RPM Package Manager, CVS Repository http://rpm5.org/cvs/ ____________________________________________________________________________
Server: rpm5.org Name: Jeff Johnson Root: /v/rpm/cvs Email: [email protected] Module: rpm Date: 30-May-2010 09:39:49 Branch: HEAD Handle: 2010053007394701 Modified files: rpm/rpmio rpmgc.c rpmgc.h rpm/tests trsa.c Log: - rsa: WIP. Summary: Revision Changes Path 2.24 +68 -68 rpm/rpmio/rpmgc.c 2.8 +6 -7 rpm/rpmio/rpmgc.h 1.10 +98 -42 rpm/tests/trsa.c ____________________________________________________________________________ patch -p0 <<'@@ .' Index: rpm/rpmio/rpmgc.c ============================================================================ $ cvs diff -u -r2.23 -r2.24 rpmgc.c --- rpm/rpmio/rpmgc.c 30 May 2010 02:15:19 -0000 2.23 +++ rpm/rpmio/rpmgc.c 30 May 2010 07:39:48 -0000 2.24 @@ -135,34 +135,35 @@ /*...@*/ { rpmgc gc = dig->impl; - gcry_error_t err; /*...@-moduncon@*/ - err = rpmgcErr(gc, "RSA gc->sig", + gc->err = rpmgcErr(gc, "RSA gc->sig", gcry_sexp_build(&gc->sig, NULL, "(sig-val (RSA (s %m)))", gc->c) ); /*...@=moduncon@*/ if (_pgp_debug < 0) rpmgcDump("gc->sig", gc->sig); /*...@-moduncon@*/ - err = rpmgcErr(gc, "RSA gc->pkey", - gcry_sexp_build(&gc->pkey, NULL, + gc->err = rpmgcErr(gc, "RSA gc->pub_key", + gcry_sexp_build(&gc->pub_key, NULL, "(public-key (RSA (n %m) (e %m)))", gc->n, gc->e) ); /*...@=moduncon@*/ if (_pgp_debug < 0) -rpmgcDump("gc->pkey", gc->pkey); +rpmgcDump("gc->pub_key", gc->pub_key); /* Verify RSA signature. */ /*...@-moduncon@*/ - err = rpmgcErr(gc, "RSA verify", - gcry_pk_verify (gc->sig, gc->hash, gc->pkey) ); + gc->err = rpmgcErr(gc, "RSA verify", + gcry_pk_verify (gc->sig, gc->hash, gc->pub_key) ); /*...@=moduncon@*/ - gcry_sexp_release(gc->pkey); gc->pkey = NULL; +#ifdef DYING + gcry_sexp_release(gc->pub_key); gc->pub_key = NULL; gcry_sexp_release(gc->hash); gc->hash = NULL; gcry_sexp_release(gc->sig); gc->sig = NULL; +#endif - return (err ? 0 : 1); + return (gc->err ? 0 : 1); } static @@ -217,33 +218,34 @@ /*...@*/ { rpmgc gc = dig->impl; - gcry_error_t err; /*...@-moduncon -noeffectuncon @*/ - err = rpmgcErr(gc, "DSA gc->sig", + gc->err = rpmgcErr(gc, "DSA gc->sig", gcry_sexp_build(&gc->sig, NULL, "(sig-val (DSA (r %m) (s %m)))", gc->r, gc->s) ); if (_pgp_debug < 0) rpmgcDump("gc->sig", gc->sig); - err = rpmgcErr(gc, "DSA gc->pkey", - gcry_sexp_build(&gc->pkey, NULL, + gc->err = rpmgcErr(gc, "DSA gc->pub_key", + gcry_sexp_build(&gc->pub_key, NULL, "(public-key (DSA (p %m) (q %m) (g %m) (y %m)))", gc->p, gc->q, gc->g, gc->y) ); if (_pgp_debug < 0) -rpmgcDump("gc->pkey", gc->pkey); +rpmgcDump("gc->pub_key", gc->pub_key); /* Verify DSA signature. */ - err = rpmgcErr(gc, "DSA verify", - gcry_pk_verify (gc->sig, gc->hash, gc->pkey) ); + gc->err = rpmgcErr(gc, "DSA verify", + gcry_pk_verify (gc->sig, gc->hash, gc->pub_key) ); - gcry_sexp_release(gc->pkey); gc->pkey = NULL; +#ifdef DYING + gcry_sexp_release(gc->pub_key); gc->pub_key = NULL; gcry_sexp_release(gc->hash); gc->hash = NULL; gcry_sexp_release(gc->sig); gc->sig = NULL; +#endif /*...@=moduncon -noeffectuncon @*/ - return (err ? 0 : 1); + return (gc->err ? 0 : 1); } static @@ -355,21 +357,20 @@ int rpmgcGenerateECDSA(/*...@unused@*/pgpDig dig) /*...@*/ { - int rc = 0; /* assume failure. */ rpmgc gc = dig->impl; - gpg_error_t err; + int rc; - err = rpmgcErr(gc, "ECDSA gc->key_spec", + gc->err = rpmgcErr(gc, "ECDSA gc->key_spec", gcry_sexp_build (&gc->key_spec, NULL, "(genkey (ECDSA (nbits %d)))", gc->nbits)); if (_pgp_debug < 0 && gc->key_spec) rpmgcDump("gc->key_spec", gc->key_spec); - if (err == 0) - err = rpmgcErr(gc, "ECDSA generate", + if (gc->err == 0) + gc->err = rpmgcErr(gc, "ECDSA generate", gcry_pk_genkey (&gc->key_pair, gc->key_spec)); if (_pgp_debug < 0 && gc->key_pair) rpmgcDump("gc->key_pair", gc->key_pair); - if (err == 0) { + if (gc->err == 0) { gc->pub_key = gcry_sexp_find_token (gc->key_pair, "public-key", 0); if (_pgp_debug < 0 && gc->pub_key) rpmgcDump("gc->pub_key", gc->pub_key); gc->sec_key = gcry_sexp_find_token (gc->key_pair, "private-key", 0); @@ -383,7 +384,7 @@ } #endif - rc = (err == 0); + rc = (gc->err == 0); if (_pgp_debug < 0) fprintf(stderr, "<-- %s(%p) rc %d\n", __FUNCTION__, dig, rc); @@ -404,7 +405,6 @@ const char * mpiname = ""; gcry_mpi_t * mpip = NULL; size_t nscan = 0; - gcry_error_t err; int rc = 0; switch (itemno) { @@ -445,7 +445,7 @@ } /*...@-moduncon -noeffectuncon @*/ - err = rpmgcErr(gc, mpiname, + gc->err = rpmgcErr(gc, mpiname, gcry_mpi_scan(mpip, GCRYMPI_FMT_PGP, p, nb, &nscan) ); /*...@=moduncon =noeffectuncon @*/ assert(nb == nscan); @@ -454,7 +454,7 @@ { unsigned nbits = gcry_mpi_get_nbits(*mpip); unsigned char * hex = NULL; size_t nhex = 0; - err = rpmgcErr(gc, "MPI print", + gc->err = rpmgcErr(gc, "MPI print", gcry_mpi_aprint(GCRYMPI_FMT_HEX, &hex, &nhex, *mpip) ); fprintf(stderr, "*** %s\t%5d:%s\n", mpiname, (int)nbits, hex); hex = _free(hex); @@ -473,34 +473,34 @@ /*...@-moduncon -noeffectuncon @*/ if (gc != NULL) { gc->nbits = 0; - if (gc->sig) { - gcry_sexp_release(gc->sig); - gc->sig = NULL; - } - if (gc->hash) { - gcry_sexp_release(gc->hash); - gc->hash = NULL; + gc->err = 0; + gc->badok = 0; + + if (gc->key_spec) { + gcry_sexp_release(gc->key_spec); + gc->key_spec = NULL; } - if (gc->pkey) { - gcry_sexp_release(gc->pkey); - gc->pkey = NULL; + if (gc->key_pair) { + gcry_sexp_release(gc->key_pair); + gc->key_pair = NULL; } - if (gc->r) { - gcry_mpi_release(gc->r); - gc->r = NULL; + if (gc->pub_key) { + gcry_sexp_release(gc->pub_key); + gc->pub_key = NULL; } - if (gc->s) { - gcry_mpi_release(gc->s); - gc->s = NULL; + if (gc->sec_key) { + gcry_sexp_release(gc->sec_key); + gc->sec_key = NULL; } - if (gc->n) { - gcry_mpi_release(gc->n); - gc->n = NULL; + if (gc->hash) { + gcry_sexp_release(gc->hash); + gc->hash = NULL; } - if (gc->e) { - gcry_mpi_release(gc->e); - gc->e = NULL; + if (gc->sig) { + gcry_sexp_release(gc->sig); + gc->sig = NULL; } + if (gc->c) { gcry_mpi_release(gc->c); gc->c = NULL; @@ -521,22 +521,24 @@ gcry_mpi_release(gc->y); gc->y = NULL; } - if (gc->key_spec) { - gcry_sexp_release(gc->key_spec); - gc->key_spec = NULL; + + if (gc->r) { + gcry_mpi_release(gc->r); + gc->r = NULL; } - if (gc->key_pair) { - gcry_sexp_release(gc->key_pair); - gc->key_pair = NULL; + if (gc->s) { + gcry_mpi_release(gc->s); + gc->s = NULL; } - if (gc->pub_key) { - gcry_sexp_release(gc->pub_key); - gc->pub_key = NULL; + if (gc->n) { + gcry_mpi_release(gc->n); + gc->n = NULL; } - if (gc->sec_key) { - gcry_sexp_release(gc->sec_key); - gc->sec_key = NULL; + if (gc->e) { + gcry_mpi_release(gc->e); + gc->e = NULL; } + gc->digest = _free(gc->digest); gc->digestlen = 0; } @@ -557,10 +559,9 @@ rpmgcClean(impl); if (--rpmgc_initialized == 0 && _pgp_debug < 0) { - gcry_error_t err; - err = rpmgcErr(gc, "CLEAR_DEBUG_FLAGS", + gc->err = rpmgcErr(gc, "CLEAR_DEBUG_FLAGS", gcry_control(GCRYCTL_CLEAR_DEBUG_FLAGS, 3)); - err = rpmgcErr(gc, "SET_VERBOSITY", + gc->err = rpmgcErr(gc, "SET_VERBOSITY", gcry_control(GCRYCTL_SET_VERBOSITY, 0) ); } @@ -577,10 +578,9 @@ rpmgc gc = xcalloc(1, sizeof(*gc)); if (rpmgc_initialized++ == 0 && _pgp_debug < 0) { - gcry_error_t err; - err = rpmgcErr(gc, "SET_VERBOSITY", + gc->err = rpmgcErr(gc, "SET_VERBOSITY", gcry_control(GCRYCTL_SET_VERBOSITY, 3) ); - err = rpmgcErr(gc, "SET_DEBUG_FLAGS", + gc->err = rpmgcErr(gc, "SET_DEBUG_FLAGS", gcry_control(GCRYCTL_SET_DEBUG_FLAGS, 3) ); } @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmgc.h ============================================================================ $ cvs diff -u -r2.7 -r2.8 rpmgc.h --- rpm/rpmio/rpmgc.h 30 May 2010 02:15:19 -0000 2.7 +++ rpm/rpmio/rpmgc.h 30 May 2010 07:39:48 -0000 2.8 @@ -27,9 +27,12 @@ gcry_error_t err; gcry_error_t badok; /* XXX trsa */ - gcry_sexp_t sig; + gcry_sexp_t key_spec; + gcry_sexp_t key_pair; + gcry_sexp_t pub_key; + gcry_sexp_t sec_key; gcry_sexp_t hash; - gcry_sexp_t pkey; + gcry_sexp_t sig; /* DSA parameters. */ gcry_mpi_t p; @@ -47,11 +50,7 @@ gcry_mpi_t e; gcry_mpi_t c; - /* ECDSA parameters */ - gcry_sexp_t key_spec; - gcry_sexp_t key_pair; - gcry_sexp_t pub_key; - gcry_sexp_t sec_key; + /* ECDSA parameters (none atm). */ void * digest; size_t digestlen; @@ . patch -p0 <<'@@ .' Index: rpm/tests/trsa.c ============================================================================ $ cvs diff -u -r1.9 -r1.10 trsa.c --- rpm/tests/trsa.c 30 May 2010 02:15:18 -0000 1.9 +++ rpm/tests/trsa.c 30 May 2010 07:39:47 -0000 1.10 @@ -257,34 +257,53 @@ /*...@*/ { rpmgc gc = dig->impl; - gcry_error_t err; + int rc; + /* Generate signature (if not present). */ + if (gc->sig == NULL && gc->c) { /*...@-moduncon@*/ - err = rpmgcErr(gc, "RSA gc->sig", + gc->err = rpmgcErr(gc, "RSA gc->sig", gcry_sexp_build(&gc->sig, NULL, "(sig-val (RSA (s %m)))", gc->c) ); + if (gc->err) + goto exit; /*...@=moduncon@*/ if (_pgp_debug < 0) rpmgcDump("gc->sig", gc->sig); /*...@-moduncon@*/ - err = rpmgcErr(gc, "RSA gc->pkey", - gcry_sexp_build(&gc->pkey, NULL, + } + + /* Generate pubkey (if not present). */ + if (gc->pub_key == NULL && gc->n && gc->e) { + gc->err = rpmgcErr(gc, "RSA gc->pub_key", + gcry_sexp_build(&gc->pub_key, NULL, "(public-key (RSA (n %m) (e %m)))", gc->n, gc->e) ); + if (gc->err) + goto exit; /*...@=moduncon@*/ if (_pgp_debug < 0) -rpmgcDump("gc->pkey", gc->pkey); +rpmgcDump("gc->pub_key", gc->pub_key); + } /* Verify RSA signature. */ /*...@-moduncon@*/ - err = rpmgcErr(gc, "RSA verify", - gcry_pk_verify (gc->sig, gc->hash, gc->pkey) ); + gc->err = rpmgcErr(gc, "RSA verify", + gcry_pk_verify (gc->sig, gc->hash, gc->pub_key) ); /*...@=moduncon@*/ - gcry_sexp_release(gc->pkey); gc->pkey = NULL; +#ifdef DYING + gcry_sexp_release(gc-pub_keypkey); gc->pub_key = NULL; gcry_sexp_release(gc->hash); gc->hash = NULL; gcry_sexp_release(gc->sig); gc->sig = NULL; +#endif + +exit: + rc = (gc->err == 0); + +if (_pgp_debug < 0) +fprintf(stderr, "<-- %s(%p) rc %d\n", __FUNCTION__, dig, rc); - return (err ? 0 : 1); + return rc; } static @@ -353,28 +372,42 @@ /*...@-moduncon -noeffectuncon @*/ - gc->err = rpmgcErr(gc, "DSA gc->sig", + /* Generate signature (if not present). */ + if (gc->sig == NULL && gc->r && gc->s) { + gc->err = rpmgcErr(gc, "DSA gc->sig", gcry_sexp_build(&gc->sig, NULL, "(sig-val (DSA (r %m) (s %m)))", gc->r, gc->s) ); if (_pgp_debug < 0) rpmgcDump("gc->sig", gc->sig); - gc->err = rpmgcErr(gc, "DSA gc->pkey", - gcry_sexp_build(&gc->pkey, NULL, + if (gc->err) + goto exit; + } + + /* Generate pubkey (if not present). */ + if (gc->pub_key == NULL && gc->p && gc->q && gc->g && gc->y) { + gc->err = rpmgcErr(gc, "DSA gc->pub_key", + gcry_sexp_build(&gc->pub_key, NULL, "(public-key (DSA (p %m) (q %m) (g %m) (y %m)))", gc->p, gc->q, gc->g, gc->y) ); + if (gc->err) + goto exit; if (_pgp_debug < 0) -rpmgcDump("gc->pkey", gc->pkey); +rpmgcDump("gc->pub_key", gc->pub_key); + } /* Verify DSA signature. */ gc->err = rpmgcErr(gc, "DSA verify", - gcry_pk_verify (gc->sig, gc->hash, gc->pkey) ); + gcry_pk_verify (gc->sig, gc->hash, gc->pub_key) ); - gcry_sexp_release(gc->pkey); gc->pkey = NULL; +#ifdef DYING + gcry_sexp_release(gc->pub_key); gc->pub_key = NULL; gcry_sexp_release(gc->hash); gc->hash = NULL; gcry_sexp_release(gc->sig); gc->sig = NULL; +#endif /*...@=moduncon -noeffectuncon @*/ +exit: rc = (gc->err == 0); if (_pgp_debug < 0) @@ -439,8 +472,8 @@ int rpmgcVerifyECDSA(/*...@unused@*/pgpDig dig) /*...@*/ { - int rc = 0; /* assume failure. */ rpmgc gc = dig->impl; + int rc; /* Verify ECDSA signature. */ gc->err = rpmgcErr(gc, "ECDSA verify", @@ -449,9 +482,9 @@ /* XXX unnecessary? */ #ifdef DYING gcry_sexp_release(gc->pub_key); gc->pub_key = NULL; -#endif gcry_sexp_release(gc->hash); gc->hash = NULL; gcry_sexp_release(gc->sig); gc->sig = NULL; +#endif rc = (gc->err == 0); @@ -1521,7 +1554,6 @@ } - static void check_ciphers(pgpDig dig) { static int algos[] = { @@ -1626,10 +1658,10 @@ pgpDigTestDigest(pgpDig dig, int algo, int flags, const char *data, int datalen, const char *expect) { - DIGEST_CTX nctx; + DIGEST_CTX nctx = NULL; DIGEST_CTX ctx; - rpmuint8_t * p; - size_t plen; + rpmuint8_t * p = NULL; + size_t plen = 0; int xx; ctx = rpmDigestInit(algo, flags); @@ -1675,6 +1707,8 @@ expected_str = _free(expected_str); } +p = _free(p); +plen = 0; xx = rpmDigestFinal(nctx, &p, &plen, 0); if (plen < 1 || plen > 500) { rpmlog(RPMLOG_ERR, "dup digest(%d) length out-of-range\n", algo, plen); @@ -1689,6 +1723,9 @@ p_str = _free(p_str); expected_str = _free(expected_str); } +p = _free(p); +plen = 0; + } static void pgpDigTestDigests(pgpDig dig) @@ -1953,10 +1990,10 @@ pgpDigTestHMAC(pgpDig dig, int algo, int flags, const char *data, int datalen, const char *key, int keylen, const char *expect) { - DIGEST_CTX nctx; + DIGEST_CTX nctx = NULL; DIGEST_CTX ctx; - rpmuint8_t * p; - size_t plen; + rpmuint8_t * p = NULL; + size_t plen = 0; int xx; ctx = rpmDigestInit(algo, flags); @@ -2004,6 +2041,8 @@ expected_str = _free(expected_str); } +p = _free(p); +plen = 0; xx = rpmDigestFinal(nctx, &p, &plen, 0); if (plen < 1 || plen > 500) { rpmlog(RPMLOG_ERR, "dup digest(%d) length out-of-range\n", algo, plen); @@ -2018,6 +2057,9 @@ p_str = _free(p_str); expected_str = _free(expected_str); } +p = _free(p); +plen = 0; + } static void pgpDigTestHMACS(pgpDig dig) @@ -2330,21 +2372,23 @@ static void verify_one_signature(pgpDig dig, gcry_sexp_t badhash) { -rpmgc gc = dig->impl; - gcry_error_t rc; + rpmgc gc = dig->impl; +gcry_sexp_t hash; +int xx; - rc = rpmgcErr(gc, "RSA verify", - gcry_pk_verify(gc->sig, gc->hash, gc->pub_key)); - if (rc) - fail("gcry_pk_verify failed: %s\n", gpg_strerror(rc)); + xx = rpmgcVerifyRSA(dig); + if (gc->err) + fail("gcry_pk_verify failed: %s\n", gpg_strerror(gc->err)); gc->badok = GPG_ERR_BAD_SIGNATURE; - rc = rpmgcErr(gc, "gcry_pk_verify(BAD)", - gcry_pk_verify(gc->sig, badhash, gc->pub_key)); +hash = gc->hash; +gc->hash = badhash; + xx = rpmgcVerifyRSA(dig); +gc->hash = hash; gc->badok = 0; - if (gcry_err_code(rc) != GPG_ERR_BAD_SIGNATURE) + if (gcry_err_code(gc->err) != GPG_ERR_BAD_SIGNATURE) fail("gcry_pk_verify failed to detect a bad signature: %s\n", - gpg_strerror(rc)); + gpg_strerror(gc->err)); } @@ -2484,40 +2528,52 @@ static void get_keys_new(pgpDig dig) { -rpmgc gc = dig->impl; - int rc; + rpmgc gc = dig->impl; rpmlog(RPMLOG_INFO, " generating RSA key:"); /* XXX FIXME: use gc->nbits */ - rc = rpmgcErr(gc, "gc->key_spec", + gc->err = rpmgcErr(gc, "gc->key_spec", gcry_sexp_new(&gc->key_spec, in_fips_mode ? "(genkey (rsa (nbits 4:1024)))" : "(genkey (rsa (nbits 4:1024)(transient-key)))", 0, 1)); - if (rc) - die("error creating S-expression: %s\n", gpg_strerror(rc)); + if (gc->err) + die("error creating S-expression: %s\n", gpg_strerror(gc->err)); - rc = rpmgcErr(gc, "gc->key_pair", + gc->err = rpmgcErr(gc, "gc->key_pair", gcry_pk_genkey(&gc->key_pair, gc->key_spec)); + +if (gc->key_spec) { gcry_sexp_release(gc->key_spec); gc->key_spec = NULL; +} - if (rc) - die("error generating RSA key: %s\n", gpg_strerror(rc)); + if (gc->err) + die("error generating RSA key: %s\n", gpg_strerror(gc->err)); +if (gc->pub_key) { + gcry_sexp_release(gc->pub_key); + gc->pub_key = NULL; +} gc->pub_key = gcry_sexp_find_token(gc->key_pair, "public-key", 0); if (gc->pub_key == NULL) die("public part missing in key\n"); +if (gc->sec_key) { + gcry_sexp_release(gc->sec_key); + gc->sec_key = NULL; +} gc->sec_key = gcry_sexp_find_token(gc->key_pair, "private-key", 0); if (gc->sec_key == NULL) die("private part missing in key\n"); +if (gc->key_pair) { gcry_sexp_release(gc->key_pair); gc->key_pair = NULL; +} } @@ . ______________________________________________________________________ RPM Package Manager http://rpm5.org CVS Sources Repository [email protected]
