->bz.avail_in > 0) {
int zret = BZ2_bzCompress(&param->bz, BZ_RUN);
if (zret < 0) {
RNP_LOG("error %d", zret);
return RNP_ERROR_BAD_STATE;
}
/* writing only full blocks, the rest will be written in close */
if (param->bz.avail_out == 0) {
dst_write(param->pkt.writedst, param->cache, sizeof(param->cache));
param->len = 0;
param->bz.next_out = (char *) param->cache;
param->bz.avail_out = sizeof(param->cache);
}
}
param->len = sizeof(param->cache) - param->bz.avail_out;
return RNP_SUCCESS;
#else
return RNP_ERROR_NOT_IMPLEMENTED;
#endif
} else {
RNP_LOG("unknown algorithm");
return RNP_ERROR_BAD_PARAMETERS;
}
}
static rnp_result_t
compressed_dst_finish(pgp_dest_t *dst)
{
int zret;
pgp_dest_compressed_param_t *param = (pgp_dest_compressed_param_t *) dst->param;
if ((param->alg == PGP_C_ZIP) || (param->alg == PGP_C_ZLIB)) {
param->z.next_in = Z_NULL;
param->z.avail_in = 0;
param->z.next_out = param->cache + param->len;
param->z.avail_out = sizeof(param->cache) - param->len;
do {
zret = deflate(&param->z, Z_FINISH);
if (zret == Z_STREAM_ERROR) {
RNP_LOG("wrong deflate state");
return RNP_ERROR_BAD_STATE;
}
if (param->z.avail_out == 0) {
dst_write(param->pkt.writedst, param->cache, sizeof(param->cache));
param->len = 0;
param->z.next_out = param->cache;
param->z.avail_out = sizeof(param->cache);
}
} while (zret != Z_STREAM_END);
param->len = sizeof(param->cache) - param->z.avail_out;
dst_write(param->pkt.writedst, param->cache, param->len);
}
#ifdef HAVE_BZLIB_H
if (param->alg == PGP_C_BZIP2) {
param->bz.next_in = NULL;
param->bz.avail_in = 0;
param->bz.next_out = (char *) (param->cache + param->len);
param->bz.avail_out = sizeof(param->cache) - param->len;
do {
zret = BZ2_bzCompress(&param->bz, BZ_FINISH);
if (zret < 0) {
RNP_LOG("wrong bzip2 state %d", zret);
return RNP_ERROR_BAD_STATE;
}
/* writing only full blocks, the rest will be written in close */
if (param->bz.avail_out == 0) {
dst_write(param->pkt.writedst, param->cache, sizeof(param->cache));
param->len = 0;
param->bz.next_out = (char *) param->cache;
param->bz.avail_out = sizeof(param->cache);
}
} while (zret != BZ_STREAM_END);
param->len = sizeof(param->cache) - param->bz.avail_out;
dst_write(param->pkt.writedst, param->cache, param->len);
}
#endif
if (param->pkt.writedst->werr) {
return param->pkt.writedst->werr;
}
return finish_streamed_packet(&param->pkt);
}
static void
compressed_dst_close(pgp_dest_t *dst, bool discard)
{
pgp_dest_compressed_param_t *param = (pgp_dest_compressed_param_t *) dst->param;
if (!param) {
return;
}
if (param->zstarted) {
if ((param->alg == PGP_C_ZIP) || (param->alg == PGP_C_ZLIB)) {
deflateEnd(&param->z);
}
#ifdef HAVE_BZLIB_H
if (param->alg == PGP_C_BZIP2) {
BZ2_bzCompressEnd(&param->bz);
}
#endif
}
close_streamed_packet(&param->pkt, discard);
free(param);
dst->param = NULL;
}
static rnp_result_t
init_compressed_dst(rnp_ctx_t &ctx, pgp_dest_t &dst, pgp_dest_t &writedst)
{
pgp_dest_compressed_param_t *param = NULL;
rnp_result_t ret = RNP_ERROR_GENERIC;
uint8_t buf = 0;
int zret = 0;
if (!init_dst_common(&dst, sizeof(*param))) {
return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
}
param = (pgp_dest_compressed_param_t *) dst.param;
dst.write = compressed_dst_write;
dst.finish = compressed_dst_finish;
dst.close = compressed_dst_close;
dst.type = PGP_STREAM_COMPRESSED;
param->alg = (pgp_compression_type_t) ctx.zalg;
param->pkt.partial = true;
param->pkt.indeterminate = false;
param->pkt.tag = PGP_PKT_COMPRESSED;
/* initializing partial length or indeterminate packet, writing header */
if (!init_streamed_packet(param->pkt, writedst)) {
/* LCOV_EXCL_START */
RNP_LOG("failed to init streamed packet");
ret = RNP_ERROR_BAD_PARAMETERS;
goto finish;
/* LCOV_EXCL_END */
}
/* compression algorithm */
buf = param->alg;
dst_write(param->pkt.writedst, &buf, 1);
/* initializing compression */
switch (param->alg) {
case PGP_C_ZIP:
case PGP_C_ZLIB:
(void) memset(&param->z, 0x0, sizeof(param->z));
if (param->alg == PGP_C_ZIP) {
zret = deflateInit2(&param->z, ctx.zlevel, Z_DEFLATED, -15, 8, Z_DEFAULT_STRATEGY);
} else {
zret = deflateInit(&param->z, ctx.zlevel);
}
if (zret != Z_OK) {
RNP_LOG("failed to init zlib, error %d", zret);
ret = RNP_ERROR_NOT_SUPPORTED;
goto finish;
}
break;
#ifdef HAVE_BZLIB_H
case PGP_C_BZIP2:
(void) memset(&param->bz, 0x0, sizeof(param->bz));
zret = BZ2_bzCompressInit(&param->bz, ctx.zlevel, 0, 0);
if (zret != BZ_OK) {
RNP_LOG("failed to init bz, error %d", zret);
ret = RNP_ERROR_NOT_SUPPORTED;
goto finish;
}
break;
#endif
default:
RNP_LOG("unknown compression algorithm");
ret = RNP_ERROR_NOT_SUPPORTED;
goto finish;
}
param->zstarted = true;
ret = RNP_SUCCESS;
finish:
if (ret != RNP_SUCCESS) {
compressed_dst_close(&dst, true);
}
return ret;
}
static rnp_result_t
literal_dst_write(pgp_dest_t *dst, const void *buf, size_t len)
{
pgp_dest_packet_param_t *param = (pgp_dest_packet_param_t *) dst->param;
if (!param) {
/* LCOV_EXCL_START */
RNP_LOG("wrong param");
return RNP_ERROR_BAD_PARAMETERS;
/* LCOV_EXCL_END */
}
dst_write(param->writedst, buf, len);
return RNP_SUCCESS;
}
static rnp_result_t
literal_dst_finish(pgp_dest_t *dst)
{
return finish_streamed_packet((pgp_dest_packet_param_t *) dst->param);
}
static void
literal_dst_close(pgp_dest_t *dst, bool discard)
{
pgp_dest_packet_param_t *param = (pgp_dest_packet_param_t *) dst->param;
if (!param) {
return; // LCOV_EXCL_LINE
}
close_streamed_packet(param, discard);
free(param);
dst->param = NULL;
}
static void
build_literal_hdr(const rnp_ctx_t &ctx, pgp_literal_hdr_t &hdr)
{
/* content type - forcing binary now */
hdr.format = 'b';
#if defined(ENABLE_CRYPTO_REFRESH)
// filename and timestamp SHOULD NOT be set (struct is zero-initialized)
return;
#endif
/* filename */
size_t flen = ctx.filename.size();
if (flen > 255) {
RNP_LOG("filename too long, truncating");
flen = 255;
}
hdr.fname_len = flen;
memcpy(hdr.fname, ctx.filename.c_str(), flen);
/* timestamp */
hdr.timestamp = ctx.filemtime;
}
static rnp_result_t
init_literal_dst(pgp_literal_hdr_t &hdr, pgp_dest_t &dst, pgp_dest_t &writedst)
{
pgp_dest_packet_param_t *param = NULL;
if (!init_dst_common(&dst, sizeof(*param))) {
return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
}
param = (pgp_dest_packet_param_t *) dst.param;
dst.write = literal_dst_write;
dst.finish = literal_dst_finish;
dst.close = literal_dst_close;
dst.type = PGP_STREAM_LITERAL;
param->partial = true;
param->indeterminate = false;
param->tag = PGP_PKT_LITDATA;
/* initializing partial length or indeterminate packet, writing header */
if (!init_streamed_packet(*param, writedst)) {
/* LCOV_EXCL_START */
RNP_LOG("failed to init streamed packet");
literal_dst_close(&dst, true);
return RNP_ERROR_BAD_PARAMETERS;
/* LCOV_EXCL_END */
}
/* content type - forcing binary now */
uint8_t buf[4] = {0};
buf[0] = hdr.format;
/* filename length */
buf[1] = hdr.fname_len;
dst_write(param->writedst, buf, 2);
/* filename */
if (hdr.fname_len) {
dst_write(param->writedst, hdr.fname, hdr.fname_len);
}
/* timestamp */
write_uint32(buf, hdr.timestamp);
dst_write(param->writedst, buf, 4);
return RNP_SUCCESS;
}
static rnp_result_t
process_stream_sequence(pgp_source_t &src,
pgp_dest_t * streams,
unsigned count,
pgp_dest_t * sstream,
pgp_dest_t * wstream)
{
std::unique_ptr<uint8_t[]> readbuf(new (std::nothrow) uint8_t[PGP_INPUT_CACHE_SIZE]);
if (!readbuf) {
/* LCOV_EXCL_START */
RNP_LOG("allocation failure");
return RNP_ERROR_OUT_OF_MEMORY;
/* LCOV_EXCL_END */
}
/* processing source stream */
while (!src.eof_) {
size_t read = 0;
if (!src.read(readbuf.get(), PGP_INPUT_CACHE_SIZE, &read)) {
RNP_LOG("failed to read from source");
return RNP_ERROR_READ;
} else if (!read) {
continue;
}
if (sstream) {
signed_dst_update(sstream, readbuf.get(), read);
}
if (wstream) {
dst_write(wstream, readbuf.get(), read);
for (int i = count - 1; i >= 0; i--) {
if (streams[i].werr) {
RNP_LOG("failed to process data");
return RNP_ERROR_WRITE;
}
}
}
}
/* finalizing destinations */
for (int i = count - 1; i >= 0; i--) {
rnp_result_t ret = dst_finish(&streams[i]);
if (ret) {
RNP_LOG("failed to finish stream");
return ret;
}
}
return RNP_SUCCESS;
}
rnp_result_t
rnp_sign_src(rnp_ctx_t &ctx, pgp_source_t &src, pgp_dest_t &dst)
{
/* stack of the streams would be as following:
[armoring stream] - if armoring is enabled
[compressing stream, partial writing stream] - compression is enabled, and not detached
signing stream
literal data stream, partial writing stream - if not detached or cleartext signature
*/
pgp_dest_t dests[4];
size_t destc = 0;
rnp_result_t ret = RNP_ERROR_GENERIC;
pgp_dest_t * wstream = NULL;
pgp_dest_t * sstream = NULL;
/* pushing armoring stream, which will write to the output */
if (ctx.armor && !ctx.clearsign) {
pgp_armored_msg_t msgt = ctx.detached ? PGP_ARMORED_SIGNATURE : PGP_ARMORED_MESSAGE;
ret = init_armored_dst(&dests[destc], &dst, msgt);
if (ret) {
goto finish;
}
destc++;
}
/* if compression is enabled then pushing compressing stream */
if (!ctx.detached && !ctx.clearsign && (ctx.zlevel > 0)) {
if ((ret = init_compressed_dst(ctx, dests[destc], destc ? dests[destc - 1] : dst))) {
goto finish;
}
destc++;
}
/* pushing signing stream, which will use handler->ctx to distinguish between
* attached/detached/cleartext signature */
if ((ret = init_signed_dst(ctx, dests[destc], destc ? dests[destc - 1] : dst))) {
goto finish;
}
if (!ctx.clearsign) {
sstream = &dests[destc];
}
if (!ctx.detached) {
wstream = &dests[destc];
}
destc++;
/* pushing literal data stream, if not detached/cleartext signature */
if (!ctx.no_wrap && !ctx.detached && !ctx.clearsign) {
pgp_literal_hdr_t hdr{};
build_literal_hdr(ctx, hdr);
if ((ret = init_literal_dst(hdr, dests[destc], dests[destc - 1]))) {
goto finish;
}
signed_dst_set_literal_hdr(dests[destc - 1], hdr);
wstream = &dests[destc];
destc++;
}
if (ctx.clearsign) {
/* See https://dev.gnupg.org/T6615 for the details */
pgp_literal_hdr_t hdr{};
hdr.format = 't';
hdr.fname_len = 0;
hdr.timestamp = 0;
signed_dst_set_literal_hdr(dests[destc - 1], hdr);
}
/* process source with streams stack */
ret = process_stream_sequence(src, dests, destc, sstream, wstream);
finish:
for (auto i = destc; i > 0; i--) {
dst_close(&dests[i - 1], ret);
}
return ret;
}
rnp_result_t
rnp_encrypt_sign_src(rnp_ctx_t &ctx, pgp_source_t &src, pgp_dest_t &dst)
{
/* stack of the streams would be as following:
[armoring stream] - if armoring is enabled
[encrypting stream, partial writing stream]
[compressing stream, partial writing stream] - compression is enabled
signing stream
literal data stream, partial writing stream
*/
pgp_dest_t dests[5];
size_t destc = 0;
rnp_result_t ret = RNP_SUCCESS;
pgp_dest_t * sstream = NULL;
/* we may use only attached signatures here */
if (ctx.clearsign || ctx.detached) {
RNP_LOG("cannot clearsign or sign detached together with encryption");
return RNP_ERROR_BAD_PARAMETERS;
}
/* pushing armoring stream, which will write to the output */
if (ctx.armor) {
if ((ret = init_armored_dst(&dests[destc], &dst, PGP_ARMORED_MESSAGE))) {
goto finish;
}
destc++;
}
/* pushing encrypting stream, which will write to the output or armoring stream */
if ((ret = init_encrypted_dst(ctx, dests[destc], destc ? dests[destc - 1] : dst))) {
goto finish;
}
destc++;
/* if compression is enabled then pushing compressing stream */
if (ctx.zlevel > 0) {
if ((ret = init_compressed_dst(ctx, dests[destc], dests[destc - 1]))) {
goto finish;
}
destc++;
}
/* pushing signing stream if we have signers */
if (!ctx.signers.empty()) {
if ((ret = init_signed_dst(ctx, dests[destc], dests[destc - 1]))) {
goto finish;
}
sstream = &dests[destc];
destc++;
}
/* pushing literal data stream */
if (!ctx.no_wrap) {
pgp_literal_hdr_t hdr{};
build_literal_hdr(ctx, hdr);
if ((ret = init_literal_dst(hdr, dests[destc], dests[destc - 1]))) {
goto finish;
}
if (sstream) {
signed_dst_set_literal_hdr(*sstream, hdr);
}
destc++;
}
/* process source with streams stack */
ret = process_stream_sequence(src, dests, destc, sstream, &dests[destc - 1]);
finish:
for (size_t i = destc; i > 0; i--) {
dst_close(&dests[i - 1], ret);
}
return ret;
}
rnp_result_t
rnp_compress_src(pgp_source_t &src, pgp_dest_t &dst, pgp_compression_type_t zalg, int zlevel)
{
rnp::SecurityContext sec_ctx;
rnp::KeyProvider key_prov;
pgp_password_provider_t pass_prov;
rnp_ctx_t ctx(sec_ctx, key_prov, pass_prov);
ctx.zalg = zalg;
ctx.zlevel = zlevel;
pgp_dest_t compressed = {};
rnp_result_t ret = init_compressed_dst(ctx, compressed, dst);
if (ret) {
goto done;
}
ret = dst_write_src(&src, &compressed);
done:
dst_close(&compressed, ret);
return ret;
}
rnp_result_t
rnp_wrap_src(pgp_source_t &src, pgp_dest_t &dst, const std::string &filename, uint32_t modtime)
{
rnp::SecurityContext sec_ctx;
rnp::KeyProvider key_prov;
pgp_password_provider_t pass_prov;
rnp_ctx_t ctx(sec_ctx, key_prov, pass_prov);
ctx.filename = filename;
ctx.filemtime = modtime;
pgp_dest_t literal{};
pgp_literal_hdr_t hdr{};
build_literal_hdr(ctx, hdr);
rnp_result_t ret = init_literal_dst(hdr, literal, dst);
if (ret) {
goto done;
}
ret = dst_write_src(&src, &literal);
done:
dst_close(&literal, ret);
return ret;
}
rnp_result_t
rnp_raw_encrypt_src(pgp_source_t & src,
pgp_dest_t & dst,
const std::string & password,
rnp::SecurityContext &secctx)
{
rnp::SecurityContext sec_ctx;
rnp::KeyProvider key_prov;
pgp_password_provider_t pass_prov;
rnp_ctx_t ctx(sec_ctx, key_prov, pass_prov);
pgp_dest_t encrypted = {};
rnp_result_t ret = RNP_ERROR_GENERIC;
try {
ret =
ctx.add_encryption_password(password, DEFAULT_PGP_HASH_ALG, DEFAULT_PGP_SYMM_ALG);
} catch (const std::exception &e) {
/* LCOV_EXCL_START */
RNP_LOG("%s", e.what());
goto done;
/* LCOV_EXCL_END */
}
if (ret) {
goto done;
}
ret = init_encrypted_dst(ctx, encrypted, dst);
if (ret) {
goto done;
}
ret = dst_write_src(&src, &encrypted);
done:
dst_close(&encrypted, ret);
return ret;
}