[git] GnuPG - branch, master, updated. gnupg-2.1.9-22-gc376211
by Neal H. Walfield
cvs at cvs.gnupg.org
Mon Oct 19 20:47:38 CEST 2015
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".
The branch, master has been updated
via c37621166e9cc2a818de73bc99287a393dbb5744 (commit)
via a608ee750dd83bf77a5fb4f0ab5bcf812436ba4d (commit)
via 0433e667029508d6933e8798d3d95bcdde70a7aa (commit)
via 547a1b3fb881bb8581d03dbf4eacf49163eaa4b5 (commit)
from b98939812abf6c643c752ce7c325f98039a1a9e2 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit c37621166e9cc2a818de73bc99287a393dbb5744
Author: Neal H. Walfield <neal at g10code.com>
Date: Mon Oct 19 15:04:45 2015 +0200
gpg: Fix --desig-revoke.
* g10/revoke.c (gen_desig_revoke): Add additional parameter ctrl.
Check that the secret key is available. If not, display an error
message.
--
Signed-off-by: Neal H. Walfield <neal at g10code.com>
Regression-due-to: 8459bcf9
diff --git a/g10/gpg.c b/g10/gpg.c
index cb610a1..794d5ea 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -4179,11 +4179,11 @@ main (int argc, char **argv)
break;
case aDesigRevoke:
- if( argc != 1 )
- wrong_args("--desig-revoke user-id");
- username = make_username(*argv);
- gen_desig_revoke( username, locusr );
- xfree( username );
+ if (argc != 1)
+ wrong_args ("--desig-revoke user-id");
+ username = make_username (*argv);
+ gen_desig_revoke (ctrl, username, locusr);
+ xfree (username);
break;
case aDeArmor:
diff --git a/g10/main.h b/g10/main.h
index 518ec94..a50c85c 100644
--- a/g10/main.h
+++ b/g10/main.h
@@ -356,7 +356,7 @@ int enarmor_file( const char *fname );
struct revocation_reason_info;
int gen_standard_revoke (PKT_public_key *psk, const char *cache_nonce);
int gen_revoke( const char *uname );
-int gen_desig_revoke( const char *uname, strlist_t locusr);
+int gen_desig_revoke (ctrl_t ctrl, const char *uname, strlist_t locusr);
int revocation_reason_build_cb( PKT_signature *sig, void *opaque );
struct revocation_reason_info *
ask_revocation_reason( int key_rev, int cert_rev, int hint );
diff --git a/g10/revoke.c b/g10/revoke.c
index eb3a989..b341cce 100644
--- a/g10/revoke.c
+++ b/g10/revoke.c
@@ -195,7 +195,7 @@ export_minimal_pk(IOBUF out,KBNODE keyblock,
* Generate a revocation certificate for UNAME via a designated revoker
*/
int
-gen_desig_revoke( const char *uname, strlist_t locusr )
+gen_desig_revoke (ctrl_t ctrl, const char *uname, strlist_t locusr)
{
int rc = 0;
armor_filter_context_t *afx;
@@ -312,6 +312,13 @@ gen_desig_revoke( const char *uname, strlist_t locusr )
tty_printf(_("(This is a sensitive revocation key)\n"));
tty_printf("\n");
+ rc = agent_probe_secret_key (ctrl, pk2);
+ if (rc)
+ {
+ tty_printf (_("Secret key is not available.\n"));
+ continue;
+ }
+
if( !cpr_get_answer_is_yes("gen_desig_revoke.okay",
_("Create a designated revocation certificate for this key? (y/N) ")))
continue;
@@ -321,10 +328,6 @@ gen_desig_revoke( const char *uname, strlist_t locusr )
if( !reason )
continue;
- rc = -1;/*FIXME: check_secret_key (pk2, 0 );*/
- if (rc)
- continue;
-
if( !opt.armor )
tty_printf(_("ASCII armored output forced.\n"));
commit a608ee750dd83bf77a5fb4f0ab5bcf812436ba4d
Author: Neal H. Walfield <neal at g10code.com>
Date: Mon Oct 19 11:15:00 2015 +0200
gpg: Improve function documentation and some comments.
* g10/main.h: Improve function documentation.
* g10/packet.h.h: Improve function documentation.
* g10/sig-check.c: Improve function documentation and some comments.
--
Signed-off-by: Neal H. Walfield <neal at g10code.com>
diff --git a/g10/main.h b/g10/main.h
index 601a952..518ec94 100644
--- a/g10/main.h
+++ b/g10/main.h
@@ -181,7 +181,7 @@ int mpi_print (estream_t stream, gcry_mpi_t a, int mode);
unsigned int ecdsa_qbits_from_Q (unsigned int qbits);
-/*-- status.c --*/
+/*-- cpr.c --*/
void set_status_fd ( int fd );
int is_status_enabled ( void );
void write_status ( int no );
@@ -239,10 +239,22 @@ int clearsign_file( const char *fname, strlist_t locusr, const char *outfile );
int sign_symencrypt_file (const char *fname, strlist_t locusr);
/*-- sig-check.c --*/
+
+/* SIG is a revocation signature. Check if any of PK's designated
+ revokers generated it. If so, return 0. Note: this function
+ (correctly) doesn't care if the designated revoker is revoked. */
int check_revocation_keys (PKT_public_key *pk, PKT_signature *sig);
+/* Check that the backsig BACKSIG from the subkey SUB_PK to its
+ primary key MAIN_PK is valid. */
int check_backsig(PKT_public_key *main_pk,PKT_public_key *sub_pk,
PKT_signature *backsig);
-int check_key_signature( KBNODE root, KBNODE node, int *is_selfsig );
+/* Check that the signature SIG over a key (e.g., a key binding or a
+ key revocation) is valid. (To check signatures over data, use
+ check_signature.) */
+int check_key_signature( KBNODE root, KBNODE sig, int *is_selfsig );
+/* Like check_key_signature, but with the ability to specify some
+ additional parameters and get back additional information. See the
+ documentation for the implementation for details. */
int check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
PKT_public_key *ret_pk, int *is_selfsig,
u32 *r_expiredate, int *r_expired );
diff --git a/g10/packet.h b/g10/packet.h
index 87671a6..2bc911d 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -638,9 +638,18 @@ int cmp_user_ids( PKT_user_id *a, PKT_user_id *b );
/*-- sig-check.c --*/
-int check_signature( PKT_signature *sig, gcry_md_hd_t digest );
-int check_signature2( PKT_signature *sig, gcry_md_hd_t digest, u32 *r_expiredate,
- int *r_expired, int *r_revoked, PKT_public_key *ret_pk );
+/* Check a signature. This is shorthand for check_signature2 with
+ the unnamed arguments passed as NULL. */
+int check_signature (PKT_signature *sig, gcry_md_hd_t digest);
+
+/* Check a signature. Looks up the public key from the key db. (If
+ RET_PK is not NULL, it is returned in *RET_PK.) DIGEST contains a
+ valid hash context that already includes the signed data. This
+ function adds the relevant meta-data to the hash before finalizing
+ it and verifying the signature. */
+int check_signature2 (PKT_signature *sig, gcry_md_hd_t digest,
+ u32 *r_expiredate, int *r_expired, int *r_revoked,
+ PKT_public_key *ret_pk);
/*-- pubkey-enc.c --*/
diff --git a/g10/sig-check.c b/g10/sig-check.c
index fe6aba9..f912c0c 100644
--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -40,18 +40,50 @@ static int check_signature_end (PKT_public_key *pk, PKT_signature *sig,
int *r_expired, int *r_revoked,
PKT_public_key *ret_pk);
-
-/****************
- * Check the signature which is contained in SIG.
- * The MD_HANDLE should be currently open, so that this function
- * is able to append some data, before finalizing the digest.
- */
+/* Check a signature. This is shorthand for check_signature2 with
+ the unnamed arguments passed as NULL. */
int
check_signature (PKT_signature *sig, gcry_md_hd_t digest)
{
return check_signature2 (sig, digest, NULL, NULL, NULL, NULL);
}
+/* Check a signature.
+
+ Looks up the public key that created the signature (SIG->KEYID)
+ from the key db. Makes sure that the signature is valid (it was
+ not created prior to the key, the public key was created in the
+ past, and the signature does not include any unsupported critical
+ features), finishes computing the hash of the signature data, and
+ checks that the signature verifies the digest. If the key that
+ generated the signature is a subkey, this function also verifies
+ that there is a valid backsig from the subkey to the primary key.
+ Finally, if status fd is enabled and the signature class is 0x00 or
+ 0x01, then a STATUS_SIG_ID is emitted on the status fd.
+
+ SIG is the signature to check.
+
+ DIGEST contains a valid hash context that already includes the
+ signed data. This function adds the relevant meta-data from the
+ signature packet to compute the final hash. (See Section 5.2 of
+ RFC 4880: "The concatenation of the data being signed and the
+ signature data from the version number through the hashed subpacket
+ data (inclusive) is hashed.")
+
+ If R_EXPIREDATE is not NULL, R_EXPIREDATE is set to the key's
+ expiry.
+
+ If R_EXPIRED is not NULL, *R_EXPIRED is set to 1 if PK has expired
+ (0 otherwise). Note: PK being expired does not cause this function
+ to fail.
+
+ If R_REVOKED is not NULL, *R_REVOKED is set to 1 if PK has been
+ revoked (0 otherwise). Note: PK being revoked does not cause this
+ function to fail.
+
+ If PK is not NULL, the public key is saved in *PK on success.
+
+ Returns 0 on success. An error code otherwise. */
int
check_signature2 (PKT_signature *sig, gcry_md_hd_t digest, u32 *r_expiredate,
int *r_expired, int *r_revoked, PKT_public_key *pk )
@@ -204,6 +236,23 @@ check_signature2 (PKT_signature *sig, gcry_md_hd_t digest, u32 *r_expiredate,
}
+/* The signature SIG was generated with the public key PK. Check
+ whether the signature is valid in the following sense:
+
+ - Make sure the public key was created before the signature was
+ generated.
+
+ - Make sure the public key was created in the past
+
+ - Check whether PK has expired (set *R_EXPIRED to 1 if so and 0
+ otherwise)
+
+ - Check whether PK has been revoked (set *R_REVOKED to 1 if so
+ and 0 otherwise).
+
+ If either of the first two tests fail, returns an error code.
+ Otherwise returns 0. (Thus, this function doesn't fail if the
+ public key is expired or revoked.) */
static int
check_signature_metadata_validity (PKT_public_key *pk, PKT_signature *sig,
int *r_expired, int *r_revoked)
@@ -268,6 +317,35 @@ check_signature_metadata_validity (PKT_public_key *pk, PKT_signature *sig,
}
+/* Finish generating a signature and check it. Concretely: make sure
+ that the signature is valid (it was not created prior to the key,
+ the public key was created in the past, and the signature does not
+ include any unsupported critical features), finish computing the
+ digest by adding the relevant data from the signature packet, and
+ check that the signature verifies the digest.
+
+ DIGEST contains a hash context, which has already hashed the signed
+ data. This function adds the relevant meta-data from the signature
+ packet to compute the final hash. (See Section 5.2 of RFC 4880:
+ "The concatenation of the data being signed and the signature data
+ from the version number through the hashed subpacket data
+ (inclusive) is hashed.")
+
+ SIG is the signature to check.
+
+ PK is the public key used to generate the signature.
+
+ If R_EXPIRED is not NULL, *R_EXPIRED is set to 1 if PK has expired
+ (0 otherwise). Note: PK being expired does not cause this function
+ to fail.
+
+ If R_REVOKED is not NULL, *R_REVOKED is set to 1 if PK has been
+ revoked (0 otherwise). Note: PK being revoked does not cause this
+ function to fail.
+
+ If RET_PK is not NULL, PK is copied into RET_PK on success.
+
+ Returns 0 on success. An error code other. */
static int
check_signature_end (PKT_public_key *pk, PKT_signature *sig,
gcry_md_hd_t digest,
@@ -330,7 +408,7 @@ check_signature_end (PKT_public_key *pk, PKT_signature *sig,
gcry_md_putc (digest, 0);
n = 6;
}
- /* add some magic */
+ /* add some magic per Section 5.2.4 of RFC 4880. */
buf[0] = sig->version;
buf[1] = 0xff;
buf[2] = n >> 24;
@@ -341,9 +419,12 @@ check_signature_end (PKT_public_key *pk, PKT_signature *sig,
}
gcry_md_final( digest );
+ /* Convert the digest to an MPI. */
result = encode_md_value (pk, digest, sig->digest_algo );
if (!result)
return GPG_ERR_GENERAL;
+
+ /* Verify the signature. */
rc = pk_verify( pk->pubkey_algo, result, sig->data, pk->pkey );
gcry_mpi_release (result);
@@ -361,7 +442,8 @@ check_signature_end (PKT_public_key *pk, PKT_signature *sig,
}
-
+/* Add a uid node to a hash context. See section 5.2.4, paragraph 4
+ of RFC 4880. */
static void
hash_uid_node( KBNODE unode, gcry_md_hd_t md, PKT_signature *sig )
{
@@ -411,24 +493,37 @@ cache_sig_result ( PKT_signature *sig, int result )
}
}
-/* Check the revocation keys to see if any of them have revoked our
- pk. sig is the revocation sig. pk is the key it is on. This code
- will need to be modified if gpg ever becomes multi-threaded. Note
- that this guarantees that a designated revocation sig will never be
- considered valid unless it is actually valid, as well as being
- issued by a revocation key in a valid direct signature. Note also
- that this is written so that a revoked revoker can still issue
- revocations: i.e. If A revokes B, but A is revoked, B is still
- revoked. I'm not completely convinced this is the proper behavior,
- but it matches how PGP does it. -dms */
-
-/* Returns 0 if sig is valid (i.e. pk is revoked), non-0 if not
- revoked. It is important that GPG_ERR_NO_PUBKEY is only returned
- when a revocation signature is from a valid revocation key
- designated in a revkey subpacket, but the revocation key itself
- isn't present. */
+/* SIG is a key revocation signature. Check if this signature was
+ generated by any of the public key PK's designated revokers.
+
+ PK is the public key that SIG allegedly revokes.
+
+ SIG is the revocation signature to check.
+
+ This function avoids infinite recursion, which can happen if two
+ keys are designed revokers for each other and they revoke each
+ other. This is done by observing that if a key A is revoked by key
+ B we still consider the revocation to be valid even if B is
+ revoked. Thus, we don't need to determine whether B is revoked to
+ determine whether A has been revoked by B, we just need to check
+ the signature.
+
+ Returns 0 if sig is valid (i.e. pk is revoked), non-0 if not
+ revoked. We are careful to make sure that GPG_ERR_NO_PUBKEY is
+ only returned when a revocation signature is from a valid
+ revocation key designated in a revkey subpacket, but the revocation
+ key itself isn't present. */
+
+/* XXX: This code will need to be modified if gpg ever becomes
+ multi-threaded. Note that this guarantees that a designated
+ revocation sig will never be considered valid unless it is actually
+ valid, as well as being issued by a revocation key in a valid
+ direct signature. Note also that this is written so that a revoked
+ revoker can still issue revocations: i.e. If A revokes B, but A is
+ revoked, B is still revoked. I'm not completely convinced this is
+ the proper behavior, but it matches how PGP does it. -dms */
int
-check_revocation_keys(PKT_public_key *pk,PKT_signature *sig)
+check_revocation_keys (PKT_public_key *pk, PKT_signature *sig)
{
static int busy=0;
int i;
@@ -437,6 +532,30 @@ check_revocation_keys(PKT_public_key *pk,PKT_signature *sig)
assert(IS_KEY_REV(sig));
assert((sig->keyid[0]!=pk->keyid[0]) || (sig->keyid[0]!=pk->keyid[1]));
+ /* Avoid infinite recursion. Consider the following:
+
+ - We want to check if A is revoked.
+
+ - C is a designated revoker for B and has revoked B.
+
+ - B is a designated revoker for A and has revoked A.
+
+ When checking if A is revoked (in merge_selfsigs_main), we
+ observe that A has a designed revoker. As such, we call this
+ function. This function sees that there is a valid revocation
+ signature, which is signed by B. It then calls check_signature()
+ to verify that the signature is good. To check the sig, we need
+ to lookup B. Looking up B means calling merge_selfsigs_main,
+ which checks whether B is revoked, which calls this function to
+ see if B was revoked by some key.
+
+ In this case, the added level of indirection doesn't hurt. It
+ just means a bit more work. However, if C == A, then we'd end up
+ in a loop. But, it doesn't make sense to look up C anyways: even
+ if B is revoked, we conservatively consider a valid revocation
+ signed by B to revoke A. Since this is the only place where this
+ type of recursion can occur, we simply cause this function to
+ fail if it is entered recursively. */
if (busy)
{
/* Return an error (i.e. not revoked), but mark the pk as
@@ -457,17 +576,22 @@ check_revocation_keys(PKT_public_key *pk,PKT_signature *sig)
else
for(i=0;i<pk->numrevkeys;i++)
{
+ /* The revoker's keyid. */
u32 keyid[2];
keyid_from_fingerprint(pk->revkey[i].fpr,MAX_FINGERPRINT_LEN,keyid);
if(keyid[0]==sig->keyid[0] && keyid[1]==sig->keyid[1])
+ /* The signature was generated by a designated revoker.
+ Verify the signature. */
{
gcry_md_hd_t md;
if (gcry_md_open (&md, sig->digest_algo, 0))
BUG ();
hash_public_key(md,pk);
+ /* Note: check_signature only checks that the signature
+ is good. It does not fail if the key is revoked. */
rc=check_signature(sig,md);
cache_sig_result(sig,rc);
gcry_md_close (md);
@@ -480,21 +604,24 @@ check_revocation_keys(PKT_public_key *pk,PKT_signature *sig)
return rc;
}
-/* Backsigs (0x19) have the same format as binding sigs (0x18), but
+/* Check that the backsig BACKSIG from the subkey SUB_PK to its
+ primary key MAIN_PK is valid.
+
+ Backsigs (0x19) have the same format as binding sigs (0x18), but
this function is simpler than check_key_signature in a few ways.
For example, there is no support for expiring backsigs since it is
questionable what such a thing actually means. Note also that the
sig cache check here, unlike other sig caches in GnuPG, is not
persistent. */
int
-check_backsig(PKT_public_key *main_pk,PKT_public_key *sub_pk,
- PKT_signature *backsig)
+check_backsig (PKT_public_key *main_pk,PKT_public_key *sub_pk,
+ PKT_signature *backsig)
{
gcry_md_hd_t md;
int rc;
/* Always check whether the algorithm is available. Although
- gcry_md_open woyuld throw an error, some libgcrypt versions will
+ gcry_md_open would throw an error, some libgcrypt versions will
print a debug message in that case too. */
if ((rc=openpgp_md_test_algo (backsig->digest_algo)))
return rc;
@@ -516,27 +643,53 @@ check_backsig(PKT_public_key *main_pk,PKT_public_key *sub_pk,
}
-/****************
- * check the signature pointed to by NODE. This is a key signature.
- * If the function detects a self-signature, it uses the PK from
- * ROOT and does not read any public key.
- */
+/* Check that a signature over a key is valid. This is a
+ specialization of check_key_signature2 with the unnamed parameters
+ passed as NULL. See the documentation for that function for more
+ details. */
int
-check_key_signature( KBNODE root, KBNODE node, int *is_selfsig )
+check_key_signature (KBNODE root, KBNODE node, int *is_selfsig)
{
- return check_key_signature2(root, node, NULL, NULL, is_selfsig, NULL, NULL );
+ return check_key_signature2 (root, node, NULL, NULL, is_selfsig, NULL, NULL);
}
-/* If check_pk is set, then use it to check the signature in node
- rather than getting it from root or the keydb. If ret_pk is set,
- fill in the public key that was used to verify the signature.
- ret_pk is only meaningful when the verification was successful. */
+/* Check that a signature over a key (e.g., a key revocation, key
+ binding, user id certification, etc.) is valid. If the function
+ detects a self-signature, it uses the public key from the specified
+ key block and does not bother looking up the key specified in the
+ signature packet.
+
+ ROOT is a keyblock.
+
+ NODE references a signature packet that appears in the keyblock
+ that should be verified.
+
+ If CHECK_PK is set, the specified key is sometimes preferred for
+ verifying signatures. See the implementation for details.
+
+ If RET_PK is not NULL, the public key that successfully verified
+ the signature is copied into *RET_PK.
+
+ If IS_SELFSIG is not NULL, *IS_SELFSIG is set to 1 if NODE is a
+ self-signature.
+
+ If R_EXPIREDATE is not NULL, *R_EXPIREDATE is set to the expiry
+ date.
+
+ If R_EXPIRED is not NULL, *R_EXPIRED is set to 1 if PK has been
+ expired (0 otherwise). Note: PK being revoked does not cause this
+ function to fail.
+
+
+ If OPT.NO_SIG_CACHE is not set, this function will first check if
+ the result of a previous verification is already cached in the
+ signature packet's data structure. */
/* TODO: add r_revoked here as well. It has the same problems as
r_expiredate and r_expired and the cache. */
int
-check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
- PKT_public_key *ret_pk, int *is_selfsig,
- u32 *r_expiredate, int *r_expired )
+check_key_signature2(KBNODE root, KBNODE node, PKT_public_key *check_pk,
+ PKT_public_key *ret_pk, int *is_selfsig,
+ u32 *r_expiredate, int *r_expired )
{
gcry_md_hd_t md;
PKT_public_key *pk;
@@ -668,6 +821,7 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
hash_public_key( md, pk );
hash_uid_node( unode, md, sig );
if( keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1] )
+ /* The primary key is the signing key. */
{
if( is_selfsig )
*is_selfsig = 1;
commit 0433e667029508d6933e8798d3d95bcdde70a7aa
Author: Neal H. Walfield <neal at g10code.com>
Date: Mon Oct 19 11:06:57 2015 +0200
gpg: Improve and regularize naming of signature checking functions.
* g10/packet.h (signature_check): Rename from this...
(check_signature): ... to this. Update users.
(signature_check2): Rename from this...
(check_signature2): ... to this. Update users.
* g10/sig-check.c (do_check): Rename from this...
(check_signature_end): ... to this. Update users.
(do_check_messages): Rename from this...
(check_signature_metadata_validity): ... to this. Update users.
--
Signed-off-by: Neal H. Walfield <neal at g10code.com>
diff --git a/g10/mainproc.c b/g10/mainproc.c
index af50987..4bf5a4e 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -873,7 +873,7 @@ do_check_sig (CTX c, kbnode_t node, int *is_selfsig,
}
else /* detached signature */
{
- /* signature_check() will enable the md. */
+ /* check_signature() will enable the md. */
if (gcry_md_open (&md, 0, 0 ))
BUG ();
}
@@ -892,7 +892,7 @@ do_check_sig (CTX c, kbnode_t node, int *is_selfsig,
else /* detached signature */
{
log_debug ("Do we really need this here?");
- /* signature_check() will enable the md*/
+ /* check_signature() will enable the md*/
if (gcry_md_open (&md, 0, 0 ))
BUG ();
if (gcry_md_open (&md2, 0, 0 ))
@@ -926,12 +926,14 @@ do_check_sig (CTX c, kbnode_t node, int *is_selfsig,
else
return GPG_ERR_SIG_CLASS;
- rc = signature_check2 (sig, md, NULL, is_expkey, is_revkey, NULL);
+ /* We only get here if we are checking the signature of a binary
+ (0x00) or text document (0x01). */
+ rc = check_signature2 (sig, md, NULL, is_expkey, is_revkey, NULL);
if (! rc)
md_good = md;
else if (gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE && md2)
{
- rc = signature_check2 (sig, md2, NULL, is_expkey, is_revkey, NULL);
+ rc = check_signature2 (sig, md2, NULL, is_expkey, is_revkey, NULL);
if (! rc)
md_good = md2;
}
diff --git a/g10/packet.h b/g10/packet.h
index 2c1b478..87671a6 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -638,8 +638,8 @@ int cmp_user_ids( PKT_user_id *a, PKT_user_id *b );
/*-- sig-check.c --*/
-int signature_check( PKT_signature *sig, gcry_md_hd_t digest );
-int signature_check2( PKT_signature *sig, gcry_md_hd_t digest, u32 *r_expiredate,
+int check_signature( PKT_signature *sig, gcry_md_hd_t digest );
+int check_signature2( PKT_signature *sig, gcry_md_hd_t digest, u32 *r_expiredate,
int *r_expired, int *r_revoked, PKT_public_key *ret_pk );
diff --git a/g10/sig-check.c b/g10/sig-check.c
index 23f42b9..fe6aba9 100644
--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -1,6 +1,7 @@
/* sig-check.c - Check a signature
* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003,
* 2004, 2006 Free Software Foundation, Inc.
+ * Copyright (C) 2015 g10 Code GmbH
*
* This file is part of GnuPG.
*
@@ -34,26 +35,25 @@
#include "options.h"
#include "pkglue.h"
+static int check_signature_end (PKT_public_key *pk, PKT_signature *sig,
+ gcry_md_hd_t digest,
+ int *r_expired, int *r_revoked,
+ PKT_public_key *ret_pk);
-
-static int do_check( PKT_public_key *pk, PKT_signature *sig,
- gcry_md_hd_t digest,
- int *r_expired, int *r_revoked, PKT_public_key *ret_pk);
-
/****************
* Check the signature which is contained in SIG.
* The MD_HANDLE should be currently open, so that this function
* is able to append some data, before finalizing the digest.
*/
int
-signature_check (PKT_signature *sig, gcry_md_hd_t digest)
+check_signature (PKT_signature *sig, gcry_md_hd_t digest)
{
- return signature_check2( sig, digest, NULL, NULL, NULL, NULL );
+ return check_signature2 (sig, digest, NULL, NULL, NULL, NULL);
}
int
-signature_check2 (PKT_signature *sig, gcry_md_hd_t digest, u32 *r_expiredate,
+check_signature2 (PKT_signature *sig, gcry_md_hd_t digest, u32 *r_expiredate,
int *r_expired, int *r_revoked, PKT_public_key *pk )
{
int rc=0;
@@ -93,14 +93,14 @@ signature_check2 (PKT_signature *sig, gcry_md_hd_t digest, u32 *r_expiredate,
if(r_expiredate)
*r_expiredate = pk->expiredate;
- rc = do_check( pk, sig, digest, r_expired, r_revoked, NULL );
+ rc = check_signature_end (pk, sig, digest, r_expired, r_revoked, NULL);
/* Check the backsig. This is a 0x19 signature from the
subkey on the primary key. The idea here is that it should
not be possible for someone to "steal" subkeys and claim
them as their own. The attacker couldn't actually use the
subkey, but they could try and claim ownership of any
- signaures issued by it. */
+ signatures issued by it. */
if(rc==0 && !pk->flags.primary && pk->flags.backsig < 2)
{
if (!pk->flags.backsig)
@@ -205,8 +205,8 @@ signature_check2 (PKT_signature *sig, gcry_md_hd_t digest, u32 *r_expiredate,
static int
-do_check_messages( PKT_public_key *pk, PKT_signature *sig,
- int *r_expired, int *r_revoked )
+check_signature_metadata_validity (PKT_public_key *pk, PKT_signature *sig,
+ int *r_expired, int *r_revoked)
{
u32 cur_time;
@@ -269,14 +269,16 @@ do_check_messages( PKT_public_key *pk, PKT_signature *sig,
static int
-do_check( PKT_public_key *pk, PKT_signature *sig, gcry_md_hd_t digest,
- int *r_expired, int *r_revoked, PKT_public_key *ret_pk )
+check_signature_end (PKT_public_key *pk, PKT_signature *sig,
+ gcry_md_hd_t digest,
+ int *r_expired, int *r_revoked, PKT_public_key *ret_pk)
{
gcry_mpi_t result = NULL;
int rc = 0;
const struct weakhash *weak;
- if( (rc=do_check_messages(pk,sig,r_expired,r_revoked)) )
+ if ((rc = check_signature_metadata_validity (pk, sig,
+ r_expired, r_revoked)))
return rc;
if (!opt.flags.allow_weak_digest_algos)
@@ -466,7 +468,7 @@ check_revocation_keys(PKT_public_key *pk,PKT_signature *sig)
if (gcry_md_open (&md, sig->digest_algo, 0))
BUG ();
hash_public_key(md,pk);
- rc=signature_check(sig,md);
+ rc=check_signature(sig,md);
cache_sig_result(sig,rc);
gcry_md_close (md);
break;
@@ -505,7 +507,7 @@ check_backsig(PKT_public_key *main_pk,PKT_public_key *sub_pk,
{
hash_public_key(md,main_pk);
hash_public_key(md,sub_pk);
- rc=do_check(sub_pk,backsig,md,NULL,NULL,NULL);
+ rc = check_signature_end (sub_pk, backsig, md, NULL, NULL, NULL);
cache_sig_result(backsig,rc);
gcry_md_close(md);
}
@@ -570,7 +572,8 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
}
/* BUG: This is wrong for non-self-sigs.. needs to be the
actual pk */
- if((rc=do_check_messages(pk,sig,r_expired,NULL)))
+ if((rc = check_signature_metadata_validity (pk, sig,
+ r_expired, NULL)))
return rc;
return sig->flags.valid? 0 : gpg_error (GPG_ERR_BAD_SIGNATURE);
}
@@ -593,7 +596,7 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
if (gcry_md_open (&md, algo, 0 ))
BUG ();
hash_public_key( md, pk );
- rc = do_check( pk, sig, md, r_expired, NULL, ret_pk );
+ rc = check_signature_end (pk, sig, md, r_expired, NULL, ret_pk);
cache_sig_result ( sig, rc );
gcry_md_close(md);
}
@@ -606,7 +609,7 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
BUG ();
hash_public_key( md, pk );
hash_public_key( md, snode->pkt->pkt.public_key );
- rc = do_check( pk, sig, md, r_expired, NULL, ret_pk );
+ rc = check_signature_end (pk, sig, md, r_expired, NULL, ret_pk);
cache_sig_result ( sig, rc );
gcry_md_close(md);
}
@@ -633,7 +636,7 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
BUG ();
hash_public_key( md, pk );
hash_public_key( md, snode->pkt->pkt.public_key );
- rc = do_check( pk, sig, md, r_expired, NULL, ret_pk );
+ rc = check_signature_end (pk, sig, md, r_expired, NULL, ret_pk);
cache_sig_result ( sig, rc );
gcry_md_close(md);
}
@@ -649,7 +652,7 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
if (gcry_md_open (&md, algo, 0 ))
BUG ();
hash_public_key( md, pk );
- rc = do_check( pk, sig, md, r_expired, NULL, ret_pk );
+ rc = check_signature_end (pk, sig, md, r_expired, NULL, ret_pk);
cache_sig_result ( sig, rc );
gcry_md_close(md);
}
@@ -668,12 +671,17 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
{
if( is_selfsig )
*is_selfsig = 1;
- rc = do_check( pk, sig, md, r_expired, NULL, ret_pk );
+ rc = check_signature_end (pk, sig, md, r_expired, NULL, ret_pk);
}
else if (check_pk)
- rc=do_check(check_pk,sig,md,r_expired,NULL,ret_pk);
+ /* The caller specified a key. Try that. */
+ rc = check_signature_end (check_pk, sig, md,
+ r_expired, NULL, ret_pk);
else
- rc=signature_check2(sig,md,r_expiredate,r_expired,NULL,ret_pk);
+ /* Look up the key. XXX: Could it be that the key is
+ not is not in this keyblock? */
+ rc = check_signature2 (sig, md, r_expiredate, r_expired,
+ NULL, ret_pk);
cache_sig_result ( sig, rc );
gcry_md_close(md);
commit 547a1b3fb881bb8581d03dbf4eacf49163eaa4b5
Author: Neal H. Walfield <neal at g10code.com>
Date: Mon Oct 19 10:51:05 2015 +0200
gpg: Mark local function as static.
* g10/tdbio.c (put_record_into_cache): Mark as static.
--
Signed-off-by: Neal H. Walfield <neal at g10code.com>
diff --git a/g10/tdbio.c b/g10/tdbio.c
index 69b9789..c7432a8 100644
--- a/g10/tdbio.c
+++ b/g10/tdbio.c
@@ -225,7 +225,7 @@ write_cache_item (CACHE_CTRL r)
*
* Returns: 0 on success or an error code.
*/
-int
+static int
put_record_into_cache (ulong recno, const char *data)
{
CACHE_CTRL r, unused;
-----------------------------------------------------------------------
Summary of changes:
g10/gpg.c | 10 +-
g10/main.h | 18 +++-
g10/mainproc.c | 10 +-
g10/packet.h | 15 ++-
g10/revoke.c | 13 ++-
g10/sig-check.c | 298 +++++++++++++++++++++++++++++++++++++++++++-------------
g10/tdbio.c | 2 +-
7 files changed, 277 insertions(+), 89 deletions(-)
hooks/post-receive
--
The GNU Privacy Guard
http://git.gnupg.org
More information about the Gnupg-commits
mailing list