From cvs at cvs.gnupg.org Thu Jan 1 19:35:16 2015 From: cvs at cvs.gnupg.org (by Jussi Kivilinna) Date: Thu, 01 Jan 2015 19:35:16 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-144-gc2e1f8f Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via c2e1f8fea271f3ef8027809547c4a52e0b1e24a2 (commit) via 1dab4c9422bf0f3cdc7a4d3ccf9db090abd90e94 (commit) via 99faf9cb34f872144313403f29f3379798debfc9 (commit) via 4515315f61fbf79413e150fbd1d5f5a2435f2bc5 (commit) via cc26106dbebeb84d481661813edc3e5aea9a7d99 (commit) from 520070e02e2e6ee7228945015573a6e1f4895ec3 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c2e1f8fea271f3ef8027809547c4a52e0b1e24a2 Author: Jussi Kivilinna Date: Tue Dec 23 13:33:12 2014 +0200 random-csprng: fix compiler warnings on ARM * random/random-csprng.c (_gcry_rngcsprng_update_seed_file) (read_pool): Cast keypool and rndpool to 'unsigned long *' through 'void *'. -- Patch fixes 'cast increases required alignment' warnings seen on GCC: random-csprng.c: In function '_gcry_rngcsprng_update_seed_file': random-csprng.c:867:15: warning: cast increases required alignment of target type [-Wcast-align] for (i=0,dp=(unsigned long*)keypool, sp=(unsigned long*)rndpool; ^ random-csprng.c:867:43: warning: cast increases required alignment of target type [-Wcast-align] for (i=0,dp=(unsigned long*)keypool, sp=(unsigned long*)rndpool; ^ random-csprng.c: In function 'read_pool': random-csprng.c:1023:14: warning: cast increases required alignment of target type [-Wcast-align] for(i=0,dp=(unsigned long*)keypool, sp=(unsigned long*)rndpool; ^ random-csprng.c:1023:42: warning: cast increases required alignment of target type [-Wcast-align] for(i=0,dp=(unsigned long*)keypool, sp=(unsigned long*)rndpool; ^ Signed-off-by: Jussi Kivilinna diff --git a/random/random-csprng.c b/random/random-csprng.c index 429c84f..332744b 100644 --- a/random/random-csprng.c +++ b/random/random-csprng.c @@ -864,7 +864,7 @@ _gcry_rngcsprng_update_seed_file (void) /* Copy the entropy pool to a scratch pool and mix both of them. */ - for (i=0,dp=(unsigned long*)keypool, sp=(unsigned long*)rndpool; + for (i=0,dp=(unsigned long*)(void*)keypool, sp=(unsigned long*)(void*)rndpool; i < POOLWORDS; i++, dp++, sp++ ) { *dp = *sp + ADD_VALUE; @@ -1020,7 +1020,7 @@ read_pool (byte *buffer, size_t length, int level) } /* Create a new pool. */ - for(i=0,dp=(unsigned long*)keypool, sp=(unsigned long*)rndpool; + for(i=0,dp=(unsigned long*)(void*)keypool, sp=(unsigned long*)(void*)rndpool; i < POOLWORDS; i++, dp++, sp++ ) *dp = *sp + ADD_VALUE; commit 1dab4c9422bf0f3cdc7a4d3ccf9db090abd90e94 Author: Jussi Kivilinna Date: Tue Dec 23 13:31:58 2014 +0200 scrypt: fix compiler warnings on ARM * cipher/scrypt.c (_scryptBlockMix): Cast X to 'u32 *' through 'void *'. -- Patch fixes 'cast increases required alignment' warnings seen on GCC: scrypt.c: In function '_scryptBlockMix': scrypt.c:145:22: warning: cast increases required alignment of target type [-Wcast-align] _salsa20_core ((u32*)X, (u32*)X, 8); ^ scrypt.c:145:31: warning: cast increases required alignment of target type [-Wcast-align] _salsa20_core ((u32*)X, (u32*)X, 8); ^ Signed-off-by: Jussi Kivilinna diff --git a/cipher/scrypt.c b/cipher/scrypt.c index 404943d..aca903d 100644 --- a/cipher/scrypt.c +++ b/cipher/scrypt.c @@ -142,7 +142,7 @@ _scryptBlockMix (u32 r, unsigned char *B, unsigned char *tmp2) buf_xor(X, X, &B[i * 64], 64); /* X = Salsa (T) */ - _salsa20_core ((u32*)X, (u32*)X, 8); + _salsa20_core ((u32*)(void*)X, (u32*)(void*)X, 8); /* Y[i] = X */ memcpy (&Y[i * 64], X, 64); commit 99faf9cb34f872144313403f29f3379798debfc9 Author: Jussi Kivilinna Date: Tue Dec 23 13:31:09 2014 +0200 secmem: fix compiler warnings on ARM * src/secmem.c (ADDR_TO_BLOCK, mb_get_next, mb_get_new): Cast pointer from 'char *' to 'memblock_t *' through 'void *'. (MB_WIPE_OUT): Remove unneeded cast to 'memblock_t *'. -- Patch fixes 'cast increases required alignment' warnings seen on GCC: secmem.c: In function 'mb_get_next': secmem.c:140:13: warning: cast increases required alignment of target type [-Wcast-align] mb_next = (memblock_t *) ((char *) mb + BLOCK_HEAD_SIZE + mb->size); ^ secmem.c: In function 'mb_get_new': secmem.c:208:17: warning: cast increases required alignment of target type [-Wcast-align] mb_split = (memblock_t *) (((char *) mb) + BLOCK_HEAD_SIZE + size); ^ secmem.c: In function '_gcry_secmem_free_internal': secmem.c:101:3: warning: cast increases required alignment of target type [-Wcast-align] (memblock_t *) ((char *) addr - BLOCK_HEAD_SIZE) ^ secmem.c:603:8: note: in expansion of macro 'ADDR_TO_BLOCK' mb = ADDR_TO_BLOCK (a); ^ In file included from secmem.c:40:0: secmem.c:609:16: warning: cast increases required alignment of target type [-Wcast-align] wipememory2 ((memblock_t *) ((char *) mb + BLOCK_HEAD_SIZE), (byte), size); ^ g10lib.h:309:54: note: in definition of macro 'wipememory2' volatile char *_vptr=(volatile char *)(_ptr); \ ^ secmem.c:611:3: note: in expansion of macro 'MB_WIPE_OUT' MB_WIPE_OUT (0xff); ^ secmem.c:609:16: warning: cast increases required alignment of target type [-Wcast-align] wipememory2 ((memblock_t *) ((char *) mb + BLOCK_HEAD_SIZE), (byte), size); ^ g10lib.h:309:54: note: in definition of macro 'wipememory2' volatile char *_vptr=(volatile char *)(_ptr); \ ^ secmem.c:612:3: note: in expansion of macro 'MB_WIPE_OUT' MB_WIPE_OUT (0xaa); ^ secmem.c:609:16: warning: cast increases required alignment of target type [-Wcast-align] wipememory2 ((memblock_t *) ((char *) mb + BLOCK_HEAD_SIZE), (byte), size); ^ g10lib.h:309:54: note: in definition of macro 'wipememory2' volatile char *_vptr=(volatile char *)(_ptr); \ ^ secmem.c:613:3: note: in expansion of macro 'MB_WIPE_OUT' MB_WIPE_OUT (0x55); ^ secmem.c:609:16: warning: cast increases required alignment of target type [-Wcast-align] wipememory2 ((memblock_t *) ((char *) mb + BLOCK_HEAD_SIZE), (byte), size); ^ g10lib.h:309:54: note: in definition of macro 'wipememory2' volatile char *_vptr=(volatile char *)(_ptr); \ ^ secmem.c:614:3: note: in expansion of macro 'MB_WIPE_OUT' MB_WIPE_OUT (0x00); ^ secmem.c: In function '_gcry_secmem_realloc': secmem.c:644:8: warning: cast increases required alignment of target type [-Wcast-align] mb = (memblock_t *) ((char *) p - ((size_t) &((memblock_t *) 0)->aligned.c)); ^ Signed-off-by: Jussi Kivilinna diff --git a/src/secmem.c b/src/secmem.c index cfea921..df15df0 100644 --- a/src/secmem.c +++ b/src/secmem.c @@ -98,7 +98,7 @@ GPGRT_LOCK_DEFINE (secmem_lock); /* Convert an address into the according memory block structure. */ #define ADDR_TO_BLOCK(addr) \ - (memblock_t *) ((char *) addr - BLOCK_HEAD_SIZE) + (memblock_t *) (void *) ((char *) addr - BLOCK_HEAD_SIZE) /* Check whether P points into the pool. */ static int @@ -137,7 +137,7 @@ mb_get_next (memblock_t *mb) { memblock_t *mb_next; - mb_next = (memblock_t *) ((char *) mb + BLOCK_HEAD_SIZE + mb->size); + mb_next = (memblock_t *) (void *) ((char *) mb + BLOCK_HEAD_SIZE + mb->size); if (! ptr_into_pool_p (mb_next)) mb_next = NULL; @@ -205,7 +205,8 @@ mb_get_new (memblock_t *block, size_t size) { /* Split block. */ - mb_split = (memblock_t *) (((char *) mb) + BLOCK_HEAD_SIZE + size); + mb_split = (memblock_t *) (void *) (((char *) mb) + BLOCK_HEAD_SIZE + + size); mb_split->size = mb->size - size - BLOCK_HEAD_SIZE; mb_split->flags = 0; @@ -606,7 +607,7 @@ _gcry_secmem_free_internal (void *a) /* This does not make much sense: probably this memory is held in the * cache. We do it anyway: */ #define MB_WIPE_OUT(byte) \ - wipememory2 ((memblock_t *) ((char *) mb + BLOCK_HEAD_SIZE), (byte), size); + wipememory2 (((char *) mb + BLOCK_HEAD_SIZE), (byte), size); MB_WIPE_OUT (0xff); MB_WIPE_OUT (0xaa); @@ -641,7 +642,8 @@ _gcry_secmem_realloc (void *p, size_t newsize) SECMEM_LOCK; - mb = (memblock_t *) ((char *) p - ((size_t) &((memblock_t *) 0)->aligned.c)); + mb = (memblock_t *) (void *) ((char *) p + - ((size_t) &((memblock_t *) 0)->aligned.c)); size = mb->size; if (newsize < size) { commit 4515315f61fbf79413e150fbd1d5f5a2435f2bc5 Author: Jussi Kivilinna Date: Tue Dec 23 13:01:33 2014 +0200 hash: fix compiler warning on ARM * cipher/md.c (md_open, md_copy): Cast 'char *' to ctx through 'void *'. * cipher/md4.c (md4_final): Use buf_put_* helper instead of converting 'char *' to 'u32 *'. * cipher/md5.c (md5_final): Ditto. * cipher/rmd160.c (_gcry_rmd160_mixblock, rmd160_final): Ditto. * cipher/sha1.c (sha1_final): Ditto. * cipher/sha256.c (sha256_final): Ditto. * cipher/sha512.c (sha512_final): Ditto. * cipher/tiger.c (tiger_final): Ditto. -- Patch fixes 'cast increases required alignment' warnings seen on GCC: md.c: In function 'md_open': md.c:318:23: warning: cast increases required alignment of target type [-Wcast-align] hd->ctx = ctx = (struct gcry_md_context *) ((char *) hd + n); ^ md.c: In function 'md_copy': md.c:491:22: warning: cast increases required alignment of target type [-Wcast-align] bhd->ctx = b = (struct gcry_md_context *) ((char *) bhd + n); ^ md4.c: In function 'md4_final': md4.c:258:20: warning: cast increases required alignment of target type [-Wcast-align] #define X(a) do { *(u32*)p = le_bswap32((*hd).a) ; p += 4; } while(0) ^ md4.c:259:3: note: in expansion of macro 'X' X(A); ^ md4.c:258:20: warning: cast increases required alignment of target type [-Wcast-align] #define X(a) do { *(u32*)p = le_bswap32((*hd).a) ; p += 4; } while(0) ^ md4.c:260:3: note: in expansion of macro 'X' X(B); ^ [removed the rest] Signed-off-by: Jussi Kivilinna diff --git a/cipher/md.c b/cipher/md.c index df8b027..f9414de 100644 --- a/cipher/md.c +++ b/cipher/md.c @@ -315,7 +315,7 @@ md_open (gcry_md_hd_t *h, int algo, unsigned int flags) if (! err) { - hd->ctx = ctx = (struct gcry_md_context *) ((char *) hd + n); + hd->ctx = ctx = (void *) ((char *) hd + n); /* Setup the globally visible data (bctl in the diagram).*/ hd->bufsize = n - sizeof (struct gcry_md_handle) + 1; hd->bufpos = 0; @@ -488,7 +488,7 @@ md_copy (gcry_md_hd_t ahd, gcry_md_hd_t *b_hd) if (! err) { - bhd->ctx = b = (struct gcry_md_context *) ((char *) bhd + n); + bhd->ctx = b = (void *) ((char *) bhd + n); /* No need to copy the buffer due to the write above. */ gcry_assert (ahd->bufsize == (n - sizeof (struct gcry_md_handle) + 1)); bhd->bufsize = ahd->bufsize; diff --git a/cipher/md4.c b/cipher/md4.c index 7291254..c9b4154 100644 --- a/cipher/md4.c +++ b/cipher/md4.c @@ -255,7 +255,7 @@ md4_final( void *context ) _gcry_burn_stack (burn); p = hd->bctx.buf; -#define X(a) do { *(u32*)p = le_bswap32((*hd).a) ; p += 4; } while(0) +#define X(a) do { buf_put_le32(p, hd->a); p += 4; } while(0) X(A); X(B); X(C); diff --git a/cipher/md5.c b/cipher/md5.c index 73ad968..f17af7a 100644 --- a/cipher/md5.c +++ b/cipher/md5.c @@ -279,7 +279,7 @@ md5_final( void *context) _gcry_burn_stack (burn); p = hd->bctx.buf; -#define X(a) do { *(u32*)p = le_bswap32((*hd).a) ; p += 4; } while(0) +#define X(a) do { buf_put_le32(p, hd->a); p += 4; } while(0) X(A); X(B); X(C); diff --git a/cipher/rmd160.c b/cipher/rmd160.c index e6d02f5..2b1f321 100644 --- a/cipher/rmd160.c +++ b/cipher/rmd160.c @@ -411,7 +411,7 @@ _gcry_rmd160_mixblock ( RMD160_CONTEXT *hd, void *blockof64byte ) char *p = blockof64byte; transform ( hd, blockof64byte, 1 ); -#define X(a) do { *(u32*)p = hd->h##a ; p += 4; } while(0) +#define X(a) do { buf_put_le32(p, hd->h##a); p += 4; } while(0) X(0); X(1); X(2); @@ -474,7 +474,7 @@ rmd160_final( void *context ) _gcry_burn_stack (burn); p = hd->bctx.buf; -#define X(a) do { *(u32*)p = le_bswap32(hd->h##a) ; p += 4; } while(0) +#define X(a) do { buf_put_le32(p, hd->h##a); p += 4; } while(0) X(0); X(1); X(2); diff --git a/cipher/sha1.c b/cipher/sha1.c index 00c57dd..6ccf0e8 100644 --- a/cipher/sha1.c +++ b/cipher/sha1.c @@ -401,7 +401,7 @@ sha1_final(void *context) _gcry_burn_stack (burn); p = hd->bctx.buf; -#define X(a) do { *(u32*)p = be_bswap32(hd->h##a) ; p += 4; } while(0) +#define X(a) do { buf_put_be32(p, hd->h##a); p += 4; } while(0) X(0); X(1); X(2); diff --git a/cipher/sha256.c b/cipher/sha256.c index 4efaec6..d3af172 100644 --- a/cipher/sha256.c +++ b/cipher/sha256.c @@ -428,7 +428,7 @@ sha256_final(void *context) _gcry_burn_stack (burn); p = hd->bctx.buf; -#define X(a) do { *(u32*)p = be_bswap32(hd->h##a); p += 4; } while(0) +#define X(a) do { buf_put_be32(p, hd->h##a); p += 4; } while(0) X(0); X(1); X(2); diff --git a/cipher/sha512.c b/cipher/sha512.c index 7d60df0..5a6af80 100644 --- a/cipher/sha512.c +++ b/cipher/sha512.c @@ -669,7 +669,7 @@ sha512_final (void *context) _gcry_burn_stack (stack_burn_depth); p = hd->bctx.buf; -#define X(a) do { *(u64*)p = be_bswap64(hd->state.h##a) ; p += 8; } while (0) +#define X(a) do { buf_put_be64(p, hd->state.h##a); p += 8; } while (0) X (0); X (1); X (2); diff --git a/cipher/tiger.c b/cipher/tiger.c index 91db4e6..8a08953 100644 --- a/cipher/tiger.c +++ b/cipher/tiger.c @@ -805,8 +805,8 @@ tiger_final( void *context ) _gcry_burn_stack (burn); p = hd->bctx.buf; -#define X(a) do { *(u64*)p = be_bswap64(hd->a); p += 8; } while(0) -#define Y(a) do { *(u64*)p = le_bswap64(hd->a); p += 8; } while(0) +#define X(a) do { buf_put_be64(p, hd->a); p += 8; } while(0) +#define Y(a) do { buf_put_le64(p, hd->a); p += 8; } while(0) if (hd->variant == 0) { X(a); commit cc26106dbebeb84d481661813edc3e5aea9a7d99 Author: Jussi Kivilinna Date: Tue Dec 23 12:13:50 2014 +0200 rijndael: fix compiler warnings on ARM * cipher/rijndael-internal.h (RIJNDAEL_context_s): Add u32 variants of keyschedule arrays to unions u1 and u2. (keyschedenc32, keyscheddec32): New. * cipher/rijndael.c (u32_a_t): Remove. (do_setkey): Add and use tkk[].data32, k_u32, tk_u32 and W_u32; Remove casting byte arrays to u32_a_t. (prepare_decryption, do_encrypt_fn, do_decrypt_fn): Use keyschedenc32 and keyscheddec32; Remove casting byte arrays to u32_a_t. -- Patch fixes 'cast increases required alignment' compiler warnings that GCC was showing: rijndael.c: In function 'do_setkey': rijndael.c:310:13: warning: cast increases required alignment of target type [-Wcast-align] *((u32_a_t*)tk[j]) = *((u32_a_t*)k[j]); ^ rijndael.c:310:34: warning: cast increases required alignment of target type [-Wcast-align] *((u32_a_t*)tk[j]) = *((u32_a_t*)k[j]); [removed the rest] Signed-off-by: Jussi Kivilinna diff --git a/cipher/rijndael-internal.h b/cipher/rijndael-internal.h index 7bc3790..7ff8660 100644 --- a/cipher/rijndael-internal.h +++ b/cipher/rijndael-internal.h @@ -95,6 +95,7 @@ typedef struct RIJNDAEL_context_s { PROPERLY_ALIGNED_TYPE dummy; byte keyschedule[MAXROUNDS+1][4][4]; + u32 keyschedule32[MAXROUNDS+1][4]; #ifdef USE_PADLOCK /* The key as passed to the padlock engine. It is only used if the padlock engine is used (USE_PADLOCK, below). */ @@ -105,6 +106,7 @@ typedef struct RIJNDAEL_context_s { PROPERLY_ALIGNED_TYPE dummy; byte keyschedule[MAXROUNDS+1][4][4]; + u32 keyschedule32[MAXROUNDS+1][4]; } u2; int rounds; /* Key-length-dependent number of rounds. */ unsigned int decryption_prepared:1; /* The decryption key schedule is available. */ @@ -121,8 +123,10 @@ typedef struct RIJNDAEL_context_s } RIJNDAEL_context ATTR_ALIGNED_16; /* Macros defining alias for the keyschedules. */ -#define keyschenc u1.keyschedule -#define keyschdec u2.keyschedule -#define padlockkey u1.padlock_key +#define keyschenc u1.keyschedule +#define keyschenc32 u1.keyschedule32 +#define keyschdec u2.keyschedule +#define keyschdec32 u2.keyschedule32 +#define padlockkey u1.padlock_key #endif /* G10_RIJNDAEL_INTERNAL_H */ diff --git a/cipher/rijndael.c b/cipher/rijndael.c index 5b0fe1c..7a83718 100644 --- a/cipher/rijndael.c +++ b/cipher/rijndael.c @@ -50,14 +50,6 @@ #include "rijndael-internal.h" -/* Define an u32 variant for the sake of gcc 4.4's strict aliasing. */ -#if __GNUC__ > 4 || ( __GNUC__ == 4 && __GNUC_MINOR__ >= 4 ) -typedef u32 __attribute__ ((__may_alias__)) u32_a_t; -#else -typedef u32 u32_a_t; -#endif - - #ifdef USE_AMD64_ASM /* AMD64 assembly implementations of AES */ extern unsigned int _gcry_aes_amd64_encrypt_block(const void *keysched_enc, @@ -293,10 +285,14 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) { PROPERLY_ALIGNED_TYPE dummy; byte data[MAXKC][4]; + u32 data32[MAXKC]; } tkk[2]; -#define k tkk[0].data -#define tk tkk[1].data -#define W (ctx->keyschenc) +#define k tkk[0].data +#define k_u32 tkk[0].data32 +#define tk tkk[1].data +#define tk_u32 tkk[1].data32 +#define W (ctx->keyschenc) +#define W_u32 (ctx->keyschenc32) prefetch_enc(); @@ -307,7 +303,7 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) for (j = KC-1; j >= 0; j--) { - *((u32_a_t*)tk[j]) = *((u32_a_t*)k[j]); + tk_u32[j] = k_u32[j]; } r = 0; t = 0; @@ -316,7 +312,7 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) { for (; (j < KC) && (t < 4); j++, t++) { - *((u32_a_t*)W[r][t]) = le_bswap32(*((u32_a_t*)tk[j])); + W_u32[r][t] = le_bswap32(tk_u32[j]); } if (t == 4) { @@ -339,14 +335,14 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) { for (j = 1; j < KC; j++) { - *((u32_a_t*)tk[j]) ^= *((u32_a_t*)tk[j-1]); + tk_u32[j] ^= tk_u32[j-1]; } } else { for (j = 1; j < KC/2; j++) { - *((u32_a_t*)tk[j]) ^= *((u32_a_t*)tk[j-1]); + tk_u32[j] ^= tk_u32[j-1]; } tk[KC/2][0] ^= sbox[tk[KC/2 - 1][0] * 4]; tk[KC/2][1] ^= sbox[tk[KC/2 - 1][1] * 4]; @@ -354,7 +350,7 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) tk[KC/2][3] ^= sbox[tk[KC/2 - 1][3] * 4]; for (j = KC/2 + 1; j < KC; j++) { - *((u32_a_t*)tk[j]) ^= *((u32_a_t*)tk[j-1]); + tk_u32[j] ^= tk_u32[j-1]; } } @@ -363,7 +359,7 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) { for (; (j < KC) && (t < 4); j++, t++) { - *((u32_a_t*)W[r][t]) = le_bswap32(*((u32_a_t*)tk[j])); + W_u32[r][t] = le_bswap32(tk_u32[j]); } if (t == 4) { @@ -375,6 +371,9 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) #undef W #undef tk #undef k +#undef W_u32 +#undef tk_u32 +#undef k_u32 wipememory(&tkk, sizeof(tkk)); } @@ -417,15 +416,15 @@ prepare_decryption( RIJNDAEL_context *ctx ) prefetch_enc(); prefetch_dec(); - *((u32_a_t*)ctx->keyschdec[0][0]) = *((u32_a_t*)ctx->keyschenc[0][0]); - *((u32_a_t*)ctx->keyschdec[0][1]) = *((u32_a_t*)ctx->keyschenc[0][1]); - *((u32_a_t*)ctx->keyschdec[0][2]) = *((u32_a_t*)ctx->keyschenc[0][2]); - *((u32_a_t*)ctx->keyschdec[0][3]) = *((u32_a_t*)ctx->keyschenc[0][3]); + ctx->keyschdec32[0][0] = ctx->keyschenc32[0][0]; + ctx->keyschdec32[0][1] = ctx->keyschenc32[0][1]; + ctx->keyschdec32[0][2] = ctx->keyschenc32[0][2]; + ctx->keyschdec32[0][3] = ctx->keyschenc32[0][3]; for (r = 1; r < ctx->rounds; r++) { - u32_a_t *wi = (u32_a_t*)((ctx->keyschenc)[r]); - u32_a_t *wo = (u32_a_t*)((ctx->keyschdec)[r]); + u32 *wi = ctx->keyschenc32[r]; + u32 *wo = ctx->keyschdec32[r]; u32 wt; wt = wi[0]; @@ -453,10 +452,10 @@ prepare_decryption( RIJNDAEL_context *ctx ) ^ rol(decT[sbox[(byte)(wt >> 24) * 4]], 8 * 3); } - *((u32_a_t*)ctx->keyschdec[r][0]) = *((u32_a_t*)ctx->keyschenc[r][0]); - *((u32_a_t*)ctx->keyschdec[r][1]) = *((u32_a_t*)ctx->keyschenc[r][1]); - *((u32_a_t*)ctx->keyschdec[r][2]) = *((u32_a_t*)ctx->keyschenc[r][2]); - *((u32_a_t*)ctx->keyschdec[r][3]) = *((u32_a_t*)ctx->keyschenc[r][3]); + ctx->keyschdec32[r][0] = ctx->keyschenc32[r][0]; + ctx->keyschdec32[r][1] = ctx->keyschenc32[r][1]; + ctx->keyschdec32[r][2] = ctx->keyschenc32[r][2]; + ctx->keyschdec32[r][3] = ctx->keyschenc32[r][3]; } } @@ -467,7 +466,7 @@ static unsigned int do_encrypt_fn (const RIJNDAEL_context *ctx, unsigned char *b, const unsigned char *a) { -#define rk (ctx->keyschenc) +#define rk (ctx->keyschenc32) const byte *sbox = ((const byte *)encT) + 1; int rounds = ctx->rounds; int r; @@ -479,34 +478,34 @@ do_encrypt_fn (const RIJNDAEL_context *ctx, unsigned char *b, sb[2] = buf_get_le32(a + 8); sb[3] = buf_get_le32(a + 12); - sa[0] = sb[0] ^ *((u32_a_t*)rk[0][0]); - sa[1] = sb[1] ^ *((u32_a_t*)rk[0][1]); - sa[2] = sb[2] ^ *((u32_a_t*)rk[0][2]); - sa[3] = sb[3] ^ *((u32_a_t*)rk[0][3]); + sa[0] = sb[0] ^ rk[0][0]; + sa[1] = sb[1] ^ rk[0][1]; + sa[2] = sb[2] ^ rk[0][2]; + sa[3] = sb[3] ^ rk[0][3]; sb[0] = rol(encT[(byte)(sa[0] >> (0 * 8))], (0 * 8)); sb[3] = rol(encT[(byte)(sa[0] >> (1 * 8))], (1 * 8)); sb[2] = rol(encT[(byte)(sa[0] >> (2 * 8))], (2 * 8)); sb[1] = rol(encT[(byte)(sa[0] >> (3 * 8))], (3 * 8)); - sa[0] = *((u32_a_t*)rk[1][0]) ^ sb[0]; + sa[0] = rk[1][0] ^ sb[0]; sb[1] ^= rol(encT[(byte)(sa[1] >> (0 * 8))], (0 * 8)); sa[0] ^= rol(encT[(byte)(sa[1] >> (1 * 8))], (1 * 8)); sb[3] ^= rol(encT[(byte)(sa[1] >> (2 * 8))], (2 * 8)); sb[2] ^= rol(encT[(byte)(sa[1] >> (3 * 8))], (3 * 8)); - sa[1] = *((u32_a_t*)rk[1][1]) ^ sb[1]; + sa[1] = rk[1][1] ^ sb[1]; sb[2] ^= rol(encT[(byte)(sa[2] >> (0 * 8))], (0 * 8)); sa[1] ^= rol(encT[(byte)(sa[2] >> (1 * 8))], (1 * 8)); sa[0] ^= rol(encT[(byte)(sa[2] >> (2 * 8))], (2 * 8)); sb[3] ^= rol(encT[(byte)(sa[2] >> (3 * 8))], (3 * 8)); - sa[2] = *((u32_a_t*)rk[1][2]) ^ sb[2]; + sa[2] = rk[1][2] ^ sb[2]; sb[3] ^= rol(encT[(byte)(sa[3] >> (0 * 8))], (0 * 8)); sa[2] ^= rol(encT[(byte)(sa[3] >> (1 * 8))], (1 * 8)); sa[1] ^= rol(encT[(byte)(sa[3] >> (2 * 8))], (2 * 8)); sa[0] ^= rol(encT[(byte)(sa[3] >> (3 * 8))], (3 * 8)); - sa[3] = *((u32_a_t*)rk[1][3]) ^ sb[3]; + sa[3] = rk[1][3] ^ sb[3]; for (r = 2; r < rounds; r++) { @@ -514,25 +513,25 @@ do_encrypt_fn (const RIJNDAEL_context *ctx, unsigned char *b, sb[3] = rol(encT[(byte)(sa[0] >> (1 * 8))], (1 * 8)); sb[2] = rol(encT[(byte)(sa[0] >> (2 * 8))], (2 * 8)); sb[1] = rol(encT[(byte)(sa[0] >> (3 * 8))], (3 * 8)); - sa[0] = *((u32_a_t*)rk[r][0]) ^ sb[0]; + sa[0] = rk[r][0] ^ sb[0]; sb[1] ^= rol(encT[(byte)(sa[1] >> (0 * 8))], (0 * 8)); sa[0] ^= rol(encT[(byte)(sa[1] >> (1 * 8))], (1 * 8)); sb[3] ^= rol(encT[(byte)(sa[1] >> (2 * 8))], (2 * 8)); sb[2] ^= rol(encT[(byte)(sa[1] >> (3 * 8))], (3 * 8)); - sa[1] = *((u32_a_t*)rk[r][1]) ^ sb[1]; + sa[1] = rk[r][1] ^ sb[1]; sb[2] ^= rol(encT[(byte)(sa[2] >> (0 * 8))], (0 * 8)); sa[1] ^= rol(encT[(byte)(sa[2] >> (1 * 8))], (1 * 8)); sa[0] ^= rol(encT[(byte)(sa[2] >> (2 * 8))], (2 * 8)); sb[3] ^= rol(encT[(byte)(sa[2] >> (3 * 8))], (3 * 8)); - sa[2] = *((u32_a_t*)rk[r][2]) ^ sb[2]; + sa[2] = rk[r][2] ^ sb[2]; sb[3] ^= rol(encT[(byte)(sa[3] >> (0 * 8))], (0 * 8)); sa[2] ^= rol(encT[(byte)(sa[3] >> (1 * 8))], (1 * 8)); sa[1] ^= rol(encT[(byte)(sa[3] >> (2 * 8))], (2 * 8)); sa[0] ^= rol(encT[(byte)(sa[3] >> (3 * 8))], (3 * 8)); - sa[3] = *((u32_a_t*)rk[r][3]) ^ sb[3]; + sa[3] = rk[r][3] ^ sb[3]; r++; @@ -540,25 +539,25 @@ do_encrypt_fn (const RIJNDAEL_context *ctx, unsigned char *b, sb[3] = rol(encT[(byte)(sa[0] >> (1 * 8))], (1 * 8)); sb[2] = rol(encT[(byte)(sa[0] >> (2 * 8))], (2 * 8)); sb[1] = rol(encT[(byte)(sa[0] >> (3 * 8))], (3 * 8)); - sa[0] = *((u32_a_t*)rk[r][0]) ^ sb[0]; + sa[0] = rk[r][0] ^ sb[0]; sb[1] ^= rol(encT[(byte)(sa[1] >> (0 * 8))], (0 * 8)); sa[0] ^= rol(encT[(byte)(sa[1] >> (1 * 8))], (1 * 8)); sb[3] ^= rol(encT[(byte)(sa[1] >> (2 * 8))], (2 * 8)); sb[2] ^= rol(encT[(byte)(sa[1] >> (3 * 8))], (3 * 8)); - sa[1] = *((u32_a_t*)rk[r][1]) ^ sb[1]; + sa[1] = rk[r][1] ^ sb[1]; sb[2] ^= rol(encT[(byte)(sa[2] >> (0 * 8))], (0 * 8)); sa[1] ^= rol(encT[(byte)(sa[2] >> (1 * 8))], (1 * 8)); sa[0] ^= rol(encT[(byte)(sa[2] >> (2 * 8))], (2 * 8)); sb[3] ^= rol(encT[(byte)(sa[2] >> (3 * 8))], (3 * 8)); - sa[2] = *((u32_a_t*)rk[r][2]) ^ sb[2]; + sa[2] = rk[r][2] ^ sb[2]; sb[3] ^= rol(encT[(byte)(sa[3] >> (0 * 8))], (0 * 8)); sa[2] ^= rol(encT[(byte)(sa[3] >> (1 * 8))], (1 * 8)); sa[1] ^= rol(encT[(byte)(sa[3] >> (2 * 8))], (2 * 8)); sa[0] ^= rol(encT[(byte)(sa[3] >> (3 * 8))], (3 * 8)); - sa[3] = *((u32_a_t*)rk[r][3]) ^ sb[3]; + sa[3] = rk[r][3] ^ sb[3]; } /* Last round is special. */ @@ -567,25 +566,25 @@ do_encrypt_fn (const RIJNDAEL_context *ctx, unsigned char *b, sb[3] = (sbox[(byte)(sa[0] >> (1 * 8)) * 4]) << (1 * 8); sb[2] = (sbox[(byte)(sa[0] >> (2 * 8)) * 4]) << (2 * 8); sb[1] = (sbox[(byte)(sa[0] >> (3 * 8)) * 4]) << (3 * 8); - sa[0] = *((u32_a_t*)rk[r][0]) ^ sb[0]; + sa[0] = rk[r][0] ^ sb[0]; sb[1] ^= (sbox[(byte)(sa[1] >> (0 * 8)) * 4]) << (0 * 8); sa[0] ^= (sbox[(byte)(sa[1] >> (1 * 8)) * 4]) << (1 * 8); sb[3] ^= (sbox[(byte)(sa[1] >> (2 * 8)) * 4]) << (2 * 8); sb[2] ^= (sbox[(byte)(sa[1] >> (3 * 8)) * 4]) << (3 * 8); - sa[1] = *((u32_a_t*)rk[r][1]) ^ sb[1]; + sa[1] = rk[r][1] ^ sb[1]; sb[2] ^= (sbox[(byte)(sa[2] >> (0 * 8)) * 4]) << (0 * 8); sa[1] ^= (sbox[(byte)(sa[2] >> (1 * 8)) * 4]) << (1 * 8); sa[0] ^= (sbox[(byte)(sa[2] >> (2 * 8)) * 4]) << (2 * 8); sb[3] ^= (sbox[(byte)(sa[2] >> (3 * 8)) * 4]) << (3 * 8); - sa[2] = *((u32_a_t*)rk[r][2]) ^ sb[2]; + sa[2] = rk[r][2] ^ sb[2]; sb[3] ^= (sbox[(byte)(sa[3] >> (0 * 8)) * 4]) << (0 * 8); sa[2] ^= (sbox[(byte)(sa[3] >> (1 * 8)) * 4]) << (1 * 8); sa[1] ^= (sbox[(byte)(sa[3] >> (2 * 8)) * 4]) << (2 * 8); sa[0] ^= (sbox[(byte)(sa[3] >> (3 * 8)) * 4]) << (3 * 8); - sa[3] = *((u32_a_t*)rk[r][3]) ^ sb[3]; + sa[3] = rk[r][3] ^ sb[3]; buf_put_le32(b + 0, sa[0]); buf_put_le32(b + 4, sa[1]); @@ -790,7 +789,7 @@ static unsigned int do_decrypt_fn (const RIJNDAEL_context *ctx, unsigned char *b, const unsigned char *a) { -#define rk (ctx->keyschdec) +#define rk (ctx->keyschdec32) int rounds = ctx->rounds; int r; u32 sa[4]; @@ -801,10 +800,10 @@ do_decrypt_fn (const RIJNDAEL_context *ctx, unsigned char *b, sb[2] = buf_get_le32(a + 8); sb[3] = buf_get_le32(a + 12); - sa[0] = sb[0] ^ *((u32_a_t*)rk[rounds][0]); - sa[1] = sb[1] ^ *((u32_a_t*)rk[rounds][1]); - sa[2] = sb[2] ^ *((u32_a_t*)rk[rounds][2]); - sa[3] = sb[3] ^ *((u32_a_t*)rk[rounds][3]); + sa[0] = sb[0] ^ rk[rounds][0]; + sa[1] = sb[1] ^ rk[rounds][1]; + sa[2] = sb[2] ^ rk[rounds][2]; + sa[3] = sb[3] ^ rk[rounds][3]; for (r = rounds - 1; r > 1; r--) { @@ -812,25 +811,25 @@ do_decrypt_fn (const RIJNDAEL_context *ctx, unsigned char *b, sb[1] = rol(decT[(byte)(sa[0] >> (1 * 8))], (1 * 8)); sb[2] = rol(decT[(byte)(sa[0] >> (2 * 8))], (2 * 8)); sb[3] = rol(decT[(byte)(sa[0] >> (3 * 8))], (3 * 8)); - sa[0] = *((u32_a_t*)rk[r][0]) ^ sb[0]; + sa[0] = rk[r][0] ^ sb[0]; sb[1] ^= rol(decT[(byte)(sa[1] >> (0 * 8))], (0 * 8)); sb[2] ^= rol(decT[(byte)(sa[1] >> (1 * 8))], (1 * 8)); sb[3] ^= rol(decT[(byte)(sa[1] >> (2 * 8))], (2 * 8)); sa[0] ^= rol(decT[(byte)(sa[1] >> (3 * 8))], (3 * 8)); - sa[1] = *((u32_a_t*)rk[r][1]) ^ sb[1]; + sa[1] = rk[r][1] ^ sb[1]; sb[2] ^= rol(decT[(byte)(sa[2] >> (0 * 8))], (0 * 8)); sb[3] ^= rol(decT[(byte)(sa[2] >> (1 * 8))], (1 * 8)); sa[0] ^= rol(decT[(byte)(sa[2] >> (2 * 8))], (2 * 8)); sa[1] ^= rol(decT[(byte)(sa[2] >> (3 * 8))], (3 * 8)); - sa[2] = *((u32_a_t*)rk[r][2]) ^ sb[2]; + sa[2] = rk[r][2] ^ sb[2]; sb[3] ^= rol(decT[(byte)(sa[3] >> (0 * 8))], (0 * 8)); sa[0] ^= rol(decT[(byte)(sa[3] >> (1 * 8))], (1 * 8)); sa[1] ^= rol(decT[(byte)(sa[3] >> (2 * 8))], (2 * 8)); sa[2] ^= rol(decT[(byte)(sa[3] >> (3 * 8))], (3 * 8)); - sa[3] = *((u32_a_t*)rk[r][3]) ^ sb[3]; + sa[3] = rk[r][3] ^ sb[3]; r--; @@ -838,75 +837,75 @@ do_decrypt_fn (const RIJNDAEL_context *ctx, unsigned char *b, sb[1] = rol(decT[(byte)(sa[0] >> (1 * 8))], (1 * 8)); sb[2] = rol(decT[(byte)(sa[0] >> (2 * 8))], (2 * 8)); sb[3] = rol(decT[(byte)(sa[0] >> (3 * 8))], (3 * 8)); - sa[0] = *((u32_a_t*)rk[r][0]) ^ sb[0]; + sa[0] = rk[r][0] ^ sb[0]; sb[1] ^= rol(decT[(byte)(sa[1] >> (0 * 8))], (0 * 8)); sb[2] ^= rol(decT[(byte)(sa[1] >> (1 * 8))], (1 * 8)); sb[3] ^= rol(decT[(byte)(sa[1] >> (2 * 8))], (2 * 8)); sa[0] ^= rol(decT[(byte)(sa[1] >> (3 * 8))], (3 * 8)); - sa[1] = *((u32_a_t*)rk[r][1]) ^ sb[1]; + sa[1] = rk[r][1] ^ sb[1]; sb[2] ^= rol(decT[(byte)(sa[2] >> (0 * 8))], (0 * 8)); sb[3] ^= rol(decT[(byte)(sa[2] >> (1 * 8))], (1 * 8)); sa[0] ^= rol(decT[(byte)(sa[2] >> (2 * 8))], (2 * 8)); sa[1] ^= rol(decT[(byte)(sa[2] >> (3 * 8))], (3 * 8)); - sa[2] = *((u32_a_t*)rk[r][2]) ^ sb[2]; + sa[2] = rk[r][2] ^ sb[2]; sb[3] ^= rol(decT[(byte)(sa[3] >> (0 * 8))], (0 * 8)); sa[0] ^= rol(decT[(byte)(sa[3] >> (1 * 8))], (1 * 8)); sa[1] ^= rol(decT[(byte)(sa[3] >> (2 * 8))], (2 * 8)); sa[2] ^= rol(decT[(byte)(sa[3] >> (3 * 8))], (3 * 8)); - sa[3] = *((u32_a_t*)rk[r][3]) ^ sb[3]; + sa[3] = rk[r][3] ^ sb[3]; } sb[0] = rol(decT[(byte)(sa[0] >> (0 * 8))], (0 * 8)); sb[1] = rol(decT[(byte)(sa[0] >> (1 * 8))], (1 * 8)); sb[2] = rol(decT[(byte)(sa[0] >> (2 * 8))], (2 * 8)); sb[3] = rol(decT[(byte)(sa[0] >> (3 * 8))], (3 * 8)); - sa[0] = *((u32_a_t*)rk[1][0]) ^ sb[0]; + sa[0] = rk[1][0] ^ sb[0]; sb[1] ^= rol(decT[(byte)(sa[1] >> (0 * 8))], (0 * 8)); sb[2] ^= rol(decT[(byte)(sa[1] >> (1 * 8))], (1 * 8)); sb[3] ^= rol(decT[(byte)(sa[1] >> (2 * 8))], (2 * 8)); sa[0] ^= rol(decT[(byte)(sa[1] >> (3 * 8))], (3 * 8)); - sa[1] = *((u32_a_t*)rk[1][1]) ^ sb[1]; + sa[1] = rk[1][1] ^ sb[1]; sb[2] ^= rol(decT[(byte)(sa[2] >> (0 * 8))], (0 * 8)); sb[3] ^= rol(decT[(byte)(sa[2] >> (1 * 8))], (1 * 8)); sa[0] ^= rol(decT[(byte)(sa[2] >> (2 * 8))], (2 * 8)); sa[1] ^= rol(decT[(byte)(sa[2] >> (3 * 8))], (3 * 8)); - sa[2] = *((u32_a_t*)rk[1][2]) ^ sb[2]; + sa[2] = rk[1][2] ^ sb[2]; sb[3] ^= rol(decT[(byte)(sa[3] >> (0 * 8))], (0 * 8)); sa[0] ^= rol(decT[(byte)(sa[3] >> (1 * 8))], (1 * 8)); sa[1] ^= rol(decT[(byte)(sa[3] >> (2 * 8))], (2 * 8)); sa[2] ^= rol(decT[(byte)(sa[3] >> (3 * 8))], (3 * 8)); - sa[3] = *((u32_a_t*)rk[1][3]) ^ sb[3]; + sa[3] = rk[1][3] ^ sb[3]; /* Last round is special. */ sb[0] = inv_sbox[(byte)(sa[0] >> (0 * 8))] << (0 * 8); sb[1] = inv_sbox[(byte)(sa[0] >> (1 * 8))] << (1 * 8); sb[2] = inv_sbox[(byte)(sa[0] >> (2 * 8))] << (2 * 8); sb[3] = inv_sbox[(byte)(sa[0] >> (3 * 8))] << (3 * 8); - sa[0] = sb[0] ^ *((u32_a_t*)rk[0][0]); + sa[0] = sb[0] ^ rk[0][0]; sb[1] ^= inv_sbox[(byte)(sa[1] >> (0 * 8))] << (0 * 8); sb[2] ^= inv_sbox[(byte)(sa[1] >> (1 * 8))] << (1 * 8); sb[3] ^= inv_sbox[(byte)(sa[1] >> (2 * 8))] << (2 * 8); sa[0] ^= inv_sbox[(byte)(sa[1] >> (3 * 8))] << (3 * 8); - sa[1] = sb[1] ^ *((u32_a_t*)rk[0][1]); + sa[1] = sb[1] ^ rk[0][1]; sb[2] ^= inv_sbox[(byte)(sa[2] >> (0 * 8))] << (0 * 8); sb[3] ^= inv_sbox[(byte)(sa[2] >> (1 * 8))] << (1 * 8); sa[0] ^= inv_sbox[(byte)(sa[2] >> (2 * 8))] << (2 * 8); sa[1] ^= inv_sbox[(byte)(sa[2] >> (3 * 8))] << (3 * 8); - sa[2] = sb[2] ^ *((u32_a_t*)rk[0][2]); + sa[2] = sb[2] ^ rk[0][2]; sb[3] ^= inv_sbox[(byte)(sa[3] >> (0 * 8))] << (0 * 8); sa[0] ^= inv_sbox[(byte)(sa[3] >> (1 * 8))] << (1 * 8); sa[1] ^= inv_sbox[(byte)(sa[3] >> (2 * 8))] << (2 * 8); sa[2] ^= inv_sbox[(byte)(sa[3] >> (3 * 8))] << (3 * 8); - sa[3] = sb[3] ^ *((u32_a_t*)rk[0][3]); + sa[3] = sb[3] ^ rk[0][3]; buf_put_le32(b + 0, sa[0]); buf_put_le32(b + 4, sa[1]); ----------------------------------------------------------------------- Summary of changes: cipher/md.c | 4 +- cipher/md4.c | 2 +- cipher/md5.c | 2 +- cipher/rijndael-internal.h | 10 +++- cipher/rijndael.c | 137 ++++++++++++++++++++++---------------------- cipher/rmd160.c | 4 +- cipher/scrypt.c | 2 +- cipher/sha1.c | 2 +- cipher/sha256.c | 2 +- cipher/sha512.c | 2 +- cipher/tiger.c | 4 +- random/random-csprng.c | 4 +- src/secmem.c | 12 ++-- 13 files changed, 96 insertions(+), 91 deletions(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 1 19:46:07 2015 From: cvs at cvs.gnupg.org (by Jussi Kivilinna) Date: Thu, 01 Jan 2015 19:46:07 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-145-g8eabecc Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via 8eabecc883332156adffc1df42d27f614c157e06 (commit) from c2e1f8fea271f3ef8027809547c4a52e0b1e24a2 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 8eabecc883332156adffc1df42d27f614c157e06 Author: Jussi Kivilinna Date: Sat Dec 27 12:37:16 2014 +0200 Add Intel SSSE3 based vector permutation AES implementation * cipher/Makefile.am: Add 'rijndael-ssse3-amd64.c'. * cipher/rijndael-internal.h (USE_SSSE3): New. (RIJNDAEL_context_s) [USE_SSSE3]: Add 'use_ssse3'. * cipher/rijndael-ssse3-amd64.c: New. * cipher/rijndael.c [USE_SSSE3] (_gcry_aes_ssse3_do_setkey) (_gcry_aes_ssse3_prepare_decryption, _gcry_aes_ssse3_encrypt) (_gcry_aes_ssse3_decrypt, _gcry_aes_ssse3_cfb_enc) (_gcry_aes_ssse3_cbc_enc, _gcry_aes_ssse3_ctr_enc) (_gcry_aes_ssse3_cfb_dec, _gcry_aes_ssse3_cbc_dec): New. (do_setkey): Add HWF check for SSSE3 and setup for SSSE3 implementation. (prepare_decryption, _gcry_aes_cfb_enc, _gcry_aes_cbc_enc) (_gcry_aes_ctr_enc, _gcry_aes_cfb_dec, _gcry_aes_cbc_dec): Add selection for SSSE3 implementation. * configure.ac [host=x86_64]: Add 'rijndael-ssse3-amd64.lo'. -- This patch adds "AES with vector permutations" implementation by Mike Hamburg. Public-domain source-code is available at: http://crypto.stanford.edu/vpaes/ Benchmark on Intel Core2 T8100 (2.1Ghz, no turbo): Old (AMD64 asm): AES | nanosecs/byte mebibytes/sec cycles/byte ECB enc | 8.79 ns/B 108.5 MiB/s 18.46 c/B ECB dec | 9.07 ns/B 105.1 MiB/s 19.05 c/B CBC enc | 7.77 ns/B 122.7 MiB/s 16.33 c/B CBC dec | 7.74 ns/B 123.2 MiB/s 16.26 c/B CFB enc | 7.88 ns/B 121.0 MiB/s 16.54 c/B CFB dec | 7.56 ns/B 126.1 MiB/s 15.88 c/B OFB enc | 9.02 ns/B 105.8 MiB/s 18.94 c/B OFB dec | 9.07 ns/B 105.1 MiB/s 19.05 c/B CTR enc | 7.80 ns/B 122.2 MiB/s 16.38 c/B CTR dec | 7.81 ns/B 122.2 MiB/s 16.39 c/B New (ssse3): AES | nanosecs/byte mebibytes/sec cycles/byte ECB enc | 5.77 ns/B 165.2 MiB/s 12.13 c/B ECB dec | 7.13 ns/B 133.7 MiB/s 14.98 c/B CBC enc | 5.27 ns/B 181.0 MiB/s 11.06 c/B CBC dec | 6.39 ns/B 149.3 MiB/s 13.42 c/B CFB enc | 5.27 ns/B 180.9 MiB/s 11.07 c/B CFB dec | 5.28 ns/B 180.7 MiB/s 11.08 c/B OFB enc | 6.11 ns/B 156.1 MiB/s 12.83 c/B OFB dec | 6.13 ns/B 155.5 MiB/s 12.88 c/B CTR enc | 5.26 ns/B 181.5 MiB/s 11.04 c/B CTR dec | 5.24 ns/B 182.0 MiB/s 11.00 c/B Benchmark on Intel i5-2450M (2.5Ghz, no turbo, aes-ni disabled): Old (AMD64 asm): AES | nanosecs/byte mebibytes/sec cycles/byte ECB enc | 8.06 ns/B 118.3 MiB/s 20.15 c/B ECB dec | 8.21 ns/B 116.1 MiB/s 20.53 c/B CBC enc | 7.88 ns/B 121.1 MiB/s 19.69 c/B CBC dec | 7.57 ns/B 126.0 MiB/s 18.92 c/B CFB enc | 7.87 ns/B 121.2 MiB/s 19.67 c/B CFB dec | 7.56 ns/B 126.2 MiB/s 18.89 c/B OFB enc | 8.27 ns/B 115.3 MiB/s 20.67 c/B OFB dec | 8.28 ns/B 115.1 MiB/s 20.71 c/B CTR enc | 8.02 ns/B 119.0 MiB/s 20.04 c/B CTR dec | 8.02 ns/B 118.9 MiB/s 20.05 c/B New (ssse3): AES | nanosecs/byte mebibytes/sec cycles/byte ECB enc | 4.03 ns/B 236.6 MiB/s 10.07 c/B ECB dec | 5.28 ns/B 180.8 MiB/s 13.19 c/B CBC enc | 3.77 ns/B 252.7 MiB/s 9.43 c/B CBC dec | 4.69 ns/B 203.3 MiB/s 11.73 c/B CFB enc | 3.75 ns/B 254.3 MiB/s 9.37 c/B CFB dec | 3.69 ns/B 258.6 MiB/s 9.22 c/B OFB enc | 4.17 ns/B 228.7 MiB/s 10.43 c/B OFB dec | 4.17 ns/B 228.7 MiB/s 10.42 c/B CTR enc | 3.72 ns/B 256.5 MiB/s 9.30 c/B CTR dec | 3.72 ns/B 256.1 MiB/s 9.31 c/B Signed-off-by: Jussi Kivilinna diff --git a/cipher/Makefile.am b/cipher/Makefile.am index 98142ed..7dd626c 100644 --- a/cipher/Makefile.am +++ b/cipher/Makefile.am @@ -75,7 +75,7 @@ md4.c \ md5.c \ poly1305-sse2-amd64.S poly1305-avx2-amd64.S poly1305-armv7-neon.S \ rijndael.c rijndael-internal.h rijndael-tables.h rijndael-aesni.c \ - rijndael-padlock.c rijndael-amd64.S rijndael-arm.S \ + rijndael-padlock.c rijndael-amd64.S rijndael-arm.S rijndael-ssse3-amd64.c \ rmd160.c \ rsa.c \ salsa20.c salsa20-amd64.S salsa20-armv7-neon.S \ diff --git a/cipher/rijndael-internal.h b/cipher/rijndael-internal.h index 7ff8660..854980b 100644 --- a/cipher/rijndael-internal.h +++ b/cipher/rijndael-internal.h @@ -43,6 +43,12 @@ # define USE_AMD64_ASM 1 #endif +/* USE_SSSE3 indicates whether to use SSSE3 code. */ +#if defined(__x86_64__) && defined(HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS) && \ + defined(HAVE_GCC_INLINE_ASM_SSSE3) +# define USE_SSSE3 1 +#endif + /* USE_ARM_ASM indicates whether to use ARM assembly code. */ #undef USE_ARM_ASM #if defined(__ARMEL__) @@ -116,6 +122,9 @@ typedef struct RIJNDAEL_context_s #ifdef USE_AESNI unsigned int use_aesni:1; /* AES-NI shall be used. */ #endif /*USE_AESNI*/ +#ifdef USE_SSSE3 + unsigned int use_ssse3:1; /* SSSE3 shall be used. */ +#endif /*USE_SSSE3*/ rijndael_cryptfn_t encrypt_fn; rijndael_cryptfn_t decrypt_fn; rijndael_prefetchfn_t prefetch_enc_fn; diff --git a/cipher/rijndael-ssse3-amd64.c b/cipher/rijndael-ssse3-amd64.c new file mode 100644 index 0000000..112ab22 --- /dev/null +++ b/cipher/rijndael-ssse3-amd64.c @@ -0,0 +1,1209 @@ +/* SSSE3 vector permutation AES for Libgcrypt + * Copyright (C) 2014-2015 Jussi Kivilinna + * + * This file is part of Libgcrypt. + * + * Libgcrypt is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * Libgcrypt is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this program; if not, see . + */ + +#include +#include +#include +#include /* for memcmp() */ + +#include "types.h" /* for byte and u32 typedefs */ +#include "g10lib.h" +#include "cipher.h" +#include "bufhelp.h" +#include "cipher-selftest.h" +#include "rijndael-internal.h" + + +#ifdef USE_SSSE3 + + +/* Two macros to be called prior and after the use of SSSE3 + instructions. There should be no external function calls between + the use of these macros. There purpose is to make sure that the + SSE regsiters are cleared and won't reveal any information about + the key or the data. */ +#define vpaes_ssse3_prepare_enc(const_ptr) \ + asm volatile ("lea .Laes_consts(%%rip), %q0 \n\t" \ + "movdqa (%q0), %%xmm9 # 0F \n\t" \ + "movdqa .Lk_inv (%q0), %%xmm10 # inv \n\t" \ + "movdqa .Lk_inv+16(%q0), %%xmm11 # inva \n\t" \ + "movdqa .Lk_sb1 (%q0), %%xmm13 # sb1u \n\t" \ + "movdqa .Lk_sb1+16(%q0), %%xmm12 # sb1t \n\t" \ + "movdqa .Lk_sb2 (%q0), %%xmm15 # sb2u \n\t" \ + "movdqa .Lk_sb2+16(%q0), %%xmm14 # sb2t \n\t" \ + : "=c" (const_ptr) \ + : \ + : "memory" ) + +#define vpaes_ssse3_prepare_dec(const_ptr) \ + asm volatile ("lea .Laes_consts(%%rip), %q0 \n\t" \ + "movdqa (%q0), %%xmm9 # 0F \n\t" \ + "movdqa .Lk_inv (%q0), %%xmm10 # inv \n\t" \ + "movdqa .Lk_inv+16(%q0), %%xmm11 # inva \n\t" \ + "movdqa .Lk_dsb9 (%q0), %%xmm13 # sb9u \n\t" \ + "movdqa .Lk_dsb9+16(%q0), %%xmm12 # sb9t \n\t" \ + "movdqa .Lk_dsbd (%q0), %%xmm15 # sbdu \n\t" \ + "movdqa .Lk_dsbb (%q0), %%xmm14 # sbbu \n\t" \ + "movdqa .Lk_dsbe (%q0), %%xmm8 # sbeu \n\t" \ + : "=c" (const_ptr) \ + : \ + : "memory" ) + +#define vpaes_ssse3_cleanup() \ + asm volatile ("pxor %%xmm0, %%xmm0 \n\t" \ + "pxor %%xmm1, %%xmm1 \n\t" \ + "pxor %%xmm2, %%xmm2 \n\t" \ + "pxor %%xmm3, %%xmm3 \n\t" \ + "pxor %%xmm4, %%xmm4 \n\t" \ + "pxor %%xmm5, %%xmm5 \n\t" \ + "pxor %%xmm6, %%xmm6 \n\t" \ + "pxor %%xmm7, %%xmm7 \n\t" \ + "pxor %%xmm8, %%xmm8 \n\t" \ + ::: "memory" ) + + +void +_gcry_aes_ssse3_do_setkey (RIJNDAEL_context *ctx, const byte *key) +{ + unsigned int keybits = (ctx->rounds - 10) * 32 + 128; + + asm volatile ("leaq %q[key], %%rdi" "\n\t" + "movl %[bits], %%esi" "\n\t" + "leaq %[buf], %%rdx" "\n\t" + "movl %[dir], %%ecx" "\n\t" + "movl %[rotoffs], %%r8d" "\n\t" + "call _aes_schedule_core" "\n\t" + : + : [key] "m" (*key), + [bits] "g" (keybits), + [buf] "m" (ctx->keyschenc32[0][0]), + [dir] "g" (0), + [rotoffs] "g" (48) + : "r8", "r9", "r10", "r11", "rax", "rcx", "rdx", "rdi", "rsi", + "cc", "memory"); + + /* Save key for setting up decryption. */ + memcpy(&ctx->keyschdec32[0][0], key, keybits / 8); +} + + +/* Make a decryption key from an encryption key. */ +void +_gcry_aes_ssse3_prepare_decryption (RIJNDAEL_context *ctx) +{ + unsigned int keybits = (ctx->rounds - 10) * 32 + 128; + + asm volatile ("leaq %q[key], %%rdi" "\n\t" + "movl %[bits], %%esi" "\n\t" + "leaq %[buf], %%rdx" "\n\t" + "movl %[dir], %%ecx" "\n\t" + "movl %[rotoffs], %%r8d" "\n\t" + "call _aes_schedule_core" "\n\t" + : + : [key] "m" (ctx->keyschdec32[0][0]), + [bits] "g" (keybits), + [buf] "m" (ctx->keyschdec32[ctx->rounds][0]), + [dir] "g" (1), + [rotoffs] "g" ((keybits == 192) ? 0 : 32) + : "r8", "r9", "r10", "r11", "rax", "rcx", "rdx", "rdi", "rsi", + "cc", "memory"); +} + + +/* Encrypt one block using the Intel SSSE3 instructions. Block is input +* and output through SSE register xmm0. */ +static inline void +do_vpaes_ssse3_enc (const RIJNDAEL_context *ctx, unsigned int nrounds, + const void *aes_const_ptr) +{ + unsigned int middle_rounds = nrounds - 1; + const void *keysched = ctx->keyschenc32; + + asm volatile ("call _aes_encrypt_core" "\n\t" + : "+a" (middle_rounds), "+d" (keysched) + : "c" (aes_const_ptr) + : "rdi", "rsi", "cc", "memory"); +} + + +/* Decrypt one block using the Intel SSSE3 instructions. Block is input +* and output through SSE register xmm0. */ +static inline void +do_vpaes_ssse3_dec (const RIJNDAEL_context *ctx, unsigned int nrounds, + const void *aes_const_ptr) +{ + unsigned int middle_rounds = nrounds - 1; + const void *keysched = ctx->keyschdec32; + + asm volatile ("call _aes_decrypt_core" "\n\t" + : "+a" (middle_rounds), "+d" (keysched) + : "c" (aes_const_ptr) + : "rsi", "cc", "memory"); +} + + +unsigned int +_gcry_aes_ssse3_encrypt (const RIJNDAEL_context *ctx, unsigned char *dst, + const unsigned char *src) +{ + unsigned int nrounds = ctx->rounds; + const void *aes_const_ptr; + + vpaes_ssse3_prepare_enc (aes_const_ptr); + asm volatile ("movdqu %[src], %%xmm0\n\t" + : + : [src] "m" (*src) + : "memory" ); + do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr); + asm volatile ("movdqu %%xmm0, %[dst]\n\t" + : [dst] "=m" (*dst) + : + : "memory" ); + vpaes_ssse3_cleanup (); + return 0; +} + + +void +_gcry_aes_ssse3_cfb_enc (RIJNDAEL_context *ctx, unsigned char *outbuf, + const unsigned char *inbuf, unsigned char *iv, + size_t nblocks) +{ + unsigned int nrounds = ctx->rounds; + const void *aes_const_ptr; + + vpaes_ssse3_prepare_enc (aes_const_ptr); + + asm volatile ("movdqu %[iv], %%xmm0\n\t" + : /* No output */ + : [iv] "m" (*iv) + : "memory" ); + + for ( ;nblocks; nblocks-- ) + { + do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr); + + asm volatile ("movdqu %[inbuf], %%xmm1\n\t" + "pxor %%xmm1, %%xmm0\n\t" + "movdqu %%xmm0, %[outbuf]\n\t" + : [outbuf] "=m" (*outbuf) + : [inbuf] "m" (*inbuf) + : "memory" ); + + outbuf += BLOCKSIZE; + inbuf += BLOCKSIZE; + } + + asm volatile ("movdqu %%xmm0, %[iv]\n\t" + : [iv] "=m" (*iv) + : + : "memory" ); + + vpaes_ssse3_cleanup (); +} + + +void +_gcry_aes_ssse3_cbc_enc (RIJNDAEL_context *ctx, unsigned char *outbuf, + const unsigned char *inbuf, unsigned char *iv, + size_t nblocks, int cbc_mac) +{ + unsigned int nrounds = ctx->rounds; + const void *aes_const_ptr; + + vpaes_ssse3_prepare_enc (aes_const_ptr); + + asm volatile ("movdqu %[iv], %%xmm7\n\t" + : /* No output */ + : [iv] "m" (*iv) + : "memory" ); + + for ( ;nblocks; nblocks-- ) + { + asm volatile ("movdqu %[inbuf], %%xmm0\n\t" + "pxor %%xmm7, %%xmm0\n\t" + : /* No output */ + : [inbuf] "m" (*inbuf) + : "memory" ); + + do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr); + + asm volatile ("movdqa %%xmm0, %%xmm7\n\t" + "movdqu %%xmm0, %[outbuf]\n\t" + : [outbuf] "=m" (*outbuf) + : + : "memory" ); + + inbuf += BLOCKSIZE; + if (!cbc_mac) + outbuf += BLOCKSIZE; + } + + asm volatile ("movdqu %%xmm7, %[iv]\n\t" + : [iv] "=m" (*iv) + : + : "memory" ); + + vpaes_ssse3_cleanup (); +} + + +void +_gcry_aes_ssse3_ctr_enc (RIJNDAEL_context *ctx, unsigned char *outbuf, + const unsigned char *inbuf, unsigned char *ctr, + size_t nblocks) +{ + static const unsigned char be_mask[16] __attribute__ ((aligned (16))) = + { 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 }; + unsigned int nrounds = ctx->rounds; + const void *aes_const_ptr; + u64 ctrlow; + + vpaes_ssse3_prepare_enc (aes_const_ptr); + + asm volatile ("movdqa %[mask], %%xmm6\n\t" /* Preload mask */ + "movdqa (%[ctr]), %%xmm7\n\t" /* Preload CTR */ + "movq 8(%[ctr]), %q[ctrlow]\n\t" + "bswapq %q[ctrlow]\n\t" + : [ctrlow] "=r" (ctrlow) + : [mask] "m" (*be_mask), + [ctr] "r" (ctr) + : "memory", "cc"); + + for ( ;nblocks; nblocks-- ) + { + asm volatile ("movdqa %%xmm7, %%xmm0\n\t" /* xmm0 := CTR (xmm7) */ + "pcmpeqd %%xmm1, %%xmm1\n\t" + "psrldq $8, %%xmm1\n\t" /* xmm1 = -1 */ + + "pshufb %%xmm6, %%xmm7\n\t" + "psubq %%xmm1, %%xmm7\n\t" /* xmm7++ (big endian) */ + + /* detect if 64-bit carry handling is needed */ + "incq %q[ctrlow]\n\t" + "jnz .Lno_carry%=\n\t" + + "pslldq $8, %%xmm1\n\t" /* move lower 64-bit to high */ + "psubq %%xmm1, %%xmm7\n\t" /* add carry to upper 64bits */ + + ".Lno_carry%=:\n\t" + + "pshufb %%xmm6, %%xmm7\n\t" + : + : [ctr] "r" (ctr), [ctrlow] "r" (ctrlow) + : "cc", "memory"); + + do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr); + + asm volatile ("movdqu %[src], %%xmm1\n\t" /* xmm1 := input */ + "pxor %%xmm1, %%xmm0\n\t" /* EncCTR ^= input */ + "movdqu %%xmm0, %[dst]" /* Store EncCTR. */ + : [dst] "=m" (*outbuf) + : [src] "m" (*inbuf) + : "memory"); + + outbuf += BLOCKSIZE; + inbuf += BLOCKSIZE; + } + + asm volatile ("movdqu %%xmm7, %[ctr]\n\t" /* Update CTR (mem). */ + : [ctr] "=m" (*ctr) + : + : "memory" ); + + vpaes_ssse3_cleanup (); +} + + +unsigned int +_gcry_aes_ssse3_decrypt (const RIJNDAEL_context *ctx, unsigned char *dst, + const unsigned char *src) +{ + unsigned int nrounds = ctx->rounds; + const void *aes_const_ptr; + + vpaes_ssse3_prepare_dec (aes_const_ptr); + asm volatile ("movdqu %[src], %%xmm0\n\t" + : + : [src] "m" (*src) + : "memory" ); + do_vpaes_ssse3_dec (ctx, nrounds, aes_const_ptr); + asm volatile ("movdqu %%xmm0, %[dst]\n\t" + : [dst] "=m" (*dst) + : + : "memory" ); + vpaes_ssse3_cleanup (); + return 0; +} + + +void +_gcry_aes_ssse3_cfb_dec (RIJNDAEL_context *ctx, unsigned char *outbuf, + const unsigned char *inbuf, unsigned char *iv, + size_t nblocks) +{ + unsigned int nrounds = ctx->rounds; + const void *aes_const_ptr; + + vpaes_ssse3_prepare_enc (aes_const_ptr); + + asm volatile ("movdqu %[iv], %%xmm0\n\t" + : /* No output */ + : [iv] "m" (*iv) + : "memory" ); + + for ( ;nblocks; nblocks-- ) + { + do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr); + + asm volatile ("movdqa %%xmm0, %%xmm6\n\t" + "movdqu %[inbuf], %%xmm0\n\t" + "pxor %%xmm0, %%xmm6\n\t" + "movdqu %%xmm6, %[outbuf]\n\t" + : [outbuf] "=m" (*outbuf) + : [inbuf] "m" (*inbuf) + : "memory" ); + + outbuf += BLOCKSIZE; + inbuf += BLOCKSIZE; + } + + asm volatile ("movdqu %%xmm0, %[iv]\n\t" + : [iv] "=m" (*iv) + : + : "memory" ); + + vpaes_ssse3_cleanup (); +} + + +void +_gcry_aes_ssse3_cbc_dec (RIJNDAEL_context *ctx, unsigned char *outbuf, + const unsigned char *inbuf, unsigned char *iv, + size_t nblocks) +{ + unsigned int nrounds = ctx->rounds; + const void *aes_const_ptr; + + vpaes_ssse3_prepare_dec (aes_const_ptr); + + asm volatile + ("movdqu %[iv], %%xmm7\n\t" /* use xmm7 as fast IV storage */ + : /* No output */ + : [iv] "m" (*iv) + : "memory"); + + for ( ;nblocks; nblocks-- ) + { + asm volatile + ("movdqu %[inbuf], %%xmm0\n\t" + "movdqa %%xmm0, %%xmm6\n\t" /* use xmm6 as savebuf */ + : /* No output */ + : [inbuf] "m" (*inbuf) + : "memory"); + + do_vpaes_ssse3_dec (ctx, nrounds, aes_const_ptr); + + asm volatile + ("pxor %%xmm7, %%xmm0\n\t" /* xor IV with output */ + "movdqu %%xmm0, %[outbuf]\n\t" + "movdqu %%xmm6, %%xmm7\n\t" /* store savebuf as new IV */ + : [outbuf] "=m" (*outbuf) + : + : "memory"); + + outbuf += BLOCKSIZE; + inbuf += BLOCKSIZE; + } + + asm volatile + ("movdqu %%xmm7, %[iv]\n\t" /* store IV */ + : /* No output */ + : [iv] "m" (*iv) + : "memory"); + + vpaes_ssse3_cleanup (); +} + + + +asm ( + "\n\t" "##" + "\n\t" "## Constant-time SSSE3 AES core implementation." + "\n\t" "##" + "\n\t" "## By Mike Hamburg (Stanford University), 2009" + "\n\t" "## Public domain." + "\n\t" "##" + + "\n\t" ".text" + + "\n\t" "##" + "\n\t" "## _aes_encrypt_core" + "\n\t" "##" + "\n\t" "## AES-encrypt %xmm0." + "\n\t" "##" + "\n\t" "## Inputs:" + "\n\t" "## %xmm0 = input" + "\n\t" "## %xmm9-%xmm15 as in .Laes_preheat" + "\n\t" "## %rcx = .Laes_consts" + "\n\t" "## (%rdx) = scheduled keys" + "\n\t" "## %rax = nrounds - 1" + "\n\t" "##" + "\n\t" "## Output in %xmm0" + "\n\t" "## Clobbers %xmm1-%xmm4, %r9, %r11, %rax" + "\n\t" "## Preserves %xmm6 - %xmm7 so you get some local vectors" + "\n\t" "##" + "\n\t" "##" + "\n\t" ".align 16" + "\n\t" ".type _aes_encrypt_core, at function" + "\n\t" "_aes_encrypt_core:" + "\n\t" " leaq .Lk_mc_backward(%rcx), %rdi" + "\n\t" " mov $16, %rsi" + "\n\t" " movdqa .Lk_ipt (%rcx), %xmm2 # iptlo" + "\n\t" " movdqa %xmm9, %xmm1" + "\n\t" " pandn %xmm0, %xmm1" + "\n\t" " psrld $4, %xmm1" + "\n\t" " pand %xmm9, %xmm0" + "\n\t" " pshufb %xmm0, %xmm2" + "\n\t" " movdqa .Lk_ipt+16(%rcx), %xmm0 # ipthi" + "\n\t" " pshufb %xmm1, %xmm0" + "\n\t" " pxor (%rdx),%xmm2" + "\n\t" " pxor %xmm2, %xmm0" + "\n\t" " add $16, %rdx" + "\n\t" " jmp .Laes_entry" + + "\n\t" ".align 8" + "\n\t" ".Laes_loop:" + "\n\t" " # middle of middle round" + "\n\t" " movdqa %xmm13, %xmm4 # 4 : sb1u" + "\n\t" " pshufb %xmm2, %xmm4 # 4 = sb1u" + "\n\t" " pxor (%rdx), %xmm4 # 4 = sb1u + k" + "\n\t" " movdqa %xmm12, %xmm0 # 0 : sb1t" + "\n\t" " pshufb %xmm3, %xmm0 # 0 = sb1t" + "\n\t" " pxor %xmm4, %xmm0 # 0 = A" + "\n\t" " movdqa %xmm15, %xmm4 # 4 : sb2u" + "\n\t" " pshufb %xmm2, %xmm4 # 4 = sb2u" + "\n\t" " movdqa .Lk_mc_forward-.Lk_mc_backward(%rsi,%rdi), %xmm1" + "\n\t" " movdqa %xmm14, %xmm2 # 2 : sb2t" + "\n\t" " pshufb %xmm3, %xmm2 # 2 = sb2t" + "\n\t" " pxor %xmm4, %xmm2 # 2 = 2A" + "\n\t" " movdqa %xmm0, %xmm3 # 3 = A" + "\n\t" " pshufb %xmm1, %xmm0 # 0 = B" + "\n\t" " pxor %xmm2, %xmm0 # 0 = 2A+B" + "\n\t" " pshufb (%rsi,%rdi), %xmm3 # 3 = D" + "\n\t" " lea 16(%esi),%esi # next mc" + "\n\t" " pxor %xmm0, %xmm3 # 3 = 2A+B+D" + "\n\t" " lea 16(%rdx),%rdx # next key" + "\n\t" " pshufb %xmm1, %xmm0 # 0 = 2B+C" + "\n\t" " pxor %xmm3, %xmm0 # 0 = 2A+3B+C+D" + "\n\t" " and $48, %rsi # ... mod 4" + "\n\t" " dec %rax # nr--" + + "\n\t" ".Laes_entry:" + "\n\t" " # top of round" + "\n\t" " movdqa %xmm9, %xmm1 # 1 : i" + "\n\t" " pandn %xmm0, %xmm1 # 1 = i<<4" + "\n\t" " psrld $4, %xmm1 # 1 = i" + "\n\t" " pand %xmm9, %xmm0 # 0 = k" + "\n\t" " movdqa %xmm11, %xmm2 # 2 : a/k" + "\n\t" " pshufb %xmm0, %xmm2 # 2 = a/k" + "\n\t" " pxor %xmm1, %xmm0 # 0 = j" + "\n\t" " movdqa %xmm10, %xmm3 # 3 : 1/i" + "\n\t" " pshufb %xmm1, %xmm3 # 3 = 1/i" + "\n\t" " pxor %xmm2, %xmm3 # 3 = iak = 1/i + a/k" + "\n\t" " movdqa %xmm10, %xmm4 # 4 : 1/j" + "\n\t" " pshufb %xmm0, %xmm4 # 4 = 1/j" + "\n\t" " pxor %xmm2, %xmm4 # 4 = jak = 1/j + a/k" + "\n\t" " movdqa %xmm10, %xmm2 # 2 : 1/iak" + "\n\t" " pshufb %xmm3, %xmm2 # 2 = 1/iak" + "\n\t" " pxor %xmm0, %xmm2 # 2 = io" + "\n\t" " movdqa %xmm10, %xmm3 # 3 : 1/jak" + "\n\t" " pshufb %xmm4, %xmm3 # 3 = 1/jak" + "\n\t" " pxor %xmm1, %xmm3 # 3 = jo" + "\n\t" " jnz .Laes_loop" + + "\n\t" " # middle of last round" + "\n\t" " movdqa .Lk_sbo(%rcx), %xmm4 # 3 : sbou" + "\n\t" " pshufb %xmm2, %xmm4 # 4 = sbou" + "\n\t" " pxor (%rdx), %xmm4 # 4 = sb1u + k" + "\n\t" " movdqa .Lk_sbo+16(%rcx), %xmm0 # 0 : sbot" + "\n\t" " pshufb %xmm3, %xmm0 # 0 = sb1t" + "\n\t" " pxor %xmm4, %xmm0 # 0 = A" + "\n\t" " pshufb .Lk_sr(%rsi,%rcx), %xmm0" + "\n\t" " ret" + "\n\t" ".size _aes_encrypt_core,.-_aes_encrypt_core" + + "\n\t" "##" + "\n\t" "## Decryption core" + "\n\t" "##" + "\n\t" "## Same API as encryption core." + "\n\t" "##" + "\n\t" ".align 16" + "\n\t" ".type _aes_decrypt_core, at function" + "\n\t" "_aes_decrypt_core:" + "\n\t" " movl %eax, %esi" + "\n\t" " shll $4, %esi" + "\n\t" " xorl $48, %esi" + "\n\t" " andl $48, %esi" + "\n\t" " movdqa .Lk_dipt (%rcx), %xmm2 # iptlo" + "\n\t" " movdqa %xmm9, %xmm1" + "\n\t" " pandn %xmm0, %xmm1" + "\n\t" " psrld $4, %xmm1" + "\n\t" " pand %xmm9, %xmm0" + "\n\t" " pshufb %xmm0, %xmm2" + "\n\t" " movdqa .Lk_dipt+16(%rcx), %xmm0 # ipthi" + "\n\t" " pshufb %xmm1, %xmm0" + "\n\t" " pxor (%rdx), %xmm2" + "\n\t" " pxor %xmm2, %xmm0" + "\n\t" " movdqa .Lk_mc_forward+48(%rcx), %xmm5" + "\n\t" " lea 16(%rdx), %rdx" + "\n\t" " neg %rax" + "\n\t" " jmp .Laes_dec_entry" + + "\n\t" ".align 16" + "\n\t" ".Laes_dec_loop:" + "\n\t" "##" + "\n\t" "## Inverse mix columns" + "\n\t" "##" + "\n\t" " movdqa %xmm13, %xmm4 # 4 : sb9u" + "\n\t" " pshufb %xmm2, %xmm4 # 4 = sb9u" + "\n\t" " pxor (%rdx), %xmm4" + "\n\t" " movdqa %xmm12, %xmm0 # 0 : sb9t" + "\n\t" " pshufb %xmm3, %xmm0 # 0 = sb9t" + "\n\t" " movdqa .Lk_dsbd+16(%rcx),%xmm1 # 1 : sbdt" + "\n\t" " pxor %xmm4, %xmm0 # 0 = ch" + "\n\t" " lea 16(%rdx), %rdx # next round key" + + "\n\t" " pshufb %xmm5, %xmm0 # MC ch" + "\n\t" " movdqa %xmm15, %xmm4 # 4 : sbdu" + "\n\t" " pshufb %xmm2, %xmm4 # 4 = sbdu" + "\n\t" " pxor %xmm0, %xmm4 # 4 = ch" + "\n\t" " pshufb %xmm3, %xmm1 # 1 = sbdt" + "\n\t" " pxor %xmm4, %xmm1 # 1 = ch" + + "\n\t" " pshufb %xmm5, %xmm1 # MC ch" + "\n\t" " movdqa %xmm14, %xmm4 # 4 : sbbu" + "\n\t" " pshufb %xmm2, %xmm4 # 4 = sbbu" + "\n\t" " inc %rax # nr--" + "\n\t" " pxor %xmm1, %xmm4 # 4 = ch" + "\n\t" " movdqa .Lk_dsbb+16(%rcx),%xmm0 # 0 : sbbt" + "\n\t" " pshufb %xmm3, %xmm0 # 0 = sbbt" + "\n\t" " pxor %xmm4, %xmm0 # 0 = ch" + + "\n\t" " pshufb %xmm5, %xmm0 # MC ch" + "\n\t" " movdqa %xmm8, %xmm4 # 4 : sbeu" + "\n\t" " pshufb %xmm2, %xmm4 # 4 = sbeu" + "\n\t" " pshufd $0x93, %xmm5, %xmm5" + "\n\t" " pxor %xmm0, %xmm4 # 4 = ch" + "\n\t" " movdqa .Lk_dsbe+16(%rcx),%xmm0 # 0 : sbet" + "\n\t" " pshufb %xmm3, %xmm0 # 0 = sbet" + "\n\t" " pxor %xmm4, %xmm0 # 0 = ch" + + "\n\t" ".Laes_dec_entry:" + "\n\t" " # top of round" + "\n\t" " movdqa %xmm9, %xmm1 # 1 : i" + "\n\t" " pandn %xmm0, %xmm1 # 1 = i<<4" + "\n\t" " psrld $4, %xmm1 # 1 = i" + "\n\t" " pand %xmm9, %xmm0 # 0 = k" + "\n\t" " movdqa %xmm11, %xmm2 # 2 : a/k" + "\n\t" " pshufb %xmm0, %xmm2 # 2 = a/k" + "\n\t" " pxor %xmm1, %xmm0 # 0 = j" + "\n\t" " movdqa %xmm10, %xmm3 # 3 : 1/i" + "\n\t" " pshufb %xmm1, %xmm3 # 3 = 1/i" + "\n\t" " pxor %xmm2, %xmm3 # 3 = iak = 1/i + a/k" + "\n\t" " movdqa %xmm10, %xmm4 # 4 : 1/j" + "\n\t" " pshufb %xmm0, %xmm4 # 4 = 1/j" + "\n\t" " pxor %xmm2, %xmm4 # 4 = jak = 1/j + a/k" + "\n\t" " movdqa %xmm10, %xmm2 # 2 : 1/iak" + "\n\t" " pshufb %xmm3, %xmm2 # 2 = 1/iak" + "\n\t" " pxor %xmm0, %xmm2 # 2 = io" + "\n\t" " movdqa %xmm10, %xmm3 # 3 : 1/jak" + "\n\t" " pshufb %xmm4, %xmm3 # 3 = 1/jak" + "\n\t" " pxor %xmm1, %xmm3 # 3 = jo" + "\n\t" " jnz .Laes_dec_loop" + + "\n\t" " # middle of last round" + "\n\t" " movdqa .Lk_dsbo(%rcx), %xmm4 # 3 : sbou" + "\n\t" " pshufb %xmm2, %xmm4 # 4 = sbou" + "\n\t" " pxor (%rdx), %xmm4 # 4 = sb1u + k" + "\n\t" " movdqa .Lk_dsbo+16(%rcx), %xmm0 # 0 : sbot" + "\n\t" " pshufb %xmm3, %xmm0 # 0 = sb1t" + "\n\t" " pxor %xmm4, %xmm0 # 0 = A" + "\n\t" " pshufb .Lk_sr(%rsi,%rcx), %xmm0" + "\n\t" " ret" + "\n\t" ".size _aes_decrypt_core,.-_aes_decrypt_core" + + "\n\t" "########################################################" + "\n\t" "## ##" + "\n\t" "## AES key schedule ##" + "\n\t" "## ##" + "\n\t" "########################################################" + + "\n\t" ".align 16" + "\n\t" ".type _aes_schedule_core, at function" + "\n\t" "_aes_schedule_core:" + "\n\t" " # rdi = key" + "\n\t" " # rsi = size in bits" + "\n\t" " # rdx = buffer" + "\n\t" " # rcx = direction. 0=encrypt, 1=decrypt" + + "\n\t" " # load the tables" + "\n\t" " lea .Laes_consts(%rip), %r10" + "\n\t" " movdqa (%r10), %xmm9 # 0F" + "\n\t" " movdqa .Lk_inv (%r10), %xmm10 # inv" + "\n\t" " movdqa .Lk_inv+16(%r10), %xmm11 # inva" + "\n\t" " movdqa .Lk_sb1 (%r10), %xmm13 # sb1u" + "\n\t" " movdqa .Lk_sb1+16(%r10), %xmm12 # sb1t" + "\n\t" " movdqa .Lk_sb2 (%r10), %xmm15 # sb2u" + "\n\t" " movdqa .Lk_sb2+16(%r10), %xmm14 # sb2t" + + "\n\t" " movdqa .Lk_rcon(%r10), %xmm8 # load rcon" + "\n\t" " movdqu (%rdi), %xmm0 # load key (unaligned)" + + "\n\t" " # input transform" + "\n\t" " movdqu %xmm0, %xmm3" + "\n\t" " lea .Lk_ipt(%r10), %r11" + "\n\t" " call .Laes_schedule_transform" + "\n\t" " movdqu %xmm0, %xmm7" + + "\n\t" " test %rcx, %rcx" + "\n\t" " jnz .Laes_schedule_am_decrypting" + + "\n\t" " # encrypting, output zeroth round key after transform" + "\n\t" " movdqa %xmm0, (%rdx)" + "\n\t" " jmp .Laes_schedule_go" + + "\n\t" ".Laes_schedule_am_decrypting:" + "\n\t" " # decrypting, output zeroth round key after shiftrows" + "\n\t" " pshufb .Lk_sr(%r8,%r10),%xmm3" + "\n\t" " movdqa %xmm3, (%rdx)" + "\n\t" " xor $48, %r8" + + "\n\t" ".Laes_schedule_go:" + "\n\t" " cmp $192, %rsi" + "\n\t" " je .Laes_schedule_192" + "\n\t" " cmp $256, %rsi" + "\n\t" " je .Laes_schedule_256" + "\n\t" " # 128: fall though" + + "\n\t" "##" + "\n\t" "## .Laes_schedule_128" + "\n\t" "##" + "\n\t" "## 128-bit specific part of key schedule." + "\n\t" "##" + "\n\t" "## This schedule is really simple, because all its parts" + "\n\t" "## are accomplished by the subroutines." + "\n\t" "##" + "\n\t" ".Laes_schedule_128:" + "\n\t" " mov $10, %rsi" + + "\n\t" ".Laes_schedule_128_L:" + "\n\t" " call .Laes_schedule_round" + "\n\t" " dec %rsi" + "\n\t" " jz .Laes_schedule_mangle_last" + "\n\t" " call .Laes_schedule_mangle # write output" + "\n\t" " jmp .Laes_schedule_128_L" + + "\n\t" "##" + "\n\t" "## .Laes_schedule_192" + "\n\t" "##" + "\n\t" "## 192-bit specific part of key schedule." + "\n\t" "##" + "\n\t" "## The main body of this schedule is the same as the 128-bit" + "\n\t" "## schedule, but with more smearing. The long, high side is" + "\n\t" "## stored in %xmm7 as before, and the short, low side is in" + "\n\t" "## the high bits of %xmm6." + "\n\t" "##" + "\n\t" "## This schedule is somewhat nastier, however, because each" + "\n\t" "## round produces 192 bits of key material, or 1.5 round keys." + "\n\t" "## Therefore, on each cycle we do 2 rounds and produce 3 round" + "\n\t" "## keys." + "\n\t" "##" + "\n\t" ".Laes_schedule_192:" + "\n\t" " movdqu 8(%rdi),%xmm0 # load key part 2 (very unaligned)" + "\n\t" " call .Laes_schedule_transform # input transform" + "\n\t" " pshufd $0x0E, %xmm0, %xmm6" + "\n\t" " pslldq $8, %xmm6 # clobber low side with zeros" + "\n\t" " mov $4, %rsi" + + "\n\t" ".Laes_schedule_192_L:" + "\n\t" " call .Laes_schedule_round" + "\n\t" " palignr $8,%xmm6,%xmm0 " + "\n\t" " call .Laes_schedule_mangle # save key n" + "\n\t" " call .Laes_schedule_192_smear" + "\n\t" " call .Laes_schedule_mangle # save key n+1" + "\n\t" " call .Laes_schedule_round" + "\n\t" " dec %rsi" + "\n\t" " jz .Laes_schedule_mangle_last" + "\n\t" " call .Laes_schedule_mangle # save key n+2" + "\n\t" " call .Laes_schedule_192_smear" + "\n\t" " jmp .Laes_schedule_192_L" + + "\n\t" "##" + "\n\t" "## .Laes_schedule_192_smear" + "\n\t" "##" + "\n\t" "## Smear the short, low side in the 192-bit key schedule." + "\n\t" "##" + "\n\t" "## Inputs:" + "\n\t" "## %xmm7: high side, b a x y" + "\n\t" "## %xmm6: low side, d c 0 0" + "\n\t" "## %xmm13: 0" + "\n\t" "##" + "\n\t" "## Outputs:" + "\n\t" "## %xmm6: b+c+d b+c 0 0" + "\n\t" "## %xmm0: b+c+d b+c b a" + "\n\t" "##" + "\n\t" ".Laes_schedule_192_smear:" + "\n\t" " pshufd $0x80, %xmm6, %xmm0 # d c 0 0 -> c 0 0 0" + "\n\t" " pxor %xmm0, %xmm6 # -> c+d c 0 0" + "\n\t" " pshufd $0xFE, %xmm7, %xmm0 # b a _ _ -> b b b a" + "\n\t" " pxor %xmm6, %xmm0 # -> b+c+d b+c b a" + "\n\t" " pshufd $0x0E, %xmm0, %xmm6" + "\n\t" " pslldq $8, %xmm6 # clobber low side with zeros" + "\n\t" " ret" + + "\n\t" "##" + "\n\t" "## .Laes_schedule_256" + "\n\t" "##" + "\n\t" "## 256-bit specific part of key schedule." + "\n\t" "##" + "\n\t" "## The structure here is very similar to the 128-bit" + "\n\t" "## schedule, but with an additional 'low side' in" + "\n\t" "## %xmm6. The low side's rounds are the same as the" + "\n\t" "## high side's, except no rcon and no rotation." + "\n\t" "##" + "\n\t" ".Laes_schedule_256:" + "\n\t" " movdqu 16(%rdi),%xmm0 # load key part 2 (unaligned)" + "\n\t" " call .Laes_schedule_transform # input transform" + "\n\t" " mov $7, %rsi" + + "\n\t" ".Laes_schedule_256_L:" + "\n\t" " call .Laes_schedule_mangle # output low result" + "\n\t" " movdqa %xmm0, %xmm6 # save cur_lo in xmm6" + + "\n\t" " # high round" + "\n\t" " call .Laes_schedule_round" + "\n\t" " dec %rsi" + "\n\t" " jz .Laes_schedule_mangle_last" + "\n\t" " call .Laes_schedule_mangle " + + "\n\t" " # low round. swap xmm7 and xmm6" + "\n\t" " pshufd $0xFF, %xmm0, %xmm0" + "\n\t" " movdqa %xmm7, %xmm5" + "\n\t" " movdqa %xmm6, %xmm7" + "\n\t" " call .Laes_schedule_low_round" + "\n\t" " movdqa %xmm5, %xmm7" + + "\n\t" " jmp .Laes_schedule_256_L" + + "\n\t" "##" + "\n\t" "## .Laes_schedule_round" + "\n\t" "##" + "\n\t" "## Runs one main round of the key schedule on %xmm0, %xmm7" + "\n\t" "##" + "\n\t" "## Specifically, runs subbytes on the high dword of %xmm0" + "\n\t" "## then rotates it by one byte and xors into the low dword of" + "\n\t" "## %xmm7." + "\n\t" "##" + "\n\t" "## Adds rcon from low byte of %xmm8, then rotates %xmm8 for" + "\n\t" "## next rcon." + "\n\t" "##" + "\n\t" "## Smears the dwords of %xmm7 by xoring the low into the" + "\n\t" "## second low, result into third, result into highest." + "\n\t" "##" + "\n\t" "## Returns results in %xmm7 = %xmm0." + "\n\t" "## Clobbers %xmm1-%xmm4, %r11." + "\n\t" "##" + "\n\t" ".Laes_schedule_round:" + "\n\t" " # extract rcon from xmm8" + "\n\t" " pxor %xmm1, %xmm1" + "\n\t" " palignr $15, %xmm8, %xmm1" + "\n\t" " palignr $15, %xmm8, %xmm8" + "\n\t" " pxor %xmm1, %xmm7" + + "\n\t" " # rotate" + "\n\t" " pshufd $0xFF, %xmm0, %xmm0" + "\n\t" " palignr $1, %xmm0, %xmm0" + + "\n\t" " # fall through..." + + "\n\t" " # low round: same as high round, but no rotation and no rcon." + "\n\t" ".Laes_schedule_low_round:" + "\n\t" " # smear xmm7" + "\n\t" " movdqa %xmm7, %xmm1" + "\n\t" " pslldq $4, %xmm7" + "\n\t" " pxor %xmm1, %xmm7" + "\n\t" " movdqa %xmm7, %xmm1" + "\n\t" " pslldq $8, %xmm7" + "\n\t" " pxor %xmm1, %xmm7" + "\n\t" " pxor .Lk_s63(%r10), %xmm7" + + "\n\t" " # subbytes" + "\n\t" " movdqa %xmm9, %xmm1" + "\n\t" " pandn %xmm0, %xmm1" + "\n\t" " psrld $4, %xmm1 # 1 = i" + "\n\t" " pand %xmm9, %xmm0 # 0 = k" + "\n\t" " movdqa %xmm11, %xmm2 # 2 : a/k" + "\n\t" " pshufb %xmm0, %xmm2 # 2 = a/k" + "\n\t" " pxor %xmm1, %xmm0 # 0 = j" + "\n\t" " movdqa %xmm10, %xmm3 # 3 : 1/i" + "\n\t" " pshufb %xmm1, %xmm3 # 3 = 1/i" + "\n\t" " pxor %xmm2, %xmm3 # 3 = iak = 1/i + a/k" + "\n\t" " movdqa %xmm10, %xmm4 # 4 : 1/j" + "\n\t" " pshufb %xmm0, %xmm4 # 4 = 1/j" + "\n\t" " pxor %xmm2, %xmm4 # 4 = jak = 1/j + a/k" + "\n\t" " movdqa %xmm10, %xmm2 # 2 : 1/iak" + "\n\t" " pshufb %xmm3, %xmm2 # 2 = 1/iak" + "\n\t" " pxor %xmm0, %xmm2 # 2 = io" + "\n\t" " movdqa %xmm10, %xmm3 # 3 : 1/jak" + "\n\t" " pshufb %xmm4, %xmm3 # 3 = 1/jak" + "\n\t" " pxor %xmm1, %xmm3 # 3 = jo" + "\n\t" " movdqa .Lk_sb1(%r10), %xmm4 # 4 : sbou" + "\n\t" " pshufb %xmm2, %xmm4 # 4 = sbou" + "\n\t" " movdqa .Lk_sb1+16(%r10), %xmm0 # 0 : sbot" + "\n\t" " pshufb %xmm3, %xmm0 # 0 = sb1t" + "\n\t" " pxor %xmm4, %xmm0 # 0 = sbox output" + + "\n\t" " # add in smeared stuff" + "\n\t" " pxor %xmm7, %xmm0 " + "\n\t" " movdqa %xmm0, %xmm7" + "\n\t" " ret" + + "\n\t" "##" + "\n\t" "## .Laes_schedule_transform" + "\n\t" "##" + "\n\t" "## Linear-transform %xmm0 according to tables at (%r11)" + "\n\t" "##" + "\n\t" "## Requires that %xmm9 = 0x0F0F... as in preheat" + "\n\t" "## Output in %xmm0" + "\n\t" "## Clobbers %xmm1, %xmm2" + "\n\t" "##" + "\n\t" ".Laes_schedule_transform:" + "\n\t" " movdqa %xmm9, %xmm1" + "\n\t" " pandn %xmm0, %xmm1" + "\n\t" " psrld $4, %xmm1" + "\n\t" " pand %xmm9, %xmm0" + "\n\t" " movdqa (%r11), %xmm2 # lo" + "\n\t" " pshufb %xmm0, %xmm2" + "\n\t" " movdqa 16(%r11), %xmm0 # hi" + "\n\t" " pshufb %xmm1, %xmm0" + "\n\t" " pxor %xmm2, %xmm0" + "\n\t" " ret" + + "\n\t" "##" + "\n\t" "## .Laes_schedule_mangle" + "\n\t" "##" + "\n\t" "## Mangle xmm0 from (basis-transformed) standard version" + "\n\t" "## to our version." + "\n\t" "##" + "\n\t" "## On encrypt," + "\n\t" "## xor with 0x63" + "\n\t" "## multiply by circulant 0,1,1,1" + "\n\t" "## apply shiftrows transform" + "\n\t" "##" + "\n\t" "## On decrypt," + "\n\t" "## xor with 0x63" + "\n\t" "## multiply by 'inverse mixcolumns' circulant E,B,D,9" + "\n\t" "## deskew" + "\n\t" "## apply shiftrows transform" + "\n\t" "##" + "\n\t" "##" + "\n\t" "## Writes out to (%rdx), and increments or decrements it" + "\n\t" "## Keeps track of round number mod 4 in %r8" + "\n\t" "## Preserves xmm0" + "\n\t" "## Clobbers xmm1-xmm5" + "\n\t" "##" + "\n\t" ".Laes_schedule_mangle:" + "\n\t" " movdqa %xmm0, %xmm4 # save xmm0 for later" + "\n\t" " movdqa .Lk_mc_forward(%r10),%xmm5" + "\n\t" " test %rcx, %rcx" + "\n\t" " jnz .Laes_schedule_mangle_dec" + + "\n\t" " # encrypting" + "\n\t" " add $16, %rdx" + "\n\t" " pxor .Lk_s63(%r10),%xmm4" + "\n\t" " pshufb %xmm5, %xmm4" + "\n\t" " movdqa %xmm4, %xmm3" + "\n\t" " pshufb %xmm5, %xmm4" + "\n\t" " pxor %xmm4, %xmm3" + "\n\t" " pshufb %xmm5, %xmm4" + "\n\t" " pxor %xmm4, %xmm3" + + "\n\t" " jmp .Laes_schedule_mangle_both" + + "\n\t" ".Laes_schedule_mangle_dec:" + "\n\t" " lea .Lk_dks_1(%r10), %r11 # first table: *9" + "\n\t" " call .Laes_schedule_transform" + "\n\t" " movdqa %xmm0, %xmm3" + "\n\t" " pshufb %xmm5, %xmm3" + + "\n\t" " add $32, %r11 # next table: *B" + "\n\t" " call .Laes_schedule_transform" + "\n\t" " pxor %xmm0, %xmm3" + "\n\t" " pshufb %xmm5, %xmm3" + + "\n\t" " add $32, %r11 # next table: *D" + "\n\t" " call .Laes_schedule_transform" + "\n\t" " pxor %xmm0, %xmm3" + "\n\t" " pshufb %xmm5, %xmm3" + + "\n\t" " add $32, %r11 # next table: *E" + "\n\t" " call .Laes_schedule_transform" + "\n\t" " pxor %xmm0, %xmm3" + "\n\t" " pshufb %xmm5, %xmm3" + + "\n\t" " movdqa %xmm4, %xmm0 # restore %xmm0" + "\n\t" " add $-16, %rdx" + + "\n\t" ".Laes_schedule_mangle_both:" + "\n\t" " pshufb .Lk_sr(%r8,%r10),%xmm3" + "\n\t" " add $-16, %r8" + "\n\t" " and $48, %r8" + "\n\t" " movdqa %xmm3, (%rdx)" + "\n\t" " ret" + + "\n\t" "##" + "\n\t" "## .Laes_schedule_mangle_last" + "\n\t" "##" + "\n\t" "## Mangler for last round of key schedule" + "\n\t" "## Mangles %xmm0" + "\n\t" "## when encrypting, outputs out(%xmm0) ^ 63" + "\n\t" "## when decrypting, outputs unskew(%xmm0)" + "\n\t" "##" + "\n\t" "## Always called right before return... jumps to cleanup and exits" + "\n\t" "##" + "\n\t" ".Laes_schedule_mangle_last:" + "\n\t" " # schedule last round key from xmm0" + "\n\t" " lea .Lk_deskew(%r10),%r11 # prepare to deskew" + "\n\t" " test %rcx, %rcx" + "\n\t" " jnz .Laes_schedule_mangle_last_dec" + + "\n\t" " # encrypting" + "\n\t" " pshufb .Lk_sr(%r8,%r10),%xmm0 # output permute" + "\n\t" " lea .Lk_opt(%r10), %r11 # prepare to output transform" + "\n\t" " add $32, %rdx" + + "\n\t" ".Laes_schedule_mangle_last_dec:" + "\n\t" " add $-16, %rdx" + "\n\t" " pxor .Lk_s63(%r10), %xmm0" + "\n\t" " call .Laes_schedule_transform # output transform" + "\n\t" " movdqa %xmm0, (%rdx) # save last key" + + "\n\t" " #_aes_cleanup" + "\n\t" " pxor %xmm0, %xmm0" + "\n\t" " pxor %xmm1, %xmm1" + "\n\t" " pxor %xmm2, %xmm2" + "\n\t" " pxor %xmm3, %xmm3" + "\n\t" " pxor %xmm4, %xmm4" + "\n\t" " pxor %xmm5, %xmm5" + "\n\t" " pxor %xmm6, %xmm6" + "\n\t" " pxor %xmm7, %xmm7" + "\n\t" " pxor %xmm8, %xmm8" + "\n\t" " ret" + "\n\t" ".size _aes_schedule_core,.-_aes_schedule_core" + + "\n\t" "########################################################" + "\n\t" "## ##" + "\n\t" "## Constants ##" + "\n\t" "## ##" + "\n\t" "########################################################" + + "\n\t" ".align 16" + "\n\t" ".type _aes_consts, at object" + "\n\t" ".Laes_consts:" + "\n\t" "_aes_consts:" + "\n\t" " # s0F" + "\n\t" " .Lk_s0F = .-.Laes_consts" + "\n\t" " .quad 0x0F0F0F0F0F0F0F0F" + "\n\t" " .quad 0x0F0F0F0F0F0F0F0F" + + "\n\t" " # input transform (lo, hi)" + "\n\t" " .Lk_ipt = .-.Laes_consts" + "\n\t" " .quad 0xC2B2E8985A2A7000" + "\n\t" " .quad 0xCABAE09052227808" + "\n\t" " .quad 0x4C01307D317C4D00" + "\n\t" " .quad 0xCD80B1FCB0FDCC81" + + "\n\t" " # inv, inva" + "\n\t" " .Lk_inv = .-.Laes_consts" + "\n\t" " .quad 0x0E05060F0D080180" + "\n\t" " .quad 0x040703090A0B0C02" + "\n\t" " .quad 0x01040A060F0B0780" + "\n\t" " .quad 0x030D0E0C02050809" + + "\n\t" " # sb1u, sb1t" + "\n\t" " .Lk_sb1 = .-.Laes_consts" + "\n\t" " .quad 0xB19BE18FCB503E00" + "\n\t" " .quad 0xA5DF7A6E142AF544" + "\n\t" " .quad 0x3618D415FAE22300" + "\n\t" " .quad 0x3BF7CCC10D2ED9EF" + + + "\n\t" " # sb2u, sb2t" + "\n\t" " .Lk_sb2 = .-.Laes_consts" + "\n\t" " .quad 0xE27A93C60B712400" + "\n\t" " .quad 0x5EB7E955BC982FCD" + "\n\t" " .quad 0x69EB88400AE12900" + "\n\t" " .quad 0xC2A163C8AB82234A" + + "\n\t" " # sbou, sbot" + "\n\t" " .Lk_sbo = .-.Laes_consts" + "\n\t" " .quad 0xD0D26D176FBDC700" + "\n\t" " .quad 0x15AABF7AC502A878" + "\n\t" " .quad 0xCFE474A55FBB6A00" + "\n\t" " .quad 0x8E1E90D1412B35FA" + + "\n\t" " # mc_forward" + "\n\t" " .Lk_mc_forward = .-.Laes_consts" + "\n\t" " .quad 0x0407060500030201" + "\n\t" " .quad 0x0C0F0E0D080B0A09" + "\n\t" " .quad 0x080B0A0904070605" + "\n\t" " .quad 0x000302010C0F0E0D" + "\n\t" " .quad 0x0C0F0E0D080B0A09" + "\n\t" " .quad 0x0407060500030201" + "\n\t" " .quad 0x000302010C0F0E0D" + "\n\t" " .quad 0x080B0A0904070605" + + "\n\t" " # mc_backward" + "\n\t" " .Lk_mc_backward = .-.Laes_consts" + "\n\t" " .quad 0x0605040702010003" + "\n\t" " .quad 0x0E0D0C0F0A09080B" + "\n\t" " .quad 0x020100030E0D0C0F" + "\n\t" " .quad 0x0A09080B06050407" + "\n\t" " .quad 0x0E0D0C0F0A09080B" + "\n\t" " .quad 0x0605040702010003" + "\n\t" " .quad 0x0A09080B06050407" + "\n\t" " .quad 0x020100030E0D0C0F" + + "\n\t" " # sr" + "\n\t" " .Lk_sr = .-.Laes_consts" + "\n\t" " .quad 0x0706050403020100" + "\n\t" " .quad 0x0F0E0D0C0B0A0908" + "\n\t" " .quad 0x030E09040F0A0500" + "\n\t" " .quad 0x0B06010C07020D08" + "\n\t" " .quad 0x0F060D040B020900" + "\n\t" " .quad 0x070E050C030A0108" + "\n\t" " .quad 0x0B0E0104070A0D00" + "\n\t" " .quad 0x0306090C0F020508" + + "\n\t" " # rcon" + "\n\t" " .Lk_rcon = .-.Laes_consts" + "\n\t" " .quad 0x1F8391B9AF9DEEB6" + "\n\t" " .quad 0x702A98084D7C7D81" + + "\n\t" " # s63: all equal to 0x63 transformed" + "\n\t" " .Lk_s63 = .-.Laes_consts" + "\n\t" " .quad 0x5B5B5B5B5B5B5B5B" + "\n\t" " .quad 0x5B5B5B5B5B5B5B5B" + + "\n\t" " # output transform" + "\n\t" " .Lk_opt = .-.Laes_consts" + "\n\t" " .quad 0xFF9F4929D6B66000" + "\n\t" " .quad 0xF7974121DEBE6808" + "\n\t" " .quad 0x01EDBD5150BCEC00" + "\n\t" " .quad 0xE10D5DB1B05C0CE0" + + "\n\t" " # deskew tables: inverts the sbox's 'skew'" + "\n\t" " .Lk_deskew = .-.Laes_consts" + "\n\t" " .quad 0x07E4A34047A4E300" + "\n\t" " .quad 0x1DFEB95A5DBEF91A" + "\n\t" " .quad 0x5F36B5DC83EA6900" + "\n\t" " .quad 0x2841C2ABF49D1E77" + + "\n\t" "##" + "\n\t" "## Decryption stuff" + "\n\t" "## Key schedule constants" + "\n\t" "##" + "\n\t" " # decryption key schedule: x -> invskew x*9" + "\n\t" " .Lk_dks_1 = .-.Laes_consts" + "\n\t" " .quad 0xB6116FC87ED9A700" + "\n\t" " .quad 0x4AED933482255BFC" + "\n\t" " .quad 0x4576516227143300" + "\n\t" " .quad 0x8BB89FACE9DAFDCE" + + "\n\t" " # decryption key schedule: invskew x*9 -> invskew x*D" + "\n\t" " .Lk_dks_2 = .-.Laes_consts" + "\n\t" " .quad 0x27438FEBCCA86400" + "\n\t" " .quad 0x4622EE8AADC90561" + "\n\t" " .quad 0x815C13CE4F92DD00" + "\n\t" " .quad 0x73AEE13CBD602FF2" + + "\n\t" " # decryption key schedule: invskew x*D -> invskew x*B" + "\n\t" " .Lk_dks_3 = .-.Laes_consts" + "\n\t" " .quad 0x03C4C50201C6C700" + "\n\t" " .quad 0xF83F3EF9FA3D3CFB" + "\n\t" " .quad 0xEE1921D638CFF700" + "\n\t" " .quad 0xA5526A9D7384BC4B" + + "\n\t" " # decryption key schedule: invskew x*B -> invskew x*E + 0x63" + "\n\t" " .Lk_dks_4 = .-.Laes_consts" + "\n\t" " .quad 0xE3C390B053732000" + "\n\t" " .quad 0xA080D3F310306343" + "\n\t" " .quad 0xA0CA214B036982E8" + "\n\t" " .quad 0x2F45AEC48CE60D67" + + "\n\t" "##" + "\n\t" "## Decryption stuff" + "\n\t" "## Round function constants" + "\n\t" "##" + "\n\t" " # decryption input transform" + "\n\t" " .Lk_dipt = .-.Laes_consts" + "\n\t" " .quad 0x0F505B040B545F00" + "\n\t" " .quad 0x154A411E114E451A" + "\n\t" " .quad 0x86E383E660056500" + "\n\t" " .quad 0x12771772F491F194" + + "\n\t" " # decryption sbox output *9*u, *9*t" + "\n\t" " .Lk_dsb9 = .-.Laes_consts" + "\n\t" " .quad 0x851C03539A86D600" + "\n\t" " .quad 0xCAD51F504F994CC9" + "\n\t" " .quad 0xC03B1789ECD74900" + "\n\t" " .quad 0x725E2C9EB2FBA565" + + "\n\t" " # decryption sbox output *D*u, *D*t" + "\n\t" " .Lk_dsbd = .-.Laes_consts" + "\n\t" " .quad 0x7D57CCDFE6B1A200" + "\n\t" " .quad 0xF56E9B13882A4439" + "\n\t" " .quad 0x3CE2FAF724C6CB00" + "\n\t" " .quad 0x2931180D15DEEFD3" + + "\n\t" " # decryption sbox output *B*u, *B*t" + "\n\t" " .Lk_dsbb = .-.Laes_consts" + "\n\t" " .quad 0xD022649296B44200" + "\n\t" " .quad 0x602646F6B0F2D404" + "\n\t" " .quad 0xC19498A6CD596700" + "\n\t" " .quad 0xF3FF0C3E3255AA6B" + + "\n\t" " # decryption sbox output *E*u, *E*t" + "\n\t" " .Lk_dsbe = .-.Laes_consts" + "\n\t" " .quad 0x46F2929626D4D000" + "\n\t" " .quad 0x2242600464B4F6B0" + "\n\t" " .quad 0x0C55A6CDFFAAC100" + "\n\t" " .quad 0x9467F36B98593E32" + + "\n\t" " # decryption sbox final output" + "\n\t" " .Lk_dsbo = .-.Laes_consts" + "\n\t" " .quad 0x1387EA537EF94000" + "\n\t" " .quad 0xC7AA6DB9D4943E2D" + "\n\t" " .quad 0x12D7560F93441D00" + "\n\t" " .quad 0xCA4B8159D8C58E9C" + "\n\t" ".size _aes_consts,.-_aes_consts" +); + +#endif /* USE_SSSE3 */ diff --git a/cipher/rijndael.c b/cipher/rijndael.c index 7a83718..51c36c7 100644 --- a/cipher/rijndael.c +++ b/cipher/rijndael.c @@ -99,6 +99,40 @@ extern void _gcry_aes_aesni_cbc_dec (RIJNDAEL_context *ctx, unsigned char *iv, size_t nblocks); #endif +#ifdef USE_SSSE3 +/* SSSE3 (AMD64) vector permutation implementation of AES */ +extern void _gcry_aes_ssse3_do_setkey(RIJNDAEL_context *ctx, const byte *key); +extern void _gcry_aes_ssse3_prepare_decryption(RIJNDAEL_context *ctx); + +extern unsigned int _gcry_aes_ssse3_encrypt (const RIJNDAEL_context *ctx, + unsigned char *dst, + const unsigned char *src); +extern unsigned int _gcry_aes_ssse3_decrypt (const RIJNDAEL_context *ctx, + unsigned char *dst, + const unsigned char *src); +extern void _gcry_aes_ssse3_cfb_enc (RIJNDAEL_context *ctx, + unsigned char *outbuf, + const unsigned char *inbuf, + unsigned char *iv, size_t nblocks); +extern void _gcry_aes_ssse3_cbc_enc (RIJNDAEL_context *ctx, + unsigned char *outbuf, + const unsigned char *inbuf, + unsigned char *iv, size_t nblocks, + int cbc_mac); +extern void _gcry_aes_ssse3_ctr_enc (RIJNDAEL_context *ctx, + unsigned char *outbuf, + const unsigned char *inbuf, + unsigned char *ctr, size_t nblocks); +extern void _gcry_aes_ssse3_cfb_dec (RIJNDAEL_context *ctx, + unsigned char *outbuf, + const unsigned char *inbuf, + unsigned char *iv, size_t nblocks); +extern void _gcry_aes_ssse3_cbc_dec (RIJNDAEL_context *ctx, + unsigned char *outbuf, + const unsigned char *inbuf, + unsigned char *iv, size_t nblocks); +#endif + #ifdef USE_PADLOCK extern unsigned int _gcry_aes_padlock_encrypt (const RIJNDAEL_context *ctx, unsigned char *bx, @@ -182,7 +216,7 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) int rounds; int i,j, r, t, rconpointer = 0; int KC; -#if defined(USE_AESNI) || defined(USE_PADLOCK) +#if defined(USE_AESNI) || defined(USE_PADLOCK) || defined(USE_SSSE3) unsigned int hwfeatures; #endif @@ -223,7 +257,7 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) ctx->rounds = rounds; -#if defined(USE_AESNI) || defined(USE_PADLOCK) +#if defined(USE_AESNI) || defined(USE_PADLOCK) || defined(USE_SSSE3) hwfeatures = _gcry_get_hw_features (); #endif @@ -234,6 +268,9 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) #ifdef USE_AESNI ctx->use_aesni = 0; #endif +#ifdef USE_SSSE3 + ctx->use_ssse3 = 0; +#endif if (0) { @@ -260,6 +297,16 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) memcpy (ctx->padlockkey, key, keylen); } #endif +#ifdef USE_SSSE3 + else if (hwfeatures & HWF_INTEL_SSSE3) + { + ctx->encrypt_fn = _gcry_aes_ssse3_encrypt; + ctx->decrypt_fn = _gcry_aes_ssse3_decrypt; + ctx->prefetch_enc_fn = NULL; + ctx->prefetch_dec_fn = NULL; + ctx->use_ssse3 = 1; + } +#endif else { ctx->encrypt_fn = do_encrypt; @@ -278,6 +325,10 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) else if (ctx->use_aesni) _gcry_aes_aesni_do_setkey (ctx, key); #endif +#ifdef USE_AESNI + else if (ctx->use_ssse3) + _gcry_aes_ssse3_do_setkey (ctx, key); +#endif else { const byte *sbox = ((const byte *)encT) + 1; @@ -403,6 +454,12 @@ prepare_decryption( RIJNDAEL_context *ctx ) _gcry_aes_aesni_prepare_decryption (ctx); } #endif /*USE_AESNI*/ +#ifdef USE_SSSE3 + else if (ctx->use_ssse3) + { + _gcry_aes_ssse3_prepare_decryption (ctx); + } +#endif /*USE_SSSE3*/ #ifdef USE_PADLOCK else if (ctx->use_padlock) { @@ -650,6 +707,13 @@ _gcry_aes_cfb_enc (void *context, unsigned char *iv, burn_depth = 0; } #endif /*USE_AESNI*/ +#ifdef USE_SSSE3 + else if (ctx->use_ssse3) + { + _gcry_aes_ssse3_cfb_enc (ctx, outbuf, inbuf, iv, nblocks); + burn_depth = 0; + } +#endif /*USE_SSSE3*/ else { rijndael_cryptfn_t encrypt_fn = ctx->encrypt_fn; @@ -697,6 +761,13 @@ _gcry_aes_cbc_enc (void *context, unsigned char *iv, burn_depth = 0; } #endif /*USE_AESNI*/ +#ifdef USE_SSSE3 + else if (ctx->use_ssse3) + { + _gcry_aes_ssse3_cbc_enc (ctx, outbuf, inbuf, iv, nblocks, cbc_mac); + burn_depth = 0; + } +#endif /*USE_SSSE3*/ else { rijndael_cryptfn_t encrypt_fn = ctx->encrypt_fn; @@ -752,6 +823,13 @@ _gcry_aes_ctr_enc (void *context, unsigned char *ctr, burn_depth = 0; } #endif /*USE_AESNI*/ +#ifdef USE_SSSE3 + else if (ctx->use_ssse3) + { + _gcry_aes_ssse3_ctr_enc (ctx, outbuf, inbuf, ctr, nblocks); + burn_depth = 0; + } +#endif /*USE_SSSE3*/ else { union { unsigned char x1[16] ATTR_ALIGNED_16; u32 x32[4]; } tmp; @@ -986,6 +1064,13 @@ _gcry_aes_cfb_dec (void *context, unsigned char *iv, burn_depth = 0; } #endif /*USE_AESNI*/ +#ifdef USE_SSSE3 + else if (ctx->use_ssse3) + { + _gcry_aes_ssse3_cfb_dec (ctx, outbuf, inbuf, iv, nblocks); + burn_depth = 0; + } +#endif /*USE_SSSE3*/ else { rijndael_cryptfn_t encrypt_fn = ctx->encrypt_fn; @@ -1032,6 +1117,13 @@ _gcry_aes_cbc_dec (void *context, unsigned char *iv, burn_depth = 0; } #endif /*USE_AESNI*/ +#ifdef USE_SSSE3 + else if (ctx->use_ssse3) + { + _gcry_aes_ssse3_cbc_dec (ctx, outbuf, inbuf, iv, nblocks); + burn_depth = 0; + } +#endif /*USE_SSSE3*/ else { unsigned char savebuf[BLOCKSIZE] ATTR_ALIGNED_16; diff --git a/configure.ac b/configure.ac index a4ea990..71c50c0 100644 --- a/configure.ac +++ b/configure.ac @@ -1692,6 +1692,9 @@ if test "$found" = "1" ; then x86_64-*-*) # Build with the assembly implementation GCRYPT_CIPHERS="$GCRYPT_CIPHERS rijndael-amd64.lo" + + # Build with the SSSE3 implementation + GCRYPT_CIPHERS="$GCRYPT_CIPHERS rijndael-ssse3-amd64.lo" ;; arm*-*-*) # Build with the assembly implementation ----------------------------------------------------------------------- Summary of changes: cipher/Makefile.am | 2 +- cipher/rijndael-internal.h | 9 + cipher/rijndael-ssse3-amd64.c | 1209 +++++++++++++++++++++++++++++++++++++++++ cipher/rijndael.c | 96 +++- configure.ac | 3 + 5 files changed, 1316 insertions(+), 3 deletions(-) create mode 100644 cipher/rijndael-ssse3-amd64.c hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 1 22:01:10 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 01 Jan 2015 22:01:10 +0100 Subject: [git] gnupg-doc - branch, master, updated. 0ca1d50a7e58d991e7b572ecb58f8925f54e4157 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via 0ca1d50a7e58d991e7b572ecb58f8925f54e4157 (commit) via f0dedd5798f43e4c6905345387bf3deffff84a82 (commit) from 450481c63872bf79f03399128070bff768fae5b0 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0ca1d50a7e58d991e7b572ecb58f8925f54e4157 Author: Werner Koch Date: Thu Jan 1 22:01:13 2015 +0100 blog: Add Happy gnu year diff --git a/misc/blog.gnupg.org/20150101-happy-gnu-year.org b/misc/blog.gnupg.org/20150101-happy-gnu-year.org new file mode 100644 index 0000000..38a0ae8 --- /dev/null +++ b/misc/blog.gnupg.org/20150101-happy-gnu-year.org @@ -0,0 +1,97 @@ +# Thanks for the donations and plans for 2015 +#+STARTUP: showall +#+AUTHOR: Werner +#+DATE: January 1st, 2015 + +** Happy gnu year + +to everyone and a big *thank you* to all supporters of GnuPG. It is +awesome to see that GnuPG and its makers received a lot of attention +in the last weeks of 2014. This is really appreciated by all of us. +Speaking of me, the donations allow me to keep on working on free +software and GnuPG in particular --- at least for the next months. + +Early December friends reminded me that it is the time to kick off a +donation campaign to secure the future of GnuPG. They supported me +with a [[http://fsfe.org/news/2014/news-20141217-01.en.html][press release]] which was republished by others (e.g. [[http://boingboing.net/2014/12/21/gnupg-needs-your-support.html][Cory +Doctorow]]) and soon many small and larger donations started to fill up +the donation status bar with a bit of green. I was not just amazed by +the financial support but also by the many encouraging messages to us +developers like /Keep the excellent work! Please!/, /Thanks for +keeping us safe an protecting our basic human rights./, /You guys are +great! Safe communication should be a right./, /Thank you so much for +this hard work. You're truly directing us toward a better world/, +/GPG is important software for our society's future/, +/Thanks for doing great work. I know it's under appreciated, but it's absolutely +necessary/, /Please keep it up, guys, and run further donation rounds +if you need money. If GPG goes down, we'll all be at a loss/, or +/freedom of thought, freedom of speech, freedom of information/. Up +until today we received more than a quarter of the campaign?s goal and +donations are still coming in. Let me add that my work on GnuPG would +have not been possible without the incredible support of my family who +deserve all my thanks. + +At the 31C3 the [[http://events.ccc.de/congress/2014/Fahrplan/events/6258.html][Reconstructing narratives]] lecture ([[http://media.ccc.de/browse/congress/2014/31c3_-_6258_-_en_-_saal_1_-_201412282030_-_reconstructing_narratives_-_jacob_-_laura_poitras.html#video][video]]) told us +again about the depressingly sad state of our world regarding to +freedom and humanity. It was also reported that most of our secure +electronic communication methods don?t do what we expected from them +-- with the exception of a very few tools, GPG (i.e. GnuPG) being one +of them. + +With the raised attention towards securing our communication and to +help preserving us from a world nobody wants to have, we need to +improve GnuPG and its frontends. They need to be easy usable by +everyone and be a standard part of every communication device much +like the ubiquitous web browser. It will take time and a lot of effort +to do that. I am confident that with enough support we can achieve +that goal. Now let us look forward and see what is on the list. + +As a prerequisite we need to establish a solid organizational +framework to free developers of tasks they are not best in, like +looking for money, running funding campaigns, preparing paperwork for +donation programs, and talking to ties and non-techies. + +We need better and streamlined documentation. For example, there are +lots of different HOWTOs and other documents explaining the use of +GnuPG and frontend applications. Many of them are outdated and +some documents contradicts each other. Thus the goal is to prepare a +canonical set of documentation to support all kind of users. See and +use the [[https://wiki.gnupg.org][Wiki]] if you are interested to help. + +[[https://enigmail.net][Enigmail]] is one of the most used mailer frontends for GnuPG and thus +should be a primary target for improvements. There are currently only +two spare time developers for it --- despite that some smaller bugs +make it sometimes hard to use for a beginner. This needs to be +changed by improving the communication between the developers and +finding the resources to assign a paid developer to it. + +The network of OpenPGP keyservers works quite well for the relatively +small active user base. For a mass use of it we need to add a few +things or start to deploy an easier method for retrieving keys. This +is essential for making mail encryption the default on the net. + +Although the use or proprietary platforms supports the spook?s +surveillance programs, it is a pipe dream to believe that free +operating systems like Linux or FreeBSD can completely replace +Windows, Mac OS, and Android any time soon. Improving our crypto +tools on those platforms is thus essential to help those users and to +trigger a network effect to make encrypted communication the default. +For GnuPG this means to make the core components available on these +platforms using a standard unattended installer, so that frontend +applications (like Enigmail) can easily install it if not yet +available. Separating the GnuPG core from the frontend applications +also allows for an automatic update procedure to be prepared for +possible security relevant bugs and to be able to easily deploy new +algorithms as soon as the needs arises. + +As stated in the press release a second full time developer for GnuPG +is required to avoid relying mostly on me. Keep in mind that even +after having secured enough funds it will take some time to find a +developer and it will also takes some months until s/he is up to my +maintenance experience. Thus is at all costs required nevertheless. + +In general we need to simplify the the user interfaces of most +frontends and make it easier start with and keep on using encryption. +A dedicated developers meeting will be the first step towards this. + +Okay, let?s take up our part for a new dawn. diff --git a/misc/blog.gnupg.org/upload b/misc/blog.gnupg.org/upload index 795ebf2..912a885 100755 --- a/misc/blog.gnupg.org/upload +++ b/misc/blog.gnupg.org/upload @@ -10,7 +10,7 @@ fi echo "upload: Rendering entries" >&2 # We need to initialize that org cache to use our own publish function # despite that we do not use any org-publish feature -emacs --batch \ +emacs23 --batch \ --eval "(require 'assoc)" \ --eval "(require 'org)" \ --eval "(setq gpgweb-root-dir \"$(cd ../../web && pwd)/\")" \ @@ -74,6 +74,13 @@ awk -F: index.tmp \ } ' mv index.tmp index.html || echo "upload: error updating index.html" >&2 + +# Update the feed file +echo "upload: Updating feed file" >&2 + + + +# Remove temp file rm index.headlines.tmp echo "upload: Uploading files" >&2 commit f0dedd5798f43e4c6905345387bf3deffff84a82 Author: Werner Koch Date: Tue Dec 30 17:19:08 2014 +0100 tools: Get the donation bar ready for 2015 The current campaign started in December and thus the bar needs to show the donations from December plus those coming in in 2015. diff --git a/tools/mkkudos.sh b/tools/mkkudos.sh index 9ab6e26..ee786f1 100755 --- a/tools/mkkudos.sh +++ b/tools/mkkudos.sh @@ -75,13 +75,20 @@ monyear=$(echo "$tmp" | awk -F: 'BEGIN { m[1] = "January"; m[6] = "June"; m[7] = "July"; m[8] = "August"; m[9] = "September"; m[10] = "October"; m[11] = "November"; m[12] = "December"; } {printf "%s %d", m[$2] , $1}') -euro=$(echo "$tmp" | awk -F: '{printf "%d €", int($8 + 0.5)}') +euromo=$(echo "$tmp" | awk -F: '{printf "%d €", int($8 + 0.5)}') euroyr=$(echo "$tmp" | awk -F: '{printf "%d €", int($10 + 0.5)}') +euroyr_campaign=$(echo "$tmp" | awk -F: '{printf "%d", int($10 + 0.5)}') n=$(echo "$tmp" | awk -F: '{printf "%d", $7}') nyr=$(echo "$tmp" | awk -F: '{printf "%d", $9}') + +# Campaign data goal="120000" +tmp=$(grep '^2014:12:' "$donations") +euro=$(echo "$tmp" | awk -F: '{printf "%d", int($8 + 0.5)}') +euro=$(($euro + $euroyr_campaign)) percent=$(echo "$euro:$goal" | awk -F: '{printf "%d",(int($1)*100)/int($2)}') + for file in "$htdocs/donate/"kudos-????.html "$htdocs/donate/"kudos.html \ "$htdocs/donate/"index.html \ "$htdocs/"index.html @@ -99,6 +106,7 @@ for file in "$htdocs/donate/"kudos-????.html "$htdocs/donate/"kudos.html \ [ -f "$file.tmp" ] && rm "$file.tmp" awk -F: -v year=$year -v donors="$donors" \ -v monyear="$monyear" -v euro="$euro" -v euroyr="$euroyr" \ + -v euromo="$euromo" \ -v n="$n" -v nyr="$nyr" -v goal="$goal" -v percent="$percent" \ <"$file" >"$file.tmp" ' // {indon=1; print; insert("") } @@ -112,7 +120,7 @@ for file in "$htdocs/donate/"kudos-????.html "$htdocs/donate/"kudos.html \ next } // { - printf " %s\n", euro; + printf " %s\n", euromo; next } // { @@ -128,7 +136,7 @@ for file in "$htdocs/donate/"kudos-????.html "$htdocs/donate/"kudos.html \ next } // { - printf "%s\n", + printf "%s €\n", euro; next } diff --git a/web/donate/index.org b/web/donate/index.org index f4cc20b..5888d95 100644 --- a/web/donate/index.org +++ b/web/donate/index.org @@ -20,15 +20,6 @@ to help with development and maintenance please consider to make a donation. -** Recent donors - -#+HTML:
    -#+HTML: -#+HTML: -#+HTML:
  • (all)
    • -#+HTML:

- - ** Ways to donate Paying using a credit card is currently our preferred choice. If @@ -172,3 +163,13 @@ #+END_HTML + +** Recent donors + +#+HTML:
    +#+HTML: +#+HTML: +#+HTML:
  • (all)
    • +#+HTML:

+ +# eof # ----------------------------------------------------------------------- Summary of changes: misc/blog.gnupg.org/20150101-happy-gnu-year.org | 97 +++++++++++++++++++++++ misc/blog.gnupg.org/upload | 9 ++- tools/mkkudos.sh | 14 +++- web/donate/index.org | 19 ++--- 4 files changed, 126 insertions(+), 13 deletions(-) create mode 100644 misc/blog.gnupg.org/20150101-happy-gnu-year.org hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 2 20:14:31 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 02 Jan 2015 20:14:31 +0100 Subject: [git] gnupg-doc - branch, master, updated. 1e69a038458b3374d5a3f7df55b39e256b7b3ff3 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via 1e69a038458b3374d5a3f7df55b39e256b7b3ff3 (commit) via 39278e9e7f25faf22a466749e663a4af2175298f (commit) via 187e982d9b7d088a8f0508dc84cca3baf2b7b15d (commit) via 71de861ee508ad2472d38abb8574fdb709dbc2f5 (commit) via 8401a50feb2eddbd905530a9b9256fee78927fe5 (commit) from 0ca1d50a7e58d991e7b572ecb58f8925f54e4157 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1e69a038458b3374d5a3f7df55b39e256b7b3ff3 Author: Werner Koch Date: Fri Jan 2 20:08:01 2015 +0100 web: Move most news from 2014 to the archive. diff --git a/web/index.org b/web/index.org index b21c029..d0e2f61 100644 --- a/web/index.org +++ b/web/index.org @@ -96,7 +96,7 @@ a lot of bugs and brings some new features. Read more about 2.1 at the [[file:faq/whats-new-in-2.1.org][feature overview]] page and in the [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000360.html][announcement]] mail. -** Libksba 1.3.2 released :important: +** Libksba 1.3.2 released (2014-11-25) :important: This is a security fix release and all users of Libksba should update to this version. Note that *GnuPG 2.x* makes use of Libksba and thus @@ -111,96 +111,6 @@ features a lot of new things including support for ECC. Read more at the [[file:faq/whats-new-in-2.1.org][feature overview]] page and in the [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000358.html][announcement]] mail. -** A beta for GnuPG 2.1.0 released (2014-10-03) - -A beta release for the forthcoming GnuPG 2.1 version is now -available. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000357.html][{more}]] - -** GPA 0.95 released - -GPA is the GNU Privacy Assistant, a frontend to GnuPG. This new -release has support for ECC keys and improves on the UI server -feature. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000356.html][{more}]] - -** GnuPG 2.0.26 released (2014-08-12) - -GnuPG 2.0.26 is now available. This is a maintenance release. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000353.html][{more}]] - -** Libgcrypt 1.5.4 security fix release :important: - -Using any Libgcrypt version less than 1.5.4 with GnuPG 2.0.x and -Elgamal encryption keys is vulnerable to the /Get Your Hands Off My -Laptop/ attack. Please update to the newly released Libgcrypt 1.5.4 -or a 1.6 version. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html][{more}]] - -** Get Your Hands Off My Laptop (2014-08-07) - -Daniel Genkin, Itamar Pipman, and Eran Tromer latest side channel -attack targets an /older version/ of GnuPG. If your GnuPG and -Libgcrypt versions are up-to-date you are safe. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000349.html][{more}]] - -** GPGME 1.5.1 and 1.4.4 released (2014-08-07) :important: - -A security fix release for the GPGME library is available. It is -suggested to update to one of these version. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000350.html][{more}]] - -** GnuPG 2.0.25 and 1.4.18 released (2014-06-30) - -To fix a minor regression in the previous releases we released today -new versions of GnuPG-1 and GnuPG-2: [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000346.html][{2.0.25}]], [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000347.html][{1.4.18}]] - -** GnuPG 2.0.24 released (2014-06-24) :important: - -GnuPG 2.0.24 is now available. This GnuPG-2 release features a fix -for a denial of service attack and a few other changes. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html][{more}]] - - -** GnuPG 1.4.17 released (2014-06-23) :important: - -GnuPG 1.4.17 is now available. This GnuPG-1 release features a fix -for a denial of service attack and a few other minor changes. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html][{more}]] - - -** GnuPG 2.0.23 released (2014-06-03) - -We are pleased to announce the availability of GnuPG 2.0.23. This is -a maintenance release with a few new features. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000342.html][{more}]] - - -** Goteo campaign: preliminary results (2014-05-12) - -The blog has a report on the current status of the campaign including -an overview of the financial results. [[https://www.gnupg.org/blog/20140512-rewards-sent.html][{read here}]] - -** Mission complete: campaign ends, closing stats (2014-02-06) - -After 50 days of crowdfunding, the GnuPG campaign for new website and -infrastructure will close tomorrow. That means rewards for backers can -now be ordered and preparations for dispatch can begin. Here are the -results so far. [[https://www.gnupg.org/blog/20140206-crowdfunding-complete.html][{more}]] - - -** 16 Years of protecting privacy (2013-12-20) - -Today marks 16 years since the first release of GnuPG. In that time -the project has grown from being a hacker?s hobby into one of the -world?s most critical anti-surveillance tools. Today GnuPG stands at -the front line of the battle between invasive surveillance and civil -liberties. [[https://www.gnupg.org/blog/20131220-gnupg-turned-0x10.html][{more}]] - -** GnuPG launches crowdfunding campaign (2013-12-19) - -Today GNU Privacy Guard (GnuPG) has launched its first -[[http://goteo.org/project/gnupg-new-website-and-infrastructure][crowdfunding campaign]] with the aim of building a new website and long term -infrastructure. [[http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000338.html][{more}]] [[https://www.gnupg.org/blog/20131219-gnupg-launches-crowfunding.de.html][{deutsch}]] [[https://www.gnupg.org/blog/20131219-gnupg-launches-crowfunding.fr.html][{francaise}]] - -** GnuPG 1.4.16 released (2013-12-18) :important: - -Along with the publication of an interesting new [[http://www.cs.tau.ac.il/~tromer/acoustic/][side channel attack]] -by Genkin, Shamir, and Tromer we announce the availability of a new -stable GnuPG release to relieve this bug: Version 1.4.16 ... [[http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html][{more}]] - - * COMMENT This is the publishing info used for the GnuPG pages diff --git a/web/news.org b/web/news.org index 0d4f32c..6cfbd15 100644 --- a/web/news.org +++ b/web/news.org @@ -7,6 +7,96 @@ On this page you'll find all the news of previous years in reverse chronological order. News for the current year are found at the [[index][main page]]. + +** A beta for GnuPG 2.1.0 released (2014-10-03) + +A beta release for the forthcoming GnuPG 2.1 version is now +available. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000357.html][{more}]] + +** GPA 0.95 released + +GPA is the GNU Privacy Assistant, a frontend to GnuPG. This new +release has support for ECC keys and improves on the UI server +feature. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000356.html][{more}]] + +** GnuPG 2.0.26 released (2014-08-12) + +GnuPG 2.0.26 is now available. This is a maintenance release. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000353.html][{more}]] + +** Libgcrypt 1.5.4 security fix release :important: + +Using any Libgcrypt version less than 1.5.4 with GnuPG 2.0.x and +Elgamal encryption keys is vulnerable to the /Get Your Hands Off My +Laptop/ attack. Please update to the newly released Libgcrypt 1.5.4 +or a 1.6 version. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html][{more}]] + +** Get Your Hands Off My Laptop (2014-08-07) + +Daniel Genkin, Itamar Pipman, and Eran Tromer latest side channel +attack targets an /older version/ of GnuPG. If your GnuPG and +Libgcrypt versions are up-to-date you are safe. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000349.html][{more}]] + +** GPGME 1.5.1 and 1.4.4 released (2014-08-07) :important: + +A security fix release for the GPGME library is available. It is +suggested to update to one of these version. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000350.html][{more}]] + +** GnuPG 2.0.25 and 1.4.18 released (2014-06-30) + +To fix a minor regression in the previous releases we released today +new versions of GnuPG-1 and GnuPG-2: [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000346.html][{2.0.25}]], [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000347.html][{1.4.18}]] + +** GnuPG 2.0.24 released (2014-06-24) :important: + +GnuPG 2.0.24 is now available. This GnuPG-2 release features a fix +for a denial of service attack and a few other changes. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html][{more}]] + + +** GnuPG 1.4.17 released (2014-06-23) :important: + +GnuPG 1.4.17 is now available. This GnuPG-1 release features a fix +for a denial of service attack and a few other minor changes. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html][{more}]] + + +** GnuPG 2.0.23 released (2014-06-03) + +We are pleased to announce the availability of GnuPG 2.0.23. This is +a maintenance release with a few new features. [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000342.html][{more}]] + + +** Goteo campaign: preliminary results (2014-05-12) + +The blog has a report on the current status of the campaign including +an overview of the financial results. [[https://www.gnupg.org/blog/20140512-rewards-sent.html][{read here}]] + +** Mission complete: campaign ends, closing stats (2014-02-06) + +After 50 days of crowdfunding, the GnuPG campaign for new website and +infrastructure will close tomorrow. That means rewards for backers can +now be ordered and preparations for dispatch can begin. Here are the +results so far. [[https://www.gnupg.org/blog/20140206-crowdfunding-complete.html][{more}]] + + +** 16 Years of protecting privacy (2013-12-20) + +Today marks 16 years since the first release of GnuPG. In that time +the project has grown from being a hacker?s hobby into one of the +world?s most critical anti-surveillance tools. Today GnuPG stands at +the front line of the battle between invasive surveillance and civil +liberties. [[https://www.gnupg.org/blog/20131220-gnupg-turned-0x10.html][{more}]] + +** GnuPG launches crowdfunding campaign (2013-12-19) + +Today GNU Privacy Guard (GnuPG) has launched its first +[[http://goteo.org/project/gnupg-new-website-and-infrastructure][crowdfunding campaign]] with the aim of building a new website and long term +infrastructure. [[http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000338.html][{more}]] [[https://www.gnupg.org/blog/20131219-gnupg-launches-crowfunding.de.html][{deutsch}]] [[https://www.gnupg.org/blog/20131219-gnupg-launches-crowfunding.fr.html][{francaise}]] + +** GnuPG 1.4.16 released (2013-12-18) :important: + +Along with the publication of an interesting new [[http://www.cs.tau.ac.il/~tromer/acoustic/][side channel attack]] +by Genkin, Shamir, and Tromer we announce the availability of a new +stable GnuPG release to relieve this bug: Version 1.4.16 ... [[http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html][{more}]] + ** Blog: Getting Goteo crowdfunding approval (2013-12-18) The targets are set, the rewards are prepared, the press release has commit 39278e9e7f25faf22a466749e663a4af2175298f Author: Werner Koch Date: Fri Jan 2 20:01:06 2015 +0100 web: URL fix for EGD. diff --git a/web/related_software/swlist.org b/web/related_software/swlist.org index 7568a41..8082bdf 100644 --- a/web/related_software/swlist.org +++ b/web/related_software/swlist.org @@ -34,7 +34,7 @@ Cryptophane is an easy-to-use application for MS Windows. It allows users to encrypt, sign, decrypt, and perform key maintenance without having to deal with GnuPG's command-line interface. -** [[http://www.lothar.com/tech/crypto/][EGD]] [Unix] MISC +** [[http://egd.sourceforge.org][EGD]] [Unix] MISC :PROPERTIES: :CUSTOM_ID: egd :END: commit 187e982d9b7d088a8f0508dc84cca3baf2b7b15d Author: Werner Koch Date: Fri Jan 2 20:00:44 2015 +0100 web: Add a donors list for 2015. diff --git a/web/donate/kudos-2015.org b/web/donate/kudos-2015.org new file mode 100644 index 0000000..2f50c45 --- /dev/null +++ b/web/donate/kudos-2015.org @@ -0,0 +1,13 @@ +#+TITLE: GnuPG - List of Donors - 2015 +#+STARTUP: showall +#+SETUPFILE: "../share/setup.inc" + +* People who donated money to GnuPG in 2015 + +#+HTML:
    +#+HTML: +#+HTML:
  • [please reload in a few minutes while the list is being updated] +#+HTML: +#+HTML:
+ + Thank you. diff --git a/web/donate/kudos.org b/web/donate/kudos.org index e7cdeea..f6ad46c 100644 --- a/web/donate/kudos.org +++ b/web/donate/kudos.org @@ -13,6 +13,7 @@ Thank you. + - All donors to GnuPG in [[file:kudos-2015.org][2015]] - All donors to GnuPG in [[file:kudos-2014.org][2014]] - All donors to GnuPG in [[file:kudos-2013.org][2013]] - All donors to GnuPG in [[file:kudos-2012.org][2012]] @@ -50,8 +51,9 @@ Donations for the previous years: | 2011 | 21 | 553 | 465 | | 2012 | 53 | 5991 | 4963 | | 2013 | 148 | 5041 | 4145 | +| 2014 | 801 | 34700 | | |------+-----+-------+----------| -| | | 11585 | 9573 | +| | | 46285 | | #+TBLFM: $LR3=vsum(@I.. at II)::$LR4=vsum(@I.. at II) # In 2014 without the 32641.27 (27429.64) from the Goteo campaign commit 71de861ee508ad2472d38abb8574fdb709dbc2f5 Author: Werner Koch Date: Fri Jan 2 19:59:35 2015 +0100 tools: Remove trailing dot from mail addresses. sendmail does not grok them. diff --git a/tools/append-to-donors.sh b/tools/append-to-donors.sh index 492ab32..60ca80c 100755 --- a/tools/append-to-donors.sh +++ b/tools/append-to-donors.sh @@ -136,7 +136,7 @@ find $journal_dir -type f -name 'journal-????????.log' -print \ xmail amount currency euro rest; do name=$(echo "$name" | tr \`\$: ...) message=$(echo "$message" | tr \`\$ ..) - xmail=$(echo "$xmail" | tr \`\$ ..) + xmail=$(echo "$xmail" | tr \`\$ .. | sed 's/\.$//') # Note that we removed colons from $name echo "$jyear:$datestr:$name::$lnr:" >> "$donors.tmp" touch "$donors".stamp commit 8401a50feb2eddbd905530a9b9256fee78927fe5 Author: Werner Koch Date: Fri Jan 2 19:58:29 2015 +0100 tools: Small fix for the funding campaign results. diff --git a/tools/mkkudos.sh b/tools/mkkudos.sh index ee786f1..3dbcab8 100755 --- a/tools/mkkudos.sh +++ b/tools/mkkudos.sh @@ -77,10 +77,11 @@ monyear=$(echo "$tmp" | awk -F: 'BEGIN { m[1] = "January"; {printf "%s %d", m[$2] , $1}') euromo=$(echo "$tmp" | awk -F: '{printf "%d €", int($8 + 0.5)}') euroyr=$(echo "$tmp" | awk -F: '{printf "%d €", int($10 + 0.5)}') -euroyr_campaign=$(echo "$tmp" | awk -F: '{printf "%d", int($10 + 0.5)}') n=$(echo "$tmp" | awk -F: '{printf "%d", $7}') nyr=$(echo "$tmp" | awk -F: '{printf "%d", $9}') +euroyr_campaign=$(echo "$tmp" | awk -F: '$1=="2014"{printf "0"; next};{printf "%d", int($10 + 0.5)}') + # Campaign data goal="120000" tmp=$(grep '^2014:12:' "$donations") ----------------------------------------------------------------------- Summary of changes: tools/append-to-donors.sh | 2 +- tools/mkkudos.sh | 3 +- web/donate/{kudos-2011.org => kudos-2015.org} | 4 +- web/donate/kudos.org | 4 +- web/index.org | 92 +------------------------ web/news.org | 90 ++++++++++++++++++++++++ web/related_software/swlist.org | 2 +- 7 files changed, 100 insertions(+), 97 deletions(-) copy web/donate/{kudos-2011.org => kudos-2015.org} (73%) hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Sun Jan 4 14:58:46 2015 From: cvs at cvs.gnupg.org (by Jussi Kivilinna) Date: Sun, 04 Jan 2015 14:58:46 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-146-gd7c7453 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via d7c7453cf5e6b8f3c6b522a30e680f844a28c9de (commit) from 8eabecc883332156adffc1df42d27f614c157e06 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit d7c7453cf5e6b8f3c6b522a30e680f844a28c9de Author: Jussi Kivilinna Date: Fri Jan 2 19:07:24 2015 +0200 rmd160: restore native-endian store in _gcry_rmd160_mixblock * cipher/rmd160.c (_gcry_rmd160_mixblock): Store result to buffer in native-endianess. -- Commit 4515315f61fbf79413e150fbd1d5f5a2435f2bc5 unintendedly changed this native-endian store to little-endian. Reported-by: Yuriy Kaminskiy Signed-off-by: Jussi Kivilinna diff --git a/cipher/rmd160.c b/cipher/rmd160.c index 2b1f321..2695db2 100644 --- a/cipher/rmd160.c +++ b/cipher/rmd160.c @@ -403,15 +403,16 @@ transform ( void *c, const unsigned char *data, size_t nblks ) * Apply the rmd160 transform function on the buffer which must have * a length 64 bytes. Do not use this function together with the * other functions, use rmd160_init to initialize internal variables. - * Returns: 16 bytes in buffer with the mixed contentes of buffer. + * Buffer must be 32-bit aligned. + * Returns: 20 bytes in buffer with the mixed contents of buffer. */ void _gcry_rmd160_mixblock ( RMD160_CONTEXT *hd, void *blockof64byte ) { - char *p = blockof64byte; + u32 *p = blockof64byte; transform ( hd, blockof64byte, 1 ); -#define X(a) do { buf_put_le32(p, hd->h##a); p += 4; } while(0) +#define X(a) do { p[a] = hd->h##a; } while(0) X(0); X(1); X(2); ----------------------------------------------------------------------- Summary of changes: cipher/rmd160.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Sun Jan 4 17:19:57 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Sun, 04 Jan 2015 17:19:57 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-20-gac2cb47 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via ac2cb47fc5c0be539aaa07fd141acdbc0934800f (commit) via cf88337f8a4f8c98aca4b1da5921d18567b4f474 (commit) from d2d8481e3866124c143cac165dea8453001e2905 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ac2cb47fc5c0be539aaa07fd141acdbc0934800f Author: Werner Koch Date: Sun Jan 4 17:19:06 2015 +0100 agent: Make --allow-loopback-pinentry gpgconf changeable. diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c index 918c72b..fe310f4 100644 --- a/agent/gpg-agent.c +++ b/agent/gpg-agent.c @@ -205,7 +205,7 @@ static ARGPARSE_OPTS opts[] = { ARGPARSE_s_n (oAllowPresetPassphrase, "allow-preset-passphrase", /* */ N_("allow presetting passphrase")), ARGPARSE_s_n (oAllowLoopbackPinentry, "allow-loopback-pinentry", - N_("allow presetting passphrase")), + N_("allow caller to override the pinentry")), ARGPARSE_s_n (oSSHSupport, "enable-ssh-support", N_("enable ssh support")), ARGPARSE_s_n (oPuttySupport, "enable-putty-support", #ifdef HAVE_W32_SYSTEM @@ -1060,6 +1060,8 @@ main (int argc, char **argv ) #else es_printf ("enable-ssh-support:%lu:\n", GC_OPT_FLAG_NONE); #endif + es_printf ("allow-loopback-pinentry:%lu:\n", + GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME); agent_exit (0); } diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c index 61faa1d..86e67eb 100644 --- a/tools/gpgconf-comp.c +++ b/tools/gpgconf-comp.c @@ -542,6 +542,9 @@ static gc_option_t gc_options_gpg_agent[] = { "no-allow-mark-trusted", GC_OPT_FLAG_RUNTIME, GC_LEVEL_ADVANCED, "gnupg", "disallow clients to mark keys as \"trusted\"", GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT }, + { "allow-loopback-pinentry", GC_OPT_FLAG_RUNTIME, + GC_LEVEL_EXPERT, "gnupg", "allow caller to override the pinentry", + GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT }, { "no-grab", GC_OPT_FLAG_RUNTIME, GC_LEVEL_EXPERT, "gnupg", "do not grab keyboard and mouse", GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT }, commit cf88337f8a4f8c98aca4b1da5921d18567b4f474 Author: Joshua Rogers Date: Tue Dec 23 00:47:50 2014 +1100 tools: Free variable before return * tools/gpgconf-comp.c: Free 'dest_filename' before it is returned upon error. -- Signed-off-by: Joshua Rogers diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c index 8c47b2e..61faa1d 100644 --- a/tools/gpgconf-comp.c +++ b/tools/gpgconf-comp.c @@ -2508,7 +2508,10 @@ change_options_file (gc_component_t component, gc_backend_t backend, res = link (dest_filename, orig_filename); #endif if (res < 0 && errno != ENOENT) - return -1; + { + xfree (dest_filename); + return -1; + } if (res < 0) { xfree (orig_filename); ----------------------------------------------------------------------- Summary of changes: agent/gpg-agent.c | 4 +++- tools/gpgconf-comp.c | 8 +++++++- 2 files changed, 10 insertions(+), 2 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Jan 5 15:17:46 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 05 Jan 2015 15:17:46 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-24-g9bf4084 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 9bf40849a9f86204e113712c4cc285f1ac16127a (commit) via 616e511f278bf9af04dc66bbb8b05b37bf541f37 (commit) via 56e688823345bbcfef220b13eb418854f8798b16 (commit) via 445bb17d5fe6b53db078082fb033dbc67eea8307 (commit) from ac2cb47fc5c0be539aaa07fd141acdbc0934800f (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9bf40849a9f86204e113712c4cc285f1ac16127a Author: Werner Koch Date: Mon Jan 5 15:10:03 2015 +0100 sm,g13: Init local vars to avoid compiler warnings. * sm/misc.c (transform_sigval): Init RSA_S_LEN. * g13/mount.c (read_keyblob): Init HEADERLEN. -- Not a bug but the compiler (gcc 4.9.1) can't detect that it is not used uninitialized. Signed-off-by: Werner Koch diff --git a/g13/mount.c b/g13/mount.c index fc640e0..a9203d1 100644 --- a/g13/mount.c +++ b/g13/mount.c @@ -139,7 +139,8 @@ read_keyblob (const char *filename, { gpg_error_t err; estream_t fp = NULL; - size_t headerlen, msglen; + size_t headerlen = 0; + size_t msglen; void *msg = NULL; *r_enckeyblob = NULL; diff --git a/sm/misc.c b/sm/misc.c index ec9f97e..39897f4 100644 --- a/sm/misc.c +++ b/sm/misc.c @@ -112,7 +112,7 @@ transform_sigval (const unsigned char *sigval, size_t sigvallen, int mdalgo, int depth, last_depth1, last_depth2; int is_pubkey = 0; const unsigned char *rsa_s = NULL; - size_t rsa_s_len; + size_t rsa_s_len = 0; const char *oid; gcry_sexp_t sexp; commit 616e511f278bf9af04dc66bbb8b05b37bf541f37 Author: Werner Koch Date: Mon Jan 5 15:07:23 2015 +0100 gpg: Remove unused args from a function. * g10/keyserver.c (parse_keyserver_uri): Remove args configname and configlineno. Change all callers. Signed-off-by: Werner Koch diff --git a/g10/card-util.c b/g10/card-util.c index b030fad..4b584bf 100644 --- a/g10/card-util.c +++ b/g10/card-util.c @@ -754,7 +754,7 @@ fetch_url (ctrl_t ctrl) gpg_strerror(rc)); else if (info.pubkey_url && *info.pubkey_url) { - spec=parse_keyserver_uri(info.pubkey_url,1,NULL,0); + spec = parse_keyserver_uri (info.pubkey_url, 1); if(spec && info.fpr1valid) { /* This is not perfectly right. Currently, all card diff --git a/g10/getkey.c b/g10/getkey.c index 4a4dd55..f8cb869 100644 --- a/g10/getkey.c +++ b/g10/getkey.c @@ -2938,7 +2938,7 @@ parse_auto_key_locate (char *options) else if (ascii_strcasecmp (tok, "pka") == 0) akl->type = AKL_PKA; #endif - else if ((akl->spec = parse_keyserver_uri (tok, 1, NULL, 0))) + else if ((akl->spec = parse_keyserver_uri (tok, 1))) akl->type = AKL_SPEC; else { diff --git a/g10/gpg.c b/g10/gpg.c index 12fe7b2..73de511 100644 --- a/g10/gpg.c +++ b/g10/gpg.c @@ -2800,8 +2800,7 @@ main (int argc, char **argv) case oKeyServer: { keyserver_spec_t keyserver; - keyserver = parse_keyserver_uri (pargs.r.ret_str,0, - configname,configlineno); + keyserver = parse_keyserver_uri (pargs.r.ret_str, 0); if (!keyserver) log_error (_("could not parse keyserver URL\n")); else @@ -2990,8 +2989,7 @@ main (int argc, char **argv) case oDefaultKeyserverURL: { keyserver_spec_t keyserver; - keyserver = parse_keyserver_uri (pargs.r.ret_str,1, - configname,configlineno); + keyserver = parse_keyserver_uri (pargs.r.ret_str,1 ); if (!keyserver) log_error (_("could not parse keyserver URL\n")); else diff --git a/g10/keyedit.c b/g10/keyedit.c index a8e6f5d..e2da61b 100644 --- a/g10/keyedit.c +++ b/g10/keyedit.c @@ -4165,7 +4165,7 @@ menu_set_keyserver_url (const char *url, KBNODE pub_keyblock) { struct keyserver_spec *keyserver = NULL; /* Sanity check the format */ - keyserver = parse_keyserver_uri (answer, 1, NULL, 0); + keyserver = parse_keyserver_uri (answer, 1); xfree (answer); if (!keyserver) { diff --git a/g10/keygen.c b/g10/keygen.c index c25caad..fa466a8 100644 --- a/g10/keygen.c +++ b/g10/keygen.c @@ -3106,7 +3106,7 @@ proc_parameter_file( struct para_data_s *para, const char *fname, { struct keyserver_spec *spec; - spec=parse_keyserver_uri(s1,1,NULL,0); + spec = parse_keyserver_uri (s1, 1); if(spec) { free_keyserver_spec(spec); diff --git a/g10/keyserver-internal.h b/g10/keyserver-internal.h index 2b1b64e..a955fc7 100644 --- a/g10/keyserver-internal.h +++ b/g10/keyserver-internal.h @@ -28,10 +28,8 @@ int parse_keyserver_options(char *options); void free_keyserver_spec(struct keyserver_spec *keyserver); struct keyserver_spec *keyserver_match(struct keyserver_spec *spec); -struct keyserver_spec *parse_keyserver_uri(const char *string, - int require_scheme, - const char *configname, - unsigned int configlineno); +struct keyserver_spec *parse_keyserver_uri (const char *string, + int require_scheme); struct keyserver_spec *parse_preferred_keyserver(PKT_signature *sig); int keyserver_export (ctrl_t ctrl, strlist_t users); int keyserver_import (ctrl_t ctrl, strlist_t users); diff --git a/g10/keyserver.c b/g10/keyserver.c index a92544c..7d80756 100644 --- a/g10/keyserver.c +++ b/g10/keyserver.c @@ -258,8 +258,7 @@ keyserver_match(struct keyserver_spec *spec) keyserver/ksutil.c for limited use in gpgkeys_ldap or the like. */ keyserver_spec_t -parse_keyserver_uri (const char *string,int require_scheme, - const char *configname,unsigned int configlineno) +parse_keyserver_uri (const char *string,int require_scheme) { int assume_hkp=0; struct keyserver_spec *keyserver; @@ -481,7 +480,7 @@ parse_preferred_keyserver(PKT_signature *sig) memcpy(dupe,p,plen); dupe[plen]='\0'; - spec=parse_keyserver_uri(dupe,1,NULL,0); + spec = parse_keyserver_uri (dupe, 1); xfree(dupe); } @@ -1931,7 +1930,7 @@ keyserver_import_cert (ctrl_t ctrl, { struct keyserver_spec *spec; - spec=parse_keyserver_uri(url,1,NULL,0); + spec = parse_keyserver_uri (url, 1); if(spec) { err = keyserver_import_fprint (ctrl, *fpr,*fpr_len,spec); @@ -1977,7 +1976,7 @@ keyserver_import_pka (ctrl_t ctrl, { /* An URI is available. Lookup the key. */ struct keyserver_spec *spec; - spec = parse_keyserver_uri (uri, 1, NULL, 0); + spec = parse_keyserver_uri (uri, 1); if (spec) { rc = keyserver_import_fprint (ctrl, *fpr, 20, spec); diff --git a/g10/mainproc.c b/g10/mainproc.c index 03a13c5..a66a99d 100644 --- a/g10/mainproc.c +++ b/g10/mainproc.c @@ -1739,7 +1739,7 @@ check_sig_and_print (CTX c, kbnode_t node) int res; struct keyserver_spec *spec; - spec = parse_keyserver_uri (uri, 1, NULL, 0); + spec = parse_keyserver_uri (uri, 1); if (spec) { glo_ctrl.in_auto_key_retrieve++; commit 56e688823345bbcfef220b13eb418854f8798b16 Author: Werner Koch Date: Mon Jan 5 15:03:12 2015 +0100 gpg: Clear a possible rest of the KDF secret buffer. * g10/ecdh.c (pk_ecdh_encrypt_with_shared_point): Fix order of args. -- That bug has been here since the beginning. The entire function needs a review or be be moved to Libgcrypt. Signed-off-by: Werner Koch diff --git a/g10/ecdh.c b/g10/ecdh.c index 0b06239..07f3983 100644 --- a/g10/ecdh.c +++ b/g10/ecdh.c @@ -250,7 +250,7 @@ pk_ecdh_encrypt_with_shared_point (int is_encrypt, gcry_mpi_t shared_mpi, assert( secret_x_size <= gcry_md_get_algo_dlen (kdf_hash_algo) ); /* We could have allocated more, so clean the tail before returning. */ - memset( secret_x+secret_x_size, old_size-secret_x_size, 0 ); + memset (secret_x+secret_x_size, 0, old_size - secret_x_size); if (DBG_CIPHER) log_printhex ("ecdh KEK is:", secret_x, secret_x_size ); } commit 445bb17d5fe6b53db078082fb033dbc67eea8307 Author: Werner Koch Date: Mon Jan 5 14:55:36 2015 +0100 build: Require automake 1.14. * configure.ac (AM_INIT_AUTOMAKE): Add serial-tests. diff --git a/README.GIT b/README.GIT index ee2c638..57dab7a 100644 --- a/README.GIT +++ b/README.GIT @@ -17,8 +17,8 @@ variables to override the default tool names: AUTOMAKE_SUFFIX is used as a suffix for all tools from the automake package. For example - AUTOMAKE_SUFFIX="-1.7" ./autogen.sh - uses "automake-1.7" and "aclocal-1.7. + AUTOMAKE_SUFFIX="-1.14" ./autogen.sh + uses "automake-1.14" and "aclocal-1.14. AUTOMAKE_PREFIX is used as a prefix for all tools from the automake page and may be combined with AUTOMAKE_SUFFIX. e.g.: AUTOMAKE_PREFIX=/usr/foo/bin ./autogen.sh diff --git a/configure.ac b/configure.ac index 16843f4..30a639e 100644 --- a/configure.ac +++ b/configure.ac @@ -19,7 +19,7 @@ # Process this file with autoconf to produce a configure script. AC_PREREQ(2.61) -min_automake_version="1.10" +min_automake_version="1.14" # To build a release you need to create a tag with the version number # (git tag -s gnupg-2.n.m) and run "./autogen.sh --force". Please @@ -78,9 +78,7 @@ VERSION=$PACKAGE_VERSION AC_CONFIG_AUX_DIR([build-aux]) AC_CONFIG_SRCDIR([sm/gpgsm.c]) AC_CONFIG_HEADER([config.h]) -# Note: For automake 1.13 add the option -# serial-tests -AM_INIT_AUTOMAKE([dist-bzip2 no-dist-gzip]) +AM_INIT_AUTOMAKE([serial-tests dist-bzip2 no-dist-gzip]) AC_CANONICAL_HOST AB_INIT ----------------------------------------------------------------------- Summary of changes: README.GIT | 4 ++-- configure.ac | 6 ++---- g10/card-util.c | 2 +- g10/ecdh.c | 2 +- g10/getkey.c | 2 +- g10/gpg.c | 6 ++---- g10/keyedit.c | 2 +- g10/keygen.c | 2 +- g10/keyserver-internal.h | 6 ++---- g10/keyserver.c | 9 ++++----- g10/mainproc.c | 2 +- g13/mount.c | 3 ++- sm/misc.c | 2 +- 13 files changed, 21 insertions(+), 27 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Jan 5 17:53:43 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 05 Jan 2015 17:53:43 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-152-gdd5df19 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via dd5df198727ea5d8f6b04288e14fd732051453c8 (commit) via f65276970a6dcd6d9bca94cecc49b68acdcc9492 (commit) via 95a751d9cef2c6dfcd7358154bcdbbdf35e31a2e (commit) via 1a6d65ac0aab335541726d02f2046d883a768ec3 (commit) via c420c0fff5e3b5bdd9ef1a6a4a9b2e1da8301416 (commit) via 943ce27e6a13057c988c35c913dc6a3f56149591 (commit) from d7c7453cf5e6b8f3c6b522a30e680f844a28c9de (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit dd5df198727ea5d8f6b04288e14fd732051453c8 Author: Werner Koch Date: Mon Jan 5 17:47:26 2015 +0100 doc: Update yat2m to current upstream version (GnuPG). diff --git a/doc/yat2m.c b/doc/yat2m.c index 2ac4390..86c3c70 100644 --- a/doc/yat2m.c +++ b/doc/yat2m.c @@ -87,6 +87,10 @@ detects the number of white spaces in front of an @item and remove this number of spaces from all following lines until a new @item is found or there are less spaces than for the last @item. + + Note that @* does only work correctly if used at the end of an + input line. + */ #include @@ -136,6 +140,9 @@ typedef struct macro_s *macro_t; /* List of all defined macros. */ static macro_t macrolist; +/* List of variables set by @set. */ +static macro_t variablelist; + /* List of global macro names. The value part is not used. */ static macro_t predefinedmacrolist; @@ -375,8 +382,44 @@ set_macro (const char *macroname, char *macrovalue) } -/* Return true if the macro NAME is set, i.e. not the empty string and - not evaluating to 0. */ +/* Create or update a variable with name and value given in NAMEANDVALUE. */ +static void +set_variable (char *nameandvalue) +{ + macro_t m; + const char *value; + char *p; + + for (p = nameandvalue; *p && *p != ' ' && *p != '\t'; p++) + ; + if (!*p) + value = ""; + else + { + *p++ = 0; + while (*p == ' ' || *p == '\t') + p++; + value = p; + } + + for (m=variablelist; m; m = m->next) + if (!strcmp (m->name, nameandvalue)) + break; + if (m) + free (m->value); + else + { + m = xcalloc (1, sizeof *m + strlen (nameandvalue)); + strcpy (m->name, nameandvalue); + m->next = variablelist; + variablelist = m; + } + m->value = xstrdup (value); +} + + +/* Return true if the macro or variable NAME is set, i.e. not the + empty string and not evaluating to 0. */ static int macro_set_p (const char *name) { @@ -385,6 +428,10 @@ macro_set_p (const char *name) for (m = macrolist; m ; m = m->next) if (!strcmp (m->name, name)) break; + if (!m) + for (m = variablelist; m ; m = m->next) + if (!strcmp (m->name, name)) + break; if (!m || !m->value || !*m->value) return 0; if ((*m->value & 0x80) || !isdigit (*m->value)) @@ -609,6 +656,7 @@ write_th (FILE *fp) *p++ = 0; fprintf (fp, ".TH %s %s %s \"%s\" \"%s\"\n", name, p, isodatestring (), opt_release, opt_source); + free (name); return 0; } @@ -664,8 +712,11 @@ proc_texi_cmd (FILE *fp, const char *command, const char *rest, size_t len, { "table", 3 }, { "itemize", 3 }, { "bullet", 0, "* " }, + { "*", 0, "\n.br"}, + { "/", 0 }, { "end", 4 }, { "quotation",1, ".RS\n\\fB" }, + { "value", 8 }, { NULL } }; size_t n; @@ -741,11 +792,46 @@ proc_texi_cmd (FILE *fp, const char *command, const char *rest, size_t len, case 7: ignore_args = 1; break; + case 8: + ignore_args = 1; + if (*rest != '{') + { + err ("opening brace for command '%s' missing", command); + return len; + } + else + { + /* Find closing brace. */ + for (s=rest+1, n=1; *s && n < len; s++, n++) + if (*s == '}') + break; + if (*s != '}') + { + err ("closing brace for command '%s' not found", command); + return len; + } + else + { + size_t len = s - (rest + 1); + macro_t m; + + for (m = variablelist; m; m = m->next) + if (strlen (m->name) == len + &&!strncmp (m->name, rest+1, len)) + break; + if (m) + fputs (m->value, fp); + else + inf ("texinfo variable '%.*s' is not set", + (int)len, rest+1); + } + } + break; default: break; } } - else + else /* macro */ { macro_t m; @@ -1215,6 +1301,10 @@ parse_file (const char *fname, FILE *fp, char **section_name, int in_pause) macrovalue = xmalloc ((macrovaluesize = 1024)); macrovalueused = 0; } + else if (n == 4 && !memcmp (line, "@set", 4)) + { + set_variable (p); + } else if (n == 8 && !memcmp (line, "@manpage", 8)) { free (*section_name); @@ -1325,6 +1415,13 @@ top_parse_file (const char *fname, FILE *fp) free (macrolist); macrolist = next; } + while (variablelist) + { + macro_t next = variablelist->next; + free (variablelist->value); + free (variablelist); + variablelist = next; + } for (m=predefinedmacrolist; m; m = m->next) set_macro (m->name, xstrdup ("1")); cond_is_active = 1; commit f65276970a6dcd6d9bca94cecc49b68acdcc9492 Author: Werner Koch Date: Mon Jan 5 17:46:05 2015 +0100 build: Require automake 1.14. * configure.ac (AM_INIT_AUTOMAKE): Add serial-tests. Signed-off-by: Werner Koch diff --git a/configure.ac b/configure.ac index 71c50c0..161571a 100644 --- a/configure.ac +++ b/configure.ac @@ -21,7 +21,7 @@ # (Process this file with autoconf to produce a configure script.) AC_REVISION($Revision$) AC_PREREQ(2.60) -min_automake_version="1.10" +min_automake_version="1.14" # To build a release you need to create a tag with the version number # (git tag -s libgcrypt-n.m.k) and run "./autogen.sh --force". Please @@ -75,7 +75,7 @@ VERSION=$PACKAGE_VERSION AC_CONFIG_AUX_DIR([build-aux]) AC_CONFIG_SRCDIR([src/libgcrypt.vers]) -AM_INIT_AUTOMAKE([dist-bzip2]) +AM_INIT_AUTOMAKE([serial-tests dist-bzip2]) AC_CONFIG_HEADER(config.h) AC_CONFIG_MACRO_DIR([m4]) AC_CONFIG_LIBOBJ_DIR([compat]) commit 95a751d9cef2c6dfcd7358154bcdbbdf35e31a2e Author: Werner Koch Date: Mon Jan 5 17:16:04 2015 +0100 cipher: Add the original PD notice to rijndael-ssse3-amd64.c -- diff --git a/cipher/rijndael-ssse3-amd64.c b/cipher/rijndael-ssse3-amd64.c index 112ab22..d72ec31 100644 --- a/cipher/rijndael-ssse3-amd64.c +++ b/cipher/rijndael-ssse3-amd64.c @@ -15,6 +15,23 @@ * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . + * + * + * The code is based on the public domain library libvpaes version 0.5 + * available at http://crypto.stanford.edu/vpaes/ and which carries + * this notice: + * + * libvpaes: constant-time SSSE3 AES encryption and decryption. + * version 0.5 + * + * By Mike Hamburg, Stanford University, 2009. Public domain. + * I wrote essentially all of this code. I did not write the test + * vectors; they are the NIST known answer tests. I hereby release all + * the code and documentation here that I wrote into the public domain. + * + * This is an implementation of AES following my paper, + * "Accelerating AES with Vector Permute Instructions" + * CHES 2009; http://shiftleft.org/papers/vector_aes/ */ #include @@ -36,7 +53,7 @@ /* Two macros to be called prior and after the use of SSSE3 instructions. There should be no external function calls between the use of these macros. There purpose is to make sure that the - SSE regsiters are cleared and won't reveal any information about + SSE registers are cleared and won't reveal any information about the key or the data. */ #define vpaes_ssse3_prepare_enc(const_ptr) \ asm volatile ("lea .Laes_consts(%%rip), %q0 \n\t" \ commit 1a6d65ac0aab335541726d02f2046d883a768ec3 Author: Werner Koch Date: Mon Jan 5 17:04:10 2015 +0100 Replace camel case of internal scrypt functions. * cipher/scrypt.c (_salsa20_core): Rename to salsa20_core. Change callers. (_scryptBlockMix): Rename to scrypt_block_mix. Change callers. (_scryptROMix): Rename to scrypt_ro_mix. Change callers. -- Signed-off-by: Werner Koch diff --git a/cipher/scrypt.c b/cipher/scrypt.c index aca903d..3c21c2a 100644 --- a/cipher/scrypt.c +++ b/cipher/scrypt.c @@ -76,7 +76,7 @@ static void -_salsa20_core(u32 *dst, const u32 *src, unsigned rounds) +salsa20_core (u32 *dst, const u32 *src, unsigned int rounds) { u32 x[SALSA20_INPUT_LENGTH]; unsigned i; @@ -108,7 +108,7 @@ _salsa20_core(u32 *dst, const u32 *src, unsigned rounds) static void -_scryptBlockMix (u32 r, unsigned char *B, unsigned char *tmp2) +scrypt_block_mix (u32 r, unsigned char *B, unsigned char *tmp2) { u64 i; unsigned char *X = tmp2; @@ -142,7 +142,7 @@ _scryptBlockMix (u32 r, unsigned char *B, unsigned char *tmp2) buf_xor(X, X, &B[i * 64], 64); /* X = Salsa (T) */ - _salsa20_core ((u32*)(void*)X, (u32*)(void*)X, 8); + salsa20_core ((u32*)(void*)X, (u32*)(void*)X, 8); /* Y[i] = X */ memcpy (&Y[i * 64], X, 64); @@ -173,8 +173,9 @@ _scryptBlockMix (u32 r, unsigned char *B, unsigned char *tmp2) #endif } + static void -_scryptROMix (u32 r, unsigned char *B, u64 N, +scrypt_ro_mix (u32 r, unsigned char *B, u64 N, unsigned char *tmp1, unsigned char *tmp2) { unsigned char *X = B, *T = B; @@ -201,7 +202,7 @@ _scryptROMix (u32 r, unsigned char *B, u64 N, memcpy (&tmp1[i * 128 * r], X, 128 * r); /* X = ScryptBlockMix (X) */ - _scryptBlockMix (r, X, tmp2); + scrypt_block_mix (r, X, tmp2); } /* for i = 0 to N - 1 do */ @@ -216,7 +217,7 @@ _scryptROMix (u32 r, unsigned char *B, u64 N, buf_xor (T, T, &tmp1[j * 128 * r], 128 * r); /* X = scryptBlockMix (T) */ - _scryptBlockMix (r, T, tmp2); + scrypt_block_mix (r, T, tmp2); } #if 0 @@ -234,7 +235,9 @@ _scryptROMix (u32 r, unsigned char *B, u64 N, #endif } -/** + +/* + * */ gcry_err_code_t _gcry_kdf_scrypt (const unsigned char *passwd, size_t passwdlen, @@ -306,7 +309,7 @@ _gcry_kdf_scrypt (const unsigned char *passwd, size_t passwdlen, 1 /* iterations */, p * r128, B); for (i = 0; !ec && i < p; i++) - _scryptROMix (r, &B[i * r128], N, tmp1, tmp2); + scrypt_ro_mix (r, &B[i * r128], N, tmp1, tmp2); for (i = 0; !ec && i < p; i++) ec = _gcry_kdf_pkdf2 (passwd, passwdlen, GCRY_MD_SHA256, B, p * r128, commit c420c0fff5e3b5bdd9ef1a6a4a9b2e1da8301416 Author: Werner Koch Date: Sun Dec 28 14:26:48 2014 +0100 doc: State that gcry_md_write et al may be used after md_read. -- diff --git a/cipher/hash-common.c b/cipher/hash-common.c index ed63a0b..9a007e1 100644 --- a/cipher/hash-common.c +++ b/cipher/hash-common.c @@ -95,7 +95,10 @@ _gcry_hash_selftest_check_one (int algo, /* Common function to write a chunk of data to the transform function of a hash algorithm. Note that the use of the term "block" does - not imply a fixed size block. */ + not imply a fixed size block. Note that we explicitly allow to use + this function after the context has been finalized; the result does + not have any meaning but writing after finalize is sometimes + helpful to mitigate timing attacks. */ void _gcry_md_block_write (void *context, const void *inbuf_arg, size_t inlen) { diff --git a/cipher/md.c b/cipher/md.c index f9414de..9fef555 100644 --- a/cipher/md.c +++ b/cipher/md.c @@ -642,6 +642,9 @@ md_write (gcry_md_hd_t a, const void *inbuf, size_t inlen) } +/* Note that this function may be used after finalize and read to keep + on writing to the transform function so to mitigate timing + attacks. */ void _gcry_md_write (gcry_md_hd_t hd, const void *inbuf, size_t inlen) { diff --git a/doc/gcrypt.texi b/doc/gcrypt.texi index be5f805..30acd2f 100644 --- a/doc/gcrypt.texi +++ b/doc/gcrypt.texi @@ -3233,7 +3233,11 @@ by just one character. Both methods can be used on the same hash context. Pass @var{length} bytes of the data in @var{buffer} to the digest object with handle @var{h} to update the digest values. This -function should be used for large blocks of data. +function should be used for large blocks of data. If this function is +used after the context has been finalized, it will keep on pushing +the data through the algorithm specific transform function and change +the context; however the results are not meaningful and this feature +is only available to mitigate timing attacks. @end deftypefun @deftypefun void gcry_md_putc (gcry_md_hd_t @var{h}, int @var{c}) @@ -3253,7 +3257,9 @@ message digest or some padding. Finalize the message digest calculation. This is not really needed because @code{gcry_md_read} does this implicitly. After this has been done no further updates (by means of @code{gcry_md_write} or - at code{gcry_md_putc} are allowed. Only the first call to this function + at code{gcry_md_putc} should be done; However, to mitigate timing +attacks it is sometimes useful to keep on updating the context after +having stored away the actual digest. Only the first call to this function has an effect. It is implemented as a macro. @end deftypefun @@ -3266,8 +3272,9 @@ function: calculation. This function may be used as often as required but it will always return the same value for one handle. The returned message digest is allocated within the message context and therefore valid until the -handle is released or reseted (using @code{gcry_md_close} or - at code{gcry_md_reset}. @var{algo} may be given as 0 to return the only +handle is released or reset-ed (using @code{gcry_md_close} or + at code{gcry_md_reset} or it has been updated as a mitigation measure +against timing attacks. @var{algo} may be given as 0 to return the only enabled message digest or it may specify one of the enabled algorithms. The function does return @code{NULL} if the requested algorithm has not been enabled. @@ -3680,10 +3687,13 @@ see how it is actually done. @deftypefun gcry_error_t gcry_mac_write (gcry_mac_hd_t @var{h}, const void *@var{buffer}, size_t @var{length}) Pass @var{length} bytes of the data in @var{buffer} to the MAC object -with handle @var{h} to update the MAC values. +with handle @var{h} to update the MAC values. If this function is +used after the context has been finalized, it will keep on pushing the +data through the algorithm specific transform function and thereby +change the context; however the results are not meaningful and this +feature is only available to mitigate timing attacks. @end deftypefun - The way to read out the calculated MAC is by using the function: @deftypefun gcry_error_t gcry_mac_read (gcry_mac_hd_t @var{h}, void *@var{buffer}, size_t *@var{length}) @@ -3694,7 +3704,6 @@ Function copies the resulting MAC value to @var{buffer} of the length then length of MAC is returned through @var{length}. @end deftypefun - To compare existing MAC value with recalculated MAC, one is to use the function: @deftypefun gcry_error_t gcry_mac_verify (gcry_mac_hd_t @var{h}, void *@var{buffer}, size_t @var{length}) commit 943ce27e6a13057c988c35c913dc6a3f56149591 Author: Werner Koch Date: Fri Dec 19 09:11:08 2014 +0100 doc: typo fix -- GnuPG-bug-id: 1589 diff --git a/doc/gcrypt.texi b/doc/gcrypt.texi index 108d53a..be5f805 100644 --- a/doc/gcrypt.texi +++ b/doc/gcrypt.texi @@ -3414,7 +3414,7 @@ hashed can be written to files on request. @deftypefun void gcry_md_debug (gcry_md_hd_t @var{h}, const char *@var{suffix}) Enable debugging for the digest object with handle @var{h}. This -creates create files named @file{dbgmd-.} while doing the +creates files named @file{dbgmd-.} while doing the actual hashing. @var{suffix} is the string part in the filename. The number is a counter incremented for each new hashing. The data in the file is the raw data as passed to @code{gcry_md_write} or ----------------------------------------------------------------------- Summary of changes: cipher/hash-common.c | 5 +- cipher/md.c | 3 ++ cipher/rijndael-ssse3-amd64.c | 19 +++++++- cipher/scrypt.c | 19 ++++---- configure.ac | 4 +- doc/gcrypt.texi | 25 ++++++---- doc/yat2m.c | 103 +++++++++++++++++++++++++++++++++++++++-- 7 files changed, 155 insertions(+), 23 deletions(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Mon Jan 5 18:59:03 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 05 Jan 2015 18:59:03 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-153-g8c5eee5 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via 8c5eee51d9a25b143e41ffb7ff4a6b2a29b82d83 (commit) from dd5df198727ea5d8f6b04288e14fd732051453c8 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 8c5eee51d9a25b143e41ffb7ff4a6b2a29b82d83 Author: Werner Koch Date: Mon Jan 5 18:58:39 2015 +0100 primegen: Fix memory leak for invalid call sequences. * cipher/primegen.c (prime_generate_internal): Refactor generator code to not leak memory for non-implemented feature. (_gcry_prime_group_generator): Refactor to not leak memory for invalid args. Also make sure that R_G is set as soon as possible. -- GnuPG-bug-id: 1705 Signed-off-by: Werner Koch diff --git a/cipher/primegen.c b/cipher/primegen.c index ce6db8d..2a702a7 100644 --- a/cipher/primegen.c +++ b/cipher/primegen.c @@ -622,47 +622,44 @@ prime_generate_internal (int need_q_factor, } } - if (g) + if (g && need_q_factor) + err = GPG_ERR_NOT_IMPLEMENTED; + else if (g) { /* Create a generator (start with 3). */ gcry_mpi_t tmp = mpi_alloc (mpi_get_nlimbs (prime)); gcry_mpi_t b = mpi_alloc (mpi_get_nlimbs (prime)); gcry_mpi_t pmin1 = mpi_alloc (mpi_get_nlimbs (prime)); - if (need_q_factor) - err = GPG_ERR_NOT_IMPLEMENTED; - else + factors[n] = q; + factors[n + 1] = mpi_alloc_set_ui (2); + mpi_sub_ui (pmin1, prime, 1); + mpi_set_ui (g, 2); + do { - factors[n] = q; - factors[n + 1] = mpi_alloc_set_ui (2); - mpi_sub_ui (pmin1, prime, 1); - mpi_set_ui (g, 2); - do + mpi_add_ui (g, g, 1); + if (DBG_CIPHER) + log_printmpi ("checking g", g); + else + progress('^'); + for (i = 0; i < n + 2; i++) { - mpi_add_ui (g, g, 1); - if (DBG_CIPHER) - log_printmpi ("checking g", g); - else - progress('^'); - for (i = 0; i < n + 2; i++) - { - mpi_fdiv_q (tmp, pmin1, factors[i]); - /* No mpi_pow(), but it is okay to use this with mod - prime. */ - mpi_powm (b, g, tmp, prime); - if (! mpi_cmp_ui (b, 1)) - break; - } - if (DBG_CIPHER) - progress('\n'); + mpi_fdiv_q (tmp, pmin1, factors[i]); + /* No mpi_pow(), but it is okay to use this with mod + prime. */ + mpi_powm (b, g, tmp, prime); + if (! mpi_cmp_ui (b, 1)) + break; } - while (i < n + 2); - - mpi_free (factors[n+1]); - mpi_free (tmp); - mpi_free (b); - mpi_free (pmin1); + if (DBG_CIPHER) + progress('\n'); } + while (i < n + 2); + + mpi_free (factors[n+1]); + mpi_free (tmp); + mpi_free (b); + mpi_free (pmin1); } if (! DBG_CIPHER) @@ -1194,22 +1191,25 @@ _gcry_prime_group_generator (gcry_mpi_t *r_g, gcry_mpi_t prime, gcry_mpi_t *factors, gcry_mpi_t start_g) { - gcry_mpi_t tmp = mpi_new (0); - gcry_mpi_t b = mpi_new (0); - gcry_mpi_t pmin1 = mpi_new (0); - gcry_mpi_t g = start_g? mpi_copy (start_g) : mpi_set_ui (NULL, 3); - int first = 1; - int i, n; - - if (!factors || !r_g || !prime) + gcry_mpi_t tmp, b, pmin1, g; + int first, i, n; + + if (!r_g) return GPG_ERR_INV_ARG; *r_g = NULL; + if (!factors || !prime) + return GPG_ERR_INV_ARG; for (n=0; factors[n]; n++) ; if (n < 2) return GPG_ERR_INV_ARG; + tmp = mpi_new (0); + b = mpi_new (0); + pmin1 = mpi_new (0); + g = start_g? mpi_copy (start_g) : mpi_set_ui (NULL, 3); + /* Extra sanity check - usually disabled. */ /* mpi_set (tmp, factors[0]); */ /* for(i = 1; i < n; i++) */ @@ -1219,6 +1219,7 @@ _gcry_prime_group_generator (gcry_mpi_t *r_g, /* return gpg_error (GPG_ERR_INV_ARG); */ mpi_sub_ui (pmin1, prime, 1); + first = 1; do { if (first) ----------------------------------------------------------------------- Summary of changes: cipher/primegen.c | 79 +++++++++++++++++++++++++++-------------------------- 1 file changed, 40 insertions(+), 39 deletions(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Mon Jan 5 19:39:01 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 05 Jan 2015 19:39:01 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-154-g8174723 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via 817472358a093438e802380caecf7139406400cf (commit) from 8c5eee51d9a25b143e41ffb7ff4a6b2a29b82d83 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 817472358a093438e802380caecf7139406400cf Author: Werner Koch Date: Mon Jan 5 19:38:29 2015 +0100 random: Silent warning under NetBSD using rndunix * random/rndunix.c (STDERR_FILENO): Define if needed. (start_gatherer): Re-open standard descriptors. Fix an unsigned/signed pointer warning. -- GnuPG-bug-id: 1702 diff --git a/configure.ac b/configure.ac index 161571a..4cfebe7 100644 --- a/configure.ac +++ b/configure.ac @@ -2184,11 +2184,10 @@ cat < sizeof(msg.data)? sizeof(msg.data) : nbytes; memcpy( msg.data, p, msg.ndata ); ----------------------------------------------------------------------- Summary of changes: configure.ac | 7 +++---- random/rndunix.c | 19 ++++++++++++++++++- 2 files changed, 21 insertions(+), 5 deletions(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Tue Jan 6 14:51:45 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Tue, 06 Jan 2015 14:51:45 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-155-ge6996fe Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via e6996fe55685f8042a846b465e0d0c097d615086 (commit) from 817472358a093438e802380caecf7139406400cf (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit e6996fe55685f8042a846b465e0d0c097d615086 Author: Werner Koch Date: Tue Jan 6 14:51:39 2015 +0100 build: Add a commit-msg git-hook script. -- This is the same script as used by GnuPG. It makes sure that lines are not too long and checks some other basic things. ./autogen.sh installs it. diff --git a/build-aux/git-hooks/commit-msg b/build-aux/git-hooks/commit-msg new file mode 100755 index 0000000..5a697c7 --- /dev/null +++ b/build-aux/git-hooks/commit-msg @@ -0,0 +1,127 @@ +eval '(exit $?0)' && eval 'exec perl -w "$0" ${1+"$@"}' + & eval 'exec perl -w "$0" $argv:q' + if 0; + +# An hook script to check the commit log message. +# Called by "git commit" with one argument, the name of the file +# that has the commit message. The hook should exit with non-zero +# status after issuing an appropriate message if it wants to stop the +# commit. The hook is allowed to edit the commit message file. +# +# To enable this hook, copy it to "~/.git/hooks/commit-msg". +# +# This script is based on the one from GNU coreutils. + +use strict; +use warnings; +(my $ME = $0) =~ s|.*/||; + +my $editor = $ENV{EDITOR} || 'vi'; +$ENV{PATH} = '/bin:/usr/bin'; + +# Rewrite the $LOG_FILE (old contents in @$LINE_REF) with an additional +# commented diagnostic "# $ERR" line at the top. +sub rewrite($$$) +{ + my ($log_file, $err, $line_ref) = @_; + local *LOG; + open LOG, '>', $log_file + or die "$ME: $log_file: failed to open for writing: $!"; + print LOG "# $err"; + print LOG @$line_ref; + close LOG + or die "$ME: $log_file: failed to rewrite: $!\n"; +} + +sub re_edit($) +{ + my ($log_file) = @_; + + warn "Interrupt (Ctrl-C) to abort...\n"; + + system 'sh', '-c', "$editor $log_file"; + ($? & 127) || ($? >> 8) + and die "$ME: $log_file: the editor ($editor) failed, aborting\n"; +} + +# Given a $LOG_FILE name and a \@LINE buffer, +# read the contents of the file into the buffer and analyze it. +# If the log message passes muster, return the empty string. +# If not, return a diagnostic. +sub check_msg($$) +{ + my ($log_file, $line_ref) = @_; + + local *LOG; + open LOG, '<', $log_file + or return "failed to open for reading: $!"; + @$line_ref = ; + close LOG; + + my @line = @$line_ref; + chomp @line; + + # Don't filter out blank or comment lines; git does that already, + # and if we were to ignore them here, it could lead to committing + # with lines that start with "#" in the log. + + # Filter out leading blank and comment lines. + # while (@line && $line[0] =~ /^(?:#.*|[ \t]*)$/) { shift @line; } + + # Filter out blank and comment lines at EOF. + # while (@line && $line[$#line] =~ /^(?:#.*|[ \t]*)$/) { pop @line; } + + @line == 0 + and return 'no log message'; + + # The first line should not be too short + 8 < length $line[0] || return 'summary line too short'; + + # The first line should not start with an asterisk or a hash sign. + # An asterisk might indicate that a change entry was started right + # at the first line. + $line[0] =~ /^[*#]/ && return "summary line starts with an * or #"; + + # Second line should be blank or not present. + 2 <= @line && length $line[1] + and return 'second line must be empty'; + + # Limit line length to allow for the ChangeLog's leading TAB. + foreach my $line (@line) + { + 72 < length $line && $line =~ /^[^#]/ + and return 'line longer than 72 characters'; + } + + return ''; +} + +{ + @ARGV == 1 + or die; + + my $log_file = $ARGV[0]; + + while (1) + { + my @line; + my $err = check_msg $log_file, \@line; + $err eq '' + and last; + $err = "$ME: $err\n"; + warn $err; + exit 1; + + # Insert the diagnostic as a comment on the first line of $log_file. + #rewrite $log_file, $err, \@line; + #re_edit $log_file; + # + ## Stop if our parent is killed. + #getppid() == 1 + # and last; + } +} + +# Local Variables: +# mode: perl +# End: ----------------------------------------------------------------------- Summary of changes: build-aux/git-hooks/commit-msg | 127 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 127 insertions(+) create mode 100755 build-aux/git-hooks/commit-msg hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Tue Jan 6 15:04:33 2015 From: cvs at cvs.gnupg.org (by Dmitry Eremin-Solenikov) Date: Tue, 06 Jan 2015 15:04:33 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-157-ge4de523 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via e4de52378a85cf383994ded8edf0d5cf98dcb10c (commit) via 05dc5bcd234909ae9c9366b653346076b9a834ed (commit) from e6996fe55685f8042a846b465e0d0c097d615086 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit e4de52378a85cf383994ded8edf0d5cf98dcb10c Author: Dmitry Eremin-Solenikov Date: Sun Dec 28 12:15:33 2014 +0300 stribog: Reduce table size to the needed one. * cipher/stribog.c (C16): Avoid allocating superfluous space. -- Signed-off-by: Dmitry Eremin-Solenikov diff --git a/cipher/stribog.c b/cipher/stribog.c index 942bbf4..de167a7 100644 --- a/cipher/stribog.c +++ b/cipher/stribog.c @@ -1080,7 +1080,7 @@ static const u64 stribog_table[8][256] = U64_C(0x72d14d3493b2e388), U64_C(0xd6a30f258c153427) }, }; -static const u64 C16[13][16] = +static const u64 C16[12][8] = { { U64_C(0xdd806559f2a64507), U64_C(0x05767436cc744d23), U64_C(0xa2422a08a460d315), U64_C(0x4b7ce09192676901), commit 05dc5bcd234909ae9c9366b653346076b9a834ed Author: Dmitry Eremin-Solenikov Date: Sun Dec 28 12:05:43 2014 +0300 gostr3411-94: Fix the iteration count for length filling loop. * cipher/gostr3411-94.c (gost3411_final): Fix loop -- The maximum iteration count for filling the l (bit length) array was incrrectly set to 32 (missed that in u8->u32 refactoring). This was not resulting in stack corruption, since nblocks variable would be exausted earlier compared to 8 32-bit values (the size of the array). Signed-off-by: Dmitry Eremin-Solenikov diff --git a/cipher/gostr3411-94.c b/cipher/gostr3411-94.c index 91e5b4c..7b16e61 100644 --- a/cipher/gostr3411-94.c +++ b/cipher/gostr3411-94.c @@ -307,7 +307,7 @@ gost3411_final (void *context) l[0] |= nblocks << 8; nblocks >>= 24; - for (i = 1; i < 32 && nblocks != 0; i++) + for (i = 1; i < 8 && nblocks != 0; i++) { l[i] = nblocks; nblocks >>= 24; ----------------------------------------------------------------------- Summary of changes: cipher/gostr3411-94.c | 2 +- cipher/stribog.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Tue Jan 6 20:32:52 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Tue, 06 Jan 2015 20:32:52 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-159-g4f7dcdc Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via 4f7dcdc25af269b12275126edeef30b262fb891d (commit) via c33277d2da321df04db1988ed6758a1350025634 (commit) from e4de52378a85cf383994ded8edf0d5cf98dcb10c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 4f7dcdc25af269b12275126edeef30b262fb891d Author: Werner Koch Date: Tue Jan 6 20:30:37 2015 +0100 Make make distcheck work again. * Makefile.am (DISTCHECK_CONFIGURE_FLAGS): Remove --enable-ciphers. * cipher/Makefile.am (DISTCLEANFILES): Add gost-sb.h. diff --git a/Makefile.am b/Makefile.am index 2d7ca43..4c2c509 100644 --- a/Makefile.am +++ b/Makefile.am @@ -18,8 +18,7 @@ # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA ACLOCAL_AMFLAGS = -I m4 -DISTCHECK_CONFIGURE_FLAGS = --disable-random-daemon --enable-doc \ - --enable-ciphers=arcfour:blowfish:cast5:des:aes:twofish:serpent:rfc2268:seed:camellia +DISTCHECK_CONFIGURE_FLAGS = --disable-random-daemon --enable-doc # (A suitable gitlog-to-changelog script can be found in GnuPG master.) GITLOG_TO_CHANGELOG=gitlog-to-changelog diff --git a/cipher/Makefile.am b/cipher/Makefile.am index e59bafc..ceb95f1 100644 --- a/cipher/Makefile.am +++ b/cipher/Makefile.am @@ -26,6 +26,8 @@ AM_CFLAGS = $(GPG_ERROR_CFLAGS) AM_CCASFLAGS = $(NOEXECSTACK_FLAGS) +DISTCLEANFILES = gost-sb.h + noinst_LTLIBRARIES = libcipher.la commit c33277d2da321df04db1988ed6758a1350025634 Author: Werner Koch Date: Tue Jan 6 18:54:24 2015 +0100 Remove the old Manifest files -- The Manifest file have been part of an experiment a long time ago to implement source level integrity. I is not maintained for more than a decade and with the advent of git this is superfluous anyway. diff --git a/cipher/Makefile.am b/cipher/Makefile.am index 7dd626c..e59bafc 100644 --- a/cipher/Makefile.am +++ b/cipher/Makefile.am @@ -19,8 +19,6 @@ # Process this file with automake to produce Makefile.in -EXTRA_DIST = Manifest - # Need to include ../src in addition to top_srcdir because gcrypt.h is # a built header. AM_CPPFLAGS = -I../src -I$(top_srcdir)/src diff --git a/cipher/Manifest b/cipher/Manifest deleted file mode 100644 index 0cd64f7..0000000 --- a/cipher/Manifest +++ /dev/null @@ -1,73 +0,0 @@ -# Manifest - checksums of the cipher directory -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser general Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -# Checksums for all source files in this directory. Format is -# filename, blanks, base-64 part of an OpenPGP detached signature -# without the header lines. Blank lines and lines beginning with a -# hash mark are ignored. A tool to process this file is available by -# cvs -d :pserver:anoncvs at cvs.gnupg.org:/cvs/wk co misc-scripts/manifest-tool -# -# The special entry "$names$" holds a signature over all sorted -# filenames excluding itself. - - -# Algorithm API -cipher.c iQCVAwUAQDzrVjEAnp832S/7AQIPDgP+OVJ/YNWY5m7c09EBbPAzL/WsGoj6wrBNMmkRlMOqTHeh+OOtjuFHt1f9uhfM2Nzl7sJ5+h4ryZKLEZmQPRMTZTnAqkvGdsrJWJnigUA9QwYdV0ONqC9C63gpuG465gO9TZVOqlQu/FTxSRuTQYUulkaBNG71n8nZEOusBVwV2YA==58xH -pubkey.c iQCVAwUAP9XQ3jEAnp832S/7AQJ5UgQAyHfEBvPVJ8wTRg8c7ixS2GiVmIgwIo5tvQaiQJTPWASevvYrB+2Z2qa9cATyu50ACjLzbaquGBgPzjJV3dU/qttT1gCqRuN/LCNvXFe5qnIZezejc3RAadFNTw/pOTHq0wxD1Keg66ruei9R36Nba59pEQIWIBXTfubRft2hMYk==E09t -ac.c iQCVAwUAQDzsOzEAnp832S/7AQJCBQP/WI6EV/dsR4rmha6RVhvkjZo17kQ8z6pIl5J3cXOvqEkIFeD2HYu3HHrWST5l7yXlffhpDkVHkfMih4ruK76q6Fm0dxZ98pO4C/dVtgimlvvcy/wOQjpzsE0fYAe1BYdg81LJ09X33vW5x6C29lunfKROO2tPlV5i8ffeoFvmMF8==j26g -md.c iQCVAwUAP+NFGjEAnp832S/7AQJs8wP/Qdk0EAKsyr3O1/pmOSN8AG4rPKbd6KDTzvoBPAN4upFwKYY4hWwvy12Q3YU9DmECrzZkRCXHR7mljVQKs6B7CRZJKjFKmOELpcJDtKvu40vTs1bOH4k9iJYZpGgRA83nkQ+ELAcphAbCA+KIpVr2K4mCJAB0FhpC2uOQ50JHAko==BeF6 -primegen.c iQCVAwUAQDzsoDEAnp832S/7AQKYRwP/TqAQBm1rHTnF0HYE05PqXfWlOqa6EosqVpaOcs/OIW6PaqX0xH1UlrukK7jNOjK3xC4o1qNQ1UKzz2dvQaq1bMvNNizeavxAh10SJZc0hIc/ofc83IbjLh8SZVWQ67JxjsUd3DOXmSmhPZ+Pqd7cUIiw8fDoF+I9EZqy3COu1wY==1ebT - -# Algorithm implementations -arcfour.c iQCVAwUAP9XR/TEAnp832S/7AQJcRwP6AlvYEx++fpT4mIYo0xRDqKEQeqMQvbaRhIg2eV74JxItpHa3q5YsYIl+n1yUz5g35JRWWXSWmAZBwO5wLKsHii4kRUhgrKWnSoQZoPpl49L5+N3R58ON3S0ru5lsBiEJEze3xplf2vqwrH9v1QHVD+gU7UTlfNqrIJoOUXN+1O4==Tq+x -blowfish.c iQCVAwUAP9XTETEAnp832S/7AQJaEgQAgiqqfuO+zQtscgTB0rvOzVymIKjRKjYhFuLjVuc79G4z1RCAffvIn/YM2d7kt+Z/QF7zjcTAOgETCQL1XokpX2zz9HPAMi2tlDY5zsDufTNqj0n4WBL9nM7w6XAvsiwP1B3bqCTv9SjJV4KbxJ58vw1yQE+sqW74R/QIHFvC7mU==wZnX -cast5.c iQCVAwUAP9XT6DEAnp832S/7AQJ3xgP/ehLjEN3GELGudbqeo91Xd+PqitHrkuBbtRIYX7Udd/fyXLN+h8rMJVyIQX2m+mpxbBxudVU3x8/DNT8B0ZHAwK6qqJmEBLLhEYPgIuF76i9LMrP1KqUPhAwRZ2OppjIIugBQ+rP74aD4eLyd/aKQHNuXML8QGWR6KwQShohXM5I==/BRh -crc.c iQCVAwUAP7ouejEAnp832S/7AQIgwQQApg5Nm63tH5DQkbN+zPzMO9Ygoj3ukxfFTyTBPYSXYKMiTjEbESegaU40uN8jnz2vprcIQWcgZfzO4+opEJMcI35aPwzEk0vKOp0S/PrBLUY2rJfnDVkX5XgJFZa2Q7LLe826UEBzTVYW924utiCCe8oOaOEWVNpg1mqdknu3M9o==kz5D -des.c iQCVAwUAQCN2oDEAnp832S/7AQL/jwP6Auoq6nZCDBjpgc9tDzuIRwa9DqyuM3gX94uvgEpUwdHszb2bG43dz03kVmcYxtj1MzXbyCeCZOwox0b2SKmLgxIbrNP6yGbzVdTj6592gDYuf/ZXmc1ZNJ1DDldcPQ0n9fXUipUPwyPaNWo3mSZaNcMKSWWzdK0J6ciG6nk7SWI==9k/t -dsa.c iQCVAwUAP9XZHDEAnp832S/7AQLBRgP/XrBzTEYx5ccMj1MMb6sg37liEHdIyyy49zjvt6jUqxj4RuwVEN8S6v3u4q/QyJkHAi1E0EkREgENlyHW6PKWhYbcrd0vPIAN15yjnl2yqtrCrJImexUCoqJJewK0E4JOicGbabTil8MZjk+mbhEPnjJBqOkyP1w0i31pEDgE/8M==pC8s -elgamal.c iQCVAwUAP9XbYzEAnp832S/7AQLXagQA3HrvspZfbTGgmUH0IqLQTJ0exUPxJv5DET2TvoIy62trDmMN6lTAj5P+a7jQ8udcu0w+mR2vXUHcxUpNA2PxLaMwGzNSY4zRDNe9r3SFTDrFm6m4y9Ko2e8XtEA+WF6P/XLpck4Jn7vMEDmVGPwkNd22kXFFE8dBGwG6i5Hk1Mk==oBUs -md4.c iQCVAwUAP9h50DEAnp832S/7AQJhHgQAzNA/B6MWFDlCtPkIVaW8RpP1Eg0ZNMsy0s7SJkopOCBlu6CwXUOKe+8ppcSxhjYKh4i4uQr/QtfipYlBjzKJGnrafoF/NugXNCOHSTGT11TvK7mCiBuUMVgvZGAlOJImk6eTTfUjRrMfaXM/SWl8bdJ4ZpzdjEyVh89r7I5JrGk==x2UD -md5.c iQCVAwUAP9h7LzEAnp832S/7AQJUGQP/c0cbf6WZXCzmjufHxiE9FAQBzTsA0WtaNqdFcHl7fhmikGtknlaED8n5a7eYd/C481UQW6Wgq/oZdsvgoPWPhG3fOCy2CFP9cZVXITuMSf0ucyZTFUJNO15fnZ+nDfsUv+JPdv1aSeRinAUtfAcSKfkSyR9BCPZvkx+tgU6cphU==Zv+h -rijndael.c iQCVAwUAP9h9cTEAnp832S/7AQKF1AP+P2L/tPqDJRDg+/fwbOk8Ts0MNxnvvYEm3gE73TKuLt1S+B2+jkrZcKNvM5VGPnVMJbnS0lmIK04nmedHCOftGTOwhGulZAHHIaKGystT3Jql4iPws/JMgAjE7Fyxh5WZMtB9yEljKBpJ5XNqhrMvvxcHpnyP3+YzIXNwzk34V+c==dJ5k -rmd160.c iQCVAwUAP9h+bTEAnp832S/7AQK1OgP+PNKF6Nzi6X93easVlksdLqKEsArCAw2QjGWDGyxTnbiJM55qAl9JxR1mn3V+oOL7izLLwTt6EYK9evhzfcxY5N5Mni85RAcsLPsuAfQDEzjI6GUWHtQUKPbM+BaorzfhQjYFSZyvum/dZYJ/WfiwwwhqqIKyVU2ZFSqA38YGC/c==9jdA -rsa.c iQCVAwUAP9iHIzEAnp832S/7AQKAYwQAuWtnMte54QHN+Hij9t4sGuypXogajOb1vQQwGgS0fKsaBZsuSP2amze4o5diIvsQTsFQ4CzjvqoCVuBDoHM3xkSD8wGDizgvtCamAxkdbF7wmzldKFn8SpJqlVwWQMP6kk1IjXHEuYb4IDWGTbVMhfEu+eOlU8+PSK4IhZqNvt4==/3hp -serpent.c iQCVAwUAP9h/VzEAnp832S/7AQLyCwP/d1zbmb7l/PriZNa9/Z7mo01XFe5MnAqCfIwhl9GjeaMszcoS37jECNq5nLvrTTFIIJpm3rvBePwiCG4Wwx1I18HCxaP198pcSaR+BLOJ3Aj52EZPrxtqlDKuFr38ZOP5giyUqUYVYGVdrz4kRMNWAZQK53GeJnGhXCnhxojLEgA==ck46 -sha1.c iQCVAwUAP9iATTEAnp832S/7AQKcSwQAwAs/HnNqho3lU1ZUgCPNt5P2/Brm6W21+wWWGKJkSrra/c4NYVKJGDDwlsFE0b9ln1uZt7bHReFkKXK3JnrKTmNVcx/Cy64iCMRNMhaM72Mqy7wWx5yHBAmMBxzFGnNQKbmeY52zeGih5HsNLSibc2pPuOViWo2JPJ5Ci/wIwl8==/wtO -sha256.c iQCVAwUAP9iAtzEAnp832S/7AQJD2QP/UqvL0hhjG1wEFbGrdkV9tba1sMDXdnnK6X7HdLuRpVAgNiQiFf8JDmntd/dZ2Q71p4Uae2ctqve4WoEijPUZPjACnpuZfx0SEQL0lQBkwxzJp7lz9ujVtwQ2cM/aYexJkXcWgGcloJNLM3JbWPGIJnuYbr/IwJ6RQF9vgj0357o==UWO1 -sha512.c iQCVAwUAP9iBTDEAnp832S/7AQIPBAQA28CJSUQLiW0s2x9u8/OH2eKnxPjA4sZmb50WP7920Lem66P31C3BrOqwfBot4RLhjL+zh/+Uc4s3HPwApZuj9E4BxNMlqLv+Tqk++DAbdaOeYT4jeUt+mlhQQ6mH/RDsy32rZsNsGQ2bUGxazZmfG++PL3JyhawqCy00SUDr/o0==H+0X -tiger.c iQCVAwUAP9iCfjEAnp832S/7AQKufwP/fryv3MqSOYY+90325DH7X3/CtekxeooN0scGsHX0fxBakWSMecTNrj33KPddLS46gU/S89zIc2N/Bw/7EVIAXVFA3/3Ip+OrFOuIMO4Py1sCdB8o2Y+5ygv8iXLcsXIq1O0av79i9g774V3uaXa2qN9ZnXe0AEhcy8FHJ2i/wro==5XVB -twofish.c iQCVAwUAP9iD6TEAnp832S/7AQKUnQP/Rq8FaYeHTG7HbZuqAs9pbPitzjDbkdZddmInWR7NmevBkKvhsJALjVooc0KGQfo2lAAmy3Xi/4QQN8VPn51DVjDIgf7x+DQh/9TFJHMccxI9asUgi4+TNnmMqLU1k3N8S2PjyZ1sjeC8B79fKPpwCzj72WkqPkzZw3l2jArr+dU==NdJT -rfc2268.c iQCVAwUAQCN+3jEAnp832S/7AQLv1gQA1hJh29hAjKi4uLSGxXvJ6cyYmPdmevdKrbLnuHZWtHe4xvCgy/nTdEojEpxgLp/hL/ogasuWRC1W16Wiz9ryxf7YR0uhZWayO/bQNagpfU5MIkJTLuKqqgpwYumCSQfOugXVAqcgEzj+13eeyJaFVrzwrNa67sh84nmbjOjNjvE==0zBq - -# Random number related -random.c iQCVAwUAP7nsITEAnp832S/7AQK4SAQAtvfUgrtGOQ2PlxGMla0qJLPHjJacMwgq0ecusiI79elPdDsFfCCk6dK1Ug2kFbNm22nCGHNcUquqbX7noi7ZVQnmPBQXzyLNZd7GmrawRZfdlRerTUDBpSnR8V8ui/5+YYp627E7kKGC0hPSgqXFql6oBMIfno0LZwFJTjIevRY==L419 -random.h iQCVAwUAP7ovKDEAnp832S/7AQJ3bQQAjnPebnyTC7sphAv2I7uIz+yPgw1ZfbVhLv+OiWDlO9ish+fRyyMpy+HELBOgZjJdgRegqhlZC6qyns5arM/VglYi+PzvdLO3hIqHE/YFfpIFPz8wBrcmlqrYyd3CsGqcYsfjocXNttCBLeSWmoJ09ltKQH8yzJf3oAgN6X1yuc4==eNoU -rand-internal.h iQCVAwUAP7ouvDEAnp832S/7AQLYnAQAhdI7ERoJVCkV8GiV7MjaUxv1WIL7iZ+jIOvVhv4fNyhCGCGoEtTjkyput/lj7Nsh3FXEqRhypGGrCLf47x/gua5n+BwffogxVyUDqiOyyGhNTPpe3fQcNBvbPCtco8yMK4GJO5G3BqzlPyN+BMeogLymyV6Sm1mvh5LZDyAFbfQ==tZSE -rndlinux.c iQCVAwUAP9iPYTEAnp832S/7AQL6/AP/ZDrbOkVuB9qJ7sKeX1MImZEsz3mi0xPovJzaBtBU7a0idcUKrWYOvQFWRlLUeq0iCT6+h2l5bniP7q7hepzlKa+VPY9VWaQthqeJm2l5LN6QQ5PyMfBq04QuBncw9BJnCGmEyTLt3RxIXBAPdxmiVxtcRIFUqCBtQvoUXGLvemw==t37k -rndegd.c iQCVAwUAP9iPRDEAnp832S/7AQImBQP/WHKg+hKXcm1pQvilzML0jZpwK5PAMM4uBnnPJNIXWOYBO6I/Xg9d/tPLg8NlmmtyQCo2Eu0ybDSt+8mu+dWveAys+0LTi0MIqeP9BMzCKz8dnWH6+S8huLXwTF3m0IrqM0JLb6b71GK9SOq6sWQ22yW5vf61hXP8kH9dhIaoMZs==FaHV -rndunix.c iQCVAwUAP9iQlzEAnp832S/7AQL/KgQA29GnvcD4Xb5qjDMBgW9THEE4+4lfex/6k+Fh0IT61OLJsWVLJ7bJpRntburw4uQm4Tf7CO8vaiDFDYhKKrzXeOF1fmdpcL8hA+fNp9I/MUOc4e9kN9+YJ9wikVa0SZj1OBfhzgcFLd1xOtulkr3ii52HLF9vhrxzkgVwvD10Bi8==2cML -rndw32.c iQCVAwUAP9iRKDEAnp832S/7AQIuaAQA3AJr3WqnxNDsWCIdvehf8Suotthj+laX8nJsvDfFhXPKcXDpsg0wTTXSnnKgyED53+uYiMDnVRsxeWAyhKwvx1MjjlaSMMjzbH6isWTH8FaWpLgrxEkXoPeNqYf5FXpdUkcUxGX2RkQeuX/cIfiHLNE9CV0usaF2jysjBX2iERY==EEnO - -# Helper -bithelp.h iQCVAwUAP7ouPTEAnp832S/7AQKXggQAqjcgvihIF3WclOgw1JV2rbARw4ISIDRMFqdaNCqBRx6BwEz3UGsEIlz6+iR1sS/reqN61WvtjLb+D0+tujAkGrgQJhFLG85WtG2tB5UVoI3am1fpkwiRm+bR4rv0rGk0BYk81bC7+l4KrK9o5lVp4lCsrorlUKsd48lNmBHyAXM==mDDN -rmd.h iQCVAwUAP7oumjEAnp832S/7AQJiJQP/V4bJwjZaYndJzV+KRnIDbl1koHuw+ZK5heMYVu8Qk4ylqv//BGyeRa3jZCcfPHI35q6HilCs2VBm8hiBMjHSqY/VPn2ZQ0yg/lt6qEvl7YjsLmyMICvjG+ncszHoq9pRvnF3vTnM18sPIioXLk8fskuM0XOCNBs0ARBAQjY9UGI==olUN - -# Configuration -Makefile.am iQCVAwUAQCN33TEAnp832S/7AQKFJAQAz7BDkC814q+QiuE/jnutJHR5qlgbrm3ikGbQwdRzYUscst4bCCWy3uKL/sIPGLg+JQXtF5FnsQy3s4D9BOYhp72cA9ktYK65hhi4pNm/JQ0lXkZMNfk8Go5lNzKezlWwHvkMwRXR0Fep0wPdyeaKW5BfaW2ABvgep6Bp+hHEbyg==zSyi -$names$ iQCVAwUAQCN3EDEAnp832S/7AQJXLAP8DvHTpm5DkTF35EmzeKpi9ie59AZcZanD19ir/e/7+PaQxr2riuLHDGwFKTju+dcvvBsqrygXOC378GXVWzIF2OZwS4EdDcJ+pgojo9UpsqpKsJHouY4Ugx5cQialxba462kUn8hcihSBnMyc4LzbJ5WQ4puQuqy544d2x94+2ms==G4Ls diff --git a/mpi/Makefile.am b/mpi/Makefile.am index c41b1ea..8f39ee7 100644 --- a/mpi/Makefile.am +++ b/mpi/Makefile.am @@ -29,7 +29,7 @@ AM_CFLAGS = $(GPG_ERROR_CFLAGS) AM_ASFLAGS = $(MPI_SFLAGS) AM_CCASFLAGS = $(NOEXECSTACK_FLAGS) -EXTRA_DIST = Manifest config.links +EXTRA_DIST = config.links DISTCLEANFILES = mpi-asm-defs.h \ mpih-add1-asm.S mpih-mul1-asm.S mpih-mul2-asm.S mpih-mul3-asm.S \ mpih-lshift-asm.S mpih-rshift-asm.S mpih-sub1-asm.S asm-syntax.h \ diff --git a/mpi/Manifest b/mpi/Manifest deleted file mode 100644 index 3b0d673..0000000 --- a/mpi/Manifest +++ /dev/null @@ -1,41 +0,0 @@ -# Manifest - checksums of the mpi directory -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser general Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -Makefile.am -config.links -longlong.h -mpi-add.c -mpi-bit.c -mpi-cmp.c -mpi-div.c -mpi-gcd.c -mpi-inline.c -mpi-inline.h -mpi-internal.h -mpi-inv.c -mpi-mpow.c -mpi-mul.c -mpi-pow.c -mpi-scan.c -mpicoder.c -mpih-div.c -mpih-mul.c -mpiutil.c -$names$ iQCVAwUAP+LmfDEAnp832S/7AQKZJQQAkR/gQITUM+6Ygy9WAOAO17btyKAlCtGTXp5XSZ+J3X0o/rYneRdSCW89IJvwFRJjAOcFJd52MXs6ZVFF/RQBC8MvJzuQChbEzvihK8o2VgK34YWjU+6XH9sFgRMIgzkHs/51ZZxeQUOPy1XF7TyKB0WE7YBUVisFiRaqB1qGIOs==Z3qB - diff --git a/mpi/generic/Manifest b/mpi/generic/Manifest deleted file mode 100644 index c429fde..0000000 --- a/mpi/generic/Manifest +++ /dev/null @@ -1,29 +0,0 @@ -# Manifest - checksums -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser general Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -mpih-add1.c iQCVAwUAP+Lj2DEAnp832S/7AQKn/AQAwQLWggl6zNQ5EZ+lE+jKV8W3FsogW3/6tp9T5rrSR5JnlWyoHQ9/Pu4knOcLjS6nIfVOiAEifu3nuIysQr9jDSSSJA2LylSUBSXKLKDamPsOCwXOLxiZODslJT3CCGAUtLvXJrWDbTZQrkEuwnLnjQFDzuA7iY9JLrG9kAoXD6Q==WoWm -mpih-mul1.c iQCVAwUAP+LkCTEAnp832S/7AQKFVQP+MhBNjcY73JtnsHZfnaVZq3TiKwN151cWV51nDc1RnTaMhSIFeuNlj3vNML2W0Gn8n+GnyiWE2XXdQEaik6BL02eekUn9aq7I/rdpnTHuOjQPK1uwjuNl8RuJ9YrERBAxq4oB71f+iwMab8dsMSUlVC+NdeAocRqLLgnR/efkdLc==2Tkb -mpih-mul2.c iQCVAwUAP+LkMjEAnp832S/7AQLPeAQAqmRzxFe/mDqTdZr/pTXT8RVyB1vKB0Ei2THV05BxmI4OPv39uysfFpLMt/INsX7AGqdOlj4jOZ/qNaFXR1ceMrlSXvo8u/epk6rCXFp82kM7Qs983LjoP//PrMCkYkXwblaVrgUGiBUCbuPMliWTK6qKkxxXtEfqZ7nVbEWdBx8==Kwhl -mpih-mul3.c iQCVAwUAP+LkVDEAnp832S/7AQL91gP/Qd5iZWxRiN5DdEIVHAedoNvl23NPrT2UUdXvnSK49DpplTxkLiMBj0WqCayG/YIET2NpMRCeLvAZNcSt6lOm0bSZDYo1Hv/N+UoqD3V1McjY16REBv/nnPaMWMZcx7rl5yKTVZiX2PgV6oQOL7Yfrt5ZIOlrHBRs9S2/zcCaVz0==9BQe -mpih-lshift.c iQCVAwUAP+LlATEAnp832S/7AQIACAQAhMrpx0SRXE/LN1NkjMO9n74nMrvmzYJyru0gw2O4BYrUPvD/LWGju2FZaggKV0IBjmi0cDoCrNeK9EGjKOO1lfgODbX2IZ1LUhr9jDuMj0QRqj6T9YkAFYTNUk4GfpwIf7T6Ybo7c78Jx93PidCJt7d39eMMEalooC7LZ4IU3NM==nZ4k -mpih-rshift.c iQCVAwUAP+LlIjEAnp832S/7AQKiuAP/eYC2ZScd+taBx/kNzRvGjA0eAXvORMkMLV6Ot+OXVzVUi04eoP2yXdxSNFKwUj12p8GWXkdoMG3aOGBKg2a7bY5Q5RUho3hUWb9UsVYVUfXLf7IOTt/3a6MLh2CmV5dFPWJmSlbCyQRcn6n/fLDeJ3A2bWTS/BhqGfpOXUIU1ws==jCf8 -mpih-sub1.c iQCVAwUAP+LlZzEAnp832S/7AQIEPgP/dLHTDRbPrYJhsLp9SjGstU1M8/IC5XytcDtO3NQeu4mx6vaXjpujtsTvKIbX4QL5IahNntVVKv1xFLEm2yFg7L2ns0uD/mfwGgOhCG1j2o/SaTAWP5KxP7ae5UDcZl2w6NWvEuMj9t32zmziAZjP8W73A37FUspeRDYiL9sQzkI==QQzk -udiv-w-sdiv.c iQCVAwUAP+Lk0TEAnp832S/7AQICXAQAsxe1SQD4+xZaZTqBC0V9Cyuo0mrdccnRFzthOtm0ARwKFXU2cuLW/ZBOkmeWOVmOFhBp22/I8dEGYnMA3gcfmOMCpNu9i9zk/XHfptdunA1MnOe3GsoWgfHL0rhpAyPhp/X043ICB41NElnnuxADuQQlD4Z1fca5ygYxMr2crJg==EI/6 -mpi-asm-defs.h iQCVAwUAP+LkgDEAnp832S/7AQK0FgQAxJZ7xvXhoZa33GWe23LRb3asrno/loZSyAIXrntqtVH8M3pEsCY0OyW4ry4hX2RnxpuhRCM/PdRNLG3xXyMSVIhkHU8WVRLqzF2LLjEkyU3cAmHnnTQ9aO/XpUWtJGTZ8q2bv7ZsAEi4aPl0p6KhPXcPgM9vQ2XcyOPn3Dl0d6Q==xpjI -$names$ iQCVAwUAP+LmNDEAnp832S/7AQJa+gP+KQNJpbNOgc+s2UX+Ya2gDaOFcAROImIllhg3ej8EaBF8xxdHmWT1zaKwTwi3moEEleykMR104YAGWyQeMbFYiuPPBW+ohrT6KxRBVJpIA9auOOqqJMyglZyoR3Hv7gduVYUW1h/DebnqiKXKEfzQDFqYuT0ayuteoOR4B5NICbE==nLSh diff --git a/mpi/generic/distfiles b/mpi/generic/distfiles index 9810eef..649e829 100644 --- a/mpi/generic/distfiles +++ b/mpi/generic/distfiles @@ -1,4 +1,3 @@ -Manifest mpih-add1.c mpih-mul1.c mpih-mul2.c diff --git a/mpi/i386/Manifest b/mpi/i386/Manifest deleted file mode 100644 index 812bc8a..0000000 --- a/mpi/i386/Manifest +++ /dev/null @@ -1,28 +0,0 @@ -# Manifest - checksums -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser general Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -mpih-add1.S -mpih-mul1.S -mpih-mul2.S -mpih-mul3.S -mpih-lshift.S -mpih-rshift.S -mpih-sub1.S -syntax.h -$names$ iQCVAwUAP+LmOTEAnp832S/7AQJZmgQA1+GIl7rXiEY00y5xD2kG5Lm2QD6c9aBME8hTl812OEcj0ul/QSpdv8E2NEKooifr4SiLVhEVfLNaLqAgN3cIsttn3rRX3/pMC5JwSKHDJPsUbpN9tzb5dr2YC9GG9m8xngAQrN11IQPnGfvFLJK+oDnEMIAeHDpOnX9NeQPDAQA==bnOy diff --git a/mpi/i386/distfiles b/mpi/i386/distfiles index 22b9979..88d2a30 100644 --- a/mpi/i386/distfiles +++ b/mpi/i386/distfiles @@ -1,4 +1,3 @@ -Manifest mpih-add1.S mpih-mul1.S mpih-mul2.S diff --git a/mpi/i586/Manifest b/mpi/i586/Manifest deleted file mode 100644 index 6d1d7f8..0000000 --- a/mpi/i586/Manifest +++ /dev/null @@ -1,27 +0,0 @@ -# Manifest - checksums -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser general Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -mpih-add1.S -mpih-mul1.S -mpih-mul2.S -mpih-mul3.S -mpih-lshift.S -mpih-rshift.S -mpih-sub1.S -$names$ iQCVAwUAP+LmQDEAnp832S/7AQKCmgQAhG+E7X0KB4qdVf3sMb6Qr+Iv5Jlehzoub/5vxTRgePKzRuOHidCnTzSSoyzA++UcHrOjHQQDMsXnO6PqpS1d/TKkxjnGN7rE8mvMYlFAT8RsawTozSfh14mCzI0HTDbaKL9Z8pcMJtadB3XqAuqWJNO8kyECJFwurt3DRWXSWS8==Rug5 diff --git a/mpi/i586/distfiles b/mpi/i586/distfiles index 546f777..8f821fb 100644 --- a/mpi/i586/distfiles +++ b/mpi/i586/distfiles @@ -1,4 +1,3 @@ -Manifest mpih-add1.S mpih-mul1.S mpih-mul2.S diff --git a/mpi/m68k/Manifest b/mpi/m68k/Manifest deleted file mode 100644 index 8e0538a..0000000 --- a/mpi/m68k/Manifest +++ /dev/null @@ -1,25 +0,0 @@ -# Manifest - checksums -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser general Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -syntax.h -mpih-lshift.S -mpih-rshift.S -mpih-add1.S -mpih-sub1.S -$names$ iQCVAwUAP+LmTDEAnp832S/7AQJHUAP/dxfq2U0pDc5ZLoEizoqgjjcnHIyb9EjMG3YjvgK6jQ62yoAOCuo/jFYlJS+Mdve6bgfdTzYMrnKV7BG2SEcwb263pVnIntS7ZhKQPiMCbFgXWR2VjN3+a1v8yjQDZtgqEgm8OlQ+u7jKBY13Oryiuq5nPNxsXZqJpelG6Zkdg9M==PIee diff --git a/mpi/m68k/distfiles b/mpi/m68k/distfiles index 1e2e36f..4c0967b 100644 --- a/mpi/m68k/distfiles +++ b/mpi/m68k/distfiles @@ -1,4 +1,3 @@ -Manifest syntax.h mpih-lshift.S mpih-rshift.S diff --git a/mpi/m68k/mc68020/Manifest b/mpi/m68k/mc68020/Manifest deleted file mode 100644 index bcb2768..0000000 --- a/mpi/m68k/mc68020/Manifest +++ /dev/null @@ -1,23 +0,0 @@ -# Manifest - checksums -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser general Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -mpih-mul1.S -mpih-mul2.S -mpih-mul3.S -$names$ iQCVAwUAP+LmRTEAnp832S/7AQK3rwP/TyGBbii5HCrjDiLCVJHiDNeOdENx6AicRXnu4vuJmMmPZ0y+i7MPusDaeTbIUA0w6RaJx+Ep41nIvthmNDnFePY5Mw0pIUJcpI7AJR4vYqpwNQA6nlEdn/m1jg6sPLKZXUXNUkhroEzcHzoU+12BPS+nvSXlwSksg6rXEGOJ+Ms==XCXP diff --git a/mpi/m68k/mc68020/distfiles b/mpi/m68k/mc68020/distfiles index 6b96433..fc7df9f 100644 --- a/mpi/m68k/mc68020/distfiles +++ b/mpi/m68k/mc68020/distfiles @@ -1,4 +1,3 @@ -Manifest mpih-mul1.S mpih-mul2.S mpih-mul3.S diff --git a/mpi/mips3/Manifest b/mpi/mips3/Manifest deleted file mode 100644 index e191184..0000000 --- a/mpi/mips3/Manifest +++ /dev/null @@ -1,28 +0,0 @@ -# Manifest - checksums -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser general Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -mpih-add1.S -mpih-sub1.S -mpih-mul1.S -mpih-mul2.S -mpih-mul3.S -mpih-lshift.S -mpih-rshift.S -mpi-asm-defs.h -$names$ iQCVAwUAP+LmUTEAnp832S/7AQLm/gP/RHR2aLMwHPxsq0mGO5H0kneVn8a9l9yDNEZBefkYcOJMb7MZGKxbGspyENiU04Mc2TFnA1wS9gjNHlRWtUYxxn/wyuV6BIRgfstXt2nXGgEQrK07GIz8ETFcYqcxu7JKiICIuXZgnIgdwBJswbBV1zaMUDXeg5B8vkkEeRWj8hQ==IQVO diff --git a/mpi/mips3/distfiles b/mpi/mips3/distfiles index ef9b6fe..85260fc 100644 --- a/mpi/mips3/distfiles +++ b/mpi/mips3/distfiles @@ -1,4 +1,3 @@ -Manifest README mpih-add1.S mpih-sub1.S diff --git a/mpi/pa7100/Manifest b/mpi/pa7100/Manifest deleted file mode 100644 index f075ab0..0000000 --- a/mpi/pa7100/Manifest +++ /dev/null @@ -1,22 +0,0 @@ -# Manifest - checksums -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -mpih-lshift.S -mpih-rshift.S -$names$ iQCVAwUAP+LmVjEAnp832S/7AQKlEQQAv2+x/d+Z0t8FwwHlxKpIKOJDr9e+Y2i8y8orcIEa3dnwU5LMOH3EzFoNSD9crc31FMokgm/X5xeLjqRTdcmGHyJJQJDPJVJyuaOm6qHJaFzzfJjrfMW66nJxfNSXIiIm4DgpP20NmumaorLCkiIZ5Z81KGAc8FiRggbRVYx+wxo==Vjh9 diff --git a/mpi/pa7100/distfiles b/mpi/pa7100/distfiles index e1cde4d..fece943 100644 --- a/mpi/pa7100/distfiles +++ b/mpi/pa7100/distfiles @@ -1,4 +1,3 @@ -Manifest mpih-lshift.S mpih-rshift.S diff --git a/mpi/power/Manifest b/mpi/power/Manifest deleted file mode 100644 index c60fc23..0000000 --- a/mpi/power/Manifest +++ /dev/null @@ -1,27 +0,0 @@ -# Manifest - checksums -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -mpih-add1.S -mpih-lshift.S -mpih-mul1.S -mpih-mul2.S -mpih-mul3.S -mpih-rshift.S -mpih-sub1.S -$names$ iQCVAwUAP+LmXTEAnp832S/7AQJ+ngP/XYr5Fvl/8WGVHcIKaehxvnKcSD2ILTWZNGubgnWp8ebIxVijjQCxYneTTy+zO0sNaB002neyscyiwaJj/JQIwZXfr06uGweIqlSpwpj9ndkoJc8E4/FZu+5NTO+E3RaBDAD+Tpo+MTfbC1s18p5i+an93VrSTgNck5PPYQrUcPA==sl3t diff --git a/mpi/power/distfiles b/mpi/power/distfiles index e1bc008..e664c8d 100644 --- a/mpi/power/distfiles +++ b/mpi/power/distfiles @@ -1,4 +1,3 @@ -Manifest mpih-add1.S mpih-lshift.S mpih-mul1.S diff --git a/mpi/powerpc32/Manifest b/mpi/powerpc32/Manifest deleted file mode 100644 index 26ab6ea..0000000 --- a/mpi/powerpc32/Manifest +++ /dev/null @@ -1,28 +0,0 @@ -# Manifest - checksums -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -mpih-add1.S -mpih-sub1.S -mpih-mul1.S -mpih-mul2.S -mpih-mul3.S -mpih-lshift.S -mpih-rshift.S -syntax.h -$names$ iQCVAwUAP+LmYzEAnp832S/7AQI/cQP+Mcg9rF/c/bJTY48PE1/ARt7vCMtpIlv9alZSSSrU3WHzCtv9nVczFmwHU3DdKFawigY2DljQcK92dZ5ZlOfpFNMz4PKlVMWaKDk+jKlqm2dxvlHuqEvXPpjFAE2gHrhq5qLXS5ZHeMLJIEK84GYC6fjfLUMdZU3altXTUBvoXhA==Yax+ diff --git a/mpi/powerpc32/distfiles b/mpi/powerpc32/distfiles index a086614..af10d79 100644 --- a/mpi/powerpc32/distfiles +++ b/mpi/powerpc32/distfiles @@ -1,4 +1,3 @@ -Manifest mpih-add1.S mpih-sub1.S mpih-mul1.S diff --git a/mpi/sparc32/Manifest b/mpi/sparc32/Manifest deleted file mode 100644 index d279229..0000000 --- a/mpi/sparc32/Manifest +++ /dev/null @@ -1,24 +0,0 @@ -# Manifest - checksums -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -mpih-lshift.S -mpih-rshift.S -mpih-add1.S -udiv.S -$names$ iQCVAwUAP+LmaDEAnp832S/7AQISHgP/Z5orU+CPKBeRFCogSQDm4p7J2VpDovU6mtfMTdjhqWuZG0U6y8WqH0aj3USfziOhtc8YjQHQ+97g3+EnIWZgLjKacWC6pScY/QbATEpF1D0Wrcea5rk3qR1t7isdBVVOrxedZ5vuj5Op2zx/0OlPI+wt6fTtW88BdG/a6w/ZU/8==Py6h diff --git a/mpi/sparc32/distfiles b/mpi/sparc32/distfiles index a20f18e..51329db 100644 --- a/mpi/sparc32/distfiles +++ b/mpi/sparc32/distfiles @@ -1,4 +1,3 @@ -Manifest mpih-lshift.S mpih-rshift.S mpih-add1.S diff --git a/mpi/sparc32v8/Manifest b/mpi/sparc32v8/Manifest deleted file mode 100644 index dc1ce6a..0000000 --- a/mpi/sparc32v8/Manifest +++ /dev/null @@ -1,23 +0,0 @@ -# Manifest - checksums -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -mpih-mul1.S -mpih-mul2.S -mpih-mul3.S -$names$ iQCVAwUAP+LmbjEAnp832S/7AQKQ2gQAotpCpY9rOJUCdZHbDLXXB9i1UUMraRKbVWimtKq493Y2d2wcqXCK2WaGs1AePK3K6Qk6msxZ0PL5Ho7KgHMkzsZ+wG0EUziiuX0yZRTWNm0r3TYerP6SdWH5GOVdSXn7ckkppk2sVOokfQTy+Tmrnah3+dlYJoujan+fmXWN6Us==DolM diff --git a/mpi/sparc32v8/distfiles b/mpi/sparc32v8/distfiles index 6e9a530..2fcb0d1 100644 --- a/mpi/sparc32v8/distfiles +++ b/mpi/sparc32v8/distfiles @@ -1,4 +1,3 @@ -Manifest mpih-mul1.S mpih-mul2.S mpih-mul3.S diff --git a/mpi/supersparc/Manifest b/mpi/supersparc/Manifest deleted file mode 100644 index 869b97b..0000000 --- a/mpi/supersparc/Manifest +++ /dev/null @@ -1,21 +0,0 @@ -# Manifest - checksums -# Copyright 2003 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -udiv.S -$names$ iQCVAwUAP+LmdjEAnp832S/7AQIrUgQA3YmurZhK7r20DqRvg0gwNe9jMDcFfUY4ZPhW5HkGzMbmrxXtj5Dx50RIPteum72bXE+IhcngljQb/cskiN5Hi9oc2a2CPhyTqVFEeGyF+kJ170GI1pVfFOfzbVG0F4nEwm5lGHgv/nvFsvrjmmAXVW1v/yk5N35wbiLviOFrLOQ==byFc diff --git a/mpi/supersparc/distfiles b/mpi/supersparc/distfiles index ef7c0a5..550601c 100644 --- a/mpi/supersparc/distfiles +++ b/mpi/supersparc/distfiles @@ -1,3 +1,2 @@ -Manifest udiv.S diff --git a/src/Makefile.am b/src/Makefile.am index b764852..cbb08af 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -20,7 +20,7 @@ ## Process this file with automake to produce Makefile.in -EXTRA_DIST = Manifest libgcrypt-config.in libgcrypt.m4 libgcrypt.vers \ +EXTRA_DIST = libgcrypt-config.in libgcrypt.m4 libgcrypt.vers \ gcrypt.h.in libgcrypt.def bin_SCRIPTS = libgcrypt-config diff --git a/src/Manifest b/src/Manifest deleted file mode 100644 index 2d003d8..0000000 --- a/src/Manifest +++ /dev/null @@ -1,58 +0,0 @@ -# Manifest - checksums of the src directory -# Copyright 2004 Free Software Foundation, Inc. -# -# This file is part of Libgcrypt. -# -# Libgcrypt is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser general Public License as -# published by the Free Software Foundation; either version 2.1 of -# the License, or (at your option) any later version. -# -# Libgcrypt is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -# Checksums for all source files in this directory. Format is -# filename, blanks, base-64 part of an OpenPGP detached signature -# without the header lines. Blank lines and lines beginning with a -# hash mark are ignored. A tool to process this file is available by -# cvs -d :pserver:anoncvs at cvs.gnupg.org:/cvs/wk co misc-scripts/manifest-tool -# -# The special entry "$names$" holds a signature over all sorted -# filenames excluding itself. - -gcrypt.h iQCVAwUAQH5RsTEAnp832S/7AQK7xgP+Kc3NY9lipZkaAMrnHDkQVLdHYwTbZWuGOYdTLp8Xy7Auh9wtWV9hrWVUqs+kxDzT/2iF6XkO3WT3rf/PmQ/Q0TIGfOyjE3c/qvB/jVippaxoGda3tnGpODytdI3XPhfPS0Ss8nDzfCStPBGAEq0OVU7imnExrFzhRXt+Gljr0o0==Yagz -gcrypt-module.h iQCVAwUAQH5UXzEAnp832S/7AQJMQgQAzumz9aaZelhw+FxTCeVadphBxt1bbNQvMrnddYYblyJv+AcxZ9ZxGz2oPeusN58Qg54DQcaW3lYhTgnWfXultsi+Ruxlz7400OUrzSXOl3At7KssdODAoscFzZIgh94G9lzQxEBr9lTXI9R3LsPFJP6muNG4frcNBAA42yckK7w==BBp5 - -ath.c iQCVAwUAQH5E+DEAnp832S/7AQKFpgP+KSZHtVcnh9FFggIyHKbALUljW2FXauasZvFyN8Sk/mIMgKxyXFOG1THBAUzWLaKWIEWU+WkYU7uThqBtpnEImM5AenWzbQuJjftPC3gVHO8yjjmBWD4zmJj28htoKDoa/xDsoqumrHxae3FYcaCWtYGVjM/Pbl+OMRMOFAhp0ho==lQZ3 -ath.h iQCVAwUAQH5FODEAnp832S/7AQKiuQQAg4K+KOAn1LWBZN32MAhms4FeZKoce0fAuZW7BpyY4cCxIVgxqrtUC90CDykw8XegFfOyyYrgd0NmaMVdY7HZDncNOvIPxpgFQPCZrycsMOoAtoVwjK704RDeNo3zmeyxTKeDH+3M1J7JmLiafaEdSbOC8flX/W0icaV0Ol4dmBc==Ll6w - -cipher.h iQCVAwUAQH5FUzEAnp832S/7AQJKLgP9GSSk9f7EINIRqSQH1XKX+dYzt3phDHdqFTUGIfYNh7YzGdy0drvgFhG4k15nqDouKRuFVM/hKY3ZVY7JccmKXKGAH6+ZYShoG6LMFfIGgDX8zne0dNxc72PLfns3fVxNn/RlHmHBkrQ+ppjR9HnSthFmOqzbQaW1BKmc3Z2x5GU==lIeW -g10lib.h iQCVAwUAQH5FejEAnp832S/7AQJ75wP/ZjOybwRix5eoXdfVeXPjoPygejzpYJJdMUGN3Y5UtkfBu9mPREsKfvZ6tH+Evjx+3xfeAb4bU/k2mRMp0tiWnk2koToS08vI9uxnioKQr9oulZH6r28S+NLSgMQuEGN1JNUky6RQ9TTNRndeTjKKSrEjZ7V6bv+rb8A1bYCKChs==P5mk -mpi.h iQCVAwUAQH5FwzEAnp832S/7AQJJ4wP9E3jVkcO9M0YtSBHIbjG3hDWKWXzi86AlUh51qiE8/2XP0FfjA4TosyvmicZs7j48HitAByr9tHOSxnbeo7NBf17ICwAo6Eqty+wKDg+eyLeEGUy7VpVK3RJRQAA4H+kl3S2l3YMTKf3WJlbc7qkWSXZspdy5c9sAxeodCKrAubU==oALf - -global.c iQCVAwUAQH5HFzEAnp832S/7AQJc+QQAvi53ZkMCzLnVULHvhI6W+EX537zi9n8cplYguvIJqUhAZrP68yGAIyqyCONbZVDyB7wqeXdUMLzMk7W8fg+xuk5JSDpppAQf2m/bdQyze6XVqJso682eYBM8+b9z/IVEvLaFwhZcOKO1bcXudBlBCcJgVDpupfTtAWgPnewil9Q==Xwy1 -misc.c iQCVAwUAQH5IIjEAnp832S/7AQKNJAQAkEpyY3fCG7tvADJFAW9xA7DEQwLCa8YmiUhHvrEsWOI4YgvS7LUbWWc7VqK+ryORvXLKRAVieznbnHAuy0TKtqdnmA/kUmiurS0ah5SWqR/iuAeJtt0RGsmZaZ6oa2m4PZ2Y2GCHSTZqcclvwsetS9eq5AipxHxYFUltu5wGZNI==twM2 -missing-string.c iQCVAwUAQH5JfjEAnp832S/7AQI3ZQQAg55eEJbGQQHyBEJGxvt/FXpQiXcoDit3ZHzvdaQn/NUgdLjCHiWVzhyCXACGivLWMNModDaSaZk073NXxVkWfPcX9vkF//Wugwzidd5P3Bfu5k35o+Xxz82fsk5KuFGGq1mBUZ07xUYQ8KkKkhADUkr0QiQAuypp079Yq0uUC7Q==zvKn -module.c iQCVAwUAQH5JvjEAnp832S/7AQKlMgQAjZYTXMpWb5kHxCMXzRi069Ku/4/xnWsD+S0dje1LiKzCnRpwTTxARzc/y10Y8OcygkMuR4unEaWedO+9syjjty3fBCcue/j7YlLitq5EC9UE4o23poWvWCuX9Tadm2DK5qf4p7smMJ22O22cLTYTVCyAoYTQ2xC8ajzBsBRkX80==yRRD -secmem.c iQCVAwUAQH5LLDEAnp832S/7AQKtFwQAwY2wBr6WJC1cwqp/1DQoKzHx9C3plONxbZMazwR7VMI83NUbBAbv1mcxpeZWXmb2dRrnsR1VBbNPDSbJLN5T6czLQ2nIb6mnq9u8Ip4SAa+GCWfDV4AUtAJ4hN/yvWo8iEKu+KD5iJ6xJh31NdXjt5yk6vnk46SA6R4FkHdIEXc==UKVr -secmem.h iQCVAwUAQH5LTDEAnp832S/7AQIsJwQAkZUu4hvmh9NXCLNm98+tGZFzWYvZO/NffC2wdPE8Q/OTa/m3g+oBbEhaV1ze3oY4t1F/p7ZHFx5CsIp4zVjyPkxlni8AAVMUOQr/LopyxouHn2OjKO+dVqecWQf01+nPWjklbL2FZ3mQ99k2qeWZlVSkz0nm8u39F3v7z3OTCss==AJqE -sexp.c iQCVAwUAQH5LojEAnp832S/7AQKCTQQArlrj1KGwR2x93fcyN3M0iXuGkBq5R9KNu+1Bq04G4SLlpZ1RRY0OjV3L9To1BHTd01lXlO8MNz7NpRxWlG1Sw5FohbBlhWZQRcW8GdAawJPcfIY2Y8Ek6Yx8quZKbk9uD3bcBmStmg0P+TIA0nr20bmtfB3uX2KQVHQqWZQT5qU==P8FE -stdmem.c iQCVAwUAQH5LzjEAnp832S/7AQLOUAP9FU16itXBBrkfRDGmhUjAOeEEKdd+brQ3XdT8xoLvP/IH/6U1Kq3ampP2/xcL4kwVdz2rw6NRzP7jlL/yM3tW722lSS/JPJkH+2+qUkcb0fYNoql/WYPMYp1/Mzu6ttXnjag1cQGlKIyYAD+G6h3FtpLwQy0hEJopnF9+Ovd8U7A==CkiZ -stdmem.h iQCVAwUAQH5L8jEAnp832S/7AQIH0wP+Lyqh0tj++s2L79Tmf/gqgCK+HLMxTddcewF3XbsYf9T5FmLez1gz6Ggti4Ss9VjozOA3ti3trCiA/YNRmV9AYw4zLUPm+MsjJuveL/AgB9HdoD2v+RfJm0WwgSKiysp+8iyjg3Plopmhba4cGuOP5MJ3CWTqYwPmJVscUKC6g38==02MN - -types.h iQCVAwUAQH5MKTEAnp832S/7AQLqTAP6A3mUMD5MMkBkebq4bRY6Bq0KsgdKfZ8TLhc2o87gFay8YD0Uom3YJNG2LF/rAIct2ih4jYJaIb5dRfJ0KJoPi2ETd462J8OFCL4fjq9TaSjB2pXcB+kWoxzPasGNg2Ukk0dQ6lvF1tSYrtt32PVI7q/UaPsjTylgRmzLfX/VxrU==OMu3 - - -# Configuration -Makefile.am iQCVAwUAQH5WVjEAnp832S/7AQLmsQP/bbI8/UWAC5yITVhGcCOCbN/FaMqXVKjxESzo6GTs02jxK1y3RuuaoNU1ssQZGAxpFiMJW8u933V3yTHFMxWpwHemDnEyv/a8YACxJBQ0tQgpgHS716BjMbHOfcuOis2WlCOOm0ErjhAYNa4NQ1q3jwkOvTDLFpdnqaWI2wWn08U==Yjun -libgcrypt.m4 iQCVAwUAQH5MbTEAnp832S/7AQJ1uAQA1C6xI7qXiKVtUeXawhPytAldosrzcXmqz34xi7JklQqw83d68WtWHFMBEUa7MKfi4WCbuQb7FjGUvMRw5z/T9ez7CoDekHc63+cIIZLQ23weUK8GaA1uQLoD0scmT41J5RkBlJbH7ck1zRd3d04o75rWNEUNit6KBvrQ4Pd8oQ8==uMgB -libgcrypt-config.in iQCVAwUAQH5UbzEAnp832S/7AQJISgP+Nbd2AQnDM/k8sQLbvz8YZjwX3LigZM+AkF1VAwyAm6YOU3nrXnz5t+cXkQD2dkz4L2F0AAsIkFiJsrgmZgCp2h1L6LeFnH+hoId9RhbYw4NkDaHb+MC9JcalpcfFvvxq6vM/W37bSFimM78P+5RLKypXCytVQNAAaIRgZjVfXY8==IGDS -libgcrypt.vers iQCVAwUAQH5MjTEAnp832S/7AQKCdQQAotG6Z3zdcePI0V33YY2sh91uYkLBNhQw+PzyE3BRRAVhMGLOBD1nSWJHJvE3eyCVOqFY0ZmvpVex51Fa0D/TwsJOO4RVxf1L9bbAncu9OuEXaGXKytLZp54TliDTAWGDq0lvtx1TvDDgtM8TbbaXvMbjfQ4wXBxdLvaenFCTlR4==kgHq - -$names$ iQCVAwUAQH5UhDEAnp832S/7AQK/jwP9H7A3mI99M1NGuhD+16C+2gJIITB8GJeYeUd3vm8kWQ5n76WyMCdeA62qn0JUddIBjAbagtfvTL5aesnD9MlhEGaNlHauU7SINTIJ8njKf87EAAfDZrhS/tGDziC2nakMPweRxXQCLDWHkBPjYfrspSLLohjdegqBvTNyVM76+KE==3p9Z ----------------------------------------------------------------------- Summary of changes: Makefile.am | 3 +- cipher/Makefile.am | 4 +-- cipher/Manifest | 73 -------------------------------------------- mpi/Makefile.am | 2 +- mpi/Manifest | 41 ------------------------- mpi/generic/Manifest | 29 ------------------ mpi/generic/distfiles | 1 - mpi/i386/Manifest | 28 ----------------- mpi/i386/distfiles | 1 - mpi/i586/Manifest | 27 ---------------- mpi/i586/distfiles | 1 - mpi/m68k/Manifest | 25 --------------- mpi/m68k/distfiles | 1 - mpi/m68k/mc68020/Manifest | 23 -------------- mpi/m68k/mc68020/distfiles | 1 - mpi/mips3/Manifest | 28 ----------------- mpi/mips3/distfiles | 1 - mpi/pa7100/Manifest | 22 ------------- mpi/pa7100/distfiles | 1 - mpi/power/Manifest | 27 ---------------- mpi/power/distfiles | 1 - mpi/powerpc32/Manifest | 28 ----------------- mpi/powerpc32/distfiles | 1 - mpi/sparc32/Manifest | 24 --------------- mpi/sparc32/distfiles | 1 - mpi/sparc32v8/Manifest | 23 -------------- mpi/sparc32v8/distfiles | 1 - mpi/supersparc/Manifest | 21 ------------- mpi/supersparc/distfiles | 1 - src/Makefile.am | 2 +- src/Manifest | 58 ----------------------------------- 31 files changed, 5 insertions(+), 495 deletions(-) delete mode 100644 cipher/Manifest delete mode 100644 mpi/Manifest delete mode 100644 mpi/generic/Manifest delete mode 100644 mpi/i386/Manifest delete mode 100644 mpi/i586/Manifest delete mode 100644 mpi/m68k/Manifest delete mode 100644 mpi/m68k/mc68020/Manifest delete mode 100644 mpi/mips3/Manifest delete mode 100644 mpi/pa7100/Manifest delete mode 100644 mpi/power/Manifest delete mode 100644 mpi/powerpc32/Manifest delete mode 100644 mpi/sparc32/Manifest delete mode 100644 mpi/sparc32v8/Manifest delete mode 100644 mpi/supersparc/Manifest delete mode 100644 src/Manifest hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 7 00:18:19 2015 From: cvs at cvs.gnupg.org (by NIIBE Yutaka) Date: Wed, 07 Jan 2015 00:18:19 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-25-g602f17b Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 602f17b5a775f02e0e33a54d3155929dc00e4f53 (commit) from 9bf40849a9f86204e113712c4cc285f1ac16127a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 602f17b5a775f02e0e33a54d3155929dc00e4f53 Author: NIIBE Yutaka Date: Wed Jan 7 08:15:12 2015 +0900 scd: fix merge failure. * scd/apdu.c (pcsc_pinpad_verify): Remove wrong lines inserted by merge. -- Thanks to Joshua Rogers for reviewing and reporting. diff --git a/scd/apdu.c b/scd/apdu.c index 476723a..4ec6b4d 100644 --- a/scd/apdu.c +++ b/scd/apdu.c @@ -2336,8 +2336,6 @@ pcsc_pinpad_verify (int slot, int class, int ins, int p0, int p1, pin_verify, len, result, &resultlen); xfree (pin_verify); if (sw || resultlen < 2) - return sw? sw : SW_HOST_INCOMPLETE_CARD_RESPONSE; - sw = (result[resultlen-2] << 8) | result[resultlen-1]; { log_error ("control_pcsc failed: %d\n", sw); return sw? sw: SW_HOST_INCOMPLETE_CARD_RESPONSE; ----------------------------------------------------------------------- Summary of changes: scd/apdu.c | 2 -- 1 file changed, 2 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 7 09:06:19 2015 From: cvs at cvs.gnupg.org (by NIIBE Yutaka) Date: Wed, 07 Jan 2015 09:06:19 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-26-g22b15fc Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 22b15fccffe613f455f9748c048c8e451724a842 (commit) from 602f17b5a775f02e0e33a54d3155929dc00e4f53 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 22b15fccffe613f455f9748c048c8e451724a842 Author: NIIBE Yutaka Date: Wed Jan 7 16:56:43 2015 +0900 dirmngr: fix LDAP query PATTERNS limit check. * dirmngr/ldap.c (start_cert_fetch_ldap): fix ARGC limitation. -- Reported-by: Joshua Rogers Debian-Bug-Id: 773507 diff --git a/dirmngr/ldap.c b/dirmngr/ldap.c index 478fdfd..00df167 100644 --- a/dirmngr/ldap.c +++ b/dirmngr/ldap.c @@ -588,7 +588,7 @@ start_cert_fetch_ldap (ctrl_t ctrl, cert_fetch_context_t *context, strlist_t sl; char *url; - if (argc >= sizeof argv -1) + if (argc >= DIM (argv) - 1) { /* Too many patterns. It does not make sense to allow an arbitrary number of patters because the length of the ----------------------------------------------------------------------- Summary of changes: dirmngr/ldap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 8 03:15:14 2015 From: cvs at cvs.gnupg.org (by Joshua Rogers) Date: Thu, 08 Jan 2015 03:15:14 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-27-g100b322 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 100b322f5da3066bab5a2b0eb234c631c581c0e4 (commit) from 22b15fccffe613f455f9748c048c8e451724a842 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 100b322f5da3066bab5a2b0eb234c631c581c0e4 Author: Joshua Rogers Date: Sat Dec 20 11:38:53 2014 +1100 scd: fix get_public_key for OpenPGPcard v1.0. * scd/app-openpgp.c (get_public_key): correctly close 'fp' upon use. -- Inside the get_public_key function, 'fp' was opened using popen, but incorrectly closed using fclose. Debian-Bug-Id: 773474 diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c index 475d844..7f1ec43 100644 --- a/scd/app-openpgp.c +++ b/scd/app-openpgp.c @@ -1451,7 +1451,7 @@ get_public_key (app_t app, int keyno) } err = retrieve_key_material (fp, hexkeyid, &m, &mlen, &e, &elen); - fclose (fp); + pclose (fp); if (err) { log_error ("error while retrieving key material through pipe: %s\n", ----------------------------------------------------------------------- Summary of changes: scd/app-openpgp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 8 03:17:32 2015 From: cvs at cvs.gnupg.org (by Joshua Rogers) Date: Thu, 08 Jan 2015 03:17:32 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-2-0, updated. gnupg-2.0.26-32-g40f4768 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-2-0 has been updated via 40f476867c5874602da921d48e339ae3612a0dcc (commit) from 4f0d526b7df871318508f8c3d2f57e7069c47e6f (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 40f476867c5874602da921d48e339ae3612a0dcc Author: Joshua Rogers Date: Sat Dec 20 11:38:53 2014 +1100 scd: fix get_public_key for OpenPGPcard v1.0. * scd/app-openpgp.c (get_public_key): correctly close 'fp' upon use. -- Inside the get_public_key function, 'fp' was opened using popen, but incorrectly closed using fclose. Debian-Bug-Id: 773474 diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c index 0d4ce90..bd96ed0 100644 --- a/scd/app-openpgp.c +++ b/scd/app-openpgp.c @@ -1320,7 +1320,7 @@ get_public_key (app_t app, int keyno) } err = retrieve_key_material (fp, hexkeyid, &m, &mlen, &e, &elen); - fclose (fp); + pclose (fp); if (err) { log_error ("error while retrieving key material through pipe: %s\n", ----------------------------------------------------------------------- Summary of changes: scd/app-openpgp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 8 03:19:13 2015 From: cvs at cvs.gnupg.org (by Joshua Rogers) Date: Thu, 08 Jan 2015 03:19:13 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-1-4, updated. gnupg-1.4.18-21-g3ca1f40 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-1-4 has been updated via 3ca1f4098c70d322658cfaaa0d12164e6ac6d5ad (commit) from da66ad5bba4215b9ddd0cb927a89aa75355632aa (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3ca1f4098c70d322658cfaaa0d12164e6ac6d5ad Author: Joshua Rogers Date: Sat Dec 20 11:38:53 2014 +1100 scd: fix get_public_key for OpenPGPcard v1.0. * scd/app-openpgp.c (get_public_key): correctly close 'fp' upon use. -- Inside the get_public_key function, 'fp' was opened using popen, but incorrectly closed using fclose. Debian-Bug-Id: 773474 diff --git a/g10/app-openpgp.c b/g10/app-openpgp.c index a3a977b..b51d418 100644 --- a/g10/app-openpgp.c +++ b/g10/app-openpgp.c @@ -1250,7 +1250,7 @@ get_public_key (app_t app, int keyno) } err = retrieve_key_material (fp, hexkeyid, &m, &mlen, &e, &elen); - fclose (fp); + pclose (fp); if (err) { log_error ("error while retrieving key material through pipe: %s\n", ----------------------------------------------------------------------- Summary of changes: g10/app-openpgp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 8 04:35:26 2015 From: cvs at cvs.gnupg.org (by NIIBE Yutaka) Date: Thu, 08 Jan 2015 04:35:26 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-28-g657a26f Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 657a26f3af1b3f817d6cde2d091273d332571247 (commit) from 100b322f5da3066bab5a2b0eb234c631c581c0e4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 657a26f3af1b3f817d6cde2d091273d332571247 Author: NIIBE Yutaka Date: Thu Jan 8 12:14:13 2015 +0900 dirmngr: Fix error code path of map_host. * dirmngr/ks-engine-hkp.c (map_host): Fix error return. -- In ks-engine-hkp.c on line 509 'reftbl' is freed, but it is then used on line 511. I'm guessing this is a missing return;. Reported-by: Joshua Rogers Debian-Bug-Id: 773520 Other fixes on error added too. diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c index 3c6a003..ea607cb 100644 --- a/dirmngr/ks-engine-hkp.c +++ b/dirmngr/ks-engine-hkp.c @@ -325,6 +325,7 @@ static gpg_error_t map_host (ctrl_t ctrl, const char *name, int force_reselect, char **r_host, unsigned int *r_httpflags, char **r_poolname) { + gpg_error_t err = 0; hostinfo_t hi; int idx; @@ -361,8 +362,9 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect, idx = create_new_hostinfo (name); if (idx == -1) { + err = gpg_error_from_syserror (); xfree (reftbl); - return gpg_error_from_syserror (); + return err; } hi = hosttable[idx]; @@ -504,9 +506,11 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect, hi->pool = xtryrealloc (reftbl, (refidx+1) * sizeof *reftbl); if (!hi->pool) { + err = gpg_error_from_syserror (); log_error ("shrinking index table in map_host failed: %s\n", - strerror (errno)); + gpg_strerror (err)); xfree (reftbl); + return err; } qsort (reftbl, refidx, sizeof *reftbl, sort_hostpool); } @@ -570,12 +574,13 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect, *r_host = xtrystrdup (hi->name); if (!*r_host) { + err = gpg_error_from_syserror (); if (r_poolname) { xfree (*r_poolname); *r_poolname = NULL; } - return gpg_error_from_syserror (); + return err; } return 0; } ----------------------------------------------------------------------- Summary of changes: dirmngr/ks-engine-hkp.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 8 09:07:38 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 08 Jan 2015 09:07:38 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-160-g9d32896 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via 9d328962660da72f094dc5424d5ef67abbaffdf6 (commit) from 4f7dcdc25af269b12275126edeef30b262fb891d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9d328962660da72f094dc5424d5ef67abbaffdf6 Author: Werner Koch Date: Thu Jan 8 09:07:09 2015 +0100 cipher: Prepare for OCB mode. * src/gcrypt.h.in (GCRY_CIPHER_MODE_OCB): New. -- This is merely a claim that I am working on OCB mode. diff --git a/doc/gcrypt.texi b/doc/gcrypt.texi index 30acd2f..7337db9 100644 --- a/doc/gcrypt.texi +++ b/doc/gcrypt.texi @@ -1647,6 +1647,11 @@ Associated Data (AEAD) block cipher mode, which is specified in Poly1305 is an Authenticated Encryption with Associated Data (AEAD) mode, which can be used with ChaCha20 and Salsa20 stream ciphers. + at item GCRY_CIPHER_MODE_OCB + at cindex OCB, OCB3 +OCB is an Authenticated Encryption with Associated Data (AEAD) block +cipher mode, which is specified in RFC-7253. + @end table @node Working with cipher handles @@ -1675,12 +1680,14 @@ and the according constants. Note that some modes are incompatible with some algorithms - in particular, stream mode (@code{GCRY_CIPHER_MODE_STREAM}) only works with stream ciphers. Poly1305 AEAD mode (@code{GCRY_CIPHER_MODE_POLY1305}) only works with -ChaCha and Salsa stream ciphers. The block cipher modes (@code{GCRY_CIPHER_MODE_ECB}, - at code{GCRY_CIPHER_MODE_CBC}, @code{GCRY_CIPHER_MODE_CFB}, - at code{GCRY_CIPHER_MODE_OFB} and @code{GCRY_CIPHER_MODE_CTR}) will work -with any block cipher algorithm. GCM mode (@code{GCRY_CIPHER_MODE_CCM}) and -CCM mode (@code{GCRY_CIPHER_MODE_GCM}) will only work with block cipher algorithms -which have the block size of 16 bytes. +ChaCha and Salsa stream ciphers. The block cipher modes +(@code{GCRY_CIPHER_MODE_ECB}, @code{GCRY_CIPHER_MODE_CBC}, + at code{GCRY_CIPHER_MODE_CFB}, @code{GCRY_CIPHER_MODE_OFB} and + at code{GCRY_CIPHER_MODE_CTR}) will work with any block cipher +algorithm. GCM mode (@code{GCRY_CIPHER_MODE_CCM}), CCM mode +(@code{GCRY_CIPHER_MODE_GCM}), and OCB mode +(@code{GCRY_CIPHER_MODE_OCB}) will only work with block cipher +algorithms which have the block size of 16 bytes. The third argument @var{flags} can either be passed as @code{0} or as the bit-wise OR of the following constants. diff --git a/src/gcrypt.h.in b/src/gcrypt.h.in index f3207c9..85c6753 100644 --- a/src/gcrypt.h.in +++ b/src/gcrypt.h.in @@ -912,6 +912,7 @@ enum gcry_cipher_modes GCRY_CIPHER_MODE_CCM = 8, /* Counter with CBC-MAC. */ GCRY_CIPHER_MODE_GCM = 9, /* Galois Counter Mode. */ GCRY_CIPHER_MODE_POLY1305 = 10, /* Poly1305 based AEAD mode. */ + GCRY_CIPHER_MODE_OCB = 11 /* OCB3 mode. */ }; /* Flags used with the open function. */ ----------------------------------------------------------------------- Summary of changes: doc/gcrypt.texi | 19 +++++++++++++------ src/gcrypt.h.in | 1 + 2 files changed, 14 insertions(+), 6 deletions(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 9 01:09:18 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 09 Jan 2015 01:09:18 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-1-4, updated. gnupg-1.4.18-22-gc83e250 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-1-4 has been updated via c83e250ef36c28a275de74d96e89898e9f99cb1e (commit) from 3ca1f4098c70d322658cfaaa0d12164e6ac6d5ad (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c83e250ef36c28a275de74d96e89898e9f99cb1e Author: Werner Koch Date: Fri Dec 12 20:08:45 2014 +0100 scd: Fix possibly inhibited checkpin of the admin pin. * scd/app-openpgp.c (do_check_pin): Do not check a byte of a released buffer. Signed-off-by: Werner Koch diff --git a/g10/app-openpgp.c b/g10/app-openpgp.c index b51d418..c3b4fae 100644 --- a/g10/app-openpgp.c +++ b/g10/app-openpgp.c @@ -3497,7 +3497,7 @@ do_check_pin (app_t app, const char *keyidstr, log_info (_("card is permanently locked!\n")); return gpg_error (GPG_ERR_BAD_PIN); } - else if (value[6] < 3) + else if (count < 3) { log_info (_("verification of Admin PIN is currently prohibited " "through this command\n")); ----------------------------------------------------------------------- Summary of changes: g10/app-openpgp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 9 01:09:31 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 09 Jan 2015 01:09:31 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-2-0, updated. gnupg-2.0.26-33-gd92fe96 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-2-0 has been updated via d92fe965f3290a200d0a578decdd0867817b3b7b (commit) from 40f476867c5874602da921d48e339ae3612a0dcc (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit d92fe965f3290a200d0a578decdd0867817b3b7b Author: Werner Koch Date: Fri Dec 12 20:08:45 2014 +0100 scd: Fix possibly inhibited checkpin of the admin pin. * scd/app-openpgp.c (do_check_pin): Do not check a byte of a released buffer. Signed-off-by: Werner Koch diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c index bd96ed0..fc69fdb 100644 --- a/scd/app-openpgp.c +++ b/scd/app-openpgp.c @@ -3711,7 +3711,7 @@ do_check_pin (app_t app, const char *keyidstr, log_info (_("card is permanently locked!\n")); return gpg_error (GPG_ERR_BAD_PIN); } - else if (value[6] < 3) + else if (count < 3) { log_info (_("verification of Admin PIN is currently prohibited " "through this command\n")); ----------------------------------------------------------------------- Summary of changes: scd/app-openpgp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 9 12:52:40 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 09 Jan 2015 12:52:40 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-29-g3197f69 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 3197f69fabb54e72d0c8d7fa9dd3743cad390902 (commit) from 657a26f3af1b3f817d6cde2d091273d332571247 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3197f69fabb54e72d0c8d7fa9dd3743cad390902 Author: Werner Koch Date: Fri Jan 9 12:52:35 2015 +0100 po: Update the German translation. -- This also fixes GnuPG-bug-id: 1808 diff --git a/po/de.po b/po/de.po index 12b5623..9cd982e 100644 --- a/po/de.po +++ b/po/de.po @@ -9,7 +9,7 @@ msgid "" msgstr "" "Project-Id-Version: gnupg-2.1.0\n" "Report-Msgid-Bugs-To: translations at gnupg.org\n" -"PO-Revision-Date: 2014-12-16 15:51+0100\n" +"PO-Revision-Date: 2015-01-09 12:51+0100\n" "Last-Translator: Werner Koch \n" "Language-Team: German \n" "Language: de\n" @@ -348,6 +348,9 @@ msgstr "Verbiete Aufrufern Schl?ssel als \"vertrauensw?rdig\" zu markieren" msgid "allow presetting passphrase" msgstr "Erlaube ein \"preset\" von Passphrases" +msgid "allow caller to override the pinentry" +msgstr "Aufrufer darf das Pinentry ersetzen" + msgid "enable ssh support" msgstr "SSH Unterst?tzung einschalten" @@ -1359,7 +1362,7 @@ msgstr "" "Schl?ssel!\n" msgid "Continue? (y/N) " -msgstr "Fortsetzen? (J/n) " +msgstr "Fortsetzen? (j/N) " msgid "Really do a factory reset? (enter \"yes\") " msgstr "M?chten Sie die Karte wirklich komplett l?schen? (\"yes\" eingeben) " ----------------------------------------------------------------------- Summary of changes: po/de.po | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Tue Jan 13 02:45:23 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Tue, 13 Jan 2015 02:45:23 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-2-0, updated. gnupg-2.0.26-34-gd2b0e61 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-2-0 has been updated via d2b0e613131d52da54c3dbd72f4bfba8f7b71ad3 (commit) from d92fe965f3290a200d0a578decdd0867817b3b7b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit d2b0e613131d52da54c3dbd72f4bfba8f7b71ad3 Author: Werner Koch Date: Fri Dec 12 10:41:25 2014 +0100 gpg: Fix possible read of unallocated memory * g10/parse-packet.c (can_handle_critical): Check content length before calling can_handle_critical_notation. -- The problem was found by Jan Bee and gniibe proposed the used fix. Thanks. This bug can't be exploited: Only if the announced length of the notation is 21 or 32 a memcmp against fixed strings using that length would be done. The compared data is followed by the actual signature and thus it is highly likely that not even read of unallocated memory will happen. Nevertheless such a bug needs to be fixed. Signed-off-by: Werner Koch diff --git a/g10/parse-packet.c b/g10/parse-packet.c index 63b97f0..1048402 100644 --- a/g10/parse-packet.c +++ b/g10/parse-packet.c @@ -1196,10 +1196,13 @@ can_handle_critical( const byte *buffer, size_t n, int type ) switch( type ) { case SIGSUBPKT_NOTATION: - if(n>=8) - return can_handle_critical_notation(buffer+8,(buffer[4]<<8)|buffer[5]); - else - return 0; + if (n >= 8) + { + size_t notation_len = ((buffer[4] << 8) | buffer[5]); + if (n - 8 >= notation_len) + return can_handle_critical_notation (buffer + 8, notation_len); + } + return 0; case SIGSUBPKT_SIGNATURE: case SIGSUBPKT_SIG_CREATED: case SIGSUBPKT_SIG_EXPIRE: ----------------------------------------------------------------------- Summary of changes: g10/parse-packet.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Tue Jan 13 02:52:47 2015 From: cvs at cvs.gnupg.org (by Joshua Rogers) Date: Tue, 13 Jan 2015 02:52:47 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-2-0, updated. gnupg-2.0.26-41-g1298b14 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-2-0 has been updated via 1298b14f97efebdd88a9390af3848154dbe0d259 (commit) via ced689e12a5037c6aeca62e9eaebdc098bd9c14e (commit) via 0fd4cd8503dfe9c3e6a362003bd647b4cd882363 (commit) via 1fc4dc541af7d4bf4dba6ef37d1d7841498a05c6 (commit) via f542826b04e35f13a30116564daaf6456440b1d4 (commit) via 01b364b6da2fbb8850178674e1534d725cd760c8 (commit) via 907a9a1e986b8c8266f4f01e8ed82acfc636a519 (commit) from d2b0e613131d52da54c3dbd72f4bfba8f7b71ad3 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1298b14f97efebdd88a9390af3848154dbe0d259 Author: Joshua Rogers Date: Tue Dec 23 00:47:50 2014 +1100 tools: Free variable before return * tools/gpgconf-comp.c: Free 'dest_filename' before it is returned upon error. -- Signed-off-by: Joshua Rogers diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c index c43e87a..83bc24e 100644 --- a/tools/gpgconf-comp.c +++ b/tools/gpgconf-comp.c @@ -2390,7 +2390,10 @@ change_options_file (gc_component_t component, gc_backend_t backend, res = link (dest_filename, orig_filename); #endif if (res < 0 && errno != ENOENT) - return -1; + { + xfree (dest_filename); + return -1; + } if (res < 0) { xfree (orig_filename); commit ced689e12a5037c6aeca62e9eaebdc098bd9c14e Author: Daniel Kahn Gillmor Date: Fri Dec 19 18:53:34 2014 -0500 sm: Avoid double-free on iconv failure * sm/minip12.c: (p12_build) if jnlib_iconv_open fails, avoid double-free of pwbuf. -- Observed by Joshua Rogers , who proposed a slightly different fix. Debian-Bug-Id: 773472 Added fix at a second place - wk. diff --git a/agent/minip12.c b/agent/minip12.c index 2471717..0bcab5f 100644 --- a/agent/minip12.c +++ b/agent/minip12.c @@ -2182,6 +2182,7 @@ p12_build (gcry_mpi_t *kparms, unsigned char *cert, size_t certlen, " requested charset `%s': %s\n", charset, strerror (errno)); gcry_free (pwbuf); + pwbuf = NULL; goto failure; } @@ -2196,6 +2197,7 @@ p12_build (gcry_mpi_t *kparms, unsigned char *cert, size_t certlen, " requested charset `%s': %s\n", charset, strerror (errno)); gcry_free (pwbuf); + pwbuf = NULL; jnlib_iconv_close (cd); goto failure; } commit 0fd4cd8503dfe9c3e6a362003bd647b4cd882363 Author: Daniel Kahn Gillmor Date: Fri Dec 19 18:07:55 2014 -0500 scd: Avoid double-free on error condition in scd * scd/command.c (cmd_readkey): avoid double-free of cert -- When ksba_cert_new() fails, cert will be double-freed. Debian-Bug-Id: 773471 Original patch changed by wk to do the free only at leave. diff --git a/scd/command.c b/scd/command.c index fc1f5a2..b26bd68 100644 --- a/scd/command.c +++ b/scd/command.c @@ -777,10 +777,8 @@ cmd_readkey (assuan_context_t ctx, char *line) rc = ksba_cert_new (&kc); if (rc) - { - xfree (cert); - goto leave; - } + goto leave; + rc = ksba_cert_init_from_mem (kc, cert, ncert); if (rc) { commit 1fc4dc541af7d4bf4dba6ef37d1d7841498a05c6 Author: Daniel Kahn Gillmor Date: Fri Dec 19 17:53:36 2014 -0500 avoid future chance of using uninitialized memory * common/iobuf.c: (iobuf_open): initialize len -- In iobuf_open, IOBUFCTRL_DESC and IOBUFCTRL_INIT commands are invoked (via file_filter()) on fcx, passing in a pointer to an uninitialized len. With these two commands, file_filter doesn't actually do anything with the value of len, so there's no actual risk of use of uninitialized memory in the code as it stands. However, some static analysis tools might flag this situation with a warning, and initializing the value doesn't hurt anything, so i think this trivial cleanup is warranted. Debian-Bug-Id: 773469 diff --git a/common/iobuf.c b/common/iobuf.c index ae9bfa9..4c6d5b5 100644 --- a/common/iobuf.c +++ b/common/iobuf.c @@ -1303,7 +1303,7 @@ iobuf_open (const char *fname) iobuf_t a; fp_or_fd_t fp; file_filter_ctx_t *fcx; - size_t len; + size_t len = 0; int print_only = 0; int fd; commit f542826b04e35f13a30116564daaf6456440b1d4 Author: Daniel Kahn Gillmor Date: Fri Dec 19 17:12:05 2014 -0500 gpgkey2ssh: clean up varargs * tools/gpgkey2ssh.c (key_to_blob) : ensure that va_end is called. -- stdarg(3) says: Each invocation of va_start() must be matched by a corresponding invocation of va_end() in the same function. Observed by Joshua Rogers Debian-Bug-Id: 773415 diff --git a/tools/gpgkey2ssh.c b/tools/gpgkey2ssh.c index 903fb5b..d22c5ac 100644 --- a/tools/gpgkey2ssh.c +++ b/tools/gpgkey2ssh.c @@ -224,6 +224,8 @@ key_to_blob (unsigned char **blob, size_t *blob_n, const char *identifier, ...) assert (ret == 1); } + va_end (ap); + blob_new_n = ftell (stream); rewind (stream); commit 01b364b6da2fbb8850178674e1534d725cd760c8 Author: Werner Koch Date: Mon Dec 22 12:44:13 2014 +0100 doc: Fix memory leak in yat2m. * doc/yat2m.c (write_th): Free NAME. -- Reported-by: Joshua Rogers diff --git a/doc/yat2m.c b/doc/yat2m.c index 2ac4390..fc932d9 100644 --- a/doc/yat2m.c +++ b/doc/yat2m.c @@ -609,6 +609,7 @@ write_th (FILE *fp) *p++ = 0; fprintf (fp, ".TH %s %s %s \"%s\" \"%s\"\n", name, p, isodatestring (), opt_release, opt_source); + free (name); return 0; } commit 907a9a1e986b8c8266f4f01e8ed82acfc636a519 Author: Werner Koch Date: Mon Dec 22 12:16:46 2014 +0100 gpgsm: Return NULL on fail * sm/gpgsm.c (parse_keyserver_line): Set SERVER to NULL. -- Cherry-pick of abd5f6752d693b7f313c19604f0723ecec4d39a6. Reported-by: Joshua Rogers "If something inside the ldapserver_parse_one function failed, 'server' would be freed, then returned, leading to a use-after-free. This code is likely copied from sm/gpgsm.c, which was also susceptible to this bug." Signed-off-by: Werner Koch diff --git a/sm/gpgsm.c b/sm/gpgsm.c index 97ec4bb..855de83 100644 --- a/sm/gpgsm.c +++ b/sm/gpgsm.c @@ -840,6 +840,7 @@ parse_keyserver_line (char *line, { log_info (_("%s:%u: skipping this line\n"), filename, lineno); keyserver_list_free (server); + server = NULL; } return server; ----------------------------------------------------------------------- Summary of changes: agent/minip12.c | 2 ++ common/iobuf.c | 2 +- doc/yat2m.c | 1 + scd/command.c | 6 ++---- sm/gpgsm.c | 1 + tools/gpgconf-comp.c | 5 ++++- tools/gpgkey2ssh.c | 2 ++ 7 files changed, 13 insertions(+), 6 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Tue Jan 13 03:33:20 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Tue, 13 Jan 2015 03:33:20 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-1-4, updated. gnupg-1.4.18-26-ged6287d Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-1-4 has been updated via ed6287d2e1546ee0f4064675270da003f51e1b39 (commit) via e7cbce8fb2b7417fd1048f916b3e3281f5b9dd7b (commit) via e2e822d22526c1545e095bc24173b732137f5737 (commit) via aab282855ada8dddee99c777c91829344e91f31a (commit) from c83e250ef36c28a275de74d96e89898e9f99cb1e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ed6287d2e1546ee0f4064675270da003f51e1b39 Author: Werner Koch Date: Thu Apr 18 14:40:43 2013 +0200 doc: Formatting fixes. * doc/gpl.texi: Fix enumerate and re-indent examples. -- Cherry-pick a part of ff6115227a1ced14e2fb3d160a12181b9dfbc502. Reported-by: Ian Abbott Signed-off-by: Werner Koch diff --git a/doc/gpl.texi b/doc/gpl.texi index 7f9a48a..0b802bc 100644 --- a/doc/gpl.texi +++ b/doc/gpl.texi @@ -659,12 +659,15 @@ an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. + at end enumerate + @iftex @heading END OF TERMS AND CONDITIONS @end iftex @ifinfo @center END OF TERMS AND CONDITIONS @end ifinfo + @unnumberedsec How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest @@ -675,9 +678,11 @@ terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least -the ``copyright'' line and a pointer to where the full notice is found. - at smallexample - at var{one line to give the program's name and a brief idea of what it does.} +the ``copyright'' line and a pointer to where the full notice is +found. + + at example + at var{one line to give the program's name and a brief idea of what it does.} Copyright (C) @var{year} @var{name of author} This program is free software: you can redistribute it and/or modify @@ -692,17 +697,21 @@ General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see @url{http://www.gnu.org/licenses/}. - at end smallexample + at end example + at noindent Also add information on how to contact you by electronic and paper mail. + at noindent If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: @smallexample - at var{program} Copyright (C) @var{year} @var{name of author} -This program comes with ABSOLUTELY NO WARRANTY; for details type @samp{show w}. -This is free software, and you are welcome to redistribute it under certain conditions; type @samp{show c} for details. + at var{program} Copyright (C) @var{year} @var{name of author} +This program comes with ABSOLUTELY NO WARRANTY; for details +type @samp{show w}. This is free software, and you are +welcome to redistribute it under certain conditions; +type @samp{show c} for details. @end smallexample The hypothetical commands @samp{show w} and @samp{show c} should show @@ -721,5 +730,3 @@ library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read @url{http://www.gnu.org/philosophy/why-not-lgpl.html}. - - at end enumerate commit e7cbce8fb2b7417fd1048f916b3e3281f5b9dd7b Author: Daniel Kahn Gillmor Date: Fri Dec 19 17:53:36 2014 -0500 avoid future chance of using uninitialized memory * util/iobuf.c: (iobuf_open): initialize len -- Cherry-pick 367b073ab5f439ccf0750461d10c69f36998bd62. In iobuf_open, IOBUFCTRL_DESC and IOBUFCTRL_INIT commands are invoked (via file_filter()) on fcx, passing in a pointer to an uninitialized len. With these two commands, file_filter doesn't actually do anything with the value of len, so there's no actual risk of use of uninitialized memory in the code as it stands. However, some static analysis tools might flag this situation with a warning, and initializing the value doesn't hurt anything, so i think this trivial cleanup is warranted. Debian-Bug-Id: 773469 diff --git a/util/iobuf.c b/util/iobuf.c index 35de020..a330460 100644 --- a/util/iobuf.c +++ b/util/iobuf.c @@ -1107,7 +1107,7 @@ iobuf_open( const char *fname ) IOBUF a; FILEP_OR_FD fp; file_filter_ctx_t *fcx; - size_t len; + size_t len = 0; int print_only = 0; int fd; commit e2e822d22526c1545e095bc24173b732137f5737 Author: Werner Koch Date: Mon Dec 22 12:44:13 2014 +0100 doc: Fix memory leak in yat2m. * doc/yat2m.c (write_th): Free NAME. -- Reported-by: Joshua Rogers diff --git a/doc/yat2m.c b/doc/yat2m.c index f780952..86c3c70 100644 --- a/doc/yat2m.c +++ b/doc/yat2m.c @@ -656,6 +656,7 @@ write_th (FILE *fp) *p++ = 0; fprintf (fp, ".TH %s %s %s \"%s\" \"%s\"\n", name, p, isodatestring (), opt_release, opt_source); + free (name); return 0; } commit aab282855ada8dddee99c777c91829344e91f31a Author: Werner Koch Date: Fri Dec 12 10:41:25 2014 +0100 gpg: Fix possible read of unallocated memory * g10/parse-packet.c (can_handle_critical): Check content length before calling can_handle_critical_notation. -- The problem was found by Jan Bee and gniibe proposed the used fix. Thanks. This bug can't be exploited: Only if the announced length of the notation is 21 or 32 a memcmp against fixed strings using that length would be done. The compared data is followed by the actual signature and thus it is highly likely that not even read of unallocated memory will happen. Nevertheless such a bug needs to be fixed. Signed-off-by: Werner Koch diff --git a/g10/parse-packet.c b/g10/parse-packet.c index 01600e4..e4e524c 100644 --- a/g10/parse-packet.c +++ b/g10/parse-packet.c @@ -1123,10 +1123,13 @@ can_handle_critical( const byte *buffer, size_t n, int type ) switch( type ) { case SIGSUBPKT_NOTATION: - if(n>=8) - return can_handle_critical_notation(buffer+8,(buffer[4]<<8)|buffer[5]); - else - return 0; + if (n >= 8) + { + size_t notation_len = ((buffer[4] << 8) | buffer[5]); + if (n - 8 >= notation_len) + return can_handle_critical_notation (buffer + 8, notation_len); + } + return 0; case SIGSUBPKT_SIGNATURE: case SIGSUBPKT_SIG_CREATED: case SIGSUBPKT_SIG_EXPIRE: ----------------------------------------------------------------------- Summary of changes: doc/gpl.texi | 25 ++++++++++++++++--------- doc/yat2m.c | 1 + g10/parse-packet.c | 11 +++++++---- util/iobuf.c | 2 +- 4 files changed, 25 insertions(+), 14 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Tue Jan 13 04:24:23 2015 From: cvs at cvs.gnupg.org (by Andreas Schwier) Date: Tue, 13 Jan 2015 04:24:23 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-30-g16a1330 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 16a1330fa16f6b23e2661c0175c431ab40da45ff (commit) from 3197f69fabb54e72d0c8d7fa9dd3743cad390902 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 16a1330fa16f6b23e2661c0175c431ab40da45ff Author: Andreas Schwier Date: Fri Jul 18 18:22:26 2014 +0200 scd: Allow for certificates > 1024 with PC/SC. * scd/pcsc-wrapper.c (handle_transmit): Enlarge buffer to 4096 too allow for larger certificates. -- Cherry-pick from 5798673156a66f4c39e1d34e358b03539194d57c. Forward ported from 2.0. diff --git a/scd/pcsc-wrapper.c b/scd/pcsc-wrapper.c index b3060e1..843603a 100644 --- a/scd/pcsc-wrapper.c +++ b/scd/pcsc-wrapper.c @@ -715,7 +715,7 @@ handle_transmit (unsigned char *argbuf, size_t arglen) long err; struct pcsc_io_request_s send_pci; pcsc_dword_t recv_len; - unsigned char buffer[1024]; + unsigned char buffer[4096]; /* The apdu should at least be one byte. */ if (!arglen) ----------------------------------------------------------------------- Summary of changes: scd/pcsc-wrapper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 15 10:38:11 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 15 Jan 2015 10:38:11 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-162-g9d2a22c Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via 9d2a22c94ae99f9301321082c4fb8d73f4085fda (commit) via 27a91a93d101ef080f71e5d7e50c3cbf3dbb2e39 (commit) from 9d328962660da72f094dc5424d5ef67abbaffdf6 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9d2a22c94ae99f9301321082c4fb8d73f4085fda Author: Werner Koch Date: Thu Jan 15 10:04:43 2015 +0100 Add functions to count trailing zero bits in a word. * cipher/bithelp.h (_gcry_ctz, _gcry_ctz64): New. * configure.ac (HAVE_BUILTIN_CTZ): Add new test. -- Note that these functions return the number of bits in the word when passing 0. Signed-off-by: Werner Koch diff --git a/cipher/bithelp.h b/cipher/bithelp.h index 6e59c53..2220bc8 100644 --- a/cipher/bithelp.h +++ b/cipher/bithelp.h @@ -77,4 +77,49 @@ _gcry_bswap64(u64 x) # endif #endif + +/* Count trailing zero bits in an unsigend int. We return an int + because that is what gcc's builtin does. Returns the number of + bits in X if X is 0. */ +static inline int +_gcry_ctz (unsigned int x) +{ +#if defined (HAVE_BUILTIN_CTZ) + return x? __builtin_ctz (x) : 8 * sizeof (x); +#else + /* See + * http://graphics.stanford.edu/~seander/bithacks.html#ZerosOnRightModLookup + */ + static const unsigned char mod37[] = + { + sizeof (unsigned int)*8, + 0, 1, 26, 2, 23, 27, 0, 3, 16, 24, 30, 28, 11, 0, 13, + 4, 7, 17, 0, 25, 22, 31, 15, 29, 10, 12, 6, 0, 21, 14, 9, + 5, 20, 8, 19, 18 + }; + return (int)mod37[(-x & x) % 37]; +#endif +} + + +/* Count trailing zero bits in an u64. We return an int because that + is what gcc's builtin does. Returns the number of bits in X if X + is 0. */ +#ifdef HAVE_U64_TYPEDEF +static inline int +_gcry_ctz64(u64 x) +{ +#if defined (HAVE_BUILTIN_CTZ) && SIZEOF_UNSIGNED_INT >= 8 +#warning hello + return x? __builtin_ctz (x) : 8 * sizeof (x); +#else + if ((x & 0xffffffff)) + return _gcry_ctz (x); + else + return 32 + _gcry_ctz (x >> 32); +#endif +} +#endif /*HAVE_U64_TYPEDEF*/ + + #endif /*G10_BITHELP_H*/ diff --git a/configure.ac b/configure.ac index 4cfebe7..4bbd686 100644 --- a/configure.ac +++ b/configure.ac @@ -827,6 +827,21 @@ fi # +# Check for __builtin_ctz intrinsic. +# +AC_CACHE_CHECK(for __builtin_ctz, + [gcry_cv_have_builtin_ctz], + [gcry_cv_have_builtin_ctz=no + AC_LINK_IFELSE([AC_LANG_PROGRAM([], + [unsigned int x = 0; int y = __builtin_ctz(x); return y;])], + [gcry_cv_have_builtin_ctz=yes])]) +if test "$gcry_cv_have_builtin_ctz" = "yes" ; then + AC_DEFINE(HAVE_BUILTIN_CTZ, 1, + [Defined if compiler has '__builtin_ctz' intrinsic]) +fi + + +# # Check for VLA support (variable length arrays). # AC_CACHE_CHECK(whether the variable length arrays are supported, commit 27a91a93d101ef080f71e5d7e50c3cbf3dbb2e39 Author: Werner Koch Date: Thu Jan 15 10:02:28 2015 +0100 Re-indent types.h for easier reading. -- diff --git a/src/types.h b/src/types.h index ee0a62b..561b74d 100644 --- a/src/types.h +++ b/src/types.h @@ -25,16 +25,16 @@ /* The AC_CHECK_SIZEOF() in configure fails for some machines. * we provide some fallback values here */ #if !SIZEOF_UNSIGNED_SHORT -#undef SIZEOF_UNSIGNED_SHORT -#define SIZEOF_UNSIGNED_SHORT 2 +# undef SIZEOF_UNSIGNED_SHORT +# define SIZEOF_UNSIGNED_SHORT 2 #endif #if !SIZEOF_UNSIGNED_INT -#undef SIZEOF_UNSIGNED_INT -#define SIZEOF_UNSIGNED_INT 4 +# undef SIZEOF_UNSIGNED_INT +# define SIZEOF_UNSIGNED_INT 4 #endif #if !SIZEOF_UNSIGNED_LONG -#undef SIZEOF_UNSIGNED_LONG -#define SIZEOF_UNSIGNED_LONG 4 +# undef SIZEOF_UNSIGNED_LONG +# define SIZEOF_UNSIGNED_LONG 4 #endif @@ -42,87 +42,88 @@ #ifndef HAVE_BYTE_TYPEDEF -#undef byte /* maybe there is a macro with this name */ -/* Windows typedefs byte in the rpc headers. Avoid warning about - double definition. */ -#if !(defined(_WIN32) && defined(cbNDRContext)) - typedef unsigned char byte; -#endif -#define HAVE_BYTE_TYPEDEF +# undef byte /* In case there is a macro with that name. */ +# if !(defined(_WIN32) && defined(cbNDRContext)) + /* Windows typedefs byte in the rpc headers. Avoid warning about + double definition. */ + typedef unsigned char byte; +# endif +# define HAVE_BYTE_TYPEDEF #endif #ifndef HAVE_USHORT_TYPEDEF -#undef ushort /* maybe there is a macro with this name */ +# undef ushort /* In case there is a macro with that name. */ typedef unsigned short ushort; -#define HAVE_USHORT_TYPEDEF +# define HAVE_USHORT_TYPEDEF #endif #ifndef HAVE_ULONG_TYPEDEF -#undef ulong /* maybe there is a macro with this name */ +# undef ulong /* In case there is a macro with that name. */ typedef unsigned long ulong; -#define HAVE_ULONG_TYPEDEF +# define HAVE_ULONG_TYPEDEF #endif #ifndef HAVE_U16_TYPEDEF -#undef u16 /* maybe there is a macro with this name */ -#if SIZEOF_UNSIGNED_INT == 2 - typedef unsigned int u16; -#elif SIZEOF_UNSIGNED_SHORT == 2 - typedef unsigned short u16; -#else -#error no typedef for u16 -#endif -#define HAVE_U16_TYPEDEF +# undef u16 /* In case there is a macro with that name. */ +# if SIZEOF_UNSIGNED_INT == 2 + typedef unsigned int u16; +# elif SIZEOF_UNSIGNED_SHORT == 2 + typedef unsigned short u16; +# else +# error no typedef for u16 +# endif +# define HAVE_U16_TYPEDEF #endif #ifndef HAVE_U32_TYPEDEF -#undef u32 /* maybe there is a macro with this name */ -#if SIZEOF_UNSIGNED_INT == 4 - typedef unsigned int u32; -#elif SIZEOF_UNSIGNED_LONG == 4 - typedef unsigned long u32; -#else -#error no typedef for u32 -#endif -#define HAVE_U32_TYPEDEF +# undef u32 /* In case there is a macro with that name. */ +# if SIZEOF_UNSIGNED_INT == 4 + typedef unsigned int u32; +# elif SIZEOF_UNSIGNED_LONG == 4 + typedef unsigned long u32; +# else +# error no typedef for u32 +# endif +# define HAVE_U32_TYPEDEF #endif -/**************** +/* * Warning: Some systems segfault when this u64 typedef and * the dummy code in cipher/md.c is not available. Examples are * Solaris and IRIX. */ #ifndef HAVE_U64_TYPEDEF -#undef u64 /* maybe there is a macro with this name */ -#if SIZEOF_UNSIGNED_INT == 8 - typedef unsigned int u64; -#define U64_C(c) (c ## U) -#define HAVE_U64_TYPEDEF -#elif SIZEOF_UNSIGNED_LONG == 8 - typedef unsigned long u64; -#define U64_C(c) (c ## UL) -#define HAVE_U64_TYPEDEF -#elif SIZEOF_UNSIGNED_LONG_LONG == 8 - typedef unsigned long long u64; -#define U64_C(c) (c ## ULL) -#define HAVE_U64_TYPEDEF -#elif SIZEOF_UINT64_T == 8 - typedef uint64_t u64; -#define U64_C(c) (UINT64_C(c)) -#define HAVE_U64_TYPEDEF -#endif +# undef u64 /* In case there is a macro with that name. */ +# if SIZEOF_UNSIGNED_INT == 8 + typedef unsigned int u64; +# define U64_C(c) (c ## U) +# define HAVE_U64_TYPEDEF +# elif SIZEOF_UNSIGNED_LONG == 8 + typedef unsigned long u64; +# define U64_C(c) (c ## UL) +# define HAVE_U64_TYPEDEF +# elif SIZEOF_UNSIGNED_LONG_LONG == 8 + typedef unsigned long long u64; +# define U64_C(c) (c ## ULL) +# define HAVE_U64_TYPEDEF +# elif SIZEOF_UINT64_T == 8 + typedef uint64_t u64; +# define U64_C(c) (UINT64_C(c)) +# define HAVE_U64_TYPEDEF +# endif #endif -typedef union { - int a; - short b; - char c[1]; - long d; +typedef union +{ + int a; + short b; + char c[1]; + long d; #ifdef HAVE_U64_TYPEDEF - u64 e; + u64 e; #endif - float f; - double g; + float f; + double g; } PROPERLY_ALIGNED_TYPE; #endif /*GCRYPT_TYPES_H*/ ----------------------------------------------------------------------- Summary of changes: cipher/bithelp.h | 45 ++++++++++++++++++++ configure.ac | 15 +++++++ src/types.h | 125 ++++++++++++++++++++++++++++--------------------------- 3 files changed, 123 insertions(+), 62 deletions(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 16 14:57:30 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 16 Jan 2015 14:57:30 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-163-g067d7d8 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via 067d7d8752d4d8a98f8e0e5e9b1a5b13e1b7ff9c (commit) from 9d2a22c94ae99f9301321082c4fb8d73f4085fda (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 067d7d8752d4d8a98f8e0e5e9b1a5b13e1b7ff9c Author: Werner Koch Date: Fri Jan 16 14:55:03 2015 +0100 Add OCB cipher mode * cipher/cipher-ocb.c: New. * cipher/Makefile.am (libcipher_la_SOURCES): Add cipher-ocb.c * cipher/cipher-internal.h (OCB_BLOCK_LEN, OCB_L_TABLE_SIZE): New. (gcry_cipher_handle): Add fields marks.finalize and u_mode.ocb. * cipher/cipher.c (_gcry_cipher_open_internal): Add OCB mode. (_gcry_cipher_open_internal): Setup default taglen of OCB. (cipher_reset): Clear OCB specific data. (cipher_encrypt, cipher_decrypt, _gcry_cipher_authenticate) (_gcry_cipher_gettag, _gcry_cipher_checktag): Call OCB functions. (_gcry_cipher_setiv): Add OCB specific nonce setting. (_gcry_cipher_ctl): Add GCRYCTL_FINALIZE and GCRYCTL_SET_TAGLEN * src/gcrypt.h.in (GCRYCTL_SET_TAGLEN): New. (gcry_cipher_final): New. * cipher/bufhelp.h (buf_xor_1): New. * tests/basic.c (hex2buffer): New. (check_ocb_cipher): New. (main): Call it here. Add option --cipher-modes. * tests/bench-slope.c (bench_aead_encrypt_do_bench): Call gcry_cipher_final. (bench_aead_decrypt_do_bench): Ditto. (bench_aead_authenticate_do_bench): Ditto. Check error code. (bench_ocb_encrypt_do_bench): New. (bench_ocb_decrypt_do_bench): New. (bench_ocb_authenticate_do_bench): New. (ocb_encrypt_ops): New. (ocb_decrypt_ops): New. (ocb_authenticate_ops): New. (cipher_modes): Add them. (cipher_bench_one): Skip wrong block length for OCB. * tests/benchmark.c (cipher_bench): Add field noncelen to MODES. Add OCB support. -- See the comments on top of cipher/cipher-ocb.c for the patent status of the OCB mode. The implementation has not yet been optimized and as such is not faster that the other AEAD modes. A first candidate for optimization is the double_block function. Large improvements can be expected by writing an AES ECB function to work on multiple blocks. Signed-off-by: Werner Koch diff --git a/NEWS b/NEWS index 0150fdd..4c74533 100644 --- a/NEWS +++ b/NEWS @@ -21,6 +21,8 @@ Noteworthy changes in version 1.7.0 (unreleased) * Fixed some asm build problems and feature detection bugs. + * Added OCB mode. + * Interface changes relative to the 1.6.0 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ gcry_mac_get_algo NEW. @@ -30,6 +32,9 @@ Noteworthy changes in version 1.7.0 (unreleased) gcry_cipher_set_sbox NEW macro. GCRY_MD_GOSTR3411_CP NEW. gcry_mpi_ec_sub NEW. + GCRY_CIPHER_MODE_OCB NEW. + GCRYCTL_SET_TAGLEN NEW. + gcry_cipher_final NEW macro. Noteworthy changes in version 1.6.0 (2013-12-16) diff --git a/cipher/Makefile.am b/cipher/Makefile.am index ceb95f1..4a9c86d 100644 --- a/cipher/Makefile.am +++ b/cipher/Makefile.am @@ -41,7 +41,8 @@ libcipher_la_SOURCES = \ cipher.c cipher-internal.h \ cipher-cbc.c cipher-cfb.c cipher-ofb.c cipher-ctr.c cipher-aeswrap.c \ cipher-ccm.c cipher-cmac.c cipher-gcm.c cipher-gcm-intel-pclmul.c \ -cipher-poly1305.c cipher-selftest.c cipher-selftest.h \ +cipher-poly1305.c cipher-ocb.c \ +cipher-selftest.c cipher-selftest.h \ pubkey.c pubkey-internal.h pubkey-util.c \ md.c \ mac.c mac-internal.h \ diff --git a/cipher/bufhelp.h b/cipher/bufhelp.h index 464b141..a372acb 100644 --- a/cipher/bufhelp.h +++ b/cipher/bufhelp.h @@ -120,6 +120,40 @@ do_bytes: } +/* Optimized function for in-place buffer xoring. */ +static inline void +buf_xor_1(void *_dst, const void *_src, size_t len) +{ + byte *dst = _dst; + const byte *src = _src; + uintptr_t *ldst; + const uintptr_t *lsrc; +#ifndef BUFHELP_FAST_UNALIGNED_ACCESS + const unsigned int longmask = sizeof(uintptr_t) - 1; + + /* Skip fast processing if buffers are unaligned. */ + if (((uintptr_t)dst | (uintptr_t)src) & longmask) + goto do_bytes; +#endif + + ldst = (uintptr_t *)(void *)dst; + lsrc = (const uintptr_t *)(const void *)src; + + for (; len >= sizeof(uintptr_t); len -= sizeof(uintptr_t)) + *ldst++ ^= *lsrc++; + + dst = (byte *)ldst; + src = (const byte *)lsrc; + +#ifndef BUFHELP_FAST_UNALIGNED_ACCESS +do_bytes: +#endif + /* Handle tail. */ + for (; len; len--) + *dst++ ^= *src; +} + + /* Optimized function for buffer xoring with two destination buffers. Used mainly by CFB mode encryption. */ static inline void diff --git a/cipher/cipher-internal.h b/cipher/cipher-internal.h index 650d813..50b0324 100644 --- a/cipher/cipher-internal.h +++ b/cipher/cipher-internal.h @@ -26,6 +26,25 @@ /* The maximum supported size of a block in bytes. */ #define MAX_BLOCKSIZE 16 +/* The length for an OCB block. Although OCB supports any block + length it does not make sense to use a 64 bit blocklen (and cipher) + because this reduces the security margin to an unacceptable state. + Thus we require a cipher with 128 bit blocklength. */ +#define OCB_BLOCK_LEN (128/8) + +/* The size of the pre-computed L table for OCB. This takes the same + size as the table used for GCM and thus we don't save anything by + not using such a table. */ +#define OCB_L_TABLE_SIZE 16 + + +/* Check the above constants. */ +#if OCB_BLOCK_LEN > MAX_BLOCKSIZE +# error OCB_BLOCKLEN > MAX_BLOCKSIZE +#endif + + + /* Magic values for the context structure. */ #define CTX_MAGIC_NORMAL 0x24091964 #define CTX_MAGIC_SECURE 0x46919042 @@ -119,19 +138,22 @@ struct gcry_cipher_handle unsigned int key:1; /* Set to 1 if a key has been set. */ unsigned int iv:1; /* Set to 1 if a IV has been set. */ unsigned int tag:1; /* Set to 1 if a tag is finalized. */ + unsigned int finalize:1; /* Next encrypt/decrypt has the final data. */ } marks; /* The initialization vector. For best performance we make sure that it is properly aligned. In particular some implementations of bulk operations expect an 16 byte aligned IV. IV is also used - to store CBC-MAC in CCM mode; counter IV is stored in U_CTR. */ + to store CBC-MAC in CCM mode; counter IV is stored in U_CTR. For + OCB mode it is used for the offset value. */ union { cipher_context_alignment_t iv_align; unsigned char iv[MAX_BLOCKSIZE]; } u_iv; /* The counter for CTR mode. This field is also used by AESWRAP and - thus we can't use the U_IV union. */ + thus we can't use the U_IV union. For OCB mode it is used for + the checksum. */ union { cipher_context_alignment_t iv_align; unsigned char ctr[MAX_BLOCKSIZE]; @@ -232,6 +254,40 @@ struct gcry_cipher_handle #endif #endif } gcm; + + /* Mode specific storage for OCB mode. */ + struct { + /* Helper variables and pre-computed table of L values. */ + unsigned char L_star[OCB_BLOCK_LEN]; + unsigned char L_dollar[OCB_BLOCK_LEN]; + unsigned char L[OCB_BLOCK_LEN][OCB_L_TABLE_SIZE]; + + /* The tag is valid if marks.tag has been set. */ + unsigned char tag[OCB_BLOCK_LEN]; + + /* A buffer to hold the offset for the AAD processing. */ + unsigned char aad_offset[OCB_BLOCK_LEN]; + + /* A buffer to hold the current sum of AAD processing. We can't + use tag here because tag may already hold the preprocessed + checksum of the data. */ + unsigned char aad_sum[OCB_BLOCK_LEN]; + + /* Number of data/aad blocks processed so far. */ + u64 data_nblocks; + u64 aad_nblocks; + + /* Length of the tag. Fixed for now but may eventually be + specified using a set of gcry_cipher_flags. */ + unsigned char taglen; + + /* Flags indicating that the final data/aad block has been + processed. */ + unsigned int data_finalized:1; + unsigned int aad_finalized:1; + + } ocb; + } u_mode; /* What follows are two contexts of the cipher in use. The first @@ -363,4 +419,27 @@ gcry_err_code_t _gcry_cipher_poly1305_check_tag void _gcry_cipher_poly1305_setkey /* */ (gcry_cipher_hd_t c); + +/*-- cipher-ocb.c --*/ +gcry_err_code_t _gcry_cipher_ocb_encrypt +/* */ (gcry_cipher_hd_t c, + unsigned char *outbuf, size_t outbuflen, + const unsigned char *inbuf, size_t inbuflen); +gcry_err_code_t _gcry_cipher_ocb_decrypt +/* */ (gcry_cipher_hd_t c, + unsigned char *outbuf, size_t outbuflen, + const unsigned char *inbuf, size_t inbuflen); +gcry_err_code_t _gcry_cipher_ocb_set_nonce +/* */ (gcry_cipher_hd_t c, const unsigned char *nonce, + size_t noncelen); +gcry_err_code_t _gcry_cipher_ocb_authenticate +/* */ (gcry_cipher_hd_t c, const unsigned char *abuf, size_t abuflen); +gcry_err_code_t _gcry_cipher_ocb_get_tag +/* */ (gcry_cipher_hd_t c, + unsigned char *outtag, size_t taglen); +gcry_err_code_t _gcry_cipher_ocb_check_tag +/* */ (gcry_cipher_hd_t c, + const unsigned char *intag, size_t taglen); + + #endif /*G10_CIPHER_INTERNAL_H*/ diff --git a/cipher/cipher-ocb.c b/cipher/cipher-ocb.c new file mode 100644 index 0000000..25466f0 --- /dev/null +++ b/cipher/cipher-ocb.c @@ -0,0 +1,495 @@ +/* cipher-ocb.c - OCB cipher mode + * Copyright (C) 2015 g10 Code GmbH + * + * This file is part of Libgcrypt. + * + * Libgcrypt is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser general Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * Libgcrypt is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this program; if not, see . + * + * + * OCB is covered by several patents but may be used freely by most + * software. See http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm . + * In particular license 1 is suitable for Libgcrypt: See + * http://web.cs.ucdavis.edu/~rogaway/ocb/license1.pdf for the full + * license document; it basically says: + * + * License 1 ? License for Open-Source Software Implementations of OCB + * (Jan 9, 2013) + * + * Under this license, you are authorized to make, use, and + * distribute open-source software implementations of OCB. This + * license terminates for you if you sue someone over their + * open-source software implementation of OCB claiming that you have + * a patent covering their implementation. + */ + + +#include +#include +#include +#include +#include + +#include "g10lib.h" +#include "cipher.h" +#include "bufhelp.h" +#include "./cipher-internal.h" + + +/* Double the OCB_BLOCK_LEN sized block B in-place. */ +static inline void +double_block (unsigned char *b) +{ +#if OCB_BLOCK_LEN != 16 + unsigned char b_0 = b[0]; + int i; + + for (i=0; i < OCB_BLOCK_LEN - 1; i++) + b[i] = (b[i] << 1) | (b[i+1] >> 7); + + b[OCB_BLOCK_LEN-1] = (b[OCB_BLOCK_LEN-1] << 1) ^ ((b_0 >> 7) * 135); +#else + /* This is the generic code for 16 byte blocks. However it is not + faster than the straight byte by byte implementation. */ + u64 l_0, l, r; + + l = buf_get_be64 (b); + r = buf_get_be64 (b + 8); + + l_0 = (int64_t)l >> 63; + l = (l + l) ^ (r >> 63); + r = (r + r) ^ (l_0 & 135); + + buf_put_be64 (b, l); + buf_put_be64 (b+8, r); +#endif +} + + +/* Double the OCB_BLOCK_LEN sized block S and store it at D. S and D + may point to the same memory location but they may not overlap. */ +static void +double_block_cpy (unsigned char *d, const unsigned char *s) +{ + if (d != s) + buf_cpy (d, s, OCB_BLOCK_LEN); + double_block (d); +} + + +/* Copy NBYTES from buffer S starting at bit offset BITOFF to buffer D. */ +static void +bit_copy (unsigned char *d, const unsigned char *s, + unsigned int bitoff, unsigned int nbytes) +{ + unsigned int shift; + + s += bitoff / 8; + shift = bitoff % 8; + if (shift) + { + for (; nbytes; nbytes--, d++, s++) + *d = (s[0] << shift) | (s[1] >> (8 - shift)); + } + else + { + for (; nbytes; nbytes--, d++, s++) + *d = *s; + } +} + + +/* Return the L-value for block N. In most cases we use the table; + only if the lower OCB_L_TABLE_SIZE bits of N are zero we need to + compute it. With a table size of 16 we need to this this only + every 65536-th block. L_TMP is a helper buffer of size + OCB_BLOCK_LEN which is used to hold the computation if not taken + from the table. */ +static const unsigned char * +get_l (gcry_cipher_hd_t c, unsigned char *l_tmp, u64 n) +{ + int ntz = _gcry_ctz64 (n); + + if (ntz < OCB_L_TABLE_SIZE) + return c->u_mode.ocb.L[ntz]; + + double_block_cpy (l_tmp, c->u_mode.ocb.L[OCB_L_TABLE_SIZE - 1]); + for (ntz -= OCB_L_TABLE_SIZE; ntz; ntz--) + double_block (l_tmp); + + return l_tmp; +} + + +/* Set the nonce for OCB. This requires that the key has been set. + Using it again resets start a new encryption cycle using the same + key. */ +gcry_err_code_t +_gcry_cipher_ocb_set_nonce (gcry_cipher_hd_t c, const unsigned char *nonce, + size_t noncelen) +{ + unsigned char ktop[OCB_BLOCK_LEN]; + unsigned char stretch[OCB_BLOCK_LEN + 8]; + unsigned int bottom; + int i; + unsigned int burn = 0; + unsigned int nburn; + + /* Check args. */ + if (!c->marks.key) + return GPG_ERR_INV_STATE; /* Key must have been set first. */ + switch (c->u_mode.ocb.taglen) + { + case 8: + case 12: + case 16: + break; + default: + return GPG_ERR_BUG; /* Invalid tag length. */ + } + + if (c->spec->blocksize != OCB_BLOCK_LEN) + return GPG_ERR_CIPHER_ALGO; + if (!nonce) + return GPG_ERR_INV_ARG; + /* 120 bit is the allowed maximum. In addition we impose a minimum + of 64 bit. */ + if (noncelen > (120/8) || noncelen < (64/8) || noncelen >= OCB_BLOCK_LEN) + return GPG_ERR_INV_LENGTH; + + /* Set up the L table. */ + /* L_star = E(zero_128) */ + memset (ktop, 0, OCB_BLOCK_LEN); + nburn = c->spec->encrypt (&c->context.c, c->u_mode.ocb.L_star, ktop); + burn = nburn > burn ? nburn : burn; + /* L_dollar = double(L_star) */ + double_block_cpy (c->u_mode.ocb.L_dollar, c->u_mode.ocb.L_star); + /* L_0 = double(L_dollar), ... */ + double_block_cpy (c->u_mode.ocb.L[0], c->u_mode.ocb.L_dollar); + for (i = 1; i < OCB_L_TABLE_SIZE; i++) + double_block_cpy (c->u_mode.ocb.L[i], c->u_mode.ocb.L[i-1]); + + /* Prepare the nonce. */ + memset (ktop, 0, (OCB_BLOCK_LEN - noncelen)); + buf_cpy (ktop + (OCB_BLOCK_LEN - noncelen), nonce, noncelen); + ktop[0] = ((c->u_mode.ocb.taglen * 8) % 128) << 1; + ktop[OCB_BLOCK_LEN - noncelen - 1] |= 1; + bottom = ktop[OCB_BLOCK_LEN - 1] & 0x3f; + ktop[OCB_BLOCK_LEN - 1] &= 0xc0; /* Zero the bottom bits. */ + nburn = c->spec->encrypt (&c->context.c, ktop, ktop); + burn = nburn > burn ? nburn : burn; + /* Stretch = Ktop || (Ktop[1..64] xor Ktop[9..72]) */ + buf_cpy (stretch, ktop, OCB_BLOCK_LEN); + buf_xor (stretch + OCB_BLOCK_LEN, ktop, ktop + 1, 8); + /* Offset_0 = Stretch[1+bottom..128+bottom] + (We use the IV field to store the offset) */ + bit_copy (c->u_iv.iv, stretch, bottom, OCB_BLOCK_LEN); + c->marks.iv = 1; + + /* Checksum_0 = zeros(128) + (We use the CTR field to store the checksum) */ + memset (c->u_ctr.ctr, 0, OCB_BLOCK_LEN); + + /* Clear AAD buffer. */ + memset (c->u_mode.ocb.aad_offset, 0, OCB_BLOCK_LEN); + memset (c->u_mode.ocb.aad_sum, 0, OCB_BLOCK_LEN); + + /* Setup other values. */ + memset (c->lastiv, 0, sizeof(c->lastiv)); + c->unused = 0; + c->marks.tag = 0; + c->marks.finalize = 0; + c->u_mode.ocb.data_nblocks = 0; + c->u_mode.ocb.aad_nblocks = 0; + c->u_mode.ocb.data_finalized = 0; + c->u_mode.ocb.aad_finalized = 0; + + /* log_printhex ("L_* ", c->u_mode.ocb.L_star, OCB_BLOCK_LEN); */ + /* log_printhex ("L_$ ", c->u_mode.ocb.L_dollar, OCB_BLOCK_LEN); */ + /* log_printhex ("L_0 ", c->u_mode.ocb.L[0], OCB_BLOCK_LEN); */ + /* log_printhex ("L_1 ", c->u_mode.ocb.L[1], OCB_BLOCK_LEN); */ + /* log_debug ( "bottom : %u (decimal)\n", bottom); */ + /* log_printhex ("Ktop ", ktop, OCB_BLOCK_LEN); */ + /* log_printhex ("Stretch ", stretch, sizeof stretch); */ + /* log_printhex ("Offset_0 ", c->u_iv.iv, OCB_BLOCK_LEN); */ + + /* Cleanup */ + wipememory (ktop, sizeof ktop); + wipememory (stretch, sizeof stretch); + if (burn > 0) + _gcry_burn_stack (burn + 4*sizeof(void*)); + + return 0; +} + + +/* Process additional authentication data. This implementation allows + to add additional authentication data at any time before the final + gcry_cipher_gettag. The size of the data provided in + (ABUF,ABUFLEN) must be a multiple of the blocksize. If a + non-multiple of the blocksize is used no further data may be passed + to this function. */ +gcry_err_code_t +_gcry_cipher_ocb_authenticate (gcry_cipher_hd_t c, const unsigned char *abuf, + size_t abuflen) +{ + unsigned char l_tmp[OCB_BLOCK_LEN]; + + /* Check that a nonce and thus a key has been set and that we have + not yet computed the tag. We also return an error if the aad has + been finalized (i.e. a short block has been processed). */ + if (!c->marks.iv || c->marks.tag || c->u_mode.ocb.aad_finalized) + return GPG_ERR_INV_STATE; + + /* Check correct usage and arguments. */ + if (c->spec->blocksize != OCB_BLOCK_LEN) + return GPG_ERR_CIPHER_ALGO; + if (!abuflen) + return 0; + + /* Hash all full blocks. */ + while (abuflen >= OCB_BLOCK_LEN) + { + c->u_mode.ocb.aad_nblocks++; + + /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */ + buf_xor_1 (c->u_mode.ocb.aad_offset, + get_l (c, l_tmp, c->u_mode.ocb.aad_nblocks), OCB_BLOCK_LEN); + /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i) */ + buf_xor (l_tmp, c->u_mode.ocb.aad_offset, abuf, OCB_BLOCK_LEN); + c->spec->encrypt (&c->context.c, l_tmp, l_tmp); + buf_xor_1 (c->u_mode.ocb.aad_sum, l_tmp, OCB_BLOCK_LEN); + + abuf += OCB_BLOCK_LEN; + abuflen -= OCB_BLOCK_LEN; + } + + /* Hash final partial block. Note that we expect ABUFLEN to be + shorter than OCB_BLOCK_LEN. */ + if (abuflen) + { + /* Offset_* = Offset_m xor L_* */ + buf_xor_1 (c->u_mode.ocb.aad_offset, + c->u_mode.ocb.L_star, OCB_BLOCK_LEN); + /* CipherInput = (A_* || 1 || zeros(127-bitlen(A_*))) xor Offset_* */ + buf_cpy (l_tmp, abuf, abuflen); + memset (l_tmp + abuflen, 0, OCB_BLOCK_LEN - abuflen); + l_tmp[abuflen] = 0x80; + buf_xor_1 (l_tmp, c->u_mode.ocb.aad_offset, OCB_BLOCK_LEN); + /* Sum = Sum_m xor ENCIPHER(K, CipherInput) */ + c->spec->encrypt (&c->context.c, l_tmp, l_tmp); + buf_xor_1 (c->u_mode.ocb.aad_sum, l_tmp, OCB_BLOCK_LEN); + + /* Mark AAD as finalized to avoid accidently calling this + function again after a non-full block has been processed. */ + c->u_mode.ocb.aad_finalized = 1; + } + + return 0; +} + + +/* Common code for encrypt and decrypt. */ +static gcry_err_code_t +ocb_crypt (gcry_cipher_hd_t c, int encrypt, + unsigned char *outbuf, size_t outbuflen, + const unsigned char *inbuf, size_t inbuflen) +{ + unsigned char l_tmp[OCB_BLOCK_LEN]; + unsigned int burn = 0; + unsigned int nburn; + + /* Check that a nonce and thus a key has been set and that we are + not yet in end of data state. */ + if (!c->marks.iv || c->u_mode.ocb.data_finalized) + return GPG_ERR_INV_STATE; + + /* Check correct usage and arguments. */ + if (c->spec->blocksize != OCB_BLOCK_LEN) + return GPG_ERR_CIPHER_ALGO; + if (outbuflen < inbuflen) + return GPG_ERR_BUFFER_TOO_SHORT; + if (c->marks.finalize) + ; /* Allow arbitarty length. */ + else if ((inbuflen % OCB_BLOCK_LEN)) + return GPG_ERR_INV_LENGTH; /* We support only full blocks for now. */ + + /* Encrypt all full blocks. */ + while (inbuflen >= OCB_BLOCK_LEN) + { + c->u_mode.ocb.data_nblocks++; + + /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */ + buf_xor_1 (c->u_iv.iv, + get_l (c, l_tmp, c->u_mode.ocb.data_nblocks), OCB_BLOCK_LEN); + /* C_i = Offset_i xor ENCIPHER(K, P_i xor Offset_i) */ + buf_xor (outbuf, c->u_iv.iv, inbuf, OCB_BLOCK_LEN); + if (encrypt) + nburn = c->spec->encrypt (&c->context.c, outbuf, outbuf); + else + nburn = c->spec->decrypt (&c->context.c, outbuf, outbuf); + burn = nburn > burn ? nburn : burn; + buf_xor_1 (outbuf, c->u_iv.iv, OCB_BLOCK_LEN); + + /* Checksum_i = Checksum_{i-1} xor P_i */ + buf_xor_1 (c->u_ctr.ctr, encrypt? inbuf : outbuf, OCB_BLOCK_LEN); + + inbuf += OCB_BLOCK_LEN; + inbuflen -= OCB_BLOCK_LEN; + outbuf += OCB_BLOCK_LEN; + outbuflen =- OCB_BLOCK_LEN; + } + + /* Encrypt final partial block. Note that we expect INBUFLEN to be + shorter than OCB_BLOCK_LEN (see above). */ + if (inbuflen) + { + unsigned char pad[OCB_BLOCK_LEN]; + + /* Offset_* = Offset_m xor L_* */ + buf_xor_1 (c->u_iv.iv, c->u_mode.ocb.L_star, OCB_BLOCK_LEN); + /* Pad = ENCIPHER(K, Offset_*) */ + nburn = c->spec->encrypt (&c->context.c, pad, c->u_iv.iv); + burn = nburn > burn ? nburn : burn; + + if (encrypt) + { + /* Checksum_* = Checksum_m xor (P_* || 1 || zeros(127-bitlen(P_*))) */ + /* Note that INBUFLEN is less than OCB_BLOCK_LEN. */ + buf_cpy (l_tmp, inbuf, inbuflen); + memset (l_tmp + inbuflen, 0, OCB_BLOCK_LEN - inbuflen); + l_tmp[inbuflen] = 0x80; + buf_xor_1 (c->u_ctr.ctr, l_tmp, OCB_BLOCK_LEN); + /* C_* = P_* xor Pad[1..bitlen(P_*)] */ + buf_xor (outbuf, inbuf, pad, inbuflen); + } + else + { + /* P_* = C_* xor Pad[1..bitlen(C_*)] */ + /* Checksum_* = Checksum_m xor (P_* || 1 || zeros(127-bitlen(P_*))) */ + buf_cpy (l_tmp, pad, OCB_BLOCK_LEN); + buf_cpy (l_tmp, inbuf, inbuflen); + buf_xor_1 (l_tmp, pad, OCB_BLOCK_LEN); + l_tmp[inbuflen] = 0x80; + buf_cpy (outbuf, l_tmp, inbuflen); + + buf_xor_1 (c->u_ctr.ctr, l_tmp, OCB_BLOCK_LEN); + } + } + + /* Compute the tag if the finalize flag has been set. */ + if (c->marks.finalize) + { + /* Tag = ENCIPHER(K, Checksum xor Offset xor L_$) xor HASH(K,A) */ + buf_xor (c->u_mode.ocb.tag, c->u_ctr.ctr, c->u_iv.iv, OCB_BLOCK_LEN); + buf_xor_1 (c->u_mode.ocb.tag, c->u_mode.ocb.L_dollar, OCB_BLOCK_LEN); + nburn = c->spec->encrypt (&c->context.c, + c->u_mode.ocb.tag, c->u_mode.ocb.tag); + burn = nburn > burn ? nburn : burn; + + c->u_mode.ocb.data_finalized = 1; + /* Note that the the final part of the tag computation is done + by _gcry_cipher_ocb_get_tag. */ + } + + if (burn > 0) + _gcry_burn_stack (burn + 4*sizeof(void*)); + + return 0; +} + + +/* Encrypt (INBUF,INBUFLEN) in OCB mode to OUTBUF. OUTBUFLEN gives + the allocated size of OUTBUF. This function accepts only multiples + of a full block unless gcry_cipher_final has been called in which + case the next block may have any length. */ +gcry_err_code_t +_gcry_cipher_ocb_encrypt (gcry_cipher_hd_t c, + unsigned char *outbuf, size_t outbuflen, + const unsigned char *inbuf, size_t inbuflen) + +{ + return ocb_crypt (c, 1, outbuf, outbuflen, inbuf, inbuflen); +} + + +/* Decrypt (INBUF,INBUFLEN) in OCB mode to OUTBUF. OUTBUFLEN gives + the allocated size of OUTBUF. This function accepts only multiples + of a full block unless gcry_cipher_final has been called in which + case the next block may have any length. */ +gcry_err_code_t +_gcry_cipher_ocb_decrypt (gcry_cipher_hd_t c, + unsigned char *outbuf, size_t outbuflen, + const unsigned char *inbuf, size_t inbuflen) +{ + return ocb_crypt (c, 0, outbuf, outbuflen, inbuf, inbuflen); +} + + +/* Compute the tag. The last data operation has already done some + part of it. To allow adding AAD even after having done all data, + we finish the tag computation only here. */ +static void +compute_tag_if_needed (gcry_cipher_hd_t c) +{ + if (!c->marks.tag) + { + buf_xor_1 (c->u_mode.ocb.tag, c->u_mode.ocb.aad_sum, OCB_BLOCK_LEN); + c->marks.tag = 1; + } +} + + +/* Copy the already computed tag to OUTTAG. OUTTAGSIZE is the + allocated size of OUTTAG; the function returns an error if that is + too short to hold the tag. */ +gcry_err_code_t +_gcry_cipher_ocb_get_tag (gcry_cipher_hd_t c, + unsigned char *outtag, size_t outtagsize) +{ + if (c->u_mode.ocb.taglen > outtagsize) + return GPG_ERR_BUFFER_TOO_SHORT; + if (!c->u_mode.ocb.data_finalized) + return GPG_ERR_INV_STATE; /* Data has not yet been finalized. */ + + compute_tag_if_needed (c); + + memcpy (outtag, c->u_mode.ocb.tag, c->u_mode.ocb.taglen); + + return 0; +} + + +/* Check that the tag (INTAG,TAGLEN) matches the computed tag for the + handle C. */ +gcry_err_code_t +_gcry_cipher_ocb_check_tag (gcry_cipher_hd_t c, const unsigned char *intag, + size_t taglen) +{ + size_t n; + + if (!c->u_mode.ocb.data_finalized) + return GPG_ERR_INV_STATE; /* Data has not yet been finalized. */ + + compute_tag_if_needed (c); + + n = c->u_mode.ocb.taglen; + if (taglen < n) + n = taglen; + + if (!buf_eq_const (intag, c->u_mode.ocb.tag, n) + || c->u_mode.ocb.taglen != taglen) + return GPG_ERR_CHECKSUM; + + return 0; +} diff --git a/cipher/cipher.c b/cipher/cipher.c index 78cad21..0a13fe6 100644 --- a/cipher/cipher.c +++ b/cipher/cipher.c @@ -425,6 +425,17 @@ _gcry_cipher_open_internal (gcry_cipher_hd_t *handle, err = GPG_ERR_INV_CIPHER_MODE; break; + case GCRY_CIPHER_MODE_OCB: + /* Note that our implementation allows only for 128 bit block + length algorithms. Lower block lengths would be possible + but we do not implement them because they limit the + security too much. */ + if (!spec->encrypt || !spec->decrypt) + err = GPG_ERR_INV_CIPHER_MODE; + else if (spec->blocksize != (128/8)) + err = GPG_ERR_INV_CIPHER_MODE; + break; + case GCRY_CIPHER_MODE_STREAM: if (!spec->stencrypt || !spec->stdecrypt) err = GPG_ERR_INV_CIPHER_MODE; @@ -445,7 +456,8 @@ _gcry_cipher_open_internal (gcry_cipher_hd_t *handle, /* Perform selftest here and mark this with a flag in cipher_table? No, we should not do this as it takes too long. Further it does not make sense to exclude algorithms with failing selftests at - runtime: If a selftest fails there is something seriously wrong with the system and thus we better die immediately. */ + runtime: If a selftest fails there is something seriously wrong + with the system and thus we better die immediately. */ if (! err) { @@ -551,6 +563,18 @@ _gcry_cipher_open_internal (gcry_cipher_hd_t *handle, default: break; } + + /* Setup defaults depending on the mode. */ + switch (mode) + { + case GCRY_CIPHER_MODE_OCB: + h->u_mode.ocb.taglen = 16; /* Bytes. */ + break; + + default: + break; + } + } } @@ -716,6 +740,10 @@ cipher_reset (gcry_cipher_hd_t c) break; #endif + case GCRY_CIPHER_MODE_OCB: + memset (&c->u_mode.ocb, 0, sizeof c->u_mode.ocb); + break; + default: break; /* u_mode unused by other modes. */ } @@ -827,6 +855,10 @@ cipher_encrypt (gcry_cipher_hd_t c, byte *outbuf, size_t outbuflen, inbuf, inbuflen); break; + case GCRY_CIPHER_MODE_OCB: + rc = _gcry_cipher_ocb_encrypt (c, outbuf, outbuflen, inbuf, inbuflen); + break; + case GCRY_CIPHER_MODE_STREAM: c->spec->stencrypt (&c->context.c, outbuf, (byte*)/*arggg*/inbuf, inbuflen); @@ -940,6 +972,10 @@ cipher_decrypt (gcry_cipher_hd_t c, byte *outbuf, size_t outbuflen, inbuf, inbuflen); break; + case GCRY_CIPHER_MODE_OCB: + rc = _gcry_cipher_ocb_decrypt (c, outbuf, outbuflen, inbuf, inbuflen); + break; + case GCRY_CIPHER_MODE_STREAM: c->spec->stdecrypt (&c->context.c, outbuf, (byte*)/*arggg*/inbuf, inbuflen); @@ -1029,6 +1065,10 @@ _gcry_cipher_setiv (gcry_cipher_hd_t hd, const void *iv, size_t ivlen) rc = _gcry_cipher_poly1305_setiv (hd, iv, ivlen); break; + case GCRY_CIPHER_MODE_OCB: + rc = _gcry_cipher_ocb_set_nonce (hd, iv, ivlen); + break; + default: rc = cipher_setiv (hd, iv, ivlen); break; @@ -1083,6 +1123,10 @@ _gcry_cipher_authenticate (gcry_cipher_hd_t hd, const void *abuf, rc = _gcry_cipher_poly1305_authenticate (hd, abuf, abuflen); break; + case GCRY_CIPHER_MODE_OCB: + rc = _gcry_cipher_ocb_authenticate (hd, abuf, abuflen); + break; + default: log_error ("gcry_cipher_authenticate: invalid mode %d\n", hd->mode); rc = GPG_ERR_INV_CIPHER_MODE; @@ -1116,6 +1160,10 @@ _gcry_cipher_gettag (gcry_cipher_hd_t hd, void *outtag, size_t taglen) rc = _gcry_cipher_poly1305_get_tag (hd, outtag, taglen); break; + case GCRY_CIPHER_MODE_OCB: + rc = _gcry_cipher_ocb_get_tag (hd, outtag, taglen); + break; + default: log_error ("gcry_cipher_gettag: invalid mode %d\n", hd->mode); rc = GPG_ERR_INV_CIPHER_MODE; @@ -1149,6 +1197,10 @@ _gcry_cipher_checktag (gcry_cipher_hd_t hd, const void *intag, size_t taglen) rc = _gcry_cipher_poly1305_check_tag (hd, intag, taglen); break; + case GCRY_CIPHER_MODE_OCB: + rc = _gcry_cipher_ocb_check_tag (hd, intag, taglen); + break; + default: log_error ("gcry_cipher_checktag: invalid mode %d\n", hd->mode); rc = GPG_ERR_INV_CIPHER_MODE; @@ -1170,6 +1222,12 @@ _gcry_cipher_ctl (gcry_cipher_hd_t h, int cmd, void *buffer, size_t buflen) cipher_reset (h); break; + case GCRYCTL_FINALIZE: + if (!h || buffer || buflen) + return GPG_ERR_INV_ARG; + h->marks.finalize = 1; + break; + case GCRYCTL_CFB_SYNC: cipher_sync( h ); break; @@ -1222,6 +1280,29 @@ _gcry_cipher_ctl (gcry_cipher_hd_t h, int cmd, void *buffer, size_t buflen) #endif break; + case GCRYCTL_SET_TAGLEN: + if (!h || !buffer || buflen != sizeof(int) ) + return GPG_ERR_INV_ARG; + switch (h->mode) + { + case GCRY_CIPHER_MODE_OCB: + switch (*(int*)buffer) + { + case 8: case 12: case 16: + h->u_mode.ocb.taglen = *(int*)buffer; + break; + default: + rc = GPG_ERR_INV_LENGTH; /* Invalid tag length. */ + break; + } + break; + + default: + rc =GPG_ERR_INV_CIPHER_MODE; + break; + } + break; + case GCRYCTL_DISABLE_ALGO: /* This command expects NULL for H and BUFFER to point to an integer with the algo number. */ diff --git a/doc/gcrypt.texi b/doc/gcrypt.texi index 7337db9..8683ca8 100644 --- a/doc/gcrypt.texi +++ b/doc/gcrypt.texi @@ -1650,7 +1650,14 @@ mode, which can be used with ChaCha20 and Salsa20 stream ciphers. @item GCRY_CIPHER_MODE_OCB @cindex OCB, OCB3 OCB is an Authenticated Encryption with Associated Data (AEAD) block -cipher mode, which is specified in RFC-7253. +cipher mode, which is specified in RFC-7253. Supported tag lengths +are 128, 96, and 64 bit with the default being 128 bit. To switch to +a different tag length @code{gcry_cipher_ctl} using the command + at code{GCRYCTL_SET_TAGLEN} and the address of an @code{int} variable +set to 12 (for 96 bit) or 8 (for 64 bit) provided for the + at code{buffer} argument and @code{sizeof(int)} for @code{buflen}. + +Note that the use of @code{gcry_cipher_final} is required. @end table @@ -1750,12 +1757,9 @@ vector is passed as the buffer @var{K} of length @var{l} bytes and copied to internal data structures. The function checks that the IV matches the requirement of the selected algorithm and mode. -This function is also used with Salsa20 and ChaCha20 stream ciphers -to set or update the required nonce. In this case it needs to be -called after setting the key. - -This function is also used with the AEAD cipher modes to set or -update the required nonce. +This function is also used by AEAD modes and with Salsa20 and ChaCha20 +stream ciphers to set or update the required nonce. In these cases it +needs to be called after setting the key. @end deftypefun @@ -1827,6 +1831,9 @@ is sufficient space. Note that overlapping buffers are not allowed. Depending on the selected algorithms and encryption mode, the length of the buffers must be a multiple of the block size. +Some encryption modes require that @code{gcry_cipher_final} is used +before the final data chunk is passed to this function. + The function returns @code{0} on success or an error code. @end deftypefun @@ -1847,11 +1854,27 @@ is sufficient space. Note that overlapping buffers are not allowed. Depending on the selected algorithms and encryption mode, the length of the buffers must be a multiple of the block size. +Some encryption modes require that @code{gcry_cipher_final} is used +before the final data chunk is passed to this function. + The function returns @code{0} on success or an error code. @end deftypefun -OpenPGP (as defined in RFC-2440) requires a special sync operation in +The OCB mode features integrated padding and must thus be told about +the end of the input data. This is done with: + + at deftypefun gcry_error_t gcry_cipher_final (gcry_cipher_hd_t @var{h}) + +Set a flag in the context to tell the encrypt and decrypt functions +that their next call will provide the last chunk of data. Only the +first call to this function has an effect and only for modes which +support it. Checking the error in in general not necessary. This is +implemented as a macro. + at end deftypefun + + +OpenPGP (as defined in RFC-4880) requires a special sync operation in some places. The following function is used for this: @deftypefun gcry_error_t gcry_cipher_sync (gcry_cipher_hd_t @var{h}) diff --git a/src/gcrypt.h.in b/src/gcrypt.h.in index 85c6753..10099e1 100644 --- a/src/gcrypt.h.in +++ b/src/gcrypt.h.in @@ -331,7 +331,8 @@ enum gcry_ctl_cmds GCRYCTL_INACTIVATE_FIPS_FLAG = 71, GCRYCTL_REACTIVATE_FIPS_FLAG = 72, GCRYCTL_SET_SBOX = 73, - GCRYCTL_DRBG_REINIT = 74 + GCRYCTL_DRBG_REINIT = 74, + GCRYCTL_SET_TAGLEN = 75 }; /* Perform various operations defined by CMD. */ @@ -1012,6 +1013,11 @@ gcry_error_t gcry_cipher_checktag (gcry_cipher_hd_t hd, const void *intag, #define gcry_cipher_set_sbox(h,oid) gcry_cipher_ctl( (h), GCRYCTL_SET_SBOX, \ (oid), 0); +/* Indicate to the encrypt and decrypt functions that the next call + provides the final data. Only used with some modes. e */ +#define gcry_cipher_final(a) \ + gcry_cipher_ctl ((a), GCRYCTL_FINALIZE, NULL, 0) + /* Set counter for CTR mode. (CTR,CTRLEN) must denote a buffer of block size length, or (NULL,0) to set the CTR to the all-zero block. */ gpg_error_t gcry_cipher_setctr (gcry_cipher_hd_t hd, diff --git a/tests/basic.c b/tests/basic.c index ef8260f..869b381 100644 --- a/tests/basic.c +++ b/tests/basic.c @@ -61,6 +61,22 @@ static int error_count; static int in_fips_mode; static int die_on_error; +#define MAX_DATA_LEN 128 + +#define digitp(p) (*(p) >= '0' && *(p) <= '9') +#define hexdigitp(a) (digitp (a) \ + || (*(a) >= 'A' && *(a) <= 'F') \ + || (*(a) >= 'a' && *(a) <= 'f')) +#define xtoi_1(p) (*(p) <= '9'? (*(p)- '0'): \ + *(p) <= 'F'? (*(p)-'A'+10):(*(p)-'a'+10)) +#define xtoi_2(p) ((xtoi_1(p) * 16) + xtoi_1((p)+1)) +#define xmalloc(a) gcry_xmalloc ((a)) +#define xcalloc(a,b) gcry_xcalloc ((a),(b)) +#define xstrdup(a) gcry_xstrdup ((a)) +#define xfree(a) gcry_free ((a)) + + + static void fail (const char *format, ...) { @@ -74,6 +90,7 @@ fail (const char *format, ...) exit (1); } + static void mismatch (const void *expected, size_t expectedlen, const void *computed, size_t computedlen) @@ -102,6 +119,30 @@ die (const char *format, ...) } +/* Convert STRING consisting of hex characters into its binary + representation and return it as an allocated buffer. The valid + length of the buffer is returned at R_LENGTH. The string is + delimited by end of string. The function terminates on error. */ +static void * +hex2buffer (const char *string, size_t *r_length) +{ + const char *s; + unsigned char *buffer; + size_t length; + + buffer = xmalloc (strlen(string)/2+1); + length = 0; + for (s=string; *s; s +=2 ) + { + if (!hexdigitp (s) || !hexdigitp (s+1)) + die ("invalid hex digits in \"%s\"\n", string); + ((unsigned char*)buffer)[length++] = xtoi_2 (s); + } + *r_length = length; + return buffer; +} + + static void show_sexp (const char *prefix, gcry_sexp_t a) { @@ -195,8 +236,6 @@ show_mac_not_available (int algo) -#define MAX_DATA_LEN 128 - void progress_handler (void *cb_data, const char *what, int printchar, int current, int total) @@ -2742,6 +2781,355 @@ check_ccm_cipher (void) static void +check_ocb_cipher (void) +{ + /* Note that we use hex strings and not binary strings in TV. That + makes it easier to maintain the test vectors. */ + static const struct + { + int algo; + int taglen; /* 16, 12, or 8 bytes */ + const char *key; /* NULL means "000102030405060708090A0B0C0D0E0F" */ + const char *nonce; + const char *aad; + const char *plain; + const char *ciph; + } tv[] = { + /* The RFC-7253 test vectos*/ + { GCRY_CIPHER_AES, 16, NULL, + "BBAA99887766554433221100", + "", + "", + "785407BFFFC8AD9EDCC5520AC9111EE6" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA99887766554433221101", + "0001020304050607", + "0001020304050607", + "6820B3657B6F615A5725BDA0D3B4EB3A257C9AF1F8F03009" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA99887766554433221102", + "0001020304050607", + "", + "81017F8203F081277152FADE694A0A00" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA99887766554433221103", + "", + "0001020304050607", + "45DD69F8F5AAE72414054CD1F35D82760B2CD00D2F99BFA9" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA99887766554433221104", + "000102030405060708090A0B0C0D0E0F", + "000102030405060708090A0B0C0D0E0F", + "571D535B60B277188BE5147170A9A22C3AD7A4FF3835B8C5" + "701C1CCEC8FC3358" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA99887766554433221105", + "000102030405060708090A0B0C0D0E0F", + "", + "8CF761B6902EF764462AD86498CA6B97" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA99887766554433221106", + "", + "000102030405060708090A0B0C0D0E0F", + "5CE88EC2E0692706A915C00AEB8B2396F40E1C743F52436B" + "DF06D8FA1ECA343D" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA99887766554433221107", + "000102030405060708090A0B0C0D0E0F1011121314151617", + "000102030405060708090A0B0C0D0E0F1011121314151617", + "1CA2207308C87C010756104D8840CE1952F09673A448A122" + "C92C62241051F57356D7F3C90BB0E07F" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA99887766554433221108", + "000102030405060708090A0B0C0D0E0F1011121314151617", + "", + "6DC225A071FC1B9F7C69F93B0F1E10DE" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA99887766554433221109", + "", + "000102030405060708090A0B0C0D0E0F1011121314151617", + "221BD0DE7FA6FE993ECCD769460A0AF2D6CDED0C395B1C3C" + "E725F32494B9F914D85C0B1EB38357FF" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA9988776655443322110A", + "000102030405060708090A0B0C0D0E0F1011121314151617" + "18191A1B1C1D1E1F", + "000102030405060708090A0B0C0D0E0F1011121314151617" + "18191A1B1C1D1E1F", + "BD6F6C496201C69296C11EFD138A467ABD3C707924B964DE" + "AFFC40319AF5A48540FBBA186C5553C68AD9F592A79A4240" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA9988776655443322110B", + "000102030405060708090A0B0C0D0E0F1011121314151617" + "18191A1B1C1D1E1F", + "", + "FE80690BEE8A485D11F32965BC9D2A32" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA9988776655443322110C", + "", + "000102030405060708090A0B0C0D0E0F1011121314151617" + "18191A1B1C1D1E1F", + "2942BFC773BDA23CABC6ACFD9BFD5835BD300F0973792EF4" + "6040C53F1432BCDFB5E1DDE3BC18A5F840B52E653444D5DF" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA9988776655443322110D", + "000102030405060708090A0B0C0D0E0F1011121314151617" + "18191A1B1C1D1E1F2021222324252627", + "000102030405060708090A0B0C0D0E0F1011121314151617" + "18191A1B1C1D1E1F2021222324252627", + "D5CA91748410C1751FF8A2F618255B68A0A12E093FF45460" + "6E59F9C1D0DDC54B65E8628E568BAD7AED07BA06A4A69483" + "A7035490C5769E60" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA9988776655443322110E", + "000102030405060708090A0B0C0D0E0F1011121314151617" + "18191A1B1C1D1E1F2021222324252627", + "", + "C5CD9D1850C141E358649994EE701B68" + }, + { GCRY_CIPHER_AES, 16, NULL, + "BBAA9988776655443322110F", + "", + "000102030405060708090A0B0C0D0E0F1011121314151617" + "18191A1B1C1D1E1F2021222324252627", + "4412923493C57D5DE0D700F753CCE0D1D2D95060122E9F15" + "A5DDBFC5787E50B5CC55EE507BCB084E479AD363AC366B95" + "A98CA5F3000B1479" + }, + { GCRY_CIPHER_AES, 12, "0F0E0D0C0B0A09080706050403020100", + "BBAA9988776655443322110D", + "000102030405060708090A0B0C0D0E0F1011121314151617" + "18191A1B1C1D1E1F2021222324252627", + "000102030405060708090A0B0C0D0E0F1011121314151617" + "18191A1B1C1D1E1F2021222324252627", + "1792A4E31E0755FB03E31B22116E6C2DDF9EFD6E33D536F1" + "A0124B0A55BAE884ED93481529C76B6AD0C515F4D1CDD4FD" + "AC4F02AA" + } + }; + gpg_error_t err = 0; + gcry_cipher_hd_t hde, hdd; + unsigned char out[MAX_DATA_LEN]; + unsigned char tag[16]; + int tidx; + + if (verbose) + fprintf (stderr, " Starting OCB checks.\n"); + + for (tidx = 0; tidx < DIM (tv); tidx++) + { + char *key, *nonce, *aad, *ciph, *plain; + size_t keylen, noncelen, aadlen, ciphlen, plainlen; + int taglen; + + if (verbose) + fprintf (stderr, " checking OCB mode for %s [%i] (tv %d)\n", + gcry_cipher_algo_name (tv[tidx].algo), tv[tidx].algo, tidx); + + /* Convert to hex strings to binary. */ + key = hex2buffer (tv[tidx].key? tv[tidx].key + /* */: "000102030405060708090A0B0C0D0E0F", + &keylen); + nonce = hex2buffer (tv[tidx].nonce, &noncelen); + aad = hex2buffer (tv[tidx].aad, &aadlen); + plain = hex2buffer (tv[tidx].plain, &plainlen); + ciph = hex2buffer (tv[tidx].ciph, &ciphlen); + + /* Check that our test vectors are sane. */ + assert (plainlen <= sizeof out); + assert (tv[tidx].taglen <= ciphlen); + assert (tv[tidx].taglen <= sizeof tag); + + err = gcry_cipher_open (&hde, tv[tidx].algo, GCRY_CIPHER_MODE_OCB, 0); + if (!err) + err = gcry_cipher_open (&hdd, tv[tidx].algo, GCRY_CIPHER_MODE_OCB, 0); + if (err) + { + fail ("cipher-ocb, gcry_cipher_open failed (tv %d): %s\n", + tidx, gpg_strerror (err)); + return; + } + + /* Set the taglen. For the first handle we do this only for a + non-default taglen. For the second handle we check that we + can also set to the default taglen. */ + taglen = tv[tidx].taglen; + if (taglen != 16) + { + err = gcry_cipher_ctl (hde, GCRYCTL_SET_TAGLEN, + &taglen, sizeof taglen); + if (err) + { + fail ("cipher-ocb, gcryctl_set_taglen failed (tv %d): %s\n", + tidx, gpg_strerror (err)); + gcry_cipher_close (hde); + gcry_cipher_close (hdd); + return; + } + } + err = gcry_cipher_ctl (hdd, GCRYCTL_SET_TAGLEN, + &taglen, sizeof taglen); + if (err) + { + fail ("cipher-ocb, gcryctl_set_taglen failed (tv %d): %s\n", + tidx, gpg_strerror (err)); + gcry_cipher_close (hde); + gcry_cipher_close (hdd); + return; + } + + err = gcry_cipher_setkey (hde, key, keylen); + if (!err) + err = gcry_cipher_setkey (hdd, key, keylen); + if (err) + { + fail ("cipher-ocb, gcry_cipher_setkey failed (tv %d): %s\n", + tidx, gpg_strerror (err)); + gcry_cipher_close (hde); + gcry_cipher_close (hdd); + return; + } + + err = gcry_cipher_setiv (hde, nonce, noncelen); + if (!err) + err = gcry_cipher_setiv (hdd, nonce, noncelen); + if (err) + { + fail ("cipher-ocb, gcry_cipher_setiv failed (tv %d): %s\n", + tidx, gpg_strerror (err)); + gcry_cipher_close (hde); + gcry_cipher_close (hdd); + return; + } + + err = gcry_cipher_authenticate (hde, aad, aadlen); + if (err) + { + fail ("cipher-ocb, gcry_cipher_authenticate failed (tv %d): %s\n", + tidx, gpg_strerror (err)); + gcry_cipher_close (hde); + gcry_cipher_close (hdd); + return; + } + + err = gcry_cipher_final (hde); + if (!err) + err = gcry_cipher_encrypt (hde, out, MAX_DATA_LEN, plain, plainlen); + if (err) + { + fail ("cipher-ocb, gcry_cipher_encrypt failed (tv %d): %s\n", + tidx, gpg_strerror (err)); + gcry_cipher_close (hde); + gcry_cipher_close (hdd); + return; + } + + /* Check that the encrypt output matches the expected cipher + text without the tag (i.e. at the length of plaintext). */ + if (memcmp (ciph, out, plainlen)) + { + mismatch (ciph, plainlen, out, plainlen); + fail ("cipher-ocb, encrypt data mismatch (tv %d)\n", tidx); + } + + /* Check that the tag matches TAGLEN bytes from the end of the + expected ciphertext. */ + err = gcry_cipher_gettag (hde, tag, tv[tidx].taglen); + if (err) + { + fail ("cipher_ocb, gcry_cipher_gettag failed (tv %d): %s\n", + tidx, gpg_strerror (err)); + } + if (memcmp (ciph + ciphlen - tv[tidx].taglen, tag, tv[tidx].taglen)) + { + mismatch (ciph + ciphlen - tv[tidx].taglen, tv[tidx].taglen, + tag, tv[tidx].taglen); + fail ("cipher-ocb, encrypt tag mismatch (tv %d)\n", tidx); + } + + + err = gcry_cipher_authenticate (hdd, aad, aadlen); + if (err) + { + fail ("cipher-ocb, gcry_cipher_authenticate failed (tv %d): %s\n", + tidx, gpg_strerror (err)); + gcry_cipher_close (hde); + gcry_cipher_close (hdd); + return; + } + + /* Now for the decryption. */ + err = gcry_cipher_final (hdd); + if (!err) + err = gcry_cipher_decrypt (hdd, out, plainlen, NULL, 0); + if (err) + { + fail ("cipher-ocb, gcry_cipher_decrypt (tv %d) failed: %s\n", + tidx, gpg_strerror (err)); + gcry_cipher_close (hde); + gcry_cipher_close (hdd); + return; + } + + /* We still have TAG from the encryption. */ + err = gcry_cipher_checktag (hdd, tag, tv[tidx].taglen); + if (err) + { + fail ("cipher-ocb, gcry_cipher_checktag failed (tv %d): %s\n", + tidx, gpg_strerror (err)); + } + + /* Check that the decrypt output matches the original plaintext. */ + if (memcmp (plain, out, plainlen)) + { + mismatch (plain, plainlen, out, plainlen); + fail ("cipher-ocb, decrypt data mismatch (tv %d)\n", tidx); + } + + /* Check that gettag also works for decryption. */ + err = gcry_cipher_gettag (hdd, tag, tv[tidx].taglen); + if (err) + { + fail ("cipher_ocb, decrypt gettag failed (tv %d): %s\n", + tidx, gpg_strerror (err)); + } + if (memcmp (ciph + ciphlen - tv[tidx].taglen, tag, tv[tidx].taglen)) + { + mismatch (ciph + ciphlen - tv[tidx].taglen, tv[tidx].taglen, + tag, tv[tidx].taglen); + fail ("cipher-ocb, decrypt tag mismatch (tv %d)\n", tidx); + } + + gcry_cipher_close (hde); + gcry_cipher_close (hdd); + + xfree (nonce); + xfree (aad); + xfree (ciph); + xfree (plain); + xfree (key); + } + + if (verbose) + fprintf (stderr, " Completed OCB checks.\n"); +} + + +static void check_stream_cipher (void) { static const struct tv @@ -4391,6 +4779,7 @@ check_cipher_modes(void) check_ccm_cipher (); check_gcm_cipher (); check_poly1305_cipher (); + check_ocb_cipher (); check_stream_cipher (); check_stream_cipher_large_block (); @@ -7143,6 +7532,7 @@ main (int argc, char **argv) int use_fips = 0; int selftest_only = 0; int pubkey_only = 0; + int cipher_modes_only = 0; int loop = 0; unsigned int loopcount = 0; @@ -7183,6 +7573,11 @@ main (int argc, char **argv) pubkey_only = 1; argc--; argv++; } + else if (!strcmp (*argv, "--cipher-modes")) + { + cipher_modes_only = 1; + argc--; argv++; + } else if (!strcmp (*argv, "--die")) { die_on_error = 1; @@ -7228,6 +7623,8 @@ main (int argc, char **argv) { if (pubkey_only) check_pubkey (); + else if (cipher_modes_only) + check_ciphers (); else if (!selftest_only) { check_ciphers (); diff --git a/tests/bench-slope.c b/tests/bench-slope.c index ebf672e..c309b7e 100644 --- a/tests/bench-slope.c +++ b/tests/bench-slope.c @@ -916,6 +916,7 @@ bench_aead_encrypt_do_bench (struct bench_obj *obj, void *buf, size_t buflen, gcry_cipher_setiv (hd, nonce, noncelen); + gcry_cipher_final (hd); err = gcry_cipher_encrypt (hd, buf, buflen, buf, buflen); if (err) { @@ -945,6 +946,7 @@ bench_aead_decrypt_do_bench (struct bench_obj *obj, void *buf, size_t buflen, gcry_cipher_setiv (hd, nonce, noncelen); + gcry_cipher_final (hd); err = gcry_cipher_decrypt (hd, buf, buflen, buf, buflen); if (err) { @@ -976,7 +978,14 @@ bench_aead_authenticate_do_bench (struct bench_obj *obj, void *buf, char tag[16] = { 0, }; char data = 0xff; - gcry_cipher_setiv (hd, nonce, noncelen); + err = gcry_cipher_setiv (hd, nonce, noncelen); + if (err) + { + fprintf (stderr, PGM ": gcry_cipher_setiv failed: %s\n", + gpg_strerror (err)); + gcry_cipher_close (hd); + exit (1); + } err = gcry_cipher_authenticate (hd, buf, buflen); if (err) @@ -987,6 +996,7 @@ bench_aead_authenticate_do_bench (struct bench_obj *obj, void *buf, exit (1); } + gcry_cipher_final (hd); err = gcry_cipher_encrypt (hd, &data, sizeof (data), &data, sizeof (data)); if (err) { @@ -1012,7 +1022,7 @@ bench_gcm_encrypt_do_bench (struct bench_obj *obj, void *buf, size_t buflen) { char nonce[12] = { 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, - 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88, }; + 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88 }; bench_aead_encrypt_do_bench (obj, buf, buflen, nonce, sizeof(nonce)); } @@ -1021,7 +1031,7 @@ bench_gcm_decrypt_do_bench (struct bench_obj *obj, void *buf, size_t buflen) { char nonce[12] = { 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, - 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88, }; + 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88 }; bench_aead_decrypt_do_bench (obj, buf, buflen, nonce, sizeof(nonce)); } @@ -1030,7 +1040,7 @@ bench_gcm_authenticate_do_bench (struct bench_obj *obj, void *buf, size_t buflen) { char nonce[12] = { 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, - 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88, }; + 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88 }; bench_aead_authenticate_do_bench (obj, buf, buflen, nonce, sizeof(nonce)); } @@ -1054,6 +1064,55 @@ static struct bench_ops gcm_authenticate_ops = { static void +bench_ocb_encrypt_do_bench (struct bench_obj *obj, void *buf, + size_t buflen) +{ + char nonce[15] = { 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, + 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88, + 0x00, 0x00, 0x01 }; + bench_aead_encrypt_do_bench (obj, buf, buflen, nonce, sizeof(nonce)); +} + +static void +bench_ocb_decrypt_do_bench (struct bench_obj *obj, void *buf, + size_t buflen) +{ + char nonce[15] = { 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, + 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88, + 0x00, 0x00, 0x01 }; + bench_aead_decrypt_do_bench (obj, buf, buflen, nonce, sizeof(nonce)); +} + +static void +bench_ocb_authenticate_do_bench (struct bench_obj *obj, void *buf, + size_t buflen) +{ + char nonce[15] = { 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, + 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88, + 0x00, 0x00, 0x01 }; + bench_aead_authenticate_do_bench (obj, buf, buflen, nonce, sizeof(nonce)); +} + +static struct bench_ops ocb_encrypt_ops = { + &bench_encrypt_init, + &bench_encrypt_free, + &bench_ocb_encrypt_do_bench +}; + +static struct bench_ops ocb_decrypt_ops = { + &bench_encrypt_init, + &bench_encrypt_free, + &bench_ocb_decrypt_do_bench +}; + +static struct bench_ops ocb_authenticate_ops = { + &bench_encrypt_init, + &bench_encrypt_free, + &bench_ocb_authenticate_do_bench +}; + + +static void bench_poly1305_encrypt_do_bench (struct bench_obj *obj, void *buf, size_t buflen) { @@ -1115,6 +1174,9 @@ static struct bench_cipher_mode cipher_modes[] = { {GCRY_CIPHER_MODE_GCM, "GCM enc", &gcm_encrypt_ops}, {GCRY_CIPHER_MODE_GCM, "GCM dec", &gcm_decrypt_ops}, {GCRY_CIPHER_MODE_GCM, "GCM auth", &gcm_authenticate_ops}, + {GCRY_CIPHER_MODE_OCB, "OCB enc", &ocb_encrypt_ops}, + {GCRY_CIPHER_MODE_OCB, "OCB dec", &ocb_decrypt_ops}, + {GCRY_CIPHER_MODE_OCB, "OCB auth", &ocb_authenticate_ops}, {GCRY_CIPHER_MODE_POLY1305, "POLY1305 enc", &poly1305_encrypt_ops}, {GCRY_CIPHER_MODE_POLY1305, "POLY1305 dec", &poly1305_decrypt_ops}, {GCRY_CIPHER_MODE_POLY1305, "POLY1305 auth", &poly1305_authenticate_ops}, @@ -1155,10 +1217,14 @@ cipher_bench_one (int algo, struct bench_cipher_mode *pmode) if (mode.mode == GCRY_CIPHER_MODE_CCM && blklen != GCRY_CCM_BLOCK_LEN) return; - /* CCM has restrictions for block-size */ + /* GCM has restrictions for block-size */ if (mode.mode == GCRY_CIPHER_MODE_GCM && blklen != GCRY_GCM_BLOCK_LEN) return; + /* Our OCB implementaion has restrictions for block-size. */ + if (mode.mode == GCRY_CIPHER_MODE_OCB && blklen != 16) + return; + bench_print_mode (14, mode.name); obj.ops = mode.ops; @@ -1197,17 +1263,17 @@ cipher_bench (char **argv, int argc) if (argv && argc) { for (i = 0; i < argc; i++) - { - algo = gcry_cipher_map_name (argv[i]); - if (algo) - _cipher_bench (algo); - } + { + algo = gcry_cipher_map_name (argv[i]); + if (algo) + _cipher_bench (algo); + } } else { for (i = 1; i < 400; i++) - if (!gcry_cipher_test_algo (i)) - _cipher_bench (i); + if (!gcry_cipher_test_algo (i)) + _cipher_bench (i); } } diff --git a/tests/benchmark.c b/tests/benchmark.c index 5bf92da..6be9509 100644 --- a/tests/benchmark.c +++ b/tests/benchmark.c @@ -779,6 +779,7 @@ cipher_bench ( const char *algoname ) void (* const aead_init)(gcry_cipher_hd_t hd, size_t buflen, int authlen); int req_blocksize; int authlen; + int noncelen; } modes[] = { { GCRY_CIPHER_MODE_ECB, " ECB/Stream", 1 }, { GCRY_CIPHER_MODE_CBC, " CBC", 1 }, @@ -791,6 +792,8 @@ cipher_bench ( const char *algoname ) #endif { GCRY_CIPHER_MODE_GCM, " GCM", 0, NULL, GCRY_GCM_BLOCK_LEN, GCRY_GCM_BLOCK_LEN }, + { GCRY_CIPHER_MODE_OCB, " OCB", 1, + NULL, 16, 16, 15 }, { GCRY_CIPHER_MODE_STREAM, "", 0 }, {0} }; @@ -929,9 +932,30 @@ cipher_bench ( const char *algoname ) exit (1); } } + + if (modes[modeidx].noncelen) + { + char nonce[100]; + size_t noncelen; + + noncelen = modes[modeidx].noncelen; + if (noncelen > sizeof nonce) + noncelen = sizeof nonce; + memset (nonce, 42, noncelen); + err = gcry_cipher_setiv (hd, nonce, noncelen); + if (err) + { + fprintf (stderr, "gcry_cipher_setiv failed: %s\n", + gpg_strerror (err)); + gcry_cipher_close (hd); + exit (1); + } + } + if (modes[modeidx].aead_init) { (*modes[modeidx].aead_init) (hd, buflen, modes[modeidx].authlen); + gcry_cipher_final (hd); err = gcry_cipher_encrypt (hd, outbuf, buflen, buf, buflen); if (err) break; @@ -987,18 +1011,42 @@ cipher_bench ( const char *algoname ) exit (1); } } + + if (modes[modeidx].noncelen) + { + char nonce[100]; + size_t noncelen; + + noncelen = modes[modeidx].noncelen; + if (noncelen > sizeof nonce) + noncelen = sizeof nonce; + memset (nonce, 42, noncelen); + err = gcry_cipher_setiv (hd, nonce, noncelen); + if (err) + { + fprintf (stderr, "gcry_cipher_setiv failed: %s\n", + gpg_strerror (err)); + gcry_cipher_close (hd); + exit (1); + } + } + if (modes[modeidx].aead_init) { (*modes[modeidx].aead_init) (hd, buflen, modes[modeidx].authlen); + gcry_cipher_final (hd); err = gcry_cipher_decrypt (hd, outbuf, buflen, buf, buflen); if (err) break; err = gcry_cipher_checktag (hd, outbuf, modes[modeidx].authlen); if (gpg_err_code (err) == GPG_ERR_CHECKSUM) - err = gpg_error (GPG_ERR_NO_ERROR); + err = 0; } else - err = gcry_cipher_decrypt (hd, outbuf, buflen, buf, buflen); + { + gcry_cipher_final (hd); + err = gcry_cipher_decrypt (hd, outbuf, buflen, buf, buflen); + } } stop_timer (); printf (" %s", elapsed_time ()); ----------------------------------------------------------------------- Summary of changes: NEWS | 5 + cipher/Makefile.am | 3 +- cipher/bufhelp.h | 34 ++++ cipher/cipher-internal.h | 83 +++++++- cipher/cipher-ocb.c | 495 +++++++++++++++++++++++++++++++++++++++++++++++ cipher/cipher.c | 83 +++++++- doc/gcrypt.texi | 39 +++- src/gcrypt.h.in | 8 +- tests/basic.c | 401 +++++++++++++++++++++++++++++++++++++- tests/bench-slope.c | 90 +++++++-- tests/benchmark.c | 52 ++++- 11 files changed, 1264 insertions(+), 29 deletions(-) create mode 100644 cipher/cipher-ocb.c hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Mon Jan 19 15:47:34 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 19 Jan 2015 15:47:34 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-33-g7be1b7d Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 7be1b7d8017cb7ebf1a3855edec0ef5e342cc9c5 (commit) via c5956592c171e6fe988e74161aa99636b7f12e4b (commit) via 3da53e70b1bbde6b5956e2e5a7a2b0c28ffbe61c (commit) from 16a1330fa16f6b23e2661c0175c431ab40da45ff (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 7be1b7d8017cb7ebf1a3855edec0ef5e342cc9c5 Author: Werner Koch Date: Mon Jan 19 14:58:06 2015 +0100 kbx: Minor cleanup for the previous fix. * kbx/keybox-search.c (blob_get_keyid): Rename to blob_get_first_keyid. Check number of keys and remove blob type check. -- There is no need to check the blob type. We already know that it is a key blob type and keyids are used for X.509 and OpenPGP. Also added check for number of keys because the other parser functions do it as well. Signed-off-by: Werner Koch diff --git a/kbx/keybox-search.c b/kbx/keybox-search.c index 2126ece..0a3ed43 100644 --- a/kbx/keybox-search.c +++ b/kbx/keybox-search.c @@ -79,21 +79,21 @@ blob_get_blob_flags (KEYBOXBLOB blob) } +/* Return the first keyid from the blob. Returns true if + available. */ static int -blob_get_keyid (KEYBOXBLOB blob, u32 *kid) +blob_get_first_keyid (KEYBOXBLOB blob, u32 *kid) { const unsigned char *buffer; - size_t length, keyinfolen; + size_t length, nkeys, keyinfolen; buffer = _keybox_get_blob_image (blob, &length); if (length < 48) return 0; /* blob too short */ - if (buffer[4] != KEYBOX_BLOBTYPE_PGP) - return 0; /* don't know what to do with X.509 blobs */ - + nkeys = get16 (buffer + 16); keyinfolen = get16 (buffer + 18); - if (keyinfolen < 28) + if (!nkeys || keyinfolen < 28) return 0; /* invalid blob */ kid[0] = get32 (buffer + 32); @@ -994,7 +994,7 @@ keybox_search (KEYBOX_HANDLE hd, KEYBOX_SEARCH_DESC *desc, size_t ndesc, u32 kid[2]; if (desc[n].skipfnc - && blob_get_keyid (blob, kid) + && blob_get_first_keyid (blob, kid) && desc[n].skipfnc (desc[n].skipfncvalue, kid, NULL)) break; } commit c5956592c171e6fe988e74161aa99636b7f12e4b Author: Damien Goutte-Gattat Date: Fri Jan 16 16:56:35 2015 +0100 kbx: Call skipfnc callback to filter out keys * kbx/keybox-search.c (blob_get_keyid): New. (keybox-search): Call skipfnc callback function. -- This patch (tentatively) fixes GnuPG-bug-id: 1794 The keybox_search function in kbx/keybox-search.c currently ignores the skipfnc callback, but the validate_key_list function in g10/trustdb.c uses such a callback to exclude ultimately trusted keys. diff --git a/kbx/keybox-search.c b/kbx/keybox-search.c index 6e72d0b..2126ece 100644 --- a/kbx/keybox-search.c +++ b/kbx/keybox-search.c @@ -79,6 +79,30 @@ blob_get_blob_flags (KEYBOXBLOB blob) } +static int +blob_get_keyid (KEYBOXBLOB blob, u32 *kid) +{ + const unsigned char *buffer; + size_t length, keyinfolen; + + buffer = _keybox_get_blob_image (blob, &length); + if (length < 48) + return 0; /* blob too short */ + + if (buffer[4] != KEYBOX_BLOBTYPE_PGP) + return 0; /* don't know what to do with X.509 blobs */ + + keyinfolen = get16 (buffer + 18); + if (keyinfolen < 28) + return 0; /* invalid blob */ + + kid[0] = get32 (buffer + 32); + kid[1] = get32 (buffer + 36); + + return 1; +} + + /* Return information on the flag WHAT within the blob BUFFER,LENGTH. Return the offset and the length (in bytes) of the flag in FLAGOFF,FLAG_SIZE. */ @@ -967,9 +991,12 @@ keybox_search (KEYBOX_HANDLE hd, KEYBOX_SEARCH_DESC *desc, size_t ndesc, *r_descindex = n; for (n=any_skip?0:ndesc; n < ndesc; n++) { -/* if (desc[n].skipfnc */ -/* && desc[n].skipfnc (desc[n].skipfncvalue, aki, NULL)) */ -/* break; */ + u32 kid[2]; + + if (desc[n].skipfnc + && blob_get_keyid (blob, kid) + && desc[n].skipfnc (desc[n].skipfncvalue, kid, NULL)) + break; } if (n == ndesc) break; /* got it */ commit 3da53e70b1bbde6b5956e2e5a7a2b0c28ffbe61c Author: Werner Koch Date: Mon Jan 19 11:06:59 2015 +0100 Register DCO for Damien Goutte-Gattat. -- diff --git a/AUTHORS b/AUTHORS index 554c10a..58cfdb8 100644 --- a/AUTHORS +++ b/AUTHORS @@ -170,6 +170,9 @@ Andreas Schwier Christian Aistleitner 2013-05-26:20130626112332.GA2228 at quelltextlich.at: +Damien Goutte-Gattat +2015-01-17:54BA49AA.2040708 at incenp.org: + Daniel Kahn Gillmor 2014-09-24:87oau6w9q7.fsf at alice.fifthhorseman.net: ----------------------------------------------------------------------- Summary of changes: AUTHORS | 3 +++ kbx/keybox-search.c | 33 ++++++++++++++++++++++++++++++--- 2 files changed, 33 insertions(+), 3 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Jan 19 16:56:33 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 19 Jan 2015 16:56:33 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-1-4, updated. gnupg-1.4.18-27-g8adb5ff Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-1-4 has been updated via 8adb5ff26062f717619aa816de8b27aa7d40d6c8 (commit) from ed6287d2e1546ee0f4064675270da003f51e1b39 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 8adb5ff26062f717619aa816de8b27aa7d40d6c8 Author: Werner Koch Date: Mon Jan 19 16:46:05 2015 +0100 Fix a problem with select and high fds. * cipher/rndlinux.c (rndlinux_gather_random): Check fd before using FD_SET. -- If on systems where the maximum number of fds may be dynamically configured to a value of FD_MAXSIZE or higher and the RNG is first used after more than FD_SETSIZE-1 descriptors are in use, we disable the progress messages from the RNG. A better solution would be too use poll but that requires more tests. The same problem exists in rndunix.c - however this rng is only used on old Unices and I assume that they don't feature dynamically configured maximum fd sizes. (from Libgcrypt commit 9487099071af4478d2882e633a0ade805801d6fa) This may fix GnuPG-bug-id: 1818 diff --git a/cipher/rndlinux.c b/cipher/rndlinux.c index 9d40f47..709a7ad 100644 --- a/cipher/rndlinux.c +++ b/cipher/rndlinux.c @@ -117,28 +117,33 @@ rndlinux_gather_random( void (*add)(const void*, size_t, int), int requester, #endif #endif while( length ) { +#ifdef FD_SETSIZE fd_set rfds; struct timeval tv; - int rc; + int rc; FD_ZERO(&rfds); - FD_SET(fd, &rfds); tv.tv_sec = 3; tv.tv_usec = 0; - if( !(rc=select(fd+1, &rfds, NULL, NULL, &tv)) ) { - if( !warn ) + if (fd < FD_SETSIZE) + { + FD_SET(fd, &rfds); + if( !(rc=select(fd+1, &rfds, NULL, NULL, &tv)) ) { + if( !warn ) tty_printf( _("\n" "Not enough random bytes available. Please do some other work to give\n" "the OS a chance to collect more entropy! (Need %d more bytes)\n"), (int)length ); - warn = 1; - continue; - } - else if( rc == -1 ) { - tty_printf( - "select() error: %s\n", strerror(errno)); - continue; - } + warn = 1; + continue; + } + else if( rc == -1 ) { + tty_printf( + "select() error: %s\n", strerror(errno)); + continue; + } + } +#endif /*FD_SETSIZE*/ do { int nbytes = length < sizeof(buffer)? length : sizeof(buffer); diff --git a/cipher/rndunix.c b/cipher/rndunix.c index 75cf22e..72905e6 100644 --- a/cipher/rndunix.c +++ b/cipher/rndunix.c @@ -290,10 +290,10 @@ static struct RI { /* This is a complex and screwball program. Some systems have things * like rX_dmn, x = integer, for RAID systems, but the statistics are * pretty dodgy */ -#ifdef __QNXNTO__ +#ifdef __QNXNTO__ { "/bin/pidin", "-F%A%B%c%d%E%I%J%K%m%M%n%N%p%P%S%s%T", SC(0.3), NULL, 0, 0, 0, 0 }, -#endif +#endif #if 0 /* The following aren't enabled since they're somewhat slow and not very * unpredictable, however they give an indication of the sort of sources @@ -625,6 +625,8 @@ slow_poll(FILE *dbgfp, int dbgall, size_t *nbytes ) FD_ZERO(&fds); for (i = 0; dataSources[i].path != NULL; i++) { if (dataSources[i].pipe != NULL) { + /* FIXME: We need to make sure that PIPEFD is less + than FD_SETSIZE. */ FD_SET(dataSources[i].pipeFD, &fds); moreSources = 1; } @@ -707,7 +709,7 @@ start_gatherer( int pipefd ) #else nmax = 20; /* assume a reasonable value */ #endif - { + { int fd; if ((fd = open ("/dev/null", O_RDWR)) != -1) { dup2 (fd, STDIN_FILENO); ----------------------------------------------------------------------- Summary of changes: cipher/rndlinux.c | 29 +++++++++++++++++------------ cipher/rndunix.c | 8 +++++--- 2 files changed, 22 insertions(+), 15 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Tue Jan 20 17:07:43 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Tue, 20 Jan 2015 17:07:43 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-34-g2a8fe04 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 2a8fe0448d418a54540a2af834647df6254f682a (commit) from 7be1b7d8017cb7ebf1a3855edec0ef5e342cc9c5 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 2a8fe0448d418a54540a2af834647df6254f682a Author: Werner Koch Date: Tue Jan 20 17:06:50 2015 +0100 artwork: Crop and rename the commonly used logo. -- diff --git a/artwork/README b/artwork/README index 5e60ab9..13b8653 100644 --- a/artwork/README +++ b/artwork/README @@ -6,8 +6,10 @@ gnupg-logo-new.svg Is the new logo from the logo context. We actually use the upper right one; the other elements may still be useful. +gnupg-logo.svg This is the cropped off version of the above logo. + gnupg-logo-new.eps Other versions. -gnupg-logo-new.ai +gnupg-logo-new.ai gnupg-favicon-1.ico Icons for the website (rectangular) gnupg-favicon-2.ico (round) diff --git a/artwork/gnupg-logo-new-single.svg b/artwork/gnupg-logo-new-single.svg deleted file mode 100644 index 7765948..0000000 --- a/artwork/gnupg-logo-new-single.svg +++ /dev/null @@ -1,125 +0,0 @@ - - -image/svg+xml - - - - - - - - - - - - - - - - - - - - - - - - GnuPG - - \ No newline at end of file diff --git a/artwork/gnupg-logo.svg b/artwork/gnupg-logo.svg new file mode 100644 index 0000000..c184436 --- /dev/null +++ b/artwork/gnupg-logo.svg @@ -0,0 +1,135 @@ + + + +image/svg+xmlGnuPG + \ No newline at end of file ----------------------------------------------------------------------- Summary of changes: artwork/README | 4 +- artwork/gnupg-logo-new-single.svg | 125 ----------------------------------- artwork/gnupg-logo.svg | 135 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 138 insertions(+), 126 deletions(-) delete mode 100644 artwork/gnupg-logo-new-single.svg create mode 100644 artwork/gnupg-logo.svg hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Tue Jan 20 21:17:53 2015 From: cvs at cvs.gnupg.org (by Jussi Kivilinna) Date: Tue, 20 Jan 2015 21:17:53 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-164-gceaa97f Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via ceaa97f0d849c07f3a15b642fc3a2b0a477b4a47 (commit) from 067d7d8752d4d8a98f8e0e5e9b1a5b13e1b7ff9c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ceaa97f0d849c07f3a15b642fc3a2b0a477b4a47 Author: Jussi Kivilinna Date: Tue Jan 20 18:54:13 2015 +0200 rijndael: fix wrong ifdef for SSSE3 setkey * cipher/rijndael.c (do_setkey): Use USE_SSSE3 instead of USE_AESNI around SSSE3 setkey selection. -- Reported-by: Richard H Lee Signed-off-by: Jussi Kivilinna diff --git a/cipher/rijndael.c b/cipher/rijndael.c index 51c36c7..a481e6f 100644 --- a/cipher/rijndael.c +++ b/cipher/rijndael.c @@ -325,7 +325,7 @@ do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen) else if (ctx->use_aesni) _gcry_aes_aesni_do_setkey (ctx, key); #endif -#ifdef USE_AESNI +#ifdef USE_SSSE3 else if (ctx->use_ssse3) _gcry_aes_ssse3_do_setkey (ctx, key); #endif ----------------------------------------------------------------------- Summary of changes: cipher/rijndael.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 21 12:45:49 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 21 Jan 2015 12:45:49 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-36-g4d7c9b0 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 4d7c9b0e9aceedd924d600978bc1b6cae7d5c456 (commit) via aa99ebde778b7b563f35025f1b48954757f840be (commit) from 2a8fe0448d418a54540a2af834647df6254f682a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 4d7c9b0e9aceedd924d600978bc1b6cae7d5c456 Author: Werner Koch Date: Wed Jan 21 12:42:14 2015 +0100 gpg: Support --passphrase with --quick-gen-key. * g10/keygen.c: Include shareddefs.h. (quick_generate_keypair): Support static passphrase. (get_parameter_passphrase): New. (do_generate_keypair): Use it. Signed-off-by: Werner Koch diff --git a/NEWS b/NEWS index 6f171aa..dbeec3d 100644 --- a/NEWS +++ b/NEWS @@ -7,6 +7,9 @@ Noteworthy changes in version 2.1.2 (unreleased) * gpg: The parameter 'Passphrase' for batch key generation works again. + * gpg: Using a passphrase option in batch mode now has the expected + effect on --quick-gen-key. + Noteworthy changes in version 2.1.1 (2014-12-16) ------------------------------------------------ diff --git a/doc/gpg.texi b/doc/gpg.texi index 6921fd9..429cc5b 100644 --- a/doc/gpg.texi +++ b/doc/gpg.texi @@ -571,6 +571,14 @@ If invoked directly on the console without any special options an answer to a ``Continue?'' style confirmation prompt is required. In case the user id already exists in the key ring a second prompt to force the creation of the key will show up. + +If this command is used with @option{--batch}, + at option{--pinentry-mode} has been set to @code{loopback}, and one of +the passphrase options (@option{--passphrase}, + at option{--passphrase-fd}, or @option{passphrase-file}) is used, the +supplied passphrase is used for the new key and the agent does not ask +for it. To create a key without any protection @code{--passphrase ''} +may be used. @end ifset @item --gen-key diff --git a/g10/keygen.c b/g10/keygen.c index a3dbed8..de45d2f 100644 --- a/g10/keygen.c +++ b/g10/keygen.c @@ -42,6 +42,7 @@ #include "keyserver-internal.h" #include "call-agent.h" #include "pkglue.h" +#include "../common/shareddefs.h" /* The default algorithms. If you change them remember to change them also in gpg.c:gpgconf_list. You should also check that the value @@ -2816,6 +2817,18 @@ get_parameter_value( struct para_data_s *para, enum para_name key ) return (r && *r->u.value)? r->u.value : NULL; } + +/* This is similar to get_parameter_value but also returns the empty + string. This is required so that quick_generate_keypair can use an + empty Passphrase to specify no-protection. */ +static const char * +get_parameter_passphrase (struct para_data_s *para) +{ + struct para_data_s *r = get_parameter (para, pPASSPHRASE); + return r->u.value; +} + + static int get_parameter_algo( struct para_data_s *para, enum para_name key, int *r_default) @@ -3496,6 +3509,21 @@ quick_generate_keypair (const char *uid) DEFAULT_STD_SUBALGO, DEFAULT_STD_SUBKEYSIZE, DEFAULT_STD_SUBCURVE); + /* If the pinentry loopback mode is not and we have a static + passphrase (i.e. set with --passphrase{,-fd,-file} while in batch + mode), we use that passphrase for the new key. */ + if (opt.pinentry_mode != PINENTRY_MODE_LOOPBACK + && have_static_passphrase ()) + { + const char *s = get_static_passphrase (); + + r = xmalloc_clear (sizeof *r + strlen (s)); + r->key = pPASSPHRASE; + strcpy (r->u.value, s); + r->next = para; + para = r; + } + proc_parameter_file (para, "[internal]", &outctrl, 0); leave: release_parameter_list (para); @@ -3970,7 +3998,7 @@ do_generate_keypair (struct para_data_s *para, timestamp, get_parameter_u32( para, pKEYEXPIRE ), 0, outctrl->keygen_flags, - get_parameter_value (para, pPASSPHRASE), + get_parameter_passphrase (para), &cache_nonce); else err = gen_card_key (PUBKEY_ALGO_RSA, 1, 1, pub_root, @@ -4024,7 +4052,7 @@ do_generate_keypair (struct para_data_s *para, timestamp, get_parameter_u32 (para, pSUBKEYEXPIRE), 1, outctrl->keygen_flags, - get_parameter_value (para, pPASSPHRASE), + get_parameter_passphrase (para), &cache_nonce); /* Get the pointer to the generated public subkey packet. */ if (!err) commit aa99ebde778b7b563f35025f1b48954757f840be Author: Werner Koch Date: Wed Jan 21 11:31:20 2015 +0100 gpg: Re-enable the "Passphrase" parameter for batch key generation. * agent/command.c (cmd_genkey): Add option --inq-passwd. * agent/genkey.c (agent_genkey): Add new arg override_passphrase. * g10/call-agent.c (inq_genkey_parms): Handle NEWPASSWD keyword. (agent_genkey): Add arg optional arg "passphrase". * g10/keygen.c (common_gen, gen_elg, gen_dsa, gen_ecc) (gen_rsa, do_create): Add arg "passphrase" and pass it through. (do_generate_keypair): Make use of pPASSPHRASE. (release_parameter_list): Wipe out a passphrase parameter. Signed-off-by: Werner Koch diff --git a/NEWS b/NEWS index f4a6918..6f171aa 100644 --- a/NEWS +++ b/NEWS @@ -4,6 +4,9 @@ Noteworthy changes in version 2.1.2 (unreleased) * agent: When setting --default-cache-ttl the value for --max-cache-ttl is adjusted to be not lower than the former. + * gpg: The parameter 'Passphrase' for batch key generation works + again. + Noteworthy changes in version 2.1.1 (2014-12-16) ------------------------------------------------ diff --git a/agent/agent.h b/agent/agent.h index c7c65af..4be5925 100644 --- a/agent/agent.h +++ b/agent/agent.h @@ -396,7 +396,8 @@ gpg_error_t agent_ask_new_passphrase (ctrl_t ctrl, const char *prompt, char **r_passphrase); int agent_genkey (ctrl_t ctrl, const char *cache_nonce, const char *keyparam, size_t keyparmlen, - int no_protection, int preset, membuf_t *outbuf); + int no_protection, const char *override_passphrase, + int preset, membuf_t *outbuf); gpg_error_t agent_protect_and_store (ctrl_t ctrl, gcry_sexp_t s_skey, char **passphrase_addr); diff --git a/agent/command.c b/agent/command.c index da7e508..d5644cb 100644 --- a/agent/command.c +++ b/agent/command.c @@ -914,22 +914,23 @@ cmd_pkdecrypt (assuan_context_t ctx, char *line) static const char hlp_genkey[] = - "GENKEY [--no-protection] [--preset] []\n" + "GENKEY [--no-protection] [--preset] [--inq-passwd] []\n" "\n" "Generate a new key, store the secret part and return the public\n" "part. Here is an example transaction:\n" "\n" " C: GENKEY\n" " S: INQUIRE KEYPARAM\n" - " C: D (genkey (rsa (nbits 1024)))\n" + " C: D (genkey (rsa (nbits 2048)))\n" " C: END\n" " S: D (public-key\n" " S: D (rsa (n 326487324683264) (e 10001)))\n" " S: OK key created\n" "\n" "When the --preset option is used the passphrase for the generated\n" - "key will be added to the cache.\n" - "\n"; + "key will be added to the cache. When --inq-passwd is used an inquire\n" + "with the keyword NEWPASSWD is used to request the passphrase for the\n" + "new key.\n"; static gpg_error_t cmd_genkey (assuan_context_t ctx, char *line) { @@ -938,16 +939,20 @@ cmd_genkey (assuan_context_t ctx, char *line) int no_protection; unsigned char *value; size_t valuelen; + unsigned char *newpasswd = NULL; membuf_t outbuf; char *cache_nonce = NULL; int opt_preset; + int opt_inq_passwd; + size_t n; char *p; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); - opt_preset = has_option (line, "--preset"); no_protection = has_option (line, "--no-protection"); + opt_preset = has_option (line, "--preset"); + opt_inq_passwd = has_option (line, "--inq-passwd"); line = skip_options (line); p = line; @@ -966,8 +971,37 @@ cmd_genkey (assuan_context_t ctx, char *line) init_membuf (&outbuf, 512); + /* If requested, ask for the password to be used for the key. If + this is not used the regular Pinentry mechanism is used. */ + if (opt_inq_passwd && !no_protection) + { + /* (N is used as a dummy) */ + assuan_begin_confidential (ctx); + rc = assuan_inquire (ctx, "NEWPASSWD", &newpasswd, &n, 256); + assuan_end_confidential (ctx); + if (rc) + goto leave; + if (!*newpasswd) + { + /* Empty password given - switch to no-protection mode. */ + xfree (newpasswd); + newpasswd = NULL; + no_protection = 1; + } + + } + rc = agent_genkey (ctrl, cache_nonce, (char*)value, valuelen, no_protection, - opt_preset, &outbuf); + newpasswd, opt_preset, &outbuf); + + leave: + if (newpasswd) + { + /* Assuan_inquire does not allow us to read into secure memory + thus we need to wipe it ourself. */ + wipememory (newpasswd, strlen (newpasswd)); + xfree (newpasswd); + } xfree (value); if (rc) clear_outbuf (&outbuf); diff --git a/agent/genkey.c b/agent/genkey.c index 91917f7..d7b6007 100644 --- a/agent/genkey.c +++ b/agent/genkey.c @@ -410,14 +410,16 @@ agent_ask_new_passphrase (ctrl_t ctrl, const char *prompt, /* Generate a new keypair according to the parameters given in KEYPARAM. If CACHE_NONCE is given first try to lookup a passphrase using the cache nonce. If NO_PROTECTION is true the key will not - be protected by a passphrase. */ + be protected by a passphrase. If OVERRIDE_PASSPHRASE is true that + passphrase will be used for the new key. */ int agent_genkey (ctrl_t ctrl, const char *cache_nonce, const char *keyparam, size_t keyparamlen, int no_protection, - int preset, membuf_t *outbuf) + const char *override_passphrase, int preset, membuf_t *outbuf) { gcry_sexp_t s_keyparam, s_key, s_private, s_public; - char *passphrase; + char *passphrase_buffer = NULL; + const char *passphrase; int rc; size_t len; char *buf; @@ -430,27 +432,35 @@ agent_genkey (ctrl_t ctrl, const char *cache_nonce, } /* Get the passphrase now, cause key generation may take a while. */ - if (no_protection || !cache_nonce) + if (override_passphrase) + passphrase = override_passphrase; + else if (no_protection || !cache_nonce) passphrase = NULL; else - passphrase = agent_get_cache (cache_nonce, CACHE_MODE_NONCE); + { + passphrase_buffer = agent_get_cache (cache_nonce, CACHE_MODE_NONCE); + passphrase = passphrase_buffer; + } if (passphrase || no_protection) - rc = 0; + ; else - rc = agent_ask_new_passphrase (ctrl, - _("Please enter the passphrase to%0A" - "protect your new key"), - &passphrase); - if (rc) - return rc; + { + rc = agent_ask_new_passphrase (ctrl, + _("Please enter the passphrase to%0A" + "protect your new key"), + &passphrase_buffer); + if (rc) + return rc; + passphrase = passphrase_buffer; + } rc = gcry_pk_genkey (&s_key, s_keyparam ); gcry_sexp_release (s_keyparam); if (rc) { log_error ("key generation failed: %s\n", gpg_strerror (rc)); - xfree (passphrase); + xfree (passphrase_buffer); return rc; } @@ -460,7 +470,7 @@ agent_genkey (ctrl_t ctrl, const char *cache_nonce, { log_error ("key generation failed: invalid return value\n"); gcry_sexp_release (s_key); - xfree (passphrase); + xfree (passphrase_buffer); return gpg_error (GPG_ERR_INV_DATA); } s_public = gcry_sexp_find_token (s_key, "public-key", 0); @@ -469,7 +479,7 @@ agent_genkey (ctrl_t ctrl, const char *cache_nonce, log_error ("key generation failed: invalid return value\n"); gcry_sexp_release (s_private); gcry_sexp_release (s_key); - xfree (passphrase); + xfree (passphrase_buffer); return gpg_error (GPG_ERR_INV_DATA); } gcry_sexp_release (s_key); s_key = NULL; @@ -503,7 +513,8 @@ agent_genkey (ctrl_t ctrl, const char *cache_nonce, } } } - xfree (passphrase); + xfree (passphrase_buffer); + passphrase_buffer = NULL; passphrase = NULL; gcry_sexp_release (s_private); if (rc) diff --git a/doc/gpg-agent.texi b/doc/gpg-agent.texi index 36bd0c2..7ac441f 100644 --- a/doc/gpg-agent.texi +++ b/doc/gpg-agent.texi @@ -1134,6 +1134,13 @@ The @option{--no-protection} option may be used to prevent prompting for a passphrase to protect the secret key while leaving the secret key unprotected. The @option{--preset} option may be used to add the passphrase to the cache using the default cache parameters. + +The @option{--inq-passwd} option may be used to create the key with a +supplied passphrase. When used the agent does an inquiry with the +keyword @code{NEWPASSWD} to retrieve that passphrase. This option +takes precedence over @option{--no-protection}; however if the client +sends a empty (zero-length) passphrase, this is identical to + at option{--no-protection}. @end ifset @node Agent IMPORT diff --git a/doc/gpg.texi b/doc/gpg.texi index 71ffaf8..6921fd9 100644 --- a/doc/gpg.texi +++ b/doc/gpg.texi @@ -3341,17 +3341,13 @@ ignored and instead the usual passphrase dialog is used. This does not make sense for batch key generation; however the unattended key generation feature is also used by GUIs and this feature relinquishes the GUI from implementing its own passphrase entry code. These are -global control statements and affect all future key genrations. +global control statements and affect all future key generations. @end ifclear @ifset gpgtwoone This option is a no-op for GnuPG 2.1 and later. @end ifset - @item %no-protection -Since GnuPG version 2.1 it is not anymore possible to specify a -passphrase for unattended key generation. The passphrase command is -simply ignored and @samp{%ask-passpharse} is thus implicitly enabled. Using this option allows the creation of keys without any passphrase protection. This option is mainly intended for regression tests. @@ -3409,8 +3405,8 @@ by running the command @samp{gpg2 --gpgconf-list}". Key usage lists for a subkey; similar to @samp{Key-Usage}. @item Passphrase: @var{string} -If you want to specify a passphrase for the secret key, -enter it here. Default is not to use any passphrase. +If you want to specify a passphrase for the secret key, enter it here. +Default is to use the Pinentry dialog to ask for a passphrase. @item Name-Real: @var{name} @itemx Name-Comment: @var{comment} diff --git a/g10/call-agent.c b/g10/call-agent.c index a98a177..dc9d157 100644 --- a/g10/call-agent.c +++ b/g10/call-agent.c @@ -1,7 +1,6 @@ /* call-agent.c - Divert GPG operations to the agent. - * Copyright (C) 2001, 2002, 2003, 2006, 2007, 2008, 2009, - * 2010, 2011, 2013 Free Software Foundation, Inc. - * Copyright (C) 2013, 2014 Werner Koch + * Copyright (C) 2001-2003, 2006-2011, 2013 Free Software Foundation, Inc. + * Copyright (C) 2013-2015 Werner Koch * * This file is part of GnuPG. * @@ -90,6 +89,7 @@ struct genkey_parm_s { struct default_inq_parm_s *dflt; const char *keyparms; + const char *passphrase; }; struct import_key_parm_s @@ -1737,6 +1737,11 @@ inq_genkey_parms (void *opaque, const char *line) err = assuan_send_data (parm->dflt->ctx, parm->keyparms, strlen (parm->keyparms)); } + else if (has_leading_keyword (line, "NEWPASSWD") && parm->passphrase) + { + err = assuan_send_data (parm->dflt->ctx, + parm->passphrase, strlen (parm->passphrase)); + } else err = default_inq_cb (parm->dflt, line); @@ -1747,10 +1752,13 @@ inq_genkey_parms (void *opaque, const char *line) /* Call the agent to generate a new key. KEYPARMS is the usual S-expression giving the parameters of the key. gpg-agent passes it gcry_pk_genkey. If NO_PROTECTION is true the agent is advised not - to protect the generated key. */ + to protect the generated key. If NO_PROTECTION is not set and + PASSPHRASE is not NULL the agent is requested to protect the key + with that passphrase instead of asking for one. */ gpg_error_t agent_genkey (ctrl_t ctrl, char **cache_nonce_addr, - const char *keyparms, int no_protection, gcry_sexp_t *r_pubkey) + const char *keyparms, int no_protection, + const char *passphrase, gcry_sexp_t *r_pubkey) { gpg_error_t err; struct genkey_parm_s gk_parm; @@ -1778,8 +1786,11 @@ agent_genkey (ctrl_t ctrl, char **cache_nonce_addr, init_membuf (&data, 1024); gk_parm.dflt = &dfltparm; gk_parm.keyparms = keyparms; + gk_parm.passphrase = passphrase; snprintf (line, sizeof line, "GENKEY%s%s%s", - no_protection? " --no-protection":"", + no_protection? " --no-protection" : + passphrase ? " --inq-passwd" : + /* */ "", cache_nonce_addr && *cache_nonce_addr? " ":"", cache_nonce_addr && *cache_nonce_addr? *cache_nonce_addr:""); cn_parm.cache_nonce_addr = cache_nonce_addr; diff --git a/g10/call-agent.h b/g10/call-agent.h index bcb5ae9..9c104e8 100644 --- a/g10/call-agent.h +++ b/g10/call-agent.h @@ -154,6 +154,7 @@ gpg_error_t agent_get_keyinfo (ctrl_t ctrl, const char *hexkeygrip, /* Generate a new key. */ gpg_error_t agent_genkey (ctrl_t ctrl, char **cache_nonce_addr, const char *keyparms, int no_protection, + const char *passphrase, gcry_sexp_t *r_pubkey); /* Read a public key. */ diff --git a/g10/keygen.c b/g10/keygen.c index fa466a8..a3dbed8 100644 --- a/g10/keygen.c +++ b/g10/keygen.c @@ -1,7 +1,6 @@ /* keygen.c - generate a key pair - * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006 - * 2007, 2009, 2010, 2011 Free Software Foundation, Inc. - * Copyright (C) 2014 Werner Koch + * Copyright (C) 1998-2007, 2009-2011 Free Software Foundation, Inc. + * Copyright (C) 2014, 2015 Werner Koch * * This file is part of GnuPG. * @@ -1287,7 +1286,7 @@ do_create_from_keygrip (ctrl_t ctrl, int algo, const char *hexkeygrip, static int common_gen (const char *keyparms, int algo, const char *algoelem, kbnode_t pub_root, u32 timestamp, u32 expireval, int is_subkey, - int keygen_flags, char **cache_nonce_addr) + int keygen_flags, const char *passphrase, char **cache_nonce_addr) { int err; PACKET *pkt; @@ -1295,7 +1294,9 @@ common_gen (const char *keyparms, int algo, const char *algoelem, gcry_sexp_t s_key; err = agent_genkey (NULL, cache_nonce_addr, keyparms, - !!(keygen_flags & KEYGEN_FLAG_NO_PROTECTION), &s_key); + !!(keygen_flags & KEYGEN_FLAG_NO_PROTECTION), + passphrase, + &s_key); if (err) { log_error ("agent_genkey failed: %s\n", gpg_strerror (err) ); @@ -1353,7 +1354,7 @@ common_gen (const char *keyparms, int algo, const char *algoelem, static int gen_elg (int algo, unsigned int nbits, KBNODE pub_root, u32 timestamp, u32 expireval, int is_subkey, - int keygen_flags, char **cache_nonce_addr) + int keygen_flags, const char *passphrase, char **cache_nonce_addr) { int err; char *keyparms; @@ -1394,7 +1395,7 @@ gen_elg (int algo, unsigned int nbits, KBNODE pub_root, { err = common_gen (keyparms, algo, "pgy", pub_root, timestamp, expireval, is_subkey, - keygen_flags, cache_nonce_addr); + keygen_flags, passphrase, cache_nonce_addr); xfree (keyparms); } @@ -1408,7 +1409,7 @@ gen_elg (int algo, unsigned int nbits, KBNODE pub_root, static gpg_error_t gen_dsa (unsigned int nbits, KBNODE pub_root, u32 timestamp, u32 expireval, int is_subkey, - int keygen_flags, char **cache_nonce_addr) + int keygen_flags, const char *passphrase, char **cache_nonce_addr) { int err; unsigned int qbits; @@ -1481,7 +1482,7 @@ gen_dsa (unsigned int nbits, KBNODE pub_root, { err = common_gen (keyparms, PUBKEY_ALGO_DSA, "pqgy", pub_root, timestamp, expireval, is_subkey, - keygen_flags, cache_nonce_addr); + keygen_flags, passphrase, cache_nonce_addr); xfree (keyparms); } @@ -1496,7 +1497,7 @@ gen_dsa (unsigned int nbits, KBNODE pub_root, static gpg_error_t gen_ecc (int algo, const char *curve, kbnode_t pub_root, u32 timestamp, u32 expireval, int is_subkey, - int keygen_flags, char **cache_nonce_addr) + int keygen_flags, const char *passphrase, char **cache_nonce_addr) { gpg_error_t err; char *keyparms; @@ -1531,7 +1532,7 @@ gen_ecc (int algo, const char *curve, kbnode_t pub_root, { err = common_gen (keyparms, algo, "", pub_root, timestamp, expireval, is_subkey, - keygen_flags, cache_nonce_addr); + keygen_flags, passphrase, cache_nonce_addr); xfree (keyparms); } @@ -1545,7 +1546,7 @@ gen_ecc (int algo, const char *curve, kbnode_t pub_root, static int gen_rsa (int algo, unsigned int nbits, KBNODE pub_root, u32 timestamp, u32 expireval, int is_subkey, - int keygen_flags, char **cache_nonce_addr) + int keygen_flags, const char *passphrase, char **cache_nonce_addr) { int err; char *keyparms; @@ -1586,7 +1587,7 @@ gen_rsa (int algo, unsigned int nbits, KBNODE pub_root, { err = common_gen (keyparms, algo, "ne", pub_root, timestamp, expireval, is_subkey, - keygen_flags, cache_nonce_addr); + keygen_flags, passphrase, cache_nonce_addr); xfree (keyparms); } @@ -2724,7 +2725,7 @@ do_ask_passphrase (STRING2KEY **ret_s2k, int mode, int *r_canceled) static int do_create (int algo, unsigned int nbits, const char *curve, KBNODE pub_root, u32 timestamp, u32 expiredate, int is_subkey, - int keygen_flags, char **cache_nonce_addr) + int keygen_flags, const char *passphrase, char **cache_nonce_addr) { gpg_error_t err; @@ -2739,18 +2740,18 @@ do_create (int algo, unsigned int nbits, const char *curve, KBNODE pub_root, if (algo == PUBKEY_ALGO_ELGAMAL_E) err = gen_elg (algo, nbits, pub_root, timestamp, expiredate, is_subkey, - keygen_flags, cache_nonce_addr); + keygen_flags, passphrase, cache_nonce_addr); else if (algo == PUBKEY_ALGO_DSA) err = gen_dsa (nbits, pub_root, timestamp, expiredate, is_subkey, - keygen_flags, cache_nonce_addr); + keygen_flags, passphrase, cache_nonce_addr); else if (algo == PUBKEY_ALGO_ECDSA || algo == PUBKEY_ALGO_EDDSA || algo == PUBKEY_ALGO_ECDH) err = gen_ecc (algo, curve, pub_root, timestamp, expiredate, is_subkey, - keygen_flags, cache_nonce_addr); + keygen_flags, passphrase, cache_nonce_addr); else if (algo == PUBKEY_ALGO_RSA) err = gen_rsa (algo, nbits, pub_root, timestamp, expiredate, is_subkey, - keygen_flags, cache_nonce_addr); + keygen_flags, passphrase, cache_nonce_addr); else BUG(); @@ -2792,6 +2793,8 @@ release_parameter_list (struct para_data_s *r) for (; r ; r = r2) { r2 = r->next; + if (r->key == pPASSPHRASE && *r->u.value) + wipememory (r->u.value, strlen (r->u.value)); xfree (r); } } @@ -3966,7 +3969,9 @@ do_generate_keypair (struct para_data_s *para, pub_root, timestamp, get_parameter_u32( para, pKEYEXPIRE ), 0, - outctrl->keygen_flags, &cache_nonce); + outctrl->keygen_flags, + get_parameter_value (para, pPASSPHRASE), + &cache_nonce); else err = gen_card_key (PUBKEY_ALGO_RSA, 1, 1, pub_root, ×tamp, @@ -4018,7 +4023,9 @@ do_generate_keypair (struct para_data_s *para, pub_root, timestamp, get_parameter_u32 (para, pSUBKEYEXPIRE), 1, - outctrl->keygen_flags, &cache_nonce); + outctrl->keygen_flags, + get_parameter_value (para, pPASSPHRASE), + &cache_nonce); /* Get the pointer to the generated public subkey packet. */ if (!err) { @@ -4241,7 +4248,7 @@ generate_subkeypair (ctrl_t ctrl, kbnode_t keyblock) keyblock, cur_time, expire, 1); else err = do_create (algo, nbits, curve, - keyblock, cur_time, expire, 1, 0, NULL); + keyblock, cur_time, expire, 1, 0, NULL, NULL); if (err) goto leave; ----------------------------------------------------------------------- Summary of changes: NEWS | 6 +++++ agent/agent.h | 3 ++- agent/command.c | 46 +++++++++++++++++++++++++++----- agent/genkey.c | 43 ++++++++++++++++++------------ doc/gpg-agent.texi | 7 +++++ doc/gpg.texi | 18 ++++++++----- g10/call-agent.c | 23 +++++++++++----- g10/call-agent.h | 1 + g10/keygen.c | 77 +++++++++++++++++++++++++++++++++++++++--------------- 9 files changed, 167 insertions(+), 57 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 21 15:26:30 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 21 Jan 2015 15:26:30 +0100 Subject: [git] gnupg-doc - branch, master, updated. fe1d06f56ce9d637ed66594541d273236f07c941 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via fe1d06f56ce9d637ed66594541d273236f07c941 (commit) via 46a23a5b7384c2c2ac2a3ff38772d4ea74add976 (commit) from 1e69a038458b3374d5a3f7df55b39e256b7b3ff3 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit fe1d06f56ce9d637ed66594541d273236f07c941 Author: Werner Koch Date: Wed Jan 21 15:26:13 2015 +0100 web: Add a roadmap page This is not yet linked from the menu. diff --git a/web/roadmap.org b/web/roadmap.org new file mode 100644 index 0000000..28dc5b4 --- /dev/null +++ b/web/roadmap.org @@ -0,0 +1,59 @@ +#+TITLE: GnuPG - Roadmap +#+STARTUP: showall +#+SETUPFILE: "share/setup.inc" + +* GnuPG Roadmap + :PROPERTIES: + :CUSTOM_ID: gnupg + :END: + + This page has information on what we plan to do and what new + features will go into which version. This is _not_ a list of + guaranteed milestones or with fixed release dates. This page should + better be viewed as a scratchpad with notes of GnuPG developers. + + The next GnuPG /modern/ release will be 2.1.2 and is planned for + January. + +** New features in 2.1 + + - gpg: The parameter 'Passphrase' for batch key generation works + again. + + - gpg: Using a passphrase option in batch mode now has the expected + effect on --quick-gen-key. + + +** All things to do + + - Fix flaws in HKPS support + + - Add LDAP keyserver support + + - +Add unattended key generation with passphrase.+ + + + +* Libgcrypt Roadmap + :PROPERTIES: + :CUSTOM_ID: gcrypt + :END: + + Libgcrypt is used by a lot of other projects and thus deserves its + own roadmap + + +** Things to be done for Libgcrypt 1.7 + + The next release will be 1.7 with a lot of performance improvements + and a few new features. Here are the things we want to have before + the 1.7.0 release: + + - +Add OCB mode+ + - Update of the Windows entropy gatherer (rndw32.c) + + + The rndw32 update is pretty important because it has not seen any + updates for years. We need to compare the code against the latest + Cryptlib. Updating rndunix could also be done but it is not very + important given that all mainstream OS now feature a /dev/random. commit 46a23a5b7384c2c2ac2a3ff38772d4ea74add976 Author: Werner Koch Date: Wed Jan 21 15:25:47 2015 +0100 web: Minor updates. diff --git a/misc/blog.gnupg.org/20150101-happy-gnu-year.org b/misc/blog.gnupg.org/20150101-happy-gnu-year.org index 38a0ae8..01728ce 100644 --- a/misc/blog.gnupg.org/20150101-happy-gnu-year.org +++ b/misc/blog.gnupg.org/20150101-happy-gnu-year.org @@ -70,7 +70,7 @@ small active user base. For a mass use of it we need to add a few things or start to deploy an easier method for retrieving keys. This is essential for making mail encryption the default on the net. -Although the use or proprietary platforms supports the spook?s +Although the use of proprietary platforms supports the spook?s surveillance programs, it is a pipe dream to believe that free operating systems like Linux or FreeBSD can completely replace Windows, Mac OS, and Android any time soon. Improving our crypto @@ -87,8 +87,9 @@ algorithms as soon as the needs arises. As stated in the press release a second full time developer for GnuPG is required to avoid relying mostly on me. Keep in mind that even after having secured enough funds it will take some time to find a -developer and it will also takes some months until s/he is up to my -maintenance experience. Thus is at all costs required nevertheless. +developer and it will also take some months until s/he is up to my +maintenance experience. Nevertheless, we need to bear these +additional costs. In general we need to simplify the the user interfaces of most frontends and make it easier start with and keep on using encryption. diff --git a/web/index.org b/web/index.org index d0e2f61..946afff 100644 --- a/web/index.org +++ b/web/index.org @@ -77,7 +77,9 @@ you are in good company; GnuPG is one of the tools that Edward Snowden used to uncover his secrets about the NSA. Please visit the [[https://emailselfdefense.fsf.org][Email Self-Defense]] site to learn how and why you -should use GnuPG for your electronic communication. +should use GnuPG for your electronic communication. If you need +printed leaflets check out [[https://fsfe.org/contribute/spreadtheword.html#gnupg-leaflet][FSFE?s GnuPG leaflet]]. + * Latest news #+index: News diff --git a/web/related_software/swlist.org b/web/related_software/swlist.org index 8082bdf..1961714 100644 --- a/web/related_software/swlist.org +++ b/web/related_software/swlist.org @@ -19,7 +19,7 @@ the software: ** [[http://www.claws-mail.org/][Claws Mail]] [Unix, Windows] MUA :PROPERTIES: - :CUSTOM_ID: + :CUSTOM_ID: claws :END: Is a very nice GTK+ based MUA with full support for GnuPG. The Windows ----------------------------------------------------------------------- Summary of changes: misc/blog.gnupg.org/20150101-happy-gnu-year.org | 7 +-- web/index.org | 4 +- web/related_software/swlist.org | 2 +- web/roadmap.org | 59 +++++++++++++++++++++++++ 4 files changed, 67 insertions(+), 5 deletions(-) create mode 100644 web/roadmap.org hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 21 15:54:24 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 21 Jan 2015 15:54:24 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-37-g091c35e Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 091c35ec726a4fa4691c2665b13adee6a34b5b66 (commit) from 4d7c9b0e9aceedd924d600978bc1b6cae7d5c456 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 091c35ec726a4fa4691c2665b13adee6a34b5b66 Author: Werner Koch Date: Wed Jan 21 15:54:06 2015 +0100 dirmngr: Fix TLS build problems. * dirmngr/Makefile.am (AM_CFLAGS): Add flags for TLS libs. -- This should fix GnuPG-bug-id: 1813. diff --git a/dirmngr/Makefile.am b/dirmngr/Makefile.am index eaa02a5..2d8d336 100644 --- a/dirmngr/Makefile.am +++ b/dirmngr/Makefile.am @@ -31,8 +31,10 @@ AM_CPPFLAGS = -I$(top_srcdir)/gl -I$(top_srcdir)/intl -I$(top_srcdir)/common include $(top_srcdir)/am/cmacros.am -AM_CFLAGS = $(LIBGCRYPT_CFLAGS) $(KSBA_CFLAGS) \ - $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS) $(NPTH_CFLAGS) +AM_CFLAGS = $(LIBGCRYPT_CFLAGS) $(KSBA_CFLAGS) $(LIBASSUAN_CFLAGS) \ + $(GPG_ERROR_CFLAGS) $(NPTH_CFLAGS) $(NTBTLS_CFLAGS) \ + $(LIBGNUTLS_CFLAGS) + BUILT_SOURCES = no-libgcrypt.c ----------------------------------------------------------------------- Summary of changes: dirmngr/Makefile.am | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 21 18:19:17 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 21 Jan 2015 18:19:17 +0100 Subject: [git] gnupg-doc - branch, master, updated. 3f1715f771cd1b21b032846d7f1ea1666a14b1c7 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via 3f1715f771cd1b21b032846d7f1ea1666a14b1c7 (commit) from fe1d06f56ce9d637ed66594541d273236f07c941 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3f1715f771cd1b21b032846d7f1ea1666a14b1c7 Author: Werner Koch Date: Wed Jan 21 17:49:26 2015 +0100 web: Add link to source and change date to all pages. diff --git a/web/share/gpgweb.el b/web/share/gpgweb.el index 06c43a0..036cf52 100644 --- a/web/share/gpgweb.el +++ b/web/share/gpgweb.el @@ -43,7 +43,7 @@ (defun gpgweb-insert-header (title committed-at) "Insert the header. -COMMITED-AT is the commit date string of the source file or nil +COMMITTED-AT is the commit date string of the source file or nil if not available." (goto-char (point-min)) (insert " @@ -269,36 +269,48 @@ org filenames." "

\n"))))) -(defun gpgweb-insert-footer () - (goto-char (point-max)) - (insert " +(defun gpgweb-insert-footer (htmlfile committed-at blogmode) + "Insert the footer. + +HTMLFILE is HTML file name and COMMITTED-AT is the commit date +string of the source file or nil if not available." + (let ((srcfile (concat "https://git.gnupg.org/cgi-bin/gitweb.cgi?" + "p=gnupg-doc.git;a=blob;f=" + (if blogmode "misc/blog.gnupg.org" "web") + (file-name-sans-extension htmlfile) ".org")) + (changed (if (and committed-at (>= (length committed-at) 10)) + (substring committed-at 0 10) + "[unknown]"))) + (goto-char (point-max)) + (insert "
    ") - (gpgweb--insert-menu gpgweb-gnupg-bottom-menu-alist 0 nil) - (insert "
+ (gpgweb--insert-menu gpgweb-gnupg-bottom-menu-alist 0 nil) + (insert "
") - (goto-char (point-min)) - (unless (search-forward "" nil t) - (goto-char (point-max)) - (insert "
+ (goto-char (point-min)) + (unless (search-forward "" nil t) + (goto-char (point-max)) + (insert "
\"CC-BY-SA  These web pages are - Copyright 1998--2014 The GnuPG Project and licensed under a + Copyright 1998--2015 The GnuPG Project and licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License. See copying for details. + Page source last changed on " changed ".
\n")) (goto-char (point-max)) (insert "
-")) +"))) ;;; Post-process the generated HTML file: @@ -318,8 +330,13 @@ org filenames." (concat "git log -1 --format='%ci' -- " orgfile)))) (prog1 (with-current-buffer work-buffer (let ((fname (file-name-nondirectory htmlfile)) + ;; The first replace below is a hack to cope with + ;; blog mode where HTMLFILE is like "./foo.html". (fname-2 (replace-regexp-in-string - ".*/stage\\(/.*\\)$" "\\1" htmlfile t)) + "^\\./" "/" + (replace-regexp-in-string + ".*/stage\\(/.*\\)$" "\\1" htmlfile t) + t)) (title (org-publish-find-title orgfile))) ;; Insert header, menu, and footer. (gpgweb-insert-header title committed-at) @@ -328,7 +345,7 @@ org filenames." (gpgweb-fixup-blog plist (file-name-nondirectory orgfile) blogmode)) - (gpgweb-insert-footer) + (gpgweb-insert-footer fname-2 committed-at blogmode) ; Fixup the sitemap (when (string-equal fname "sitemap.html") ----------------------------------------------------------------------- Summary of changes: web/share/gpgweb.el | 45 +++++++++++++++++++++++++++++++-------------- 1 file changed, 31 insertions(+), 14 deletions(-) hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 21 18:57:48 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 21 Jan 2015 18:57:48 +0100 Subject: [git] gnupg-doc - branch, master, updated. b4b2626da5b628b5bbd9baf25dd2e667a68b2466 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via b4b2626da5b628b5bbd9baf25dd2e667a68b2466 (commit) from 3f1715f771cd1b21b032846d7f1ea1666a14b1c7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b4b2626da5b628b5bbd9baf25dd2e667a68b2466 Author: Werner Koch Date: Wed Jan 21 18:47:57 2015 +0100 web: Fix regression in blog menu This was introduced with the last change. diff --git a/web/share/gpgweb.el b/web/share/gpgweb.el index 036cf52..c11d27b 100644 --- a/web/share/gpgweb.el +++ b/web/share/gpgweb.el @@ -277,7 +277,12 @@ string of the source file or nil if not available." (let ((srcfile (concat "https://git.gnupg.org/cgi-bin/gitweb.cgi?" "p=gnupg-doc.git;a=blob;f=" (if blogmode "misc/blog.gnupg.org" "web") - (file-name-sans-extension htmlfile) ".org")) + ;; The replace below is a hack to cope with + ;; blogmode where HTMLFILE is like "./foo.html". + (replace-regexp-in-string + "^\\./" "/" + (file-name-sans-extension htmlfile) t) + ".org")) (changed (if (and committed-at (>= (length committed-at) 10)) (substring committed-at 0 10) "[unknown]"))) @@ -330,13 +335,8 @@ string of the source file or nil if not available." (concat "git log -1 --format='%ci' -- " orgfile)))) (prog1 (with-current-buffer work-buffer (let ((fname (file-name-nondirectory htmlfile)) - ;; The first replace below is a hack to cope with - ;; blog mode where HTMLFILE is like "./foo.html". (fname-2 (replace-regexp-in-string - "^\\./" "/" - (replace-regexp-in-string - ".*/stage\\(/.*\\)$" "\\1" htmlfile t) - t)) + ".*/stage\\(/.*\\)$" "\\1" htmlfile t)) (title (org-publish-find-title orgfile))) ;; Insert header, menu, and footer. (gpgweb-insert-header title committed-at) ----------------------------------------------------------------------- Summary of changes: web/share/gpgweb.el | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 22 11:09:23 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 22 Jan 2015 11:09:23 +0100 Subject: [git] GPG-ERROR - branch, master, updated. libgpg-error-1.17-17-g524d5bd Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Error codes used by GnuPG et al.". The branch, master has been updated via 524d5bdee2954337e748428469972957663d497d (commit) from 46aaffbe852e334fd1a72affc4a918ceb7dc457b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 524d5bdee2954337e748428469972957663d497d Author: Werner Koch Date: Thu Jan 22 11:09:02 2015 +0100 Add GPG_ERR_LEGACY_KEY. diff --git a/NEWS b/NEWS index 65083f5..e5733e4 100644 --- a/NEWS +++ b/NEWS @@ -7,6 +7,7 @@ Noteworthy changes in version 1.18 (unreleased) [C13/A13/R_] GPG_ERR_OBJ_TERM_STATE NEW. GPG_ERR_REQUEST_TOO_SHORT NEW. GPG_ERR_REQUEST_TOO_LONG NEW. + GPG_ERR_LEGACY_KEY NEW. Noteworthy changes in version 1.17 (2014-10-15) [C13/A13/R0] diff --git a/doc/errorref.txt b/doc/errorref.txt index 0657f53..2e4a6bd 100644 --- a/doc/errorref.txt +++ b/doc/errorref.txt @@ -2,15 +2,14 @@ # -name '*.[ch]' -print0 | xargs -0 grep -n GPG_ERR_ -GPG_ERR_UNKNOWN_PACKET Unknown packet +GPG_ERR_UNKNOWN_PACKET (1) Unknown packet GNUPG: - Redefined to G10ERR_UNKNOWN_PACKET in gpg. -GPG_ERR_UNKNOWN_VERSION Unknown version in packet +GPG_ERR_UNKNOWN_VERSION (2) Unknown version in packet - Not used. Fixme: We might want to use it in gpg instead of some - of the INV_PACKET in gpg. The error string does not make sense - otherwise. + Used by GnuPG 2.1 to identify valid OpenPGP packets with an + unknown version. GPG_ERR_PUBKEY_ALGO Invalid public key algorithm @@ -610,6 +609,10 @@ GPG_ERR_MAC_ALGO 212 GPG_ERR_SEXP_ODD_HEX_NUMBERS Odd hexadecimal numbers in S-expression 213 GPG_ERR_SEXP_BAD_OCT_CHAR Bad octal character in S-expression +GPG_ERR_LEGACY_KEY (222) Legacy key + + Used by GnuPG to identify version 2 and 3 OpenPGP key packets. + GPG_ERR_REQUEST_TOO_SHORT Request too short A received request is too short to continue processing. diff --git a/src/err-codes.h.in b/src/err-codes.h.in index 866380d..9e1924d 100644 --- a/src/err-codes.h.in +++ b/src/err-codes.h.in @@ -247,8 +247,9 @@ 212 GPG_ERR_SEXP_ODD_HEX_NUMBERS Odd hexadecimal numbers in S-expression 213 GPG_ERR_SEXP_BAD_OCT_CHAR Bad octal character in S-expression -# 214 to 222 are free to be used. +# 214 to 221 are free to be used. +222 GPG_ERR_LEGACY_KEY Legacy key 223 GPG_ERR_REQUEST_TOO_SHORT Request too short 224 GPG_ERR_REQUEST_TOO_LONG Request too long 225 GPG_ERR_OBJ_TERM_STATE Object is in termination state ----------------------------------------------------------------------- Summary of changes: NEWS | 1 + doc/errorref.txt | 13 ++++++++----- src/err-codes.h.in | 3 ++- 3 files changed, 11 insertions(+), 6 deletions(-) hooks/post-receive -- Error codes used by GnuPG et al. http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 22 16:42:33 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 22 Jan 2015 16:42:33 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-41-g09e8f35 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 09e8f35d3808d6e49f891360c341aae3869e8650 (commit) via 6f3d11d8837b00e3a1c4fa881066855c0321d6b2 (commit) from 11142e0ad7bc9a9e3c3dccf958d8dbd3312cb993 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 09e8f35d3808d6e49f891360c341aae3869e8650 Author: Werner Koch Date: Thu Jan 22 16:36:28 2015 +0100 gpg: Improve skipping of PGP-2 keys. * g10/keydb.c (keydb_search_first, keydb_search_next): Skip legacy keys. * g10/keyring.c (keyring_get_keyblock): Handle GPG_ERR_LEGACY_KEY. (prepare_search): Ditto. (keyring_rebuild_cache): Skip legacy keys. * g10/keyserver.c (keyidlist): Ditto. * g10/trustdb.c (validate_key_list): Ditto. -- This is not the most elegant way to handle it but it reduces the chance for unwanted side effects. GnuPG-bug-id: 1816 Signed-off-by: Werner Koch diff --git a/g10/keydb.c b/g10/keydb.c index 263b504..401478a 100644 --- a/g10/keydb.c +++ b/g10/keydb.c @@ -1489,24 +1489,40 @@ keydb_search (KEYDB_HANDLE hd, KEYDB_SEARCH_DESC *desc, } +/* Note that in contrast to using keydb_search in search first mode, + this function skips legacy keys. */ gpg_error_t keydb_search_first (KEYDB_HANDLE hd) { + gpg_error_t err; KEYDB_SEARCH_DESC desc; memset (&desc, 0, sizeof desc); desc.mode = KEYDB_SEARCH_MODE_FIRST; - return keydb_search (hd, &desc, 1, NULL); + err = keydb_search (hd, &desc, 1, NULL); + if (gpg_err_code (err) == GPG_ERR_LEGACY_KEY) + err = keydb_search_next (hd); + return err; } + +/* Note that in contrast to using keydb_search in search next mode, + this fucntion skips legacy keys. */ gpg_error_t keydb_search_next (KEYDB_HANDLE hd) { + gpg_error_t err; KEYDB_SEARCH_DESC desc; - memset (&desc, 0, sizeof desc); - desc.mode = KEYDB_SEARCH_MODE_NEXT; - return keydb_search (hd, &desc, 1, NULL); + do + { + memset (&desc, 0, sizeof desc); + desc.mode = KEYDB_SEARCH_MODE_NEXT; + err = keydb_search (hd, &desc, 1, NULL); + } + while (gpg_err_code (err) == GPG_ERR_LEGACY_KEY); + + return err; } gpg_error_t diff --git a/g10/keylist.c b/g10/keylist.c index daabc7d..5fd9eb8 100644 --- a/g10/keylist.c +++ b/g10/keylist.c @@ -466,6 +466,8 @@ list_all (int secret, int mark_secret) rc = keydb_get_keyblock (hd, &keyblock); if (rc) { + if (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY) + continue; /* Skip legacy keys. */ log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc)); goto leave; } diff --git a/g10/keyring.c b/g10/keyring.c index 34829e7..6060f08 100644 --- a/g10/keyring.c +++ b/g10/keyring.c @@ -398,6 +398,8 @@ keyring_get_keyblock (KEYRING_HANDLE hd, KBNODE *ret_kb) init_packet (pkt); continue; } + if (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY) + break; /* Upper layer needs to handle this. */ if (rc) { log_error ("keyring_get_keyblock: read error: %s\n", gpg_strerror (rc) ); @@ -654,8 +656,14 @@ keyring_search_reset (KEYRING_HANDLE hd) static int prepare_search (KEYRING_HANDLE hd) { - if (hd->current.error) - return hd->current.error; /* still in error state */ + if (hd->current.error) { + /* If the last key was a legacy key, we simply ignore the error so that + we can easily use search_next. */ + if (gpg_err_code (hd->current.error) == GPG_ERR_LEGACY_KEY) + hd->current.error = 0; + else + return hd->current.error; /* still in error state */ + } if (hd->current.kr && !hd->current.eof) { if ( !hd->current.iobuf ) @@ -1354,8 +1362,12 @@ keyring_rebuild_cache (void *token,int noisy) if(rc) goto leave; - while ( !(rc = keyring_search (hd, &desc, 1, NULL)) ) + for (;;) { + rc = keyring_search (hd, &desc, 1, NULL); + if (rc && gpg_err_code (rc) != GPG_ERR_LEGACY_KEY) + break; /* ready. */ + desc.mode = KEYDB_SEARCH_MODE_NEXT; resname = keyring_get_resource_name (hd); if (lastresname != resname ) @@ -1387,10 +1399,15 @@ keyring_rebuild_cache (void *token,int noisy) goto leave; } + if (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY) + continue; + release_kbnode (keyblock); rc = keyring_get_keyblock (hd, &keyblock); if (rc) { + if (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY) + continue; /* Skip legacy keys. */ log_error ("keyring_get_keyblock failed: %s\n", gpg_strerror (rc)); goto leave; } @@ -1416,7 +1433,9 @@ keyring_rebuild_cache (void *token,int noisy) The code required to keep them in the keyring would be too complicated. Given that we do not touch the old secring.gpg a suitable backup for decryption of v3 stuff - using an older gpg version will always be available. */ + using an older gpg version will always be available. + Note: This test is actually superfluous because we + already acted upon GPG_ERR_LEGACY_KEY. */ } else { diff --git a/g10/keyserver.c b/g10/keyserver.c index 0530907..035cd03 100644 --- a/g10/keyserver.c +++ b/g10/keyserver.c @@ -1248,16 +1248,25 @@ keyidlist(strlist_t users,KEYDB_SEARCH_DESC **klist,int *count,int fakev3) } } - while (!(rc = keydb_search (kdbhd, desc, ndesc, NULL))) + for (;;) { + rc = keydb_search (kdbhd, desc, ndesc, NULL); + if (rc && gpg_err_code (rc) != GPG_ERR_LEGACY_KEY) + break; /* ready. */ + if (!users) desc[0].mode = KEYDB_SEARCH_MODE_NEXT; + if (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY) + continue; + /* read the keyblock */ rc = keydb_get_keyblock (kdbhd, &keyblock ); if( rc ) { - log_error (_("error reading keyblock: %s\n"), gpg_strerror (rc) ); + if (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY) + continue; + log_error (_("error reading keyblock: %s\n"), gpg_strerror (rc) ); goto leave; } diff --git a/g10/trustdb.c b/g10/trustdb.c index 84179f0..08f6cf4 100644 --- a/g10/trustdb.c +++ b/g10/trustdb.c @@ -1604,6 +1604,9 @@ validate_key_list (KEYDB_HANDLE hd, KeyHashTable full_trust, { PKT_public_key *pk; + if (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY) + continue; + rc = keydb_get_keyblock (hd, &keyblock); if (rc) { @@ -1660,7 +1663,8 @@ validate_key_list (KEYDB_HANDLE hd, KeyHashTable full_trust, release_kbnode (keyblock); keyblock = NULL; } - while (!(rc = keydb_search (hd, &desc, 1, NULL))); + while (!(rc = keydb_search (hd, &desc, 1, NULL)) + || gpg_err_code (rc) == GPG_ERR_LEGACY_KEY); if (rc && gpg_err_code (rc) != GPG_ERR_NOT_FOUND) { commit 6f3d11d8837b00e3a1c4fa881066855c0321d6b2 Author: Werner Koch Date: Thu Jan 22 12:14:48 2015 +0100 gpg: Add dedicated error code for PGP-2 keys. * g10/parse-packet.c (parse_key): Return GPG_ERR_LEGACY_KEY for PGP2 keys. * g10/import.c (read_block): Simplify by checking GPG_ERR_LEGACY_KEY. * g10/getkey.c (lookup): Silence error message for PGP-2 keys. * common/util.h (GPG_ERR_LEGACY_KEY): Add replacement for older libgpg-error. Signed-off-by: Werner Koch diff --git a/common/util.h b/common/util.h index 94878bc..24107f5 100644 --- a/common/util.h +++ b/common/util.h @@ -38,6 +38,7 @@ /* These error codes are used but not defined in the required libgpg-error version. Define them here. */ #if GPG_ERROR_VERSION_NUMBER < 0x011200 /* 1.18 */ +# define GPG_ERR_LEGACY_KEY 222 # define GPG_ERR_OBJ_TERM_STATE 225 # define GPG_ERR_FORBIDDEN 251 #endif diff --git a/g10/getkey.c b/g10/getkey.c index d240dd7..62d2d33 100644 --- a/g10/getkey.c +++ b/g10/getkey.c @@ -403,8 +403,6 @@ get_pubkey (PKT_public_key * pk, u32 * keyid) if (!rc) goto leave; - log_debug ("looking up key %08X%08X failed: %s\n", keyid[0], keyid[1], - gpg_strerror (rc)); rc = GPG_ERR_NO_PUBKEY; leave: @@ -2573,7 +2571,8 @@ lookup (getkey_ctx_t ctx, kbnode_t *ret_keyblock, int want_secret) } found: - if (rc && gpg_err_code (rc) != GPG_ERR_NOT_FOUND) + if (rc && gpg_err_code (rc) != GPG_ERR_NOT_FOUND + && gpg_err_code (rc) != GPG_ERR_LEGACY_KEY) log_error ("keydb_search failed: %s\n", gpg_strerror (rc)); if (!rc) diff --git a/g10/import.c b/g10/import.c index 56121db..de22520 100644 --- a/g10/import.c +++ b/g10/import.c @@ -544,11 +544,9 @@ read_block( IOBUF a, PACKET **pending_pkt, kbnode_t *ret_root, int *r_v3keys) in_v3key = 0; while ((rc=parse_packet(a, pkt)) != -1) { - if (rc && (gpg_err_code (rc) == GPG_ERR_INV_PACKET + if (rc && (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY && (pkt->pkttype == PKT_PUBLIC_KEY - || pkt->pkttype == PKT_SECRET_KEY) - && (pkt->pkt.public_key->version == 2 - || pkt->pkt.public_key->version == 3))) + || pkt->pkttype == PKT_SECRET_KEY))) { in_v3key = 1; ++*r_v3keys; diff --git a/g10/keyring.c b/g10/keyring.c index 7ac3478..34829e7 100644 --- a/g10/keyring.c +++ b/g10/keyring.c @@ -350,7 +350,7 @@ keyring_lock (KEYRING_HANDLE hd, int yes) /* - * Return the last found keyring. Caller must free it. + * Return the last found keyblock. Caller must free it. * The returned keyblock has the kbode flag bit 0 set for the node with * the public key used to locate the keyblock or flag bit 1 set for * the user ID node. @@ -1409,8 +1409,6 @@ keyring_rebuild_cache (void *token,int noisy) goto leave; } - log_debug ("keblock with version %d\n", - keyblock->pkt->pkt.public_key->version); if (keyblock->pkt->pkt.public_key->version < 4) { /* We do not copy/cache v3 keys or any other unknown diff --git a/g10/parse-packet.c b/g10/parse-packet.c index ae215c4..73c4434 100644 --- a/g10/parse-packet.c +++ b/g10/parse-packet.c @@ -1963,7 +1963,7 @@ parse_key (IOBUF inp, int pkttype, unsigned long pktlen, if (list_mode) es_fprintf (listfp, ":key packet: [obsolete version %d]\n", version); pk->version = version; - err = gpg_error (GPG_ERR_INV_PACKET); + err = gpg_error (GPG_ERR_LEGACY_KEY); goto leave; } else ----------------------------------------------------------------------- Summary of changes: common/util.h | 1 + g10/getkey.c | 5 ++--- g10/import.c | 6 ++---- g10/keydb.c | 24 ++++++++++++++++++++---- g10/keylist.c | 2 ++ g10/keyring.c | 31 ++++++++++++++++++++++++------- g10/keyserver.c | 13 +++++++++++-- g10/parse-packet.c | 2 +- g10/trustdb.c | 6 +++++- 9 files changed, 68 insertions(+), 22 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 22 17:50:18 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 22 Jan 2015 17:50:18 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-42-gda4db17 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via da4db172f6f8fb254b770e59770c531a488e2400 (commit) from 09e8f35d3808d6e49f891360c341aae3869e8650 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit da4db172f6f8fb254b770e59770c531a488e2400 Author: Werner Koch Date: Thu Jan 22 17:49:55 2015 +0100 doc: Fix some typos and add missing options. -- GnuPG-bug-id: 1602 I added options shown with --help but missing in the man page. However, --help won't show everything listed in the man age and frankly there are even more options not listed anywhere (to see them use --dump-options). diff --git a/doc/gpg-agent.texi b/doc/gpg-agent.texi index 7ac441f..9326498 100644 --- a/doc/gpg-agent.texi +++ b/doc/gpg-agent.texi @@ -122,7 +122,7 @@ output of the @code{tty} command. For W32 systems this option is not required. Please make sure that a proper pinentry program has been installed -under the default filename (which is system dependant) or use the +under the default filename (which is system dependent) or use the option @option{pinentry-program} to specify the full name of that program. It is often useful to install a symbolic link from the actual used pinentry (e.g. @file{/usr/bin/pinentry-gtk}) to the expected @@ -582,7 +582,7 @@ gpg-connect-agent updatestartuptty /bye Although all GnuPG components try to start the gpg-agent as needed, this is not possible for the ssh support because ssh does not know about it. Thus if no GnuPG tool which accesses the agent has been run, there is no -guarantee that ssh is abale to use gpg-agent for authentication. To fix +guarantee that ssh is able to use gpg-agent for authentication. To fix this you may start gpg-agent if needed using this simple command: @smallexample diff --git a/doc/gpg.texi b/doc/gpg.texi index 429cc5b..8df0e3f 100644 --- a/doc/gpg.texi +++ b/doc/gpg.texi @@ -354,14 +354,14 @@ Present a menu to allow changing the PIN of a smartcard. This functionality is also available as the subcommand "passwd" with the @option{--card-edit} command. - at item --delete-key @code{name} - at opindex delete-key + at item --delete-keys @code{name} + at itemx --delete-keys @code{name} Remove key from the public keyring. In batch mode either @option{--yes} is required or the key must be specified by fingerprint. This is a safeguard against accidental deletion of multiple keys. - at item --delete-secret-key @code{name} - at opindex delete-secret-key + at item --delete-secret-keys @code{name} + at opindex delete-secret-keys Remove key from the secret keyring. In batch mode the key must be specified by fingerprint. @@ -545,6 +545,12 @@ Use the source, Luke :-). The output format is still subject to change. Pack or unpack an arbitrary input into/from an OpenPGP ASCII armor. This is a GnuPG extension to OpenPGP and in general not very useful. + + at c @item --server + at c @opindex server + at c Run gpg in server mode. This feature is not yet ready for use and + at c thus not documented. + @end table @@ -798,7 +804,7 @@ create a signature of any type desired. @item delkey @opindex keyedit:delkey - Remove a subkey (secondart key). Note that it is not possible to retract + Remove a subkey (secondary key). Note that it is not possible to retract a subkey, once it has been send to the public (i.e. to a keyserver). In that case you better use @code{revkey}. @@ -1960,7 +1966,7 @@ During decryption skip all anonymous recipients. This option helps in the case that people use the hidden recipients feature to hide there own encrypt-to key from others. If oneself has many secret keys this may lead to a major annoyance because all keys are tried in turn to -decrypt soemthing which was not really intended for it. The drawback +decrypt something which was not really intended for it. The drawback of this option is that it is currently not possible to decrypt a message which includes real anonymous recipients. diff --git a/doc/tools.texi b/doc/tools.texi index 0de214b..fadbcb1 100644 --- a/doc/tools.texi +++ b/doc/tools.texi @@ -330,16 +330,21 @@ scdaemon. The following options may be used: @table @gnupgtabopt - at c FIXME: Not yet supported. - at c @item -o @var{file} - at c @itemx --output @var{file} - at c Use @var{file} as output file. + + at item -o @var{file} + at itemx --output @var{file} +Write output to @var{file}. Default is to write to stdout. @item -v @itemx --verbose Outputs additional information while running. Specifically, this extends numerical field values by human-readable descriptions. + at item -q + at itemx --quiet + at opindex quiet +Try to be as quiet as possible. + @item -n @itemx --dry-run Do not actually change anything. This is currently only implemented @@ -1246,7 +1251,8 @@ passing. This option makes it use the old mode. Do not start the gpg-agent or the dirmngr if it has not yet been started. - at item --run @var{file} + at item -r @var{file} + at itemx --run @var{file} @opindex run Run the commands from @var{file} at startup and then continue with the regular input method. Note, that commands given on the command line are @@ -1361,7 +1367,7 @@ this operator. A division by zero yields an empty string. @itemx | @itemx & Evaluate all arguments as long integers using @code{strtol} and apply -the logical oeprators NOT, OR or AND. The NOT operator works on the +the logical operators NOT, OR or AND. The NOT operator works on the last argument only. ----------------------------------------------------------------------- Summary of changes: doc/gpg-agent.texi | 4 ++-- doc/gpg.texi | 18 ++++++++++++------ doc/tools.texi | 18 ++++++++++++------ 3 files changed, 26 insertions(+), 14 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 22 18:09:54 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 22 Jan 2015 18:09:54 +0100 Subject: [git] GPA - branch, master, updated. gpa-0.9.7-2-g071ed43 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Assistant". The branch, master has been updated via 071ed43fac92c68c46a1a8fb19a435eebb8927e6 (commit) from 9febd013fa1e6ad56204304b0193001f6b5fc0be (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 071ed43fac92c68c46a1a8fb19a435eebb8927e6 Author: Werner Koch Date: Thu Jan 22 18:09:29 2015 +0100 Fix handling of the windows close button in confirmation dialogs. * src/gpaexportserverop.c (confirm_send): Only act upon the Yes button. * src/confdialog.c (gpa_configure_keyserver): Ditto. * src/gpgmetools.c (check_overwriting): Ditto. -- Checking for GTK_RESPONSE_NO was a bad idea because that catches only the No button and no other events, like the window's close button. GnuPG-bug-id: 1599 diff --git a/src/confdialog.c b/src/confdialog.c index 005d55d..74ced87 100644 --- a/src/confdialog.c +++ b/src/confdialog.c @@ -1591,7 +1591,7 @@ gpa_configure_keyserver (GtkWidget *parent) gtk_dialog_add_buttons (GTK_DIALOG (msgbox), _("_Yes"), GTK_RESPONSE_YES, _("_No"), GTK_RESPONSE_NO, NULL); - if (gtk_dialog_run (GTK_DIALOG (msgbox)) == GTK_RESPONSE_NO) + if (gtk_dialog_run (GTK_DIALOG (msgbox)) != GTK_RESPONSE_YES) { gtk_widget_destroy (msgbox); return NULL; diff --git a/src/gpaexportserverop.c b/src/gpaexportserverop.c index 4691423..de3f781 100644 --- a/src/gpaexportserverop.c +++ b/src/gpaexportserverop.c @@ -157,7 +157,7 @@ confirm_send (GtkWidget *parent, const gchar *server) gtk_dialog_add_buttons (GTK_DIALOG (msgbox), _("_Yes"), GTK_RESPONSE_YES, _("_No"), GTK_RESPONSE_NO, NULL); - if (gtk_dialog_run (GTK_DIALOG (msgbox)) == GTK_RESPONSE_NO) + if (gtk_dialog_run (GTK_DIALOG (msgbox)) != GTK_RESPONSE_YES) { gtk_widget_destroy (msgbox); return FALSE; diff --git a/src/gpgmetools.c b/src/gpgmetools.c index e2e6ec1..83c4a69 100644 --- a/src/gpgmetools.c +++ b/src/gpgmetools.c @@ -174,7 +174,7 @@ check_overwriting (const char *filename, GtkWidget *parent) gtk_dialog_add_buttons (GTK_DIALOG (msgbox), _("_Yes"), GTK_RESPONSE_YES, _("_No"), GTK_RESPONSE_NO, NULL); - if (gtk_dialog_run (GTK_DIALOG (msgbox)) == GTK_RESPONSE_NO) + if (gtk_dialog_run (GTK_DIALOG (msgbox)) != GTK_RESPONSE_YES) { gtk_widget_destroy (msgbox); return FALSE; ----------------------------------------------------------------------- Summary of changes: src/confdialog.c | 2 +- src/gpaexportserverop.c | 2 +- src/gpgmetools.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) hooks/post-receive -- The GNU Privacy Assistant http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 23 15:38:40 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 23 Jan 2015 15:38:40 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-44-g3f6abb5 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 3f6abb57a7b5e54b593c5775c8f7a07d61119705 (commit) via 297b1a0d15873d8765841c54003d244b49090789 (commit) from da4db172f6f8fb254b770e59770c531a488e2400 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3f6abb57a7b5e54b593c5775c8f7a07d61119705 Author: Werner Koch Date: Fri Jan 23 15:37:51 2015 +0100 gpgconf: Fix validity check for UINT32 values. * tools/gpgconf-comp.c (option_check_validity): Enable check for UINT32. -- Reported-by: G?nther Noack This is actually a bug which inhibited the checking of values of type UINT32. Signed-off-by: Werner Koch diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c index 86e67eb..01c4135 100644 --- a/tools/gpgconf-comp.c +++ b/tools/gpgconf-comp.c @@ -2365,7 +2365,7 @@ option_check_validity (gc_option_t *option, unsigned long flags, gc_error (1, 0, "garbage after argument for option %s", option->name); } - else if (gc_arg_type[option->arg_type].fallback == GC_ARG_TYPE_INT32) + else if (gc_arg_type[option->arg_type].fallback == GC_ARG_TYPE_UINT32) { unsigned long res; commit 297b1a0d15873d8765841c54003d244b49090789 Author: Werner Koch Date: Fri Jan 23 15:30:03 2015 +0100 gpg,sm: Remove unnecessary duplicated checks -- Reported-by: G?nther Noack diff --git a/g10/keygen.c b/g10/keygen.c index aaccae4..6143269 100644 --- a/g10/keygen.c +++ b/g10/keygen.c @@ -2659,7 +2659,7 @@ ask_user_id (int mode, int full, KBNODE keyblock) xfree(answer); } xfree(answer); - if( !amail && !acomment && !amail ) + if (!amail && !acomment) break; xfree(uid); uid = NULL; } diff --git a/sm/verify.c b/sm/verify.c index 2e91137..73e0ab4 100644 --- a/sm/verify.c +++ b/sm/verify.c @@ -467,7 +467,7 @@ gpgsm_verify (ctrl_t ctrl, int in_fd, int data_fd, estream_t out_fp) s = gcry_md_read (data_md, algo); if ( !s || !msgdigestlen || gcry_md_get_algo_dlen (algo) != msgdigestlen - || !s || memcmp (s, msgdigest, msgdigestlen) ) + || memcmp (s, msgdigest, msgdigestlen) ) { char *fpr; ----------------------------------------------------------------------- Summary of changes: g10/keygen.c | 2 +- sm/verify.c | 2 +- tools/gpgconf-comp.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 23 15:40:25 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 23 Jan 2015 15:40:25 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-2-0, updated. gnupg-2.0.26-42-g068ec6c Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-2-0 has been updated via 068ec6c8ed07268469f33e5b3ba1e094d9bf3394 (commit) from 1298b14f97efebdd88a9390af3848154dbe0d259 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 068ec6c8ed07268469f33e5b3ba1e094d9bf3394 Author: Werner Koch Date: Fri Jan 23 15:37:51 2015 +0100 gpgconf: Fix validity check for UINT32 values. * tools/gpgconf-comp.c (option_check_validity): Enable check for UINT32. -- Reported-by: G?nther Noack This is actually a bug which inhibited the checking of values of type UINT32. Signed-off-by: Werner Koch (cherry picked from commit 3f6abb57a7b5e54b593c5775c8f7a07d61119705) diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c index 83bc24e..4993989 100644 --- a/tools/gpgconf-comp.c +++ b/tools/gpgconf-comp.c @@ -2249,7 +2249,7 @@ option_check_validity (gc_option_t *option, unsigned long flags, gc_error (1, 0, "garbage after argument for option %s", option->name); } - else if (gc_arg_type[option->arg_type].fallback == GC_ARG_TYPE_INT32) + else if (gc_arg_type[option->arg_type].fallback == GC_ARG_TYPE_UINT32) { errno = 0; (void) strtoul (arg, &arg, 0); ----------------------------------------------------------------------- Summary of changes: tools/gpgconf-comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Sun Jan 25 10:41:24 2015 From: cvs at cvs.gnupg.org (by Joshua Rogers) Date: Sun, 25 Jan 2015 10:41:24 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-2-0, updated. gnupg-2.0.26-43-g3d9f8bf Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-2-0 has been updated via 3d9f8bf1dc0c7165a5d2a31568ed425d2dc3b91e (commit) from 068ec6c8ed07268469f33e5b3ba1e094d9bf3394 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3d9f8bf1dc0c7165a5d2a31568ed425d2dc3b91e Author: Joshua Rogers Date: Sat Jan 24 03:03:33 2015 +1100 Remove incorrect expression leading to errors. * scd/ccid-driver.c (send_escape_cmd): Fix setting of 'rc'. -- Variable 'rc' in send_escape_cmd was overwritten before it was returned, leading to incorrect computation. Signed-off-by: Joshua Rogers [Log entry reformatted - wk] diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c index 6e0bc55..c4c0d9c 100644 --- a/scd/ccid-driver.c +++ b/scd/ccid-driver.c @@ -2266,8 +2266,8 @@ send_escape_cmd (ccid_driver_t handle, { memcpy (result, msg, msglen); *resultlen = msglen; + rc = 0; } - rc = 0; } break; default: ----------------------------------------------------------------------- Summary of changes: scd/ccid-driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Sun Jan 25 10:44:43 2015 From: cvs at cvs.gnupg.org (by Joshua Rogers) Date: Sun, 25 Jan 2015 10:44:43 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-45-g274d7b1 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 274d7b17a90908a90ba6ad295c08a79b287fc231 (commit) from 3f6abb57a7b5e54b593c5775c8f7a07d61119705 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 274d7b17a90908a90ba6ad295c08a79b287fc231 Author: Joshua Rogers Date: Sat Jan 24 03:03:33 2015 +1100 ccid: Remove incorrect expression leading to errors. * scd/ccid-driver.c (send_escape_cmd): Fix setting of 'rc'. -- Variable 'rc' in send_escape_cmd was overwritten before it was returned, leading to incorrect computation. Signed-off-by: Joshua Rogers [Log entry reformatted - wk] (cherry picked from commit 3d9f8bf1dc0c7165a5d2a31568ed425d2dc3b91e) diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c index 7a91e09..fdfe1f5 100644 --- a/scd/ccid-driver.c +++ b/scd/ccid-driver.c @@ -2230,8 +2230,8 @@ send_escape_cmd (ccid_driver_t handle, { memcpy (result, msg, msglen); *resultlen = msglen; + rc = 0; } - rc = 0; } break; default: ----------------------------------------------------------------------- Summary of changes: scd/ccid-driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Jan 26 17:59:45 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 26 Jan 2015 17:59:45 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-46-g6c87d1c Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 6c87d1ce66d8e93e6c0f16c06116e9179f6158ba (commit) from 274d7b17a90908a90ba6ad295c08a79b287fc231 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 6c87d1ce66d8e93e6c0f16c06116e9179f6158ba Author: Werner Koch Date: Mon Jan 26 17:56:52 2015 +0100 sm: Simplify fix ed8383c6 * sm/minip12.c (p12_build): Release PWBUF only at the end. -- Suggested-by: Eygene Ryabinkin Signed-off-by: Werner Koch diff --git a/sm/minip12.c b/sm/minip12.c index ca4d248..c70de8a 100644 --- a/sm/minip12.c +++ b/sm/minip12.c @@ -2421,8 +2421,6 @@ p12_build (gcry_mpi_t *kparms, const void *cert, size_t certlen, log_error ("can't convert passphrase to" " requested charset '%s': %s\n", charset, strerror (errno)); - gcry_free (pwbuf); - pwbuf = NULL; goto failure; } @@ -2436,8 +2434,6 @@ p12_build (gcry_mpi_t *kparms, const void *cert, size_t certlen, log_error ("error converting passphrase to" " requested charset '%s': %s\n", charset, strerror (errno)); - gcry_free (pwbuf); - pwbuf = NULL; jnlib_iconv_close (cd); goto failure; } @@ -2511,6 +2507,8 @@ p12_build (gcry_mpi_t *kparms, const void *cert, size_t certlen, failure: if (pwbuf) { + /* Note that wipememory is not really needed due to the use of + gcry_malloc_secure. */ wipememory (pwbuf, pwbufsize); gcry_free (pwbuf); } ----------------------------------------------------------------------- Summary of changes: sm/minip12.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Tue Jan 27 01:31:41 2015 From: cvs at cvs.gnupg.org (by NIIBE Yutaka) Date: Tue, 27 Jan 2015 01:31:41 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-47-g9453d64 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 9453d645d4a489f038829c80343c124fff62d635 (commit) from 6c87d1ce66d8e93e6c0f16c06116e9179f6158ba (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9453d645d4a489f038829c80343c124fff62d635 Author: NIIBE Yutaka Date: Tue Jan 27 09:30:11 2015 +0900 agent: Fix agent_public_key_from_file for ECC. * agent/cvt-openpgp.c (extract_private_key): New. (convert_to_openpgp): Use extract_private_key. * agent/findkey.c (agent_public_key_from_file): Use extract_private_key. -- This patch add support of ECC key with a curve name and flags. Since same functionality is also needed for convert_to_openpgp, it was factored out into the extract_private_key function. diff --git a/agent/agent.h b/agent/agent.h index 4be5925..0560835 100644 --- a/agent/agent.h +++ b/agent/agent.h @@ -497,4 +497,11 @@ int agent_card_scd (ctrl_t ctrl, const char *cmdline, int agent_handle_learn (ctrl_t ctrl, int send, void *assuan_context); +/*-- cvt-openpgp.c --*/ +gpg_error_t +extract_private_key (gcry_sexp_t s_key, int req_private_key_data, + const char **r_algoname, int *r_npkey, int *r_nskey, + const char **r_format, gcry_mpi_t *mpi_array, + gcry_sexp_t *r_curve, gcry_sexp_t *r_flags); + #endif /*AGENT_H*/ diff --git a/agent/cvt-openpgp.c b/agent/cvt-openpgp.c index 671dd4c..dff6b7c 100644 --- a/agent/cvt-openpgp.c +++ b/agent/cvt-openpgp.c @@ -1177,36 +1177,50 @@ apply_protection (gcry_mpi_t *array, int npkey, int nskey, } -/* Convert our key S_KEY into an OpenPGP key transfer format. On - success a canonical encoded S-expression is stored at R_TRANSFERKEY - and its length at R_TRANSFERKEYLEN; this S-expression is also - padded to a multiple of 64 bits. */ +/* + * Examining S_KEY in S-Expression and extract data. + * When REQ_PRIVATE_KEY_DATA == 1, S_KEY's CAR should be 'private-key', + * but it also allows shadowed or protected versions. + * On success, it returns 0, otherwise error number. + * R_ALGONAME is static string which is no need to free by caller. + * R_NPKEY is pointer to number of public key data. + * R_NSKEY is pointer to number of private key data. + * R_ELEMS is static string which is no need to free by caller. + * ARRAY contains public and private key data. + * R_CURVE is pointer to S-Expression of the curve (can be NULL). + * R_FLAGS is pointer to S-Expression of the flags (can be NULL). + */ gpg_error_t -convert_to_openpgp (ctrl_t ctrl, gcry_sexp_t s_key, const char *passphrase, - unsigned char **r_transferkey, size_t *r_transferkeylen) +extract_private_key (gcry_sexp_t s_key, int req_private_key_data, + const char **r_algoname, int *r_npkey, int *r_nskey, + const char **r_elems, gcry_mpi_t *array, + gcry_sexp_t *r_curve, gcry_sexp_t *r_flags) { gpg_error_t err; gcry_sexp_t list, l2; char *name; - const char *algoname; + const char *algoname, *format; int npkey, nskey; - gcry_mpi_t array[10]; gcry_sexp_t curve = NULL; - char protect_iv[16]; - char salt[8]; - unsigned long s2k_count; - int i, j; + gcry_sexp_t flags = NULL; - (void)ctrl; - - *r_transferkey = NULL; - - for (i=0; i < DIM (array); i++) - array[i] = NULL; + if (!req_private_key_data) + { + list = gcry_sexp_find_token (s_key, "shadowed-private-key", 0 ); + if (!list) + list = gcry_sexp_find_token (s_key, "protected-private-key", 0 ); + if (!list) + list = gcry_sexp_find_token (s_key, "private-key", 0 ); + } + else + list = gcry_sexp_find_token (s_key, "private-key", 0); - list = gcry_sexp_find_token (s_key, "private-key", 0); if (!list) - return gpg_error (GPG_ERR_NO_OBJ); /* Does not contain a key object. */ + { + log_error ("invalid private key format\n"); + return gpg_error (GPG_ERR_BAD_SECKEY); + } + l2 = gcry_sexp_cadr (list); gcry_sexp_release (list); list = l2; @@ -1224,66 +1238,81 @@ convert_to_openpgp (ctrl_t ctrl, gcry_sexp_t s_key, const char *passphrase, if (!strcmp (name, "rsa")) { algoname = "rsa"; + format = "ned?p?q?u?"; npkey = 2; nskey = 6; - err = gcry_sexp_extract_param (list, NULL, "nedpqu", + err = gcry_sexp_extract_param (list, NULL, format, array+0, array+1, array+2, array+3, array+4, array+5, NULL); } else if (!strcmp (name, "elg")) { algoname = "elg"; + format = "pgyx?"; npkey = 3; nskey = 4; - err = gcry_sexp_extract_param (list, NULL, "pgyx", + err = gcry_sexp_extract_param (list, NULL, format, array+0, array+1, array+2, array+3, NULL); } else if (!strcmp (name, "dsa")) { algoname = "dsa"; + format = "pqgyx?"; npkey = 4; nskey = 5; - err = gcry_sexp_extract_param (list, NULL, "pqgyx", + err = gcry_sexp_extract_param (list, NULL, format, array+0, array+1, array+2, array+3, array+4, NULL); } else if (!strcmp (name, "ecc")) { - gcry_buffer_t iob; - char iobbuf[32]; - - algoname = "ecc"; /* Decide later by checking the usage. */ + algoname = "ecc"; + format = "/qd?"; npkey = 1; nskey = 2; - iob.data = iobbuf; - iob.size = sizeof iobbuf - 1; - iob.off = 0; - iob.len = 0; - err = gcry_sexp_extract_param (list, NULL, "&'curve'/qd", - &iob, array+0, array+1, NULL); - if (!err) + curve = gcry_sexp_find_token (list, "curve", 0); + flags = gcry_sexp_find_token (list, "flags", 0); + err = gcry_sexp_extract_param (list, NULL, format, + array+0, array+1, NULL); + if (flags) { - assert (iob.len < sizeof iobbuf -1); - iobbuf[iob.len] = 0; - err = gcry_sexp_build (&curve, NULL, "(curve %s)", iobbuf); + gcry_sexp_t param = gcry_sexp_find_token (flags, "param", 0); + if (param) + { + gcry_sexp_release (param); + array[6] = array[0]; + array[7] = array[1]; + err = gcry_sexp_extract_param (list, NULL, "pabgnh?", + array+0, array+1, array+2, array+3, + array+4, array+5, NULL); + if (array[5] == NULL) + { + array[5] = GCRYMPI_CONST_ONE; + npkey += 6; + nskey += 6; + } + format = "pabgnhqd?"; + } } } else if (!strcmp (name, "ecdsa")) { algoname = "ecdsa"; + format = "pabgnqd?"; npkey = 6; nskey = 7; - err = gcry_sexp_extract_param (list, NULL, "pabgnqd", + err = gcry_sexp_extract_param (list, NULL, format, array+0, array+1, array+2, array+3, array+4, array+5, array+6, NULL); } else if (!strcmp (name, "ecdh")) { algoname = "ecdh"; + format = "pabgnqd?"; npkey = 6; nskey= 7; - err = gcry_sexp_extract_param (list, NULL, "pabgnqd", + err = gcry_sexp_extract_param (list, NULL, format, array+0, array+1, array+2, array+3, array+4, array+5, array+6, NULL); } @@ -1292,12 +1321,63 @@ convert_to_openpgp (ctrl_t ctrl, gcry_sexp_t s_key, const char *passphrase, err = gpg_error (GPG_ERR_PUBKEY_ALGO); } xfree (name); - gcry_sexp_release (list); list = NULL; + gcry_sexp_release (list); if (err) { gcry_sexp_release (curve); + gcry_sexp_release (flags); return err; } + else + { + *r_algoname = algoname; + if (r_elems) + { + if (format[0] == '/') /* It is opaque data qualifier, skip it. */ + *r_elems = format+1; + else + *r_elems = format; + } + *r_npkey = npkey; + if (r_nskey) + *r_nskey = nskey; + *r_curve = curve; + *r_flags = flags; + + return 0; + } +} + +/* Convert our key S_KEY into an OpenPGP key transfer format. On + success a canonical encoded S-expression is stored at R_TRANSFERKEY + and its length at R_TRANSFERKEYLEN; this S-expression is also + padded to a multiple of 64 bits. */ +gpg_error_t +convert_to_openpgp (ctrl_t ctrl, gcry_sexp_t s_key, const char *passphrase, + unsigned char **r_transferkey, size_t *r_transferkeylen) +{ + gpg_error_t err; + const char *algoname; + int npkey, nskey; + gcry_mpi_t array[10]; + gcry_sexp_t curve = NULL; + gcry_sexp_t flags = NULL; + char protect_iv[16]; + char salt[8]; + unsigned long s2k_count; + int i, j; + + (void)ctrl; + + *r_transferkey = NULL; + + for (i=0; i < DIM (array); i++) + array[i] = NULL; + + err = extract_private_key (s_key, 1, &algoname, &npkey, &nskey, NULL, + array, &curve, &flags); + if (err) + return err; gcry_create_nonce (protect_iv, sizeof protect_iv); gcry_create_nonce (salt, sizeof salt); @@ -1363,6 +1443,7 @@ convert_to_openpgp (ctrl_t ctrl, gcry_sexp_t s_key, const char *passphrase, for (i=0; i < DIM (array); i++) gcry_mpi_release (array[i]); gcry_sexp_release (curve); + gcry_sexp_release (flags); return err; } diff --git a/agent/findkey.c b/agent/findkey.c index fbe3031..064f7d2 100644 --- a/agent/findkey.c +++ b/agent/findkey.c @@ -978,18 +978,20 @@ agent_public_key_from_file (ctrl_t ctrl, gpg_error_t err; int i, idx; gcry_sexp_t s_skey; - char algoname[6]; - char elems[7]; + const char *algoname, *elems; + int npkey; + gcry_mpi_t array[10]; + gcry_sexp_t curve = NULL; + gcry_sexp_t flags = NULL; gcry_sexp_t uri_sexp, comment_sexp; const char *uri, *comment; size_t uri_length, comment_length; char *format, *p; - void *args[4+2+2+1]; /* Size is max. # of elements + 2 for uri + 2 - for comment + end-of-list. */ + void *args[2+7+2+2+1]; /* Size is 2 + max. # of elements + 2 for uri + 2 + for comment + end-of-list. */ int argidx; - gcry_sexp_t list, l2; + gcry_sexp_t list = NULL; const char *s; - gcry_mpi_t *array; (void)ctrl; @@ -999,55 +1001,17 @@ agent_public_key_from_file (ctrl_t ctrl, if (err) return err; - err = key_parms_from_sexp (s_skey, &list, - algoname, sizeof algoname, - elems, sizeof elems); - if (err) - { - gcry_sexp_release (s_skey); - return err; - } + for (i=0; i < DIM (array); i++) + array[i] = NULL; - /* Allocate an array for the parameters and copy them out of the - secret key. FIXME: We should have a generic copy function. */ - array = xtrycalloc (strlen(elems) + 1, sizeof *array); - if (!array) + err = extract_private_key (s_skey, 0, &algoname, &npkey, NULL, &elems, + array, &curve, &flags); + if (err) { - err = gpg_error_from_syserror (); - gcry_sexp_release (list); gcry_sexp_release (s_skey); return err; } - for (idx=0, s=elems; *s; s++, idx++ ) - { - l2 = gcry_sexp_find_token (list, s, 1); - if (!l2) - { - /* Required parameter not found. */ - for (i=0; i This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 6eebc56687935f3e993eac374b9f4cc5ad3bcf2b (commit) from 9453d645d4a489f038829c80343c124fff62d635 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 6eebc56687935f3e993eac374b9f4cc5ad3bcf2b Author: Werner Koch Date: Tue Jan 27 09:11:13 2015 +0100 gpg: Fix segv introduced to commit 4d7c9b0. * g10/keygen.c (get_parameter_passphrase): Take care of R == NULL. Signed-off-by: Werner Koch diff --git a/g10/keygen.c b/g10/keygen.c index 6143269..50fb67d 100644 --- a/g10/keygen.c +++ b/g10/keygen.c @@ -2826,7 +2826,7 @@ static const char * get_parameter_passphrase (struct para_data_s *para) { struct para_data_s *r = get_parameter (para, pPASSPHRASE); - return r->u.value; + return r ? r->u.value : NULL; } ----------------------------------------------------------------------- Summary of changes: g10/keygen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 28 03:25:23 2015 From: cvs at cvs.gnupg.org (by NIIBE Yutaka) Date: Wed, 28 Jan 2015 03:25:23 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-49-gf6d3c6e Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via f6d3c6e5263d84b94ebe13df9ff39b02109a2acb (commit) from 6eebc56687935f3e993eac374b9f4cc5ad3bcf2b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f6d3c6e5263d84b94ebe13df9ff39b02109a2acb Author: NIIBE Yutaka Date: Wed Jan 28 11:24:29 2015 +0900 scd: Fix varargs call for 64-bit arch on ECC keys. * scd/app-openpgp.c (store_fpr): Remove CARD_VERSION from the arguments. (rsa_writekey): Follow the change. (do_genkey): Likewise. (ecc_writekey): Likewise. Cast to size_t. -- KEYTOCARD caused SEGV of scdaemon on 64-bit arch. That's because int is 32-bit, but size_t is 64-bit. diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c index 7f1ec43..f68813b 100644 --- a/scd/app-openpgp.c +++ b/scd/app-openpgp.c @@ -755,10 +755,8 @@ get_algo_byte (int keynumber, key_type_t key_type) /* Note, that FPR must be at least 20 bytes. */ static gpg_error_t -store_fpr (app_t app, int keynumber, u32 timestamp, - unsigned char *fpr, unsigned int card_version, - key_type_t key_type, - ...) +store_fpr (app_t app, int keynumber, u32 timestamp, unsigned char *fpr, + key_type_t key_type, ...) { unsigned int n, nbits; unsigned char *buffer, *p; @@ -821,7 +819,7 @@ store_fpr (app_t app, int keynumber, u32 timestamp, xfree (buffer); - tag = (card_version > 0x0007? 0xC7 : 0xC6) + keynumber; + tag = (app->card_version > 0x0007? 0xC7 : 0xC6) + keynumber; flush_cache_item (app, 0xC5); tag2 = 0xCE + keynumber; flush_cache_item (app, 0xCD); @@ -830,7 +828,7 @@ store_fpr (app_t app, int keynumber, u32 timestamp, if (rc) log_error (_("failed to store the fingerprint: %s\n"),gpg_strerror (rc)); - if (!rc && card_version > 0x0100) + if (!rc && app->card_version > 0x0100) { unsigned char buf[4]; @@ -3196,8 +3194,8 @@ rsa_writekey (app_t app, gpg_error_t (*pincb)(void*, const char *, char **), goto leave; } - err = store_fpr (app, keyno, created_at, fprbuf, app->card_version, - KEY_TYPE_RSA, rsa_n, rsa_n_len, rsa_e, rsa_e_len); + err = store_fpr (app, keyno, created_at, fprbuf, KEY_TYPE_RSA, + rsa_n, rsa_n_len, rsa_e, rsa_e_len); if (err) goto leave; @@ -3383,16 +3381,16 @@ ecc_writekey (app_t app, gpg_error_t (*pincb)(void*, const char *, char **), goto leave; } - err = store_fpr (app, keyno, created_at, fprbuf, app->card_version, + err = store_fpr (app, keyno, created_at, fprbuf, curve == CURVE_ED25519 ? KEY_TYPE_EDDSA : KEY_TYPE_ECC, curve == CURVE_ED25519 ? "\x09\x2b\x06\x01\x04\x01\xda\x47\x0f\x01" : curve == CURVE_NIST_P256 ? "\x08\x2a\x86\x48\xce\x3d\x03\x01\x07" : "\x05\x2b\x81\x04\x00\x0a", - curve == CURVE_ED25519 ? 10 - : curve == CURVE_NIST_P256? 9 : 6, - ecc_q, ecc_q_len, "\x03\x01\x08\x07", 4); + (size_t)(curve == CURVE_ED25519 ? 10 + : curve == CURVE_NIST_P256? 9 : 6), + ecc_q, ecc_q_len, "\x03\x01\x08\x07", (size_t)4); if (err) goto leave; @@ -3604,8 +3602,8 @@ do_genkey (app_t app, ctrl_t ctrl, const char *keynostr, unsigned int flags, send_status_info (ctrl, "KEY-CREATED-AT", numbuf, (size_t)strlen(numbuf), NULL, 0); - rc = store_fpr (app, keyno, (u32)created_at, fprbuf, app->card_version, - KEY_TYPE_RSA, m, mlen, e, elen); + rc = store_fpr (app, keyno, (u32)created_at, fprbuf, KEY_TYPE_RSA, + m, mlen, e, elen); if (rc) goto leave; send_fpr_if_not_null (ctrl, "KEY-FPR", -1, fprbuf); ----------------------------------------------------------------------- Summary of changes: scd/app-openpgp.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 28 09:13:22 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 28 Jan 2015 09:13:22 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-51-gb1d5ed6 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via b1d5ed6ac842469afcb84868d0f6641dc286a6c7 (commit) via 795965437732e50f6216d7f5db0e6174e90548a9 (commit) from f6d3c6e5263d84b94ebe13df9ff39b02109a2acb (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b1d5ed6ac842469afcb84868d0f6641dc286a6c7 Author: Werner Koch Date: Wed Jan 28 09:11:02 2015 +0100 gpg: Allow predefined names as answer to the keygen.algo prompt. * g10/keygen.c (ask_algo): Add list of strings. Signed-off-by: Werner Koch diff --git a/doc/DETAILS b/doc/DETAILS index ba2725f..59ccaec 100644 --- a/doc/DETAILS +++ b/doc/DETAILS @@ -1236,3 +1236,33 @@ Status codes are: This can be implemented using Hurd's translator mechanism. However, I think the whole key server stuff has to be re-thought; I have some ideas and probably create a white paper. +** Algorithm names for the "keygen.algo" prompt + + When using a --command-fd controlled key generation or "addkey" + there is way to know the number to enter on the "keygen.algo" + prompt. The displayed numbers are for human reception and may + change with releases. To provide a stable way to enter a desired + algorithm choice the prompt also accepts predefined names for the + algorithms, which will not change. + + | Name | No | Description | + |---------+----+---------------------------------| + | rsa+rsa | 1 | RSA and RSA (default) | + | dsa+elg | 2 | DSA and Elgamal | + | dsa | 3 | DSA (sign only) | + | rsa/s | 4 | RSA (sign only) | + | elg | 5 | Elgamal (encrypt only) | + | rsa/e | 6 | RSA (encrypt only) | + | dsa/* | 7 | DSA (set your own capabilities) | + | rsa/* | 8 | RSA (set your own capabilities) | + | ecc+ecc | 9 | ECC and ECC | + | ecc/s | 10 | ECC (sign only) | + | ecc/* | 11 | ECC (set your own capabilities) | + | ecc/e | 12 | ECC (encrypt only) | + | keygrip | 13 | Existing key | + + If one of the "foo/*" names are used a "keygen.flags" prompt needs + to be answered as well. Instead of toggling the predefined flags, + it is also possible to set them direct: Use a "=" character + directly followed by a comination of "a" (for authentication), "s" + (for signing), or "c" (for certification). diff --git a/g10/keygen.c b/g10/keygen.c index 50fb67d..0789571 100644 --- a/g10/keygen.c +++ b/g10/keygen.c @@ -1820,7 +1820,7 @@ ask_algo (ctrl_t ctrl, int addmode, int *r_subkey_algo, unsigned int *r_usage, char **r_keygrip) { char *keygrip = NULL; - char *answer; + char *answer = NULL; int algo; int dummy_algo; @@ -1875,84 +1875,86 @@ ask_algo (ctrl_t ctrl, int addmode, int *r_subkey_algo, unsigned int *r_usage, { *r_usage = 0; *r_subkey_algo = 0; + xfree (answer); answer = cpr_get ("keygen.algo", _("Your selection? ")); cpr_kill_prompt (); algo = *answer? atoi (answer) : 1; - xfree(answer); - answer = NULL; - if (algo == 1 && !addmode) + if ((algo == 1 || !strcmp (answer, "rsa+rsa")) && !addmode) { algo = PUBKEY_ALGO_RSA; *r_subkey_algo = PUBKEY_ALGO_RSA; break; } - else if (algo == 2 && !addmode) + else if ((algo == 2 || !strcmp (answer, "dsa+elg")) && !addmode) { algo = PUBKEY_ALGO_DSA; *r_subkey_algo = PUBKEY_ALGO_ELGAMAL_E; break; } - else if (algo == 3) + else if (algo == 3 || !strcmp (answer, "dsa")) { algo = PUBKEY_ALGO_DSA; *r_usage = PUBKEY_USAGE_SIG; break; } - else if (algo == 4) + else if (algo == 4 || !strcmp (answer, "rsa/s")) { algo = PUBKEY_ALGO_RSA; *r_usage = PUBKEY_USAGE_SIG; break; } - else if (algo == 5 && addmode) + else if ((algo == 5 || !strcmp (answer, "elg")) && addmode) { algo = PUBKEY_ALGO_ELGAMAL_E; *r_usage = PUBKEY_USAGE_ENC; break; } - else if (algo == 6 && addmode) + else if ((algo == 6 || !strcmp (answer, "rsa/e")) && addmode) { algo = PUBKEY_ALGO_RSA; *r_usage = PUBKEY_USAGE_ENC; break; } - else if (algo == 7 && opt.expert) + else if ((algo == 7 || !strcmp (answer, "dsa/*")) && opt.expert) { algo = PUBKEY_ALGO_DSA; *r_usage = ask_key_flags (algo, addmode); break; } - else if (algo == 8 && opt.expert) + else if ((algo == 8 || !strcmp (answer, "rsa/*")) && opt.expert) { algo = PUBKEY_ALGO_RSA; *r_usage = ask_key_flags (algo, addmode); break; } - else if (algo == 9 && opt.expert && !addmode) + else if ((algo == 9 || !strcmp (answer, "ecc+ecc")) + && opt.expert && !addmode) { algo = PUBKEY_ALGO_ECDSA; *r_subkey_algo = PUBKEY_ALGO_ECDH; break; } - else if (algo == 10 && opt.expert) + else if ((algo == 10 || !strcmp (answer, "ecc/s")) && opt.expert) { algo = PUBKEY_ALGO_ECDSA; *r_usage = PUBKEY_USAGE_SIG; break; } - else if (algo == 11 && opt.expert) + else if ((algo == 11 || !strcmp (answer, "ecc/*")) && opt.expert) { algo = PUBKEY_ALGO_ECDSA; *r_usage = ask_key_flags (algo, addmode); break; } - else if (algo == 12 && opt.expert && addmode) + else if ((algo == 12 || !strcmp (answer, "ecc/e")) + && opt.expert && addmode) { algo = PUBKEY_ALGO_ECDH; *r_usage = PUBKEY_USAGE_ENC; break; } - else if (algo == 13 && opt.expert && r_keygrip) + else if ((algo == 13 || !strcmp (answer, "keygrip")) + && opt.expert && r_keygrip) { for (;;) { @@ -1984,8 +1986,10 @@ ask_algo (ctrl_t ctrl, int addmode, int *r_subkey_algo, unsigned int *r_usage, } else tty_printf (_("Invalid selection.\n")); + } + xfree(answer); if (r_keygrip) *r_keygrip = keygrip; return algo; commit 795965437732e50f6216d7f5db0e6174e90548a9 Author: Werner Koch Date: Tue Jan 27 10:22:47 2015 +0100 agent: Add some extra robustness to extract_private_key * agent/cvt-openpgp.c (extract_private_key): Add arg "arraysize". Make sure that R_FLAGS and R_CURVE are set to NULL. -- Given that extract_private_key is not file local it is good to have some extra asserts to protect against future wrong use. Signed-off-by: Werner Koch diff --git a/agent/agent.h b/agent/agent.h index 0560835..4536242 100644 --- a/agent/agent.h +++ b/agent/agent.h @@ -501,7 +501,8 @@ int agent_handle_learn (ctrl_t ctrl, int send, void *assuan_context); gpg_error_t extract_private_key (gcry_sexp_t s_key, int req_private_key_data, const char **r_algoname, int *r_npkey, int *r_nskey, - const char **r_format, gcry_mpi_t *mpi_array, + const char **r_format, + gcry_mpi_t *mpi_array, int arraysize, gcry_sexp_t *r_curve, gcry_sexp_t *r_flags); #endif /*AGENT_H*/ diff --git a/agent/cvt-openpgp.c b/agent/cvt-openpgp.c index dff6b7c..8cf0023 100644 --- a/agent/cvt-openpgp.c +++ b/agent/cvt-openpgp.c @@ -1187,13 +1187,15 @@ apply_protection (gcry_mpi_t *array, int npkey, int nskey, * R_NSKEY is pointer to number of private key data. * R_ELEMS is static string which is no need to free by caller. * ARRAY contains public and private key data. + * ARRAYSIZE is the allocated size of the array for cross-checking. * R_CURVE is pointer to S-Expression of the curve (can be NULL). * R_FLAGS is pointer to S-Expression of the flags (can be NULL). */ gpg_error_t extract_private_key (gcry_sexp_t s_key, int req_private_key_data, const char **r_algoname, int *r_npkey, int *r_nskey, - const char **r_elems, gcry_mpi_t *array, + const char **r_elems, + gcry_mpi_t *array, int arraysize, gcry_sexp_t *r_curve, gcry_sexp_t *r_flags) { gpg_error_t err; @@ -1204,6 +1206,9 @@ extract_private_key (gcry_sexp_t s_key, int req_private_key_data, gcry_sexp_t curve = NULL; gcry_sexp_t flags = NULL; + *r_curve = NULL; + *r_flags = NULL; + if (!req_private_key_data) { list = gcry_sexp_find_token (s_key, "shadowed-private-key", 0 ); @@ -1231,6 +1236,9 @@ extract_private_key (gcry_sexp_t s_key, int req_private_key_data, return gpg_error (GPG_ERR_INV_OBJ); /* Invalid structure of object. */ } + if (arraysize < 7) + BUG (); + /* Map NAME to a name as used by Libgcrypt. We do not use the Libgcrypt function here because we need a lowercase name and require special treatment for some algorithms. */ @@ -1375,7 +1383,7 @@ convert_to_openpgp (ctrl_t ctrl, gcry_sexp_t s_key, const char *passphrase, array[i] = NULL; err = extract_private_key (s_key, 1, &algoname, &npkey, &nskey, NULL, - array, &curve, &flags); + array, DIM (array), &curve, &flags); if (err) return err; diff --git a/agent/findkey.c b/agent/findkey.c index 064f7d2..156102b 100644 --- a/agent/findkey.c +++ b/agent/findkey.c @@ -1005,7 +1005,7 @@ agent_public_key_from_file (ctrl_t ctrl, array[i] = NULL; err = extract_private_key (s_skey, 0, &algoname, &npkey, NULL, &elems, - array, &curve, &flags); + array, DIM (array), &curve, &flags); if (err) { gcry_sexp_release (s_skey); ----------------------------------------------------------------------- Summary of changes: agent/agent.h | 3 ++- agent/cvt-openpgp.c | 12 ++++++++++-- agent/findkey.c | 2 +- doc/DETAILS | 30 ++++++++++++++++++++++++++++++ g10/keygen.c | 36 ++++++++++++++++++++---------------- 5 files changed, 63 insertions(+), 20 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 28 09:24:41 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 28 Jan 2015 09:24:41 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-2-0, updated. gnupg-2.0.26-48-gb2359db Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-2-0 has been updated via b2359db21c1eca7441c63b0791f8e3405b42ff83 (commit) from 2424028fd9c525d340db461cc19f8e01a13a2395 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b2359db21c1eca7441c63b0791f8e3405b42ff83 Author: Werner Koch Date: Wed Jan 28 09:11:02 2015 +0100 gpg: Allow predefined names as answer to the keygen.algo prompt. * g10/keygen.c (ask_algo): Add list of strings. -- Signed-off-by: Werner Koch (backported from commit b1d5ed6ac842469afcb84868d0f6641dc286a6c7) diff --git a/doc/DETAILS b/doc/DETAILS index e9d2d6f..927cc61 100644 --- a/doc/DETAILS +++ b/doc/DETAILS @@ -1301,3 +1301,31 @@ This can be implemented using Hurd's translator mechanism. However, I think the whole key server stuff has to be re-thought; I have some ideas and probably create a white paper. + +Algorithm names for the "keygen.algo" prompt +============================================ + + When using a --command-fd controlled key generation or "addkey" + there is way to know the number to enter on the "keygen.algo" + prompt. The displayed numbers are for human reception and may + change with releases. To provide a stable way to enter a desired + algorithm choice the prompt also accepts predefined names for the + algorithms, which will not change. + + | Name | No | Description | + |---------+----+---------------------------------| + | rsa+rsa | 1 | RSA and RSA (default) | + | dsa+elg | 2 | DSA and Elgamal | + | dsa | 3 | DSA (sign only) | + | rsa/s | 4 | RSA (sign only) | + | elg | 5 | Elgamal (encrypt only) | + | rsa/e | 6 | RSA (encrypt only) | + | dsa/* | 7 | DSA (set your own capabilities) | + | rsa/* | 8 | RSA (set your own capabilities) | + + If one of the "foo/*" names are used a "keygen.flags" prompt needs + to be answered as well. Instead of toggling the predefined flags, + it is also possible to set them direct: Use a "=" character + directly followed by a comination of "a" (for authentication), "s" + (for signing), or "c" (for certification). + diff --git a/g10/keygen.c b/g10/keygen.c index 10cca7d..33c85b4 100644 --- a/g10/keygen.c +++ b/g10/keygen.c @@ -1700,7 +1700,7 @@ ask_key_flags(int algo,int subkey) static int ask_algo (int addmode, int *r_subkey_algo, unsigned int *r_usage) { - char *answer; + char *answer = NULL; int algo; int dummy_algo; @@ -1732,53 +1732,53 @@ ask_algo (int addmode, int *r_subkey_algo, unsigned int *r_usage) { *r_usage = 0; *r_subkey_algo = 0; + xfree (answer); answer = cpr_get ("keygen.algo", _("Your selection? ")); cpr_kill_prompt (); algo = *answer? atoi (answer) : 1; - xfree(answer); - if (algo == 1 && !addmode) + if ((algo == 1 || !strcmp (answer, "rsa+rsa")) && !addmode) { algo = PUBKEY_ALGO_RSA; *r_subkey_algo = PUBKEY_ALGO_RSA; break; } - else if (algo == 2 && !addmode) + else if ((algo == 2 || !strcmp (answer, "dsa+elg")) && !addmode) { algo = PUBKEY_ALGO_DSA; *r_subkey_algo = PUBKEY_ALGO_ELGAMAL_E; break; } - else if (algo == 3) + else if (algo == 3 || !strcmp (answer, "dsa")) { algo = PUBKEY_ALGO_DSA; *r_usage = PUBKEY_USAGE_SIG; break; } - else if (algo == 4) + else if (algo == 4 || !strcmp (answer, "rsa/s")) { algo = PUBKEY_ALGO_RSA; *r_usage = PUBKEY_USAGE_SIG; break; } - else if (algo == 5 && addmode) + else if ((algo == 5 || !strcmp (answer, "elg")) && addmode) { algo = PUBKEY_ALGO_ELGAMAL_E; *r_usage = PUBKEY_USAGE_ENC; break; } - else if (algo == 6 && addmode) + else if ((algo == 6 || !strcmp (answer, "rsa/e")) && addmode) { algo = PUBKEY_ALGO_RSA; *r_usage = PUBKEY_USAGE_ENC; break; } - else if (algo == 7 && opt.expert) + else if ((algo == 7 || !strcmp (answer, "dsa/*")) && opt.expert) { algo = PUBKEY_ALGO_DSA; *r_usage = ask_key_flags (algo, addmode); break; } - else if (algo == 8 && opt.expert) + else if ((algo == 8 || !strcmp (answer, "rsa/*")) && opt.expert) { algo = PUBKEY_ALGO_RSA; *r_usage = ask_key_flags (algo, addmode); @@ -1786,8 +1786,10 @@ ask_algo (int addmode, int *r_subkey_algo, unsigned int *r_usage) } else tty_printf (_("Invalid selection.\n")); + } + xfree(answer); return algo; } ----------------------------------------------------------------------- Summary of changes: doc/DETAILS | 28 ++++++++++++++++++++++++++++ g10/keygen.c | 22 ++++++++++++---------- 2 files changed, 40 insertions(+), 10 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 28 15:14:14 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 28 Jan 2015 15:14:14 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-165-g2564d20 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via 2564d204e408b296425ac0660c6bdc6270575fb6 (commit) from ceaa97f0d849c07f3a15b642fc3a2b0a477b4a47 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 2564d204e408b296425ac0660c6bdc6270575fb6 Author: Werner Koch Date: Wed Jan 28 15:13:50 2015 +0100 Fix building of GOST s-boxes when cross-compiling. * cipher/Makefile.am (gost-s-box): USe CC_FOR_BUILD. (noinst_PROGRAMS): Remove. (EXTRA_DIST): New. (CLEANFILES): New. Signed-off-by: Werner Koch diff --git a/cipher/Makefile.am b/cipher/Makefile.am index 4a9c86d..33a68ff 100644 --- a/cipher/Makefile.am +++ b/cipher/Makefile.am @@ -26,8 +26,10 @@ AM_CFLAGS = $(GPG_ERROR_CFLAGS) AM_CCASFLAGS = $(NOEXECSTACK_FLAGS) -DISTCLEANFILES = gost-sb.h +EXTRA_DIST = gost-s-box.c +CLEANFILES = gost-s-box +DISTCLEANFILES = gost-sb.h noinst_LTLIBRARIES = libcipher.la @@ -96,10 +98,13 @@ rfc2268.c \ camellia.c camellia.h camellia-glue.c camellia-aesni-avx-amd64.S \ camellia-aesni-avx2-amd64.S camellia-arm.S -noinst_PROGRAMS = gost-s-box gost28147.lo: gost-sb.h gost-sb.h: gost-s-box - $(builddir)/gost-s-box $@ + ./gost-s-box $@ + +gost-s-box: gost-s-box.c + $(CC_FOR_BUILD) -o $@ $(srcdir)/gost-s-box.c + if ENABLE_O_FLAG_MUNGING o_flag_munging = sed -e 's/-O\([2-9s][2-9s]*\)/-O1/' -e 's/-Ofast/-O1/g' ----------------------------------------------------------------------- Summary of changes: cipher/Makefile.am | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 28 20:21:15 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 28 Jan 2015 20:21:15 +0100 Subject: [git] gnupg-doc - branch, master, updated. 650d86f2193ce6125c8c60fb39499f0b11069503 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via 650d86f2193ce6125c8c60fb39499f0b11069503 (commit) from b4b2626da5b628b5bbd9baf25dd2e667a68b2466 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 650d86f2193ce6125c8c60fb39499f0b11069503 Author: Werner Koch Date: Wed Jan 28 20:20:54 2015 +0100 web: Update roadmap. diff --git a/web/roadmap.org b/web/roadmap.org index 28dc5b4..8d5a347 100644 --- a/web/roadmap.org +++ b/web/roadmap.org @@ -13,7 +13,7 @@ better be viewed as a scratchpad with notes of GnuPG developers. The next GnuPG /modern/ release will be 2.1.2 and is planned for - January. + +January+ the first February week. ** New features in 2.1 @@ -32,6 +32,10 @@ - +Add unattended key generation with passphrase.+ + - More and more bug reports are coming in. Decide which of them to + fix for 2.1.2. + + - Migrate everything to automake 1.14. * Libgcrypt Roadmap diff --git a/web/swdb.mac b/web/swdb.mac index 9dbf061..2babb1b 100644 --- a/web/swdb.mac +++ b/web/swdb.mac @@ -98,9 +98,9 @@ # # LIBGPG-ERROR # -#+macro: libgpg_error_ver 1.17 -#+macro: libgpg_error_size 654k -#+macro: libgpg_error_sha1 ba5858b2947e7272dd197c87bac9f32caf29b256 +#+macro: libgpg_error_ver 1.18 +#+macro: libgpg_error_size 702k +#+macro: libgpg_error_sha1 7ba54f939da023af8f5b3e7a421a32eb742909c4 # ----------------------------------------------------------------------- Summary of changes: web/roadmap.org | 6 +++++- web/swdb.mac | 6 +++--- 2 files changed, 8 insertions(+), 4 deletions(-) hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Wed Jan 28 20:39:14 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 28 Jan 2015 20:39:14 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-54-g382ba4b Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 382ba4b137b42d5f25a7e256bb7c053ee5ac7b64 (commit) via d8eea25b8b7becbfa3f059be6f5966a2f1aa7112 (commit) via 0c2bfd9d5a49a6134188f8f7820f6ccdebd9f181 (commit) from b1d5ed6ac842469afcb84868d0f6641dc286a6c7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 382ba4b137b42d5f25a7e256bb7c053ee5ac7b64 Author: Werner Koch Date: Wed Jan 28 20:32:28 2015 +0100 gpg: Limit the size of key packets to a sensible value. * g10/parse-packet.c (MAX_KEY_PACKET_LENGTH): New. (MAX_UID_PACKET_LENGTH): New. (MAX_COMMENT_PACKET_LENGTH): New. (MAX_ATTR_PACKET_LENGTH): New. (parse_key): Limit the size of a key packet to 256k. (parse_user_id): Use macro for the packet size limit. (parse_attribute): Ditto. (parse_comment): Ditto. -- Without that it is possible to force gpg to allocate large amounts of memory by using a bad encoded MPI. This would be an too easy DoS. Another way to mitigate would be to change the MPI read function to allocate memory dynamically while reading the MPI. However, that complicates and possibly slows down the code. A too large key packet is in any case a sign for broken data and thus gpg should not use it. Reported-by: Hanno B?ck GnuPG-bug-id: 1823 Signed-off-by: Werner Koch diff --git a/g10/parse-packet.c b/g10/parse-packet.c index 73c4434..524fabe 100644 --- a/g10/parse-packet.c +++ b/g10/parse-packet.c @@ -35,6 +35,14 @@ #include "main.h" #include "i18n.h" + +/* Maximum length of packets to avoid excessive memory allocation. */ +#define MAX_KEY_PACKET_LENGTH (256 * 1024) +#define MAX_UID_PACKET_LENGTH ( 2 * 1024) +#define MAX_COMMENT_PACKET_LENGTH ( 64 * 1024) +#define MAX_ATTR_PACKET_LENGTH ( 16 * 1024*1024) + + static int mpi_print_mode; static int list_mode; static estream_t listfp; @@ -1983,6 +1991,14 @@ parse_key (IOBUF inp, int pkttype, unsigned long pktlen, err = gpg_error (GPG_ERR_INV_PACKET); goto leave; } + else if (pktlen > MAX_KEY_PACKET_LENGTH) + { + log_error ("packet(%d) too large\n", pkttype); + if (list_mode) + es_fputs (":key packet: [too larget]\n", listfp); + err = gpg_error (GPG_ERR_INV_PACKET); + goto leave; + } timestamp = read_32 (inp); pktlen -= 4; @@ -2415,7 +2431,7 @@ parse_user_id (IOBUF inp, int pkttype, unsigned long pktlen, PACKET * packet) allocatable, and a very large pktlen could actually cause our allocation to wrap around in xmalloc to a small number. */ - if (pktlen > 2048) + if (pktlen > MAX_UID_PACKET_LENGTH) { log_error ("packet(%d) too large\n", pkttype); if (list_mode) @@ -2496,7 +2512,7 @@ parse_attribute (IOBUF inp, int pkttype, unsigned long pktlen, /* We better cap the size of an attribute packet to make DoS not too easy. 16MB should be more then enough for one attribute packet (ie. a photo). */ - if (pktlen > 16*1024*1024) + if (pktlen > MAX_ATTR_PACKET_LENGTH) { log_error ("packet(%d) too large\n", pkttype); if (list_mode) @@ -2540,7 +2556,7 @@ parse_comment (IOBUF inp, int pkttype, unsigned long pktlen, PACKET * packet) overflow in the malloc below. Comment packets are actually not anymore define my OpenPGP and we even stopped to use our private comment packet. */ - if (pktlen > 65536) + if (pktlen > MAX_COMMENT_PACKET_LENGTH) { log_error ("packet(%d) too large\n", pkttype); if (list_mode) commit d8eea25b8b7becbfa3f059be6f5966a2f1aa7112 Author: Werner Koch Date: Wed Jan 28 20:12:21 2015 +0100 gpg: Fix buffering problem in --list-config. * g10/gpg.c (list_config): Replace print_sanitized_string2 by es_write_sanitized. * common/stringhelp.c (print_sanitized_buffer2): Remove. (print_sanitized_buffer, print_sanitized_utf8_buffer): Remove. (print_sanitized_utf8_buffer, print_sanitized_utf8_string): Remove. (print_sanitized_string): Remove. * sm/certdump.c (print_dn_part, print_dn_parts): Remove arg FP. (pretty_print_sexp, gpgsm_print_name2, gpgsm_print_name): Remove. -- Mixing stdio and estream is never a good idea. This fix also allows us to remove a lot of garbage. Reported-by: Jason A. Donenfeld GnuPG-bug-id: 1822 Signed-off-by: Werner Koch diff --git a/common/stringhelp.c b/common/stringhelp.c index 7ce041d..7128de5 100644 --- a/common/stringhelp.c +++ b/common/stringhelp.c @@ -671,129 +671,6 @@ hextobyte (const char *s) } -/* Print a BUFFER to stream FP while replacing all control characters - and the characters DELIM and DELIM2 with standard C escape - sequences. Returns the number of characters printed. */ -size_t -print_sanitized_buffer2 (FILE *fp, const void *buffer, size_t length, - int delim, int delim2) -{ - const unsigned char *p = buffer; - size_t count = 0; - - for (; length; length--, p++, count++) - { - if (*p < 0x20 - || *p == 0x7f - || *p == delim - || *p == delim2 - || ((delim || delim2) && *p=='\\')) - { - putc ('\\', fp); - count++; - if (*p == '\n') - { - putc ('n', fp); - count++; - } - else if (*p == '\r') - { - putc ('r', fp); - count++; - } - else if (*p == '\f') - { - putc ('f', fp); - count++; - } - else if (*p == '\v') - { - putc ('v', fp); - count++; - } - else if (*p == '\b') - { - putc ('b', fp); - count++; - } - else if (!*p) - { - putc('0', fp); - count++; - } - else - { - fprintf (fp, "x%02x", *p); - count += 3; - } - } - else - { - putc (*p, fp); - count++; - } - } - - return count; -} - -/* Same as print_sanitized_buffer2 but with just one delimiter. */ -size_t -print_sanitized_buffer (FILE *fp, const void *buffer, size_t length, - int delim) -{ - return print_sanitized_buffer2 (fp, buffer, length, delim, 0); -} - - -size_t -print_sanitized_utf8_buffer (FILE *fp, const void *buffer, - size_t length, int delim) -{ - const char *p = buffer; - size_t i; - - /* We can handle plain ascii simpler, so check for it first. */ - for (i=0; i < length; i++ ) - { - if ( (p[i] & 0x80) ) - break; - } - if (i < length) - { - char *buf = utf8_to_native (p, length, delim); - /*(utf8 conversion already does the control character quoting)*/ - i = strlen (buf); - fputs (buf, fp); - jnlib_free (buf); - return i; - } - else - return print_sanitized_buffer (fp, p, length, delim); -} - - -size_t -print_sanitized_string2 (FILE *fp, const char *string, int delim, int delim2) -{ - return string? print_sanitized_buffer2 (fp, string, strlen (string), - delim, delim2):0; -} - -size_t -print_sanitized_string (FILE *fp, const char *string, int delim) -{ - return string? print_sanitized_buffer (fp, string, strlen (string), delim):0; -} - -size_t -print_sanitized_utf8_string (FILE *fp, const char *string, int delim) -{ - return string? print_sanitized_utf8_buffer (fp, - string, strlen (string), - delim) : 0; -} - /* Create a string from the buffer P_ARG of length N which is suitable for printing. Caller must release the created string using xfree. This function terminates the process on memory shortage. */ diff --git a/common/stringhelp.h b/common/stringhelp.h index 1d3ee72..d4fe169 100644 --- a/common/stringhelp.h +++ b/common/stringhelp.h @@ -60,16 +60,6 @@ int compare_filenames( const char *a, const char *b ); int hextobyte (const char *s); -size_t print_sanitized_buffer (FILE *fp, const void *buffer, size_t length, - int delim); -size_t print_sanitized_buffer2 (FILE *fp, const void *buffer, size_t length, - int delim, int delim2); -size_t print_sanitized_utf8_buffer (FILE *fp, const void *buffer, - size_t length, int delim); -size_t print_sanitized_string (FILE *fp, const char *string, int delim); -size_t print_sanitized_string2 (FILE *fp, const char *string, - int delim, int delim2); -size_t print_sanitized_utf8_string (FILE *fp, const char *string, int delim); char *sanitize_buffer (const void *p, size_t n, int delim); diff --git a/g10/gpg.c b/g10/gpg.c index 5e929d9..9a6b104 100644 --- a/g10/gpg.c +++ b/g10/gpg.c @@ -1599,7 +1599,8 @@ list_config(char *items) for(sl=iter->values;sl;sl=sl->next) { - print_sanitized_string2 (stdout, sl->d, ':',';'); + es_write_sanitized (es_stdout, sl->d, strlen (sl->d), + ":;", NULL); if(sl->next) es_printf(";"); } diff --git a/sm/certdump.c b/sm/certdump.c index 23cca73..f32a27c 100644 --- a/sm/certdump.c +++ b/sm/certdump.c @@ -479,9 +479,9 @@ parse_dn (const unsigned char *string) } -/* Print a DN part to STREAM or if STREAM is NULL to FP. */ +/* Print a DN part to STREAM. */ static void -print_dn_part (FILE *fp, estream_t stream, +print_dn_part (estream_t stream, struct dn_array_s *dn, const char *key, int translate) { struct dn_array_s *first_dn = dn; @@ -500,24 +500,13 @@ print_dn_part (FILE *fp, estream_t stream, next: if (!dn->done && dn->value && *dn->value) { - if (stream) - { - es_fprintf (stream, "/%s=", dn->key); - if (translate) - print_utf8_buffer3 (stream, dn->value, strlen (dn->value), - "/"); - else - es_write_sanitized (stream, dn->value, strlen (dn->value), - "/", NULL); - } + es_fprintf (stream, "/%s=", dn->key); + if (translate) + print_utf8_buffer3 (stream, dn->value, strlen (dn->value), + "/"); else - { - fprintf (fp, "/%s=", dn->key); - if (translate) - print_sanitized_utf8_string (fp, dn->value, '/'); - else - print_sanitized_string (fp, dn->value, '/'); - } + es_write_sanitized (stream, dn->value, strlen (dn->value), + "/", NULL); } dn->done = 1; if (dn > first_dn && dn[-1].multivalued) @@ -532,7 +521,7 @@ print_dn_part (FILE *fp, estream_t stream, /* Print all parts of a DN in a "standard" sequence. We first print all the known parts, followed by the uncommon ones */ static void -print_dn_parts (FILE *fp, estream_t stream, +print_dn_parts (estream_t stream, struct dn_array_s *dn, int translate) { const char *stdpart[] = { @@ -541,59 +530,14 @@ print_dn_parts (FILE *fp, estream_t stream, int i; for (i=0; stdpart[i]; i++) - print_dn_part (fp, stream, dn, stdpart[i], translate); + print_dn_part (stream, dn, stdpart[i], translate); /* Now print the rest without any specific ordering */ for (; dn->key; dn++) - print_dn_part (fp, stream, dn, dn->key, translate); + print_dn_part (stream, dn, dn->key, translate); } -/* Print the S-Expression in BUF, which has a valid length of BUFLEN, - as a human readable string in one line to FP. */ -static void -pretty_print_sexp (FILE *fp, const unsigned char *buf, size_t buflen) -{ - size_t len; - gcry_sexp_t sexp; - char *result, *p; - - if ( gcry_sexp_sscan (&sexp, NULL, (const char*)buf, buflen) ) - { - fputs (_("[Error - invalid encoding]"), fp); - return; - } - len = gcry_sexp_sprint (sexp, GCRYSEXP_FMT_ADVANCED, NULL, 0); - assert (len); - result = xtrymalloc (len); - if (!result) - { - fputs (_("[Error - out of core]"), fp); - gcry_sexp_release (sexp); - return; - } - len = gcry_sexp_sprint (sexp, GCRYSEXP_FMT_ADVANCED, result, len); - assert (len); - for (p = result; len; len--, p++) - { - if (*p == '\n') - { - if (len > 1) /* Avoid printing the trailing LF. */ - fputs ("\\n", fp); - } - else if (*p == '\r') - fputs ("\\r", fp); - else if (*p == '\v') - fputs ("\\v", fp); - else if (*p == '\t') - fputs ("\\t", fp); - else - putc (*p, fp); - } - xfree (result); - gcry_sexp_release (sexp); -} - /* Print the S-Expression in BUF to extended STREAM, which has a valid length of BUFLEN, as a human readable string in one line to FP. */ static void @@ -640,63 +584,6 @@ pretty_es_print_sexp (estream_t fp, const unsigned char *buf, size_t buflen) } - - -void -gpgsm_print_name2 (FILE *fp, const char *name, int translate) -{ - const unsigned char *s = (const unsigned char *)name; - int i; - - if (!s) - { - fputs (_("[Error - No name]"), fp); - } - else if (*s == '<') - { - const char *s2 = strchr ( (char*)s+1, '>'); - if (s2) - { - if (translate) - print_sanitized_utf8_buffer (fp, s + 1, s2 - (char*)s - 1, 0); - else - print_sanitized_buffer (fp, s + 1, s2 - (char*)s - 1, 0); - } - } - else if (*s == '(') - { - pretty_print_sexp (fp, s, gcry_sexp_canon_len (s, 0, NULL, NULL)); - } - else if (!((*s >= '0' && *s < '9') - || (*s >= 'A' && *s <= 'Z') - || (*s >= 'a' && *s <= 'z'))) - fputs (_("[Error - invalid encoding]"), fp); - else - { - struct dn_array_s *dn = parse_dn (s); - if (!dn) - fputs (_("[Error - invalid DN]"), fp); - else - { - print_dn_parts (fp, NULL, dn, translate); - for (i=0; dn[i].key; i++) - { - xfree (dn[i].key); - xfree (dn[i].value); - } - xfree (dn); - } - } -} - - -void -gpgsm_print_name (FILE *fp, const char *name) -{ - gpgsm_print_name2 (fp, name, 1); -} - - /* This is a variant of gpgsm_print_name sending it output to an estream. */ void gpgsm_es_print_name2 (estream_t fp, const char *name, int translate) @@ -736,7 +623,7 @@ gpgsm_es_print_name2 (estream_t fp, const char *name, int translate) es_fputs (_("[Error - invalid DN]"), fp); else { - print_dn_parts (NULL, fp, dn, translate); + print_dn_parts (fp, dn, translate); for (i=0; dn[i].key; i++) { xfree (dn[i].key); commit 0c2bfd9d5a49a6134188f8f7820f6ccdebd9f181 Author: Werner Koch Date: Wed Jan 28 19:57:22 2015 +0100 Add a hook to be called right after main. * common/init.c (early_system_init): New stub function. Signed-off-by: Werner Koch diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c index fe310f4..a874e76 100644 --- a/agent/gpg-agent.c +++ b/agent/gpg-agent.c @@ -665,6 +665,8 @@ main (int argc, char **argv ) gpg_error_t err; struct assuan_malloc_hooks malloc_hooks; + early_system_init (); + /* Before we do anything else we save the list of currently open file descriptors and the signal mask. This info is required to do the exec call properly. */ diff --git a/agent/preset-passphrase.c b/agent/preset-passphrase.c index ad8e500..6378d7a 100644 --- a/agent/preset-passphrase.c +++ b/agent/preset-passphrase.c @@ -212,6 +212,7 @@ main (int argc, char **argv) int cmd = 0; const char *keygrip = NULL; + early_system_init (); set_strusage (my_strusage); log_set_prefix ("gpg-preset-passphrase", 1); diff --git a/agent/protect-tool.c b/agent/protect-tool.c index 5e540cf..dc363f2 100644 --- a/agent/protect-tool.c +++ b/agent/protect-tool.c @@ -549,6 +549,7 @@ main (int argc, char **argv ) int cmd = 0; const char *fname; + early_system_init (); set_strusage (my_strusage); gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN); log_set_prefix ("gpg-protect-tool", 1); diff --git a/common/init.c b/common/init.c index 2d5d630..c68a4e6 100644 --- a/common/init.c +++ b/common/init.c @@ -133,6 +133,13 @@ writestring_via_estream (int mode, const char *string) } +/* This function should be the first called after main. */ +void +early_system_init (void) +{ +} + + /* This function is to be used early at program startup to make sure that some subsystems are initialized. This is in particular important for W32 to initialize the sockets so that our socket diff --git a/common/init.h b/common/init.h index eea2eb1..530a479 100644 --- a/common/init.h +++ b/common/init.h @@ -38,6 +38,7 @@ void register_mem_cleanup_func (void (*func)(void)); +void early_system_init (void); void _init_common_subsystems (gpg_err_source_t errsource, int *argcp, char ***argvp); #define init_common_subsystems(a,b) \ diff --git a/dirmngr/dirmngr-client.c b/dirmngr/dirmngr-client.c index 0e62764..770e941 100644 --- a/dirmngr/dirmngr-client.c +++ b/dirmngr/dirmngr-client.c @@ -40,6 +40,7 @@ #include "i18n.h" #include "util.h" +#include "init.h" /* Constants for the options. */ @@ -180,6 +181,7 @@ main (int argc, char **argv ) int cmd_loadcrl = 0; int cmd_squid_mode = 0; + early_system_init (); set_strusage (my_strusage); log_set_prefix ("dirmngr-client", JNLIB_LOG_WITH_PREFIX); diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c index d3424c1..a46f736 100644 --- a/dirmngr/dirmngr.c +++ b/dirmngr/dirmngr.c @@ -650,6 +650,8 @@ main (int argc, char **argv) int homedir_seen = 0; struct assuan_malloc_hooks malloc_hooks; + early_system_init (); + #ifdef USE_W32_SERVICE /* The option will be set by main() below if we should run as a system daemon. */ diff --git a/dirmngr/dirmngr_ldap.c b/dirmngr/dirmngr_ldap.c index daa2d1b..981b5cc 100644 --- a/dirmngr/dirmngr_ldap.c +++ b/dirmngr/dirmngr_ldap.c @@ -242,6 +242,8 @@ ldap_wrapper_main (char **argv, estream_t outstream) memset (&my_opt_buffer, 0, sizeof my_opt_buffer); + early_system_init (); + #ifdef USE_LDAPWRAPPER set_strusage (my_strusage); log_set_prefix ("dirmngr_ldap", JNLIB_LOG_WITH_PREFIX); diff --git a/g10/gpg.c b/g10/gpg.c index 2047e30..5e929d9 100644 --- a/g10/gpg.c +++ b/g10/gpg.c @@ -2048,6 +2048,7 @@ main (int argc, char **argv) /* Please note that we may running SUID(ROOT), so be very CAREFUL when adding any stuff between here and the call to secmem_init() somewhere after the option parsing. */ + early_system_init (); gnupg_reopen_std (GPG_NAME); trap_unaligned (); gnupg_rl_initialize (); diff --git a/g10/gpgv.c b/g10/gpgv.c index f09b5da..157fdea 100644 --- a/g10/gpgv.c +++ b/g10/gpgv.c @@ -144,6 +144,7 @@ main( int argc, char **argv ) unsigned configlineno; ctrl_t ctrl; + early_system_init (); set_strusage (my_strusage); log_set_prefix ("gpgv", 1); diff --git a/g13/g13.c b/g13/g13.c index 8682114..157e646 100644 --- a/g13/g13.c +++ b/g13/g13.c @@ -344,6 +344,7 @@ main ( int argc, char **argv) /*mtrace();*/ + early_system_init (); gnupg_reopen_std (G13_NAME); set_strusage (my_strusage); gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN); diff --git a/kbx/kbxutil.c b/kbx/kbxutil.c index 34cbc53..368c02d 100644 --- a/kbx/kbxutil.c +++ b/kbx/kbxutil.c @@ -452,6 +452,7 @@ main( int argc, char **argv ) unsigned long from = 0, to = ULONG_MAX; int dry_run = 0; + early_system_init (); set_strusage( my_strusage ); gcry_control (GCRYCTL_DISABLE_SECMEM); log_set_prefix ("kbxutil", 1); diff --git a/scd/scdaemon.c b/scd/scdaemon.c index 7c786c2..d0777e8 100644 --- a/scd/scdaemon.c +++ b/scd/scdaemon.c @@ -411,6 +411,7 @@ main (int argc, char **argv ) int res; npth_t pipecon_handler; + early_system_init (); set_strusage (my_strusage); gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN); /* Please note that we may running SUID(ROOT), so be very CAREFUL diff --git a/sm/gpgsm.c b/sm/gpgsm.c index 72bceb4..62e29b8 100644 --- a/sm/gpgsm.c +++ b/sm/gpgsm.c @@ -910,6 +910,7 @@ main ( int argc, char **argv) /*mtrace();*/ + early_system_init (); gnupg_reopen_std (GPGSM_NAME); /* trap_unaligned ();*/ gnupg_rl_initialize (); diff --git a/tools/gpg-check-pattern.c b/tools/gpg-check-pattern.c index 2db9ae5..e76f121 100644 --- a/tools/gpg-check-pattern.c +++ b/tools/gpg-check-pattern.c @@ -164,6 +164,7 @@ main (int argc, char **argv ) size_t raw_pattern_length; pattern_t *patternarray; + early_system_init (); set_strusage (my_strusage); gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN); log_set_prefix ("gpg-check-pattern", 1); diff --git a/tools/gpg-connect-agent.c b/tools/gpg-connect-agent.c index 1d9bb66..f1d123f 100644 --- a/tools/gpg-connect-agent.c +++ b/tools/gpg-connect-agent.c @@ -1169,6 +1169,7 @@ main (int argc, char **argv) int loopidx; char **cmdline_commands = NULL; + early_system_init (); gnupg_rl_initialize (); set_strusage (my_strusage); log_set_prefix ("gpg-connect-agent", 1); diff --git a/tools/gpgconf.c b/tools/gpgconf.c index 423a66c..180c88a 100644 --- a/tools/gpgconf.c +++ b/tools/gpgconf.c @@ -151,6 +151,7 @@ main (int argc, char **argv) enum cmd_and_opt_values cmd = 0; estream_t outfp = NULL; + early_system_init (); gnupg_reopen_std (GPGCONF_NAME); set_strusage (my_strusage); log_set_prefix (GPGCONF_NAME, 1); diff --git a/tools/symcryptrun.c b/tools/symcryptrun.c index 4873d76..c7fc5b6 100644 --- a/tools/symcryptrun.c +++ b/tools/symcryptrun.c @@ -889,6 +889,7 @@ main (int argc, char **argv) char *logfile = NULL; int default_config = 1; + early_system_init (); set_strusage (my_strusage); log_set_prefix ("symcryptrun", 1); ----------------------------------------------------------------------- Summary of changes: agent/gpg-agent.c | 2 + agent/preset-passphrase.c | 1 + agent/protect-tool.c | 1 + common/init.c | 7 +++ common/init.h | 1 + common/stringhelp.c | 123 ----------------------------------------- common/stringhelp.h | 10 ---- dirmngr/dirmngr-client.c | 2 + dirmngr/dirmngr.c | 2 + dirmngr/dirmngr_ldap.c | 2 + g10/gpg.c | 4 +- g10/gpgv.c | 1 + g10/parse-packet.c | 22 +++++++- g13/g13.c | 1 + kbx/kbxutil.c | 1 + scd/scdaemon.c | 1 + sm/certdump.c | 137 ++++------------------------------------------ sm/gpgsm.c | 1 + tools/gpg-check-pattern.c | 1 + tools/gpg-connect-agent.c | 1 + tools/gpgconf.c | 1 + tools/symcryptrun.c | 1 + 22 files changed, 61 insertions(+), 262 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 29 07:18:34 2015 From: cvs at cvs.gnupg.org (by NIIBE Yutaka) Date: Thu, 29 Jan 2015 07:18:34 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-55-g6c36853 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 6c368533f5211bed62e8638f522cef65c7ba4b87 (commit) from 382ba4b137b42d5f25a7e256bb7c053ee5ac7b64 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 6c368533f5211bed62e8638f522cef65c7ba4b87 Author: NIIBE Yutaka Date: Thu Jan 29 15:00:30 2015 +0900 po: Update Japanese Translation. diff --git a/po/ja.po b/po/ja.po index e603c3f..13e9ce2 100644 --- a/po/ja.po +++ b/po/ja.po @@ -4,7 +4,7 @@ # IIDA Yosiaki , 1999, 2000, 2002, 2003, 2004. # Yoshihiro Kajiki , 1999. # Takashi P.KATOH, 2002. -# NIIBE Yutaka , 2013, 2014. +# NIIBE Yutaka , 2013, 2014, 2015. # msgid "" msgstr "" @@ -333,6 +333,9 @@ msgstr "?????????\"trusted\"??????????? msgid "allow presetting passphrase" msgstr "???????????????" +msgid "allow caller to override the pinentry" +msgstr "pinentry??????????????????" + msgid "enable ssh support" msgstr "ssh??????????" @@ -2261,66 +2264,67 @@ msgstr "%lu?????\n" #, c-format msgid "Total number processed: %lu\n" -msgstr " ??????: %lu\n" +msgstr " ??????: %lu\n" +#, c-format msgid " skipped PGP-2 keys: %lu\n" -msgstr "??????PGP-2?: %lu\n" +msgstr " ??????PGP-2?: %lu\n" #, c-format msgid " skipped new keys: %lu\n" -msgstr "??????????: %lu\n" +msgstr " ??????????: %lu\n" #, c-format msgid " w/o user IDs: %lu\n" -msgstr " ???ID??: %lu\n" +msgstr " ???ID??: %lu\n" #, c-format msgid " imported: %lu" -msgstr " ?????: %lu" +msgstr " ?????: %lu" #, c-format msgid " unchanged: %lu\n" -msgstr " ????: %lu\n" +msgstr " ????: %lu\n" #, c-format msgid " new user IDs: %lu\n" -msgstr " ??????ID: %lu\n" +msgstr " ??????ID: %lu\n" #, c-format msgid " new subkeys: %lu\n" -msgstr " ?????: %lu\n" +msgstr " ?????: %lu\n" #, c-format msgid " new signatures: %lu\n" -msgstr " ?????: %lu\n" +msgstr " ?????: %lu\n" #, c-format msgid " new key revocations: %lu\n" -msgstr " ???????: %lu\n" +msgstr " ???????: %lu\n" #, c-format msgid " secret keys read: %lu\n" -msgstr " ????????: %lu\n" +msgstr " ????????: %lu\n" #, c-format msgid " secret keys imported: %lu\n" -msgstr " ?????????: %lu\n" +msgstr " ?????????: %lu\n" #, c-format msgid " secret keys unchanged: %lu\n" -msgstr " ???????: %lu\n" +msgstr " ???????: %lu\n" #, c-format msgid " not imported: %lu\n" -msgstr " ??????: %lu\n" +msgstr " ??????: %lu\n" #, c-format msgid " signatures cleaned: %lu\n" -msgstr " ???????: %lu\n" +msgstr " ???????: %lu\n" #, c-format msgid " user IDs cleaned: %lu\n" -msgstr " ????????ID: %lu\n" +msgstr " ????????ID: %lu\n" #, c-format msgid "" @@ -3885,16 +3889,16 @@ msgstr "????????????:" #. TRANSLATORS: this should fit into 24 bytes to that the #. * fingerprint data is properly aligned with the user ID msgid " Primary key fingerprint:" -msgstr "???????????:" +msgstr "????????????:" msgid " Subkey fingerprint:" -msgstr "???????????:" +msgstr "????????????:" msgid " Key fingerprint =" msgstr " ????????? =" msgid " Card serial no. =" -msgstr " ?????????? =" +msgstr " ????????? =" #, c-format msgid "renaming '%s' to '%s' failed: %s\n" @@ -4543,7 +4547,7 @@ msgid "WARNING: This key has been revoked by its owner!\n" msgstr "*??*: ???????????????????!\n" msgid " This could mean that the signature is forged.\n" -msgstr " ????????????????????\n" +msgstr " ????????????????????\n" msgid "WARNING: This subkey has been revoked by its owner!\n" msgstr "*??*: ????????????????????!\n" @@ -4579,14 +4583,14 @@ msgid "WARNING: We do NOT trust this key!\n" msgstr "*??*: ???????????!\n" msgid " The signature is probably a FORGERY.\n" -msgstr " ????????? ?? ???\n" +msgstr " ????????? ?? ???\n" msgid "" "WARNING: This key is not certified with sufficiently trusted signatures!\n" msgstr "*??*: ????????????????????????!\n" msgid " It is not certain that the signature belongs to the owner.\n" -msgstr " ???????????????????????\n" +msgstr " ???????????????????????\n" #, c-format msgid "%s: skipped: %s\n" ----------------------------------------------------------------------- Summary of changes: po/ja.po | 50 +++++++++++++++++++++++++++----------------------- 1 file changed, 27 insertions(+), 23 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Thu Jan 29 16:31:44 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 29 Jan 2015 16:31:44 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-56-g6ab0fac Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 6ab0fac575a8b04152a199cb300a08436b096753 (commit) from 6c368533f5211bed62e8638f522cef65c7ba4b87 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 6ab0fac575a8b04152a199cb300a08436b096753 Author: Werner Koch Date: Thu Jan 29 16:26:07 2015 +0100 agent: Fix use of imported but unprotected openpgp keys. * agent/agent.h (PRIVATE_KEY_OPENPGP_NONE): New. * agent/command.c (do_one_keyinfo): Implement it. * agent/findkey.c (agent_key_from_file): Ditto. (agent_key_info_from_file): Ditto. (agent_delete_key): Ditto. * agent/protect.c (agent_private_key_type): Add detection for openpgp "none" method. Signed-off-by: Werner Koch diff --git a/agent/agent.h b/agent/agent.h index 4536242..f60061e 100644 --- a/agent/agent.h +++ b/agent/agent.h @@ -248,7 +248,8 @@ enum PRIVATE_KEY_PROTECTED = 2, /* The key is protected. */ PRIVATE_KEY_SHADOWED = 3, /* The key is a stub for a smartcard based key. */ - PROTECTED_SHARED_SECRET = 4 /* RFU. */ + PROTECTED_SHARED_SECRET = 4, /* RFU. */ + PRIVATE_KEY_OPENPGP_NONE = 5 /* openpgp-native with protection "none". */ }; diff --git a/agent/command.c b/agent/command.c index d5644cb..ca28e9b 100644 --- a/agent/command.c +++ b/agent/command.c @@ -1163,7 +1163,9 @@ do_one_keyinfo (ctrl_t ctrl, const unsigned char *grip, assuan_context_t ctx, { switch (keytype) { - case PRIVATE_KEY_CLEAR: protectionstr = "C"; keytypestr = "D"; + case PRIVATE_KEY_CLEAR: + case PRIVATE_KEY_OPENPGP_NONE: + protectionstr = "C"; keytypestr = "D"; break; case PRIVATE_KEY_PROTECTED: protectionstr = "P"; keytypestr = "D"; break; @@ -1801,12 +1803,12 @@ cmd_passwd (assuan_context_t ctx, char *line) } } if (!err && opt_preset) - { + { char hexgrip[40+1]; bin2hex(grip, 20, hexgrip); err = agent_put_cache (hexgrip, CACHE_MODE_ANY, newpass, ctrl->cache_ttl_opt_preset); - } + } xfree (newpass); } ctrl->in_passwd--; diff --git a/agent/cvt-openpgp.c b/agent/cvt-openpgp.c index 8cf0023..5f94493 100644 --- a/agent/cvt-openpgp.c +++ b/agent/cvt-openpgp.c @@ -1051,13 +1051,25 @@ convert_from_openpgp_native (ctrl_t ctrl, /* On success try to re-write the key. */ if (!err) { - unsigned char *protectedkey = NULL; - size_t protectedkeylen; - - if (!agent_protect (*r_key, passphrase, &protectedkey, &protectedkeylen, - ctrl->s2k_count)) - agent_write_private_key (grip, protectedkey, protectedkeylen, 1); - xfree (protectedkey); + if (*passphrase) + { + unsigned char *protectedkey = NULL; + size_t protectedkeylen; + + if (!agent_protect (*r_key, passphrase, + &protectedkey, &protectedkeylen, + ctrl->s2k_count)) + agent_write_private_key (grip, protectedkey, protectedkeylen, 1); + xfree (protectedkey); + } + else + { + /* Empty passphrase: write key without protection. */ + agent_write_private_key (grip, + *r_key, + gcry_sexp_canon_len (*r_key, 0, NULL,NULL), + 1); + } } return err; diff --git a/agent/findkey.c b/agent/findkey.c index 156102b..6f01789 100644 --- a/agent/findkey.c +++ b/agent/findkey.c @@ -664,6 +664,22 @@ agent_key_from_file (ctrl_t ctrl, const char *cache_nonce, { case PRIVATE_KEY_CLEAR: break; /* no unprotection needed */ + case PRIVATE_KEY_OPENPGP_NONE: + { + unsigned char *buf_new; + size_t buf_newlen; + + rc = agent_unprotect (ctrl, buf, "", NULL, &buf_new, &buf_newlen); + if (rc) + log_error ("failed to convert unprotected openpgp key: %s\n", + gpg_strerror (rc)); + else + { + xfree (buf); + buf = buf_new; + } + } + break; case PRIVATE_KEY_PROTECTED: { char *desc_text_final; @@ -1159,6 +1175,7 @@ agent_key_info_from_file (ctrl_t ctrl, const unsigned char *grip, switch (keytype) { case PRIVATE_KEY_CLEAR: + case PRIVATE_KEY_OPENPGP_NONE: break; case PRIVATE_KEY_PROTECTED: /* If we ever require it we could retrieve the comment fields @@ -1230,6 +1247,7 @@ agent_delete_key (ctrl_t ctrl, const char *desc_text, switch (agent_private_key_type (buf)) { case PRIVATE_KEY_CLEAR: + case PRIVATE_KEY_OPENPGP_NONE: case PRIVATE_KEY_PROTECTED: { bin2hex (grip, 20, hexgrip); diff --git a/agent/protect.c b/agent/protect.c index 01e72c2..cdb39fd 100644 --- a/agent/protect.c +++ b/agent/protect.c @@ -1,6 +1,6 @@ /* protect.c - Un/Protect a secret key * Copyright (C) 1998-2003, 2007, 2009, 2011 Free Software Foundation, Inc. - * Copyright (C) 1998-2003, 2007, 2009, 2011, 2013 Werner Koch + * Copyright (C) 1998-2003, 2007, 2009, 2011, 2013-2015 Werner Koch * * This file is part of GnuPG. * @@ -1101,13 +1101,16 @@ agent_unprotect (ctrl_t ctrl, PRIVATE_KEY_UNKNOWN if we can't figure out the type (this is the value 0), PRIVATE_KEY_CLEAR for an unprotected private key. PRIVATE_KEY_PROTECTED for an protected private key or - PRIVATE_KEY_SHADOWED for a sub key where the secret parts are stored - elsewhere. */ + PRIVATE_KEY_SHADOWED for a sub key where the secret parts are + stored elsewhere. Finally PRIVATE_KEY_OPENPGP_NONE may be returned + is the key is still in the openpgp-native format but without + protection. */ int agent_private_key_type (const unsigned char *privatekey) { const unsigned char *s; size_t n; + int i; s = privatekey; if (*s != '(') @@ -1117,7 +1120,75 @@ agent_private_key_type (const unsigned char *privatekey) if (!n) return PRIVATE_KEY_UNKNOWN; if (smatch (&s, n, "protected-private-key")) - return PRIVATE_KEY_PROTECTED; + { + /* We need to check whether this is openpgp-native protected + with the protection method "none". In that case we return a + different key type so that the caller knows that there is no + need to ask for a passphrase. */ + if (*s != '(') + return PRIVATE_KEY_PROTECTED; /* Unknown sexp - assume protected. */ + s++; + n = snext (&s); + if (!n) + return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */ + s += n; /* Skip over the algo */ + + /* Find the (protected ...) list. */ + for (;;) + { + if (*s != '(') + return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */ + s++; + n = snext (&s); + if (!n) + return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */ + if (smatch (&s, n, "protected")) + break; + s += n; + i = 1; + if (sskip (&s, &i)) + return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */ + } + /* Found - Is this openpgp-native? */ + n = snext (&s); + if (!n) + return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */ + if (smatch (&s, n, "openpgp-native")) /* Yes. */ + { + if (*s != '(') + return PRIVATE_KEY_UNKNOWN; /* Unknown sexp. */ + s++; + n = snext (&s); + if (!n) + return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */ + s += n; /* Skip over "openpgp-private-key". */ + /* Find the (protection ...) list. */ + for (;;) + { + if (*s != '(') + return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */ + s++; + n = snext (&s); + if (!n) + return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */ + if (smatch (&s, n, "protection")) + break; + s += n; + i = 1; + if (sskip (&s, &i)) + return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */ + } + /* Found - Is the mode "none"? */ + n = snext (&s); + if (!n) + return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */ + log_debug ("openpgp-native protection '%.*s'\n", (int)n, s); + if (smatch (&s, n, "none")) + return PRIVATE_KEY_OPENPGP_NONE; /* Yes. */ + } + + return PRIVATE_KEY_PROTECTED; + } if (smatch (&s, n, "shadowed-private-key")) return PRIVATE_KEY_SHADOWED; if (smatch (&s, n, "private-key")) ----------------------------------------------------------------------- Summary of changes: agent/agent.h | 3 +- agent/command.c | 8 ++++-- agent/cvt-openpgp.c | 26 +++++++++++++----- agent/findkey.c | 18 ++++++++++++ agent/protect.c | 79 ++++++++++++++++++++++++++++++++++++++++++++++++++--- 5 files changed, 119 insertions(+), 15 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 30 03:50:08 2015 From: cvs at cvs.gnupg.org (by Joshua Rogers) Date: Fri, 30 Jan 2015 03:50:08 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-57-g7db6c82 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 7db6c82cec49b7c56c403a8ea98364086baf75f3 (commit) from 6ab0fac575a8b04152a199cb300a08436b096753 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 7db6c82cec49b7c56c403a8ea98364086baf75f3 Author: Joshua Rogers Date: Fri Jan 30 11:42:52 2015 +0900 kbx: Fix resource leak. * kbx/keybox-update.c (blob_filecopy): Fix resource leak. On error return, 'fp' and 'newfp' was never closed. -- Signed-off-by: Joshua Rogers [Log entry reformatted, and added more fixes - gniibe] diff --git a/kbx/keybox-update.c b/kbx/keybox-update.c index 11861ac..7b207a5 100644 --- a/kbx/keybox-update.c +++ b/kbx/keybox-update.c @@ -241,11 +241,17 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob, rc = _keybox_write_header_blob (newfp, for_openpgp); if (rc) - return rc; + { + fclose (newfp); + return rc; + } rc = _keybox_write_blob (blob, newfp); if (rc) - return rc; + { + fclose (newfp); + return rc; + } if ( fclose (newfp) ) return gpg_error_from_syserror (); @@ -268,7 +274,8 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob, rc = create_tmp_file (fname, &bakfname, &tmpfname, &newfp); if (rc) { - fclose(fp); + fclose (fp); + fclose (newfp); goto leave; } @@ -292,12 +299,16 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob, if (fwrite (buffer, nread, 1, newfp) != 1) { rc = gpg_error_from_syserror (); + fclose (fp); + fclose (newfp); goto leave; } } if (ferror (fp)) { rc = gpg_error_from_syserror (); + fclose (fp); + fclose (newfp); goto leave; } } @@ -321,19 +332,27 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob, if (fwrite (buffer, nread, 1, newfp) != 1) { rc = gpg_error_from_syserror (); + fclose (fp); + fclose (newfp); goto leave; } } if (ferror (fp)) { rc = gpg_error_from_syserror (); + fclose (fp); + fclose (newfp); goto leave; } /* Skip this blob. */ rc = _keybox_read_blob (NULL, fp); if (rc) - return rc; + { + fclose (fp); + fclose (newfp); + return rc; + } } /* Do an insert or update. */ @@ -341,7 +360,11 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob, { rc = _keybox_write_blob (blob, newfp); if (rc) + { + fclose (fp); + fclose (newfp); return rc; + } } /* Copy the rest of the packet for an delete or update. */ @@ -352,12 +375,16 @@ blob_filecopy (int mode, const char *fname, KEYBOXBLOB blob, if (fwrite (buffer, nread, 1, newfp) != 1) { rc = gpg_error_from_syserror (); + fclose (fp); + fclose (newfp); goto leave; } } if (ferror (fp)) { rc = gpg_error_from_syserror (); + fclose (fp); + fclose (newfp); goto leave; } } @@ -726,7 +753,7 @@ keybox_compress (KEYBOX_HANDLE hd) rc = create_tmp_file (fname, &bakfname, &tmpfname, &newfp); if (rc) { - fclose(fp); + fclose (fp); return rc;; } ----------------------------------------------------------------------- Summary of changes: kbx/keybox-update.c | 37 ++++++++++++++++++++++++++++++++----- 1 file changed, 32 insertions(+), 5 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 30 10:24:29 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 30 Jan 2015 10:24:29 +0100 Subject: [git] KSBA - branch, master, updated. libksba-1.3.2-4-g569f3da Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "KSBA is a library to access X.509 certificates and CMS data.". The branch, master has been updated via 569f3da664de81638bcb322d6e9380f3ff16f70c (commit) from 32b3a47a358d694332450f9c2487a88aedc46ca7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 569f3da664de81638bcb322d6e9380f3ff16f70c Author: Werner Koch Date: Fri Jan 30 10:18:47 2015 +0100 Update ASN.1 grammar for newer Bison versions. * src/asn1-parse.y (YYERROR_VERBOSE): Replace by ... (%define parse.error.verbose): this. (YYPARSE_PARM, YYLEX_PARM): Replace by ... (%parm): this. (%pure_parser): Replace by ... (%define api.pure full): this. (yyerror): Add arg parm. Signed-off-by: Werner Koch diff --git a/build-aux/ylwrap b/build-aux/ylwrap index 279f306..8f072a8 100755 --- a/build-aux/ylwrap +++ b/build-aux/ylwrap @@ -1,10 +1,9 @@ #! /bin/sh # ylwrap - wrapper for lex/yacc invocations. -scriptversion=2007-11-22.22 +scriptversion=2013-01-12.17; # UTC -# Copyright (C) 1996, 1997, 1998, 1999, 2001, 2002, 2003, 2004, 2005, -# 2007 Free Software Foundation, Inc. +# Copyright (C) 1996-2013 Free Software Foundation, Inc. # # Written by Tom Tromey . # @@ -19,9 +18,7 @@ scriptversion=2007-11-22.22 # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA -# 02110-1301, USA. +# along with this program. If not, see . # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a @@ -32,9 +29,41 @@ scriptversion=2007-11-22.22 # bugs to or send patches to # . +get_dirname () +{ + case $1 in + */*|*\\*) printf '%s\n' "$1" | sed -e 's|\([\\/]\)[^\\/]*$|\1|';; + # Otherwise, we want the empty string (not "."). + esac +} + +# guard FILE +# ---------- +# The CPP macro used to guard inclusion of FILE. +guard () +{ + printf '%s\n' "$1" \ + | sed \ + -e 'y/abcdefghijklmnopqrstuvwxyz/ABCDEFGHIJKLMNOPQRSTUVWXYZ/' \ + -e 's/[^ABCDEFGHIJKLMNOPQRSTUVWXYZ]/_/g' \ + -e 's/__*/_/g' +} + +# quote_for_sed [STRING] +# ---------------------- +# Return STRING (or stdin) quoted to be used as a sed pattern. +quote_for_sed () +{ + case $# in + 0) cat;; + 1) printf '%s\n' "$1";; + esac \ + | sed -e 's|[][\\.*]|\\&|g' +} + case "$1" in '') - echo "$0: No files given. Try \`$0 --help' for more information." 1>&2 + echo "$0: No files given. Try '$0 --help' for more information." 1>&2 exit 1 ;; --basedir) @@ -67,41 +96,77 @@ esac # The input. -input="$1" +input=$1 shift -case "$input" in +# We'll later need for a correct munging of "#line" directives. +input_sub_rx=`get_dirname "$input" | quote_for_sed` +case $input in [\\/]* | ?:[\\/]*) # Absolute path; do nothing. ;; *) # Relative path. Make it absolute. - input="`pwd`/$input" + input=`pwd`/$input ;; esac +input_rx=`get_dirname "$input" | quote_for_sed` + +# Since DOS filename conventions don't allow two dots, +# the DOS version of Bison writes out y_tab.c instead of y.tab.c +# and y_tab.h instead of y.tab.h. Test to see if this is the case. +y_tab_nodot=false +if test -f y_tab.c || test -f y_tab.h; then + y_tab_nodot=true +fi + +# The parser itself, the first file, is the destination of the .y.c +# rule in the Makefile. +parser=$1 + +# A sed program to s/FROM/TO/g for all the FROM/TO so that, for +# instance, we rename #include "y.tab.h" into #include "parse.h" +# during the conversion from y.tab.c to parse.c. +sed_fix_filenames= -pairlist= -while test "$#" -ne 0; do - if test "$1" = "--"; then +# Also rename header guards, as Bison 2.7 for instance uses its header +# guard in its implementation file. +sed_fix_header_guards= + +while test $# -ne 0; do + if test x"$1" = x"--"; then shift break fi - pairlist="$pairlist $1" + from=$1 + # Handle y_tab.c and y_tab.h output by DOS + if $y_tab_nodot; then + case $from in + "y.tab.c") from=y_tab.c;; + "y.tab.h") from=y_tab.h;; + esac + fi shift + to=$1 + shift + sed_fix_filenames="${sed_fix_filenames}s|"`quote_for_sed "$from"`"|$to|g;" + sed_fix_header_guards="${sed_fix_header_guards}s|"`guard "$from"`"|"`guard "$to"`"|g;" done # The program to run. -prog="$1" +prog=$1 shift # Make any relative path in $prog absolute. -case "$prog" in +case $prog in [\\/]* | ?:[\\/]*) ;; - *[\\/]*) prog="`pwd`/$prog" ;; + *[\\/]*) prog=`pwd`/$prog ;; esac -# FIXME: add hostname here for parallel makes that run commands on -# other machines. But that might take us over the 14-char limit. dirname=ylwrap$$ -trap "cd '`pwd`'; rm -rf $dirname > /dev/null 2>&1" 1 2 3 15 +do_exit="cd '`pwd`' && rm -rf $dirname > /dev/null 2>&1;"' (exit $ret); exit $ret' +trap "ret=129; $do_exit" 1 +trap "ret=130; $do_exit" 2 +trap "ret=141; $do_exit" 13 +trap "ret=143; $do_exit" 15 mkdir $dirname || exit 1 cd $dirname @@ -113,98 +178,56 @@ esac ret=$? if test $ret -eq 0; then - set X $pairlist - shift - first=yes - # Since DOS filename conventions don't allow two dots, - # the DOS version of Bison writes out y_tab.c instead of y.tab.c - # and y_tab.h instead of y.tab.h. Test to see if this is the case. - y_tab_nodot="no" - if test -f y_tab.c || test -f y_tab.h; then - y_tab_nodot="yes" - fi - - # The directory holding the input. - input_dir=`echo "$input" | sed -e 's,\([\\/]\)[^\\/]*$,\1,'` - # Quote $INPUT_DIR so we can use it in a regexp. - # FIXME: really we should care about more than `.' and `\'. - input_rx=`echo "$input_dir" | sed 's,\\\\,\\\\\\\\,g;s,\\.,\\\\.,g'` - - while test "$#" -ne 0; do - from="$1" - # Handle y_tab.c and y_tab.h output by DOS - if test $y_tab_nodot = "yes"; then - if test $from = "y.tab.c"; then - from="y_tab.c" - else - if test $from = "y.tab.h"; then - from="y_tab.h" - fi - fi - fi + for from in * + do + to=`printf '%s\n' "$from" | sed "$sed_fix_filenames"` if test -f "$from"; then # If $2 is an absolute path name, then just use that, - # otherwise prepend `../'. - case "$2" in - [\\/]* | ?:[\\/]*) target="$2";; - *) target="../$2";; + # otherwise prepend '../'. + case $to in + [\\/]* | ?:[\\/]*) target=$to;; + *) target=../$to;; esac - # We do not want to overwrite a header file if it hasn't - # changed. This avoid useless recompilations. However the - # parser itself (the first file) should always be updated, - # because it is the destination of the .y.c rule in the - # Makefile. Divert the output of all other files to a temporary - # file so we can compare them to existing versions. - if test $first = no; then - realtarget="$target" - target="tmp-`echo $target | sed s/.*[\\/]//g`" + # Do not overwrite unchanged header files to avoid useless + # recompilations. Always update the parser itself: it is the + # destination of the .y.c rule in the Makefile. Divert the + # output of all other files to a temporary file so we can + # compare them to existing versions. + if test $from != $parser; then + realtarget=$target + target=tmp-`printf '%s\n' "$target" | sed 's|.*[\\/]||g'` fi - # Edit out `#line' or `#' directives. - # - # We don't want the resulting debug information to point at - # an absolute srcdir; it is better for it to just mention the - # .y file with no path. - # - # We want to use the real output file name, not yy.lex.c for - # instance. - # - # We want the include guards to be adjusted too. - FROM=`echo "$from" | sed \ - -e 'y/abcdefghijklmnopqrstuvwxyz/ABCDEFGHIJKLMNOPQRSTUVWXYZ/'\ - -e 's/[^ABCDEFGHIJKLMNOPQRSTUVWXYZ]/_/g'` - TARGET=`echo "$2" | sed \ - -e 'y/abcdefghijklmnopqrstuvwxyz/ABCDEFGHIJKLMNOPQRSTUVWXYZ/'\ - -e 's/[^ABCDEFGHIJKLMNOPQRSTUVWXYZ]/_/g'` - - sed -e "/^#/!b" -e "s,$input_rx,," -e "s,$from,$2," \ - -e "s,$FROM,$TARGET," "$from" >"$target" || ret=$? - - # Check whether header files must be updated. - if test $first = no; then - if test -f "$realtarget" && cmp -s "$realtarget" "$target"; then - echo "$2" is unchanged - rm -f "$target" - else - echo updating "$2" + + # Munge "#line" or "#" directives. Don't let the resulting + # debug information point at an absolute srcdir. Use the real + # output file name, not yy.lex.c for instance. Adjust the + # include guards too. + sed -e "/^#/!b" \ + -e "s|$input_rx|$input_sub_rx|" \ + -e "$sed_fix_filenames" \ + -e "$sed_fix_header_guards" \ + "$from" >"$target" || ret=$? + + # Check whether files must be updated. + if test "$from" != "$parser"; then + if test -f "$realtarget" && cmp -s "$realtarget" "$target"; then + echo "$to is unchanged" + rm -f "$target" + else + echo "updating $to" mv -f "$target" "$realtarget" fi fi else - # A missing file is only an error for the first file. This - # is a blatant hack to let us support using "yacc -d". If -d - # is not specified, we don't want an error when the header - # file is "missing". - if test $first = yes; then + # A missing file is only an error for the parser. This is a + # blatant hack to let us support using "yacc -d". If -d is not + # specified, don't fail when the header file is "missing". + if test "$from" = "$parser"; then ret=1 fi fi - shift - shift - first=no done -else - ret=$? fi # Remove the directory. @@ -219,5 +242,6 @@ exit $ret # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "scriptversion=" # time-stamp-format: "%:y-%02m-%02d.%02H" -# time-stamp-end: "$" +# time-stamp-time-zone: "UTC" +# time-stamp-end: "; # UTC" # End: diff --git a/src/asn1-parse.y b/src/asn1-parse.y index 2f739c0..3336c43 100755 --- a/src/asn1-parse.y +++ b/src/asn1-parse.y @@ -64,7 +64,6 @@ #define yyparse _ksba_asn1_yyparse /* #define YYDEBUG 1 */ -#define YYERROR_VERBOSE 1 #define MAX_STRING_LENGTH 129 /* Dummy print so that yytoknum will be defined. */ @@ -86,13 +85,13 @@ struct parser_control_s { AsnNode all_nodes; }; #define PARSECTL ((struct parser_control_s *)parm) -#define YYPARSE_PARAM parm -#define YYLEX_PARAM parm %} -%pure_parser +%param {void *parm} +%define api.pure full +%define parse.error verbose %expect 1 %union { @@ -113,7 +112,7 @@ static void set_down (AsnNode node, AsnNode down); static int yylex (YYSTYPE *lvalp, void *parm); -static void yyerror (const char *s); +static void yyerror (void *parm, const char *s); %} %token-table @@ -868,11 +867,14 @@ yylex (YYSTYPE *lvalp, void *parm) } static void -yyerror (const char *s) +yyerror (void *parm, const char *s) { + (void)parm; /* Sends the error description to stderr */ fprintf (stderr, "%s\n", s); - /* Why doesn't bison provide a way to pass the parm to yyerror ??*/ + /* Why doesn't bison provide a way to pass the parm to yyerror? + Update: Newer bison versions allow for this. We need to see how + we can make use of it. */ } ----------------------------------------------------------------------- Summary of changes: build-aux/ylwrap | 224 ++++++++++++++++++++++++++++++------------------------- src/asn1-parse.y | 16 ++-- 2 files changed, 133 insertions(+), 107 deletions(-) hooks/post-receive -- KSBA is a library to access X.509 certificates and CMS data. http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 30 17:27:07 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 30 Jan 2015 17:27:07 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-166-g40a7bdf Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via 40a7bdf50e19faaf106470897fed72af623adc50 (commit) from 2564d204e408b296425ac0660c6bdc6270575fb6 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 40a7bdf50e19faaf106470897fed72af623adc50 Author: Werner Koch Date: Fri Jan 30 16:58:02 2015 +0100 w32: Use -static-libgcc to avoid linking to libgcc_s_sjlj-1.dll. * src/Makefile.am (extra_ltoptions): New. (libgcrypt_la_LDFLAGS): Use it. -- Since gcc 4.8 there is a regression in that plain C programs may link to libgcc_s.a which has a dependency on libgcc_s_sjlj.dll. This is for example triggered by using long long arithmetic on a 32 bit Windows (e.g symbol __udivdi3). As usual the gcc maintainers don't care about backward compatibility and declare that as some kind of compatibility fix and not as regression from 4.7 and all earlier versions. Signed-off-by: Werner Koch diff --git a/src/Makefile.am b/src/Makefile.am index cbb08af..cd0d354 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -81,6 +81,7 @@ SUFFIXES = .rc .lo gcrypt_res = versioninfo.lo no_undefined = -no-undefined export_symbols = -export-symbols $(srcdir)/libgcrypt.def +extra_ltoptions = -XCClinker -static-libgcc install-def-file: -$(INSTALL) -d $(DESTDIR)$(libdir) @@ -97,6 +98,7 @@ gcrypt_res = gcrypt_res_ldflag = no_undefined = export_symbols = +extra_ltoptions = install-def-file: uninstall-def-file: @@ -105,7 +107,7 @@ gcrypt_deps = endif !HAVE_W32_SYSTEM -libgcrypt_la_LDFLAGS = $(no_undefined) $(export_symbols) \ +libgcrypt_la_LDFLAGS = $(no_undefined) $(export_symbols) $(extra_ltoptions) \ $(libgcrypt_version_script_cmd) -version-info \ @LIBGCRYPT_LT_CURRENT@:@LIBGCRYPT_LT_REVISION@:@LIBGCRYPT_LT_AGE@ libgcrypt_la_DEPENDENCIES = \ ----------------------------------------------------------------------- Summary of changes: src/Makefile.am | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 30 17:27:15 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 30 Jan 2015 17:27:15 +0100 Subject: [git] GPG-ERROR - branch, master, updated. libgpg-error-1.18-2-g8487ec2 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Error codes used by GnuPG et al.". The branch, master has been updated via 8487ec25e1c8f73ca7dc31e5d648cb05eede0f14 (commit) from bf44f9a2365faf6b85967e69d6f2f0de11bc9a54 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 8487ec25e1c8f73ca7dc31e5d648cb05eede0f14 Author: Werner Koch Date: Fri Jan 30 16:39:02 2015 +0100 w32: Use -static-libgcc to avoid linking to libgcc_s_sjlj-1.dll. * src/Makefile.am (extra_ltoptions): New. (libgpg_error_la_LDFLAGS): Use it. -- Since gcc 4.8 there is a regression in that plain C programs may link to libgcc_s.a which has a dependency on libgcc_s_sjlj.dll. This is for example triggered by using long long arithmetic on a 32 bit Windows (e.g symbol __udivdi3). As usual the gcc maintainers don't care about backward compatibility and declare that as some kind of compatibility fix and not as regression from 4.7 and all earlier versions. Signed-off-by: Werner Koch diff --git a/src/Makefile.am b/src/Makefile.am index b91876b..403f5d2 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -114,6 +114,12 @@ SUFFIXES = .rc .lo gpg_error_res = versioninfo.lo no_undefined = -no-undefined export_symbols = -export-symbols gpg-error.def +# i686-w64-mingw32.gcc version 4.9.1 takes the long long helper +# functions from libgcc_s_sjlj-1.dll and not from a static libgcc. As +# a plain C program we do not use exception handler and thus there is +# no need to use this DLL. Thus we force gcc to link that statically. +extra_ltoptions = -XCClinker -static-libgcc + install-def-file: gpg-error.def -$(INSTALL) -d $(DESTDIR)$(libdir) @@ -136,6 +142,8 @@ arch_sources = posix-lock.c posix-lock-obj.h posix-thread.c gpg_error_res = no_undefined = export_symbols = +extra_ltoptions = + install-def-file: uninstall-def-file: @@ -154,7 +162,7 @@ endif libgpg_error_la_LDFLAGS = \ $(no_undefined) $(export_symbols) $(libgpg_error_vers_opt) \ - -version-info \ + $(extra_ltoptions) -version-info \ @LIBGPG_ERROR_LT_CURRENT@:@LIBGPG_ERROR_LT_REVISION@:@LIBGPG_ERROR_LT_AGE@ libgpg_error_la_SOURCES = gettext.h $(arch_sources) \ ----------------------------------------------------------------------- Summary of changes: src/Makefile.am | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) hooks/post-receive -- Error codes used by GnuPG et al. http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 30 17:27:25 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 30 Jan 2015 17:27:25 +0100 Subject: [git] Assuan - branch, master, updated. libassuan-2.2.0-9-g5cdc9c4 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPC library used by GnuPG". The branch, master has been updated via 5cdc9c457f4e549491fa3f0db75119abd078b070 (commit) from 4655d5408ce9dd1c08aca871f6ccb406f6b35b3d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5cdc9c457f4e549491fa3f0db75119abd078b070 Author: Werner Koch Date: Fri Jan 30 17:06:28 2015 +0100 w32: Use -static-libgcc to avoid linking to libgcc_s_sjlj-1.dll. * src/Makefile.am (extra_ltoptions): New. (libassuan_la_LDFLAGS): Use it. -- Since gcc 4.8 there is a regression in that plain C programs may link to libgcc_s.a which has a dependency on libgcc_s_sjlj.dll. This is for example triggered by using long long arithmetic on a 32 bit Windows (e.g symbol __udivdi3). This patch does not change anything right now but we add it anyway in case long long will ever be used. Signed-off-by: Werner Koch diff --git a/src/Makefile.am b/src/Makefile.am index 435155e..8feef3a 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -95,6 +95,7 @@ libassuan_res_ldflag = -Wl,.libs/versioninfo.o no_undefined = -no-undefined export_symbols = -export-symbols $(srcdir)/libassuan.def +extra_ltoptions = -XCClinker -static-libgcc install-def-file: $(INSTALL) $(srcdir)/libassuan.def $(DESTDIR)$(libdir)/libassuan.def @@ -109,6 +110,8 @@ libassuan_res = libassuan_res_ldflag = no_undefined = export_symbols = +extra_ltoptions = + install-def-file: uninstall-def-file: @@ -120,6 +123,7 @@ libassuan_la_SOURCES = $(common_sources) assuan-io.c nodist_libassuan_la_SOURCES = assuan.h libassuan_la_CPPFLAGS = $(AM_CPPFLAGS) @GPG_ERROR_CFLAGS@ libassuan_la_LDFLAGS = $(libassuan_res_ldflag) $(no_undefined) \ + $(extra_ltoptions) \ $(export_symbols) $(libassuan_version_script_cmd) -version-info \ @LIBASSUAN_LT_CURRENT@:@LIBASSUAN_LT_REVISION@:@LIBASSUAN_LT_AGE@ libassuan_la_DEPENDENCIES = @LTLIBOBJS@ \ ----------------------------------------------------------------------- Summary of changes: src/Makefile.am | 4 ++++ 1 file changed, 4 insertions(+) hooks/post-receive -- IPC library used by GnuPG http://git.gnupg.org From cvs at cvs.gnupg.org Fri Jan 30 17:27:33 2015 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 30 Jan 2015 17:27:33 +0100 Subject: [git] KSBA - branch, master, updated. libksba-1.3.2-5-g792f4b3 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "KSBA is a library to access X.509 certificates and CMS data.". The branch, master has been updated via 792f4b36f998beba3515b776e8ca76ecbf20e468 (commit) from 569f3da664de81638bcb322d6e9380f3ff16f70c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 792f4b36f998beba3515b776e8ca76ecbf20e468 Author: Werner Koch Date: Fri Jan 30 17:09:12 2015 +0100 w32: Use -static-libgcc to avoid linking to libgcc_s_sjlj-1.dll. * src/Makefile.am (extra_ltoptions): New. (libksba_la_LDFLAGS): Use it. -- Since gcc 4.8 there is a regression in that plain C programs may link to libgcc_s.a which has a dependency on libgcc_s_sjlj.dll. This is for example triggered by using long long arithmetic on a 32 bit Windows (e.g symbol __udivdi3). Signed-off-by: Werner Koch diff --git a/src/Makefile.am b/src/Makefile.am index 2d7d7f7..7e3f06b 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -59,6 +59,7 @@ SUFFIXES = .rc .lo ksba_res = versioninfo.lo no_undefined = -no-undefined export_symbols = -export-symbols $(srcdir)/libksba.def +extra_ltoptions = -XCClinker -static-libgcc install-def-file: $(INSTALL) $(srcdir)/libksba.def $(DESTDIR)$(libdir)/libksba.def @@ -72,13 +73,14 @@ else !HAVE_W32_SYSTEM ksba_res = no_undefined = export_symbols = +extra_ltoptions = ksba_deps = install-def-file: uninstall-def-file: endif !HAVE_W32_SYSTEM -libksba_la_LDFLAGS = $(no_undefined) $(export_symbols) \ +libksba_la_LDFLAGS = $(no_undefined) $(export_symbols) $(extra_ltoptions) \ $(libksba_version_script_cmd) -version-info \ @LIBKSBA_LT_CURRENT@:@LIBKSBA_LT_REVISION@:@LIBKSBA_LT_AGE@ libksba_la_INCLUDES = -I$(top_srcdir)/lib ----------------------------------------------------------------------- Summary of changes: src/Makefile.am | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) hooks/post-receive -- KSBA is a library to access X.509 certificates and CMS data. http://git.gnupg.org