RPM Package Manager, CVS Repository http://rpm5.org/cvs/ ____________________________________________________________________________
Server: rpm5.org Name: Jeff Johnson Root: /v/rpm/cvs Email: [email protected] Module: rpm Date: 01-Jun-2010 22:08:39 Branch: HEAD Handle: 2010060120083502 Modified files: rpm CHANGES rpm/rpmio librpmio.vers rpmbc.c rpmbc.h rpmgc.c rpmgc.h rpmnss.c rpmnss.h rpmpgp.c rpmpgp.h rpmssl.c rpmssl.h rpm/tests trsa.c Log: - pgp: add methods for per-implementation cipher/digest/pubkey checks. Summary: Revision Changes Path 1.3376 +3 -0 rpm/CHANGES 2.182 +1 -0 rpm/rpmio/librpmio.vers 2.23 +163 -21 rpm/rpmio/rpmbc.c 2.8 +9 -0 rpm/rpmio/rpmbc.h 2.27 +69 -7 rpm/rpmio/rpmgc.c 2.10 +3 -3 rpm/rpmio/rpmgc.h 1.32 +152 -11 rpm/rpmio/rpmnss.c 1.9 +8 -2 rpm/rpmio/rpmnss.h 2.120 +5 -2 rpm/rpmio/rpmpgp.c 2.99 +100 -0 rpm/rpmio/rpmpgp.h 2.32 +145 -8 rpm/rpmio/rpmssl.c 2.10 +9 -3 rpm/rpmio/rpmssl.h 1.20 +81 -181 rpm/tests/trsa.c ____________________________________________________________________________ patch -p0 <<'@@ .' Index: rpm/CHANGES ============================================================================ $ cvs diff -u -r1.3375 -r1.3376 CHANGES --- rpm/CHANGES 1 Jun 2010 14:55:10 -0000 1.3375 +++ rpm/CHANGES 1 Jun 2010 20:08:35 -0000 1.3376 @@ -1,4 +1,7 @@ 5.3.0 -> 5.4a1: + - jbj: pgp: add methods for per-implementation cipher/digest/pubkey checks. + - jbj: pgp: add methods for per-implementation pubkey algo dispatch. + - jbj: gc: poplate sign/generate methods. - jbj: pgp: add methods for ElGamal signatures. - jbj: hmac: fix: permit HMAC's to be clone'd (salt size was incorrect). - jbj: ssl: populate set/verify/sign/generate methods for ECDSA. @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/librpmio.vers ============================================================================ $ cvs diff -u -r2.181 -r2.182 librpmio.vers --- rpm/rpmio/librpmio.vers 23 May 2010 14:41:41 -0000 2.181 +++ rpm/rpmio/librpmio.vers 1 Jun 2010 20:08:37 -0000 2.182 @@ -222,6 +222,7 @@ pgpDigNew; pgpDigVSFlags; _pgp_debug; + _pgp_error_count; _pgp_print; pgpFindPubkey; pgpGetPubkey; @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmbc.c ============================================================================ $ cvs diff -u -r2.22 -r2.23 rpmbc.c --- rpm/rpmio/rpmbc.c 1 Jun 2010 14:55:11 -0000 2.22 +++ rpm/rpmio/rpmbc.c 1 Jun 2010 20:08:37 -0000 2.23 @@ -100,6 +100,7 @@ return rc; } +#ifdef NOTYET static int rpmbcSignRSA(/*...@unused@*/pgpDig dig) /*...@*/ @@ -117,6 +118,7 @@ return rc; } +#endif static int rpmbcSetDSA(/*...@only@*/ DIGEST_CTX ctx, pgpDig dig, pgpDigParams sigp) @@ -159,6 +161,7 @@ return rc; } +#ifdef NOTYET static int rpmbcSignDSA(/*...@unused@*/pgpDig dig) /*...@*/ @@ -176,6 +179,7 @@ return rc; } +#endif static int rpmbcSetDUMMY(/*...@only@*/ DIGEST_CTX ctx, /*...@unused@*/pgpDig dig, pgpDigParams sigp) @@ -192,6 +196,143 @@ return rc; } +static int rpmbcErrChk(pgpDig dig, const char * msg, int rc, unsigned expected) +{ +#ifdef NOTYET +rpmgc gc = dig->impl; + /* Was the return code the expected result? */ + rc = (gcry_err_code(gc->err) != expected); + if (rc) + fail("%s failed: %s\n", msg, gpg_strerror(gc->err)); +#endif +/* XXX FIXME: rpmbcStrerror */ + return rc; /* XXX 0 on success */ +} + +static int rpmbcAvailableCipher(pgpDig dig, int algo) +{ + int rc = 0; /* assume available */ +#ifdef NOTYET + rc = rpmgbcvailable(dig->impl, algo, + (gcry_md_test_algo(algo) || algo == PGPHASHALGO_MD5)); +#endif + return rc; +} + +static int rpmbcAvailableDigest(pgpDig dig, int algo) +{ + int rc = 0; /* assume available */ +#ifdef NOTYET + rc = rpmgbcvailable(dig->impl, algo, + (gcry_md_test_algo(algo) || algo == PGPHASHALGO_MD5)); +#endif + return rc; +} + +static int rpmbcAvailablePubkey(pgpDig dig, int algo) +{ + int rc = 0; /* assume available */ +#ifdef NOTYET + rc = rpmbcAvailable(dig->impl, algo, gcry_pk_test_algo(algo)); +#endif + return rc; +} + +static int rpmbcVerify(pgpDig dig) +{ + int rc = 0; /* assume failure */ +pgpDigParams pubp = pgpGetPubkey(dig); + switch (pubp->pubkey_algo) { + default: + break; + case PGPPUBKEYALGO_RSA: + rc = rpmbcVerifyRSA(dig); + break; + case PGPPUBKEYALGO_DSA: + rc = rpmbcVerifyDSA(dig); + break; + case PGPPUBKEYALGO_ELGAMAL: +#ifdef NOTYET + rc = rpmbcVerifyELG(dig); +#endif + break; + case PGPPUBKEYALGO_ECDSA: +#ifdef NOTYET + rc = rpmbcVerifyECDSA(dig); +#endif + break; + } +if (1 || _pgp_debug < 0) +fprintf(stderr, "<-- %s(%p) rc %d\t%s\n", __FUNCTION__, dig, rc, dig->pubkey_algoN); + return rc; +} + +static int rpmbcSign(pgpDig dig) +{ + int rc = 0; /* assume failure */ +pgpDigParams pubp = pgpGetPubkey(dig); + switch (pubp->pubkey_algo) { + default: + break; + case PGPPUBKEYALGO_RSA: +#ifdef NOTYET + rc = rpmbcSignRSA(dig); +#endif + break; + case PGPPUBKEYALGO_DSA: +#ifdef NOTYET + rc = rpmbcSignDSA(dig); +#endif + break; + case PGPPUBKEYALGO_ELGAMAL: +#ifdef NOTYET + rc = rpmbcSignELG(dig); +#endif + break; + case PGPPUBKEYALGO_ECDSA: +#ifdef NOTYET + rc = rpmbcSignECDSA(dig); +#endif + break; + } +if (1 || _pgp_debug < 0) +fprintf(stderr, "<-- %s(%p) rc %d\t%s\n", __FUNCTION__, dig, rc, dig->pubkey_algoN); + return rc; +} + +static int rpmbcGenerate(pgpDig dig) +{ + int rc = 0; /* assume failure */ +pgpDigParams pubp = pgpGetPubkey(dig); + switch (pubp->pubkey_algo) { + default: + break; + case PGPPUBKEYALGO_RSA: +#ifdef NOTYET + rc = rpmbcGenerateRSA(dig); +#endif + break; + case PGPPUBKEYALGO_DSA: +#ifdef NOTYET + rc = rpmbcGenerateDSA(dig); +#endif + break; + case PGPPUBKEYALGO_ELGAMAL: +#ifdef NOTYET + rc = rpmbcGenerateELG(dig); +#endif + break; + case PGPPUBKEYALGO_ECDSA: +#ifdef NOTYET + rc = rpmbcGenerateECDSA(dig); +#endif + break; + } +if (1 || _pgp_debug < 0) +fprintf(stderr, "<-- %s(%p) rc %d\t%s\n", __FUNCTION__, dig, rc, dig->pubkey_algoN); + return rc; +} + /** */ static /*...@only@*/ @@ -319,6 +460,17 @@ { rpmbc bc = impl; if (bc != NULL) { + bc->nbits = 0; + bc->err = 0; + bc->badok = 0; + bc->digest = _free(bc->digest); + bc->digestlen = 0; + + mpbfree(&bc->p); + mpbfree(&bc->q); + mpnfree(&bc->g); + mpnfree(&bc->y); + mpnfree(&bc->hm); mpnfree(&bc->r); mpnfree(&bc->s); @@ -334,23 +486,8 @@ void * rpmbcFree(/*...@only@*/ void * impl) /*...@modifies impl @*/ { - rpmbc bc = impl; - if (bc != NULL) { - mpbfree(&bc->p); - mpbfree(&bc->q); - mpnfree(&bc->g); - mpnfree(&bc->y); - mpnfree(&bc->hm); - mpnfree(&bc->r); - mpnfree(&bc->s); - - mpbfree(&bc->rsa_pk.n); - mpnfree(&bc->rsa_pk.e); - mpnfree(&bc->m); - mpnfree(&bc->c); - mpnfree(&bc->hm); - bc = _free(bc); - } + rpmbcClean(impl); + impl = _free(impl); return NULL; } @@ -363,10 +500,15 @@ } struct pgpImplVecs_s rpmbcImplVecs = { - rpmbcSetRSA, rpmbcVerifyRSA, rpmbcSignRSA, rpmbcGenerateRSA, - rpmbcSetDSA, rpmbcVerifyDSA, rpmbcSignDSA, rpmbcGenerateDSA, - rpmbcSetDUMMY, NULL, NULL, NULL, - rpmbcSetDUMMY, NULL, NULL, NULL, + rpmbcSetRSA, rpmbcVerifyRSA, rpmbcSign, rpmbcGenerate, + rpmbcSetDSA, rpmbcVerifyDSA, rpmbcSign, rpmbcGenerate, + rpmbcSetDUMMY, rpmbcVerify, rpmbcSign, rpmbcGenerate, + rpmbcSetDUMMY, rpmbcVerify, rpmbcSign, rpmbcGenerate, + + rpmbcErrChk, + rpmbcAvailableCipher, rpmbcAvailableDigest, rpmbcAvailablePubkey, + rpmbcVerify, rpmbcSign, rpmbcGenerate, + rpmbcMpiItem, rpmbcClean, rpmbcFree, rpmbcInit }; @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmbc.h ============================================================================ $ cvs diff -u -r2.7 -r2.8 rpmbc.h --- rpm/rpmio/rpmbc.h 15 Jul 2009 05:11:39 -0000 2.7 +++ rpm/rpmio/rpmbc.h 1 Jun 2010 20:08:37 -0000 2.8 @@ -41,6 +41,15 @@ */ #if defined(_RPMBC_INTERNAL) struct rpmbc_s { + int in_fips_mode; /* XXX trsa */ + int nbits; /* XXX trsa */ + int qbits; /* XXX trsa */ + int badok; /* XXX trsa */ + int err; + + void * digest; + size_t digestlen; + /* DSA parameters. */ mpbarrett p; mpbarrett q; @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmgc.c ============================================================================ $ cvs diff -u -r2.26 -r2.27 rpmgc.c --- rpm/rpmio/rpmgc.c 1 Jun 2010 16:08:32 -0000 2.26 +++ rpm/rpmio/rpmgc.c 1 Jun 2010 20:08:37 -0000 2.27 @@ -26,6 +26,16 @@ extern int _pgp_print; /*...@=redecl@*/ +static void fail(const char *format, ...) +{ + va_list arg_ptr; + + va_start(arg_ptr, format); + vfprintf(stderr, format, arg_ptr); + va_end(arg_ptr); + _pgp_error_count++; +} + static void rpmgcDump(const char * msg, gcry_sexp_t sexp) /*...@*/ @@ -403,6 +413,53 @@ return rc; } +static int rpmgcErrChk(pgpDig dig, const char * msg, int rc, unsigned expected) +{ +rpmgc gc = dig->impl; + /* Was the return code the expected result? */ + rc = (gcry_err_code(gc->err) != expected); + if (rc) + fail("%s failed: %s\n", msg, gpg_strerror(gc->err)); +/* XXX FIXME: pgpImplStrerror */ + return rc; /* XXX 0 on success */ +} + +static int rpmgcAvailable(rpmgc gc, int algo, int rc) +{ + /* Permit non-certified algo's if not in FIPS mode. */ + if (rc && !gc->in_fips_mode) + rc = 0; +#ifdef NOTNOW + if (rc) + rpmlog(RPMLOG_INFO," algorithm %d not available in fips mode\n", algo); +#else +/* XXX FIXME: refactor back into trsa.c */ + if (rc) + fprintf(stderr," algorithm %d not available in fips mode\n", algo); +#endif + return rc; /* XXX 0 on success */ +} + +static int rpmgcAvailableCipher(pgpDig dig, int algo) +{ + return rpmgcAvailable(dig->impl, algo, gcry_cipher_test_algo(algo)); +} + +static int rpmgcAvailableDigest(pgpDig dig, int algo) +{ + int rc = 0; /* assume available */ + rc = rpmgcAvailable(dig->impl, algo, + (gcry_md_test_algo(algo) || algo == PGPHASHALGO_MD5)); + return rc; +} + +static int rpmgcAvailablePubkey(pgpDig dig, int algo) +{ + int rc = 0; /* assume available */ + rc = rpmgcAvailable(dig->impl, algo, gcry_pk_test_algo(algo)); + return rc; +} + static int rpmgcVerify(pgpDig dig) { @@ -583,9 +640,11 @@ rpmgc gc = impl; /*...@-moduncon -noeffectuncon @*/ if (gc != NULL) { - gc->nbits = 0; - gc->err = 0; - gc->badok = 0; + gc->nbits = 0; + gc->err = 0; + gc->badok = 0; + gc->digest = _free(gc->digest); + gc->digestlen = 0; if (gc->key_spec) { gcry_sexp_release(gc->key_spec); @@ -650,8 +709,6 @@ gc->e = NULL; } - gc->digest = _free(gc->digest); - gc->digestlen = 0; } /*...@=moduncon =noeffectuncon @*/ } @@ -665,18 +722,18 @@ /*...@globals rpmgc_initialized @*/ /*...@modifies impl, rpmgc_initialized @*/ { - rpmgc gc = impl; rpmgcClean(impl); if (--rpmgc_initialized == 0 && _pgp_debug < 0) { + rpmgc gc = impl; gc->err = rpmgcErr(gc, "CLEAR_DEBUG_FLAGS", gcry_control(GCRYCTL_CLEAR_DEBUG_FLAGS, 3)); gc->err = rpmgcErr(gc, "SET_VERBOSITY", gcry_control(GCRYCTL_SET_VERBOSITY, 0) ); } - gc = _free(gc); + impl = _free(impl); return NULL; } @@ -703,6 +760,11 @@ rpmgcSetDSA, rpmgcVerifyDSA, rpmgcSign, rpmgcGenerate, rpmgcSetELG, rpmgcVerify, rpmgcSign, rpmgcGenerate, rpmgcSetECDSA, rpmgcVerifyECDSA, rpmgcSignECDSA, rpmgcGenerateECDSA, + + rpmgcErrChk, + rpmgcAvailableCipher, rpmgcAvailableDigest, rpmgcAvailablePubkey, + rpmgcVerify, rpmgcSign, rpmgcGenerate, + rpmgcMpiItem, rpmgcClean, rpmgcFree, rpmgcInit }; @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmgc.h ============================================================================ $ cvs diff -u -r2.9 -r2.10 rpmgc.h --- rpm/rpmio/rpmgc.h 31 May 2010 21:13:27 -0000 2.9 +++ rpm/rpmio/rpmgc.h 1 Jun 2010 20:08:37 -0000 2.10 @@ -29,6 +29,9 @@ gcry_error_t badok; /* XXX trsa */ gcry_error_t err; + void * digest; + size_t digestlen; + gcry_sexp_t key_spec; /* XXX private to Generate? */ gcry_sexp_t key_pair; /* XXX private to Generate? */ @@ -55,9 +58,6 @@ /* ECDSA parameters (none atm). */ - void * digest; - size_t digestlen; - }; #endif @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmnss.c ============================================================================ $ cvs diff -u -r1.31 -r1.32 rpmnss.c --- rpm/rpmio/rpmnss.c 1 Jun 2010 14:55:12 -0000 1.31 +++ rpm/rpmio/rpmnss.c 1 Jun 2010 20:08:37 -0000 1.32 @@ -198,6 +198,141 @@ return (rc == SECSuccess); } +static int rpmnssErrChk(pgpDig dig, const char * msg, int rc, unsigned expected) +{ +#ifdef NOTYET +rpmgc gc = dig->impl; + /* Was the return code the expected result? */ + rc = (gcry_err_code(gc->err) != expected); + if (rc) + fail("%s failed: %s\n", msg, gpg_strerror(gc->err)); +#endif +/* XXX FIXME: rpmnssStrerror */ + return rc; /* XXX 0 on success */ +} + +static int rpmnssAvailableCipher(pgpDig dig, int algo) +{ + int rc = 0; /* assume available */ +#ifdef NOTYET + rc = rpmgnssvailable(dig->impl, algo, + (gcry_md_test_algo(algo) || algo == PGPHASHALGO_MD5)); +#endif + return rc; +} + +static int rpmnssAvailableDigest(pgpDig dig, int algo) +{ + int rc = 0; /* assume available */ +#ifdef NOTYET + rc = rpmgnssvailable(dig->impl, algo, + (gcry_md_test_algo(algo) || algo == PGPHASHALGO_MD5)); +#endif + return rc; +} + +static int rpmnssAvailablePubkey(pgpDig dig, int algo) +{ + int rc = 0; /* assume available */ +#ifdef NOTYET + rc = rpmnssAvailable(dig->impl, algo, gcry_pk_test_algo(algo)); +#endif + return rc; +} + +static int rpmnssVerify(pgpDig dig) +{ + int rc = 0; /* assume failure */ +pgpDigParams pubp = pgpGetPubkey(dig); + switch (pubp->pubkey_algo) { + default: + break; + case PGPPUBKEYALGO_RSA: + rc = rpmnssVerifyRSA(dig); + break; + case PGPPUBKEYALGO_DSA: + rc = rpmnssVerifyDSA(dig); + break; + case PGPPUBKEYALGO_ELGAMAL: +#ifdef NOTYET + rc = rpmnssVerifyELG(dig); +#endif + break; + case PGPPUBKEYALGO_ECDSA: + rc = rpmnssVerifyECDSA(dig); + break; + } +if (1 || _pgp_debug < 0) +fprintf(stderr, "<-- %s(%p) rc %d\t%s\n", __FUNCTION__, dig, rc, dig->pubkey_algoN); + return rc; +} + +static int rpmnssSign(pgpDig dig) +{ + int rc = 0; /* assume failure */ +pgpDigParams pubp = pgpGetPubkey(dig); + switch (pubp->pubkey_algo) { + default: + break; + case PGPPUBKEYALGO_RSA: +#ifdef NOTYET + rc = rpmnssSignRSA(dig); +#endif + break; + case PGPPUBKEYALGO_DSA: +#ifdef NOTYET + rc = rpmnssSignDSA(dig); +#endif + break; + case PGPPUBKEYALGO_ELGAMAL: +#ifdef NOTYET + rc = rpmnssSignELG(dig); +#endif + break; + case PGPPUBKEYALGO_ECDSA: +#ifdef NOTYET + rc = rpmnssSignECDSA(dig); +#endif + break; + } +if (1 || _pgp_debug < 0) +fprintf(stderr, "<-- %s(%p) rc %d\t%s\n", __FUNCTION__, dig, rc, dig->pubkey_algoN); + return rc; +} + +static int rpmnssGenerate(pgpDig dig) +{ + int rc = 0; /* assume failure */ +pgpDigParams pubp = pgpGetPubkey(dig); + switch (pubp->pubkey_algo) { + default: + break; + case PGPPUBKEYALGO_RSA: +#ifdef NOTYET + rc = rpmnssGenerateRSA(dig); +#endif + break; + case PGPPUBKEYALGO_DSA: +#ifdef NOTYET + rc = rpmnssGenerateDSA(dig); +#endif + break; + case PGPPUBKEYALGO_ELGAMAL: +#ifdef NOTYET + rc = rpmnssGenerateELG(dig); +#endif + break; + case PGPPUBKEYALGO_ECDSA: +#ifdef NOTYET + rc = rpmnssGenerateECDSA(dig); +#endif + break; + } +if (1 || _pgp_debug < 0) +fprintf(stderr, "<-- %s(%p) rc %d\t%s\n", __FUNCTION__, dig, rc, dig->pubkey_algoN); + return rc; +} + /** * @return 0 on success */ @@ -435,6 +570,12 @@ rpmnss nss = impl; /*...@-moduncon@*/ if (nss != NULL) { + nss->nbits = 0; + nss->err = 0; + nss->badok = 0; + nss->digest = _free(nss->digest); + nss->digestlen = 0; + if (nss->dsa != NULL) { SECKEY_DestroyPublicKey(nss->dsa); nss->dsa = NULL; @@ -467,8 +608,6 @@ SECITEM_ZfreeItem(nss->ecdsasig, PR_TRUE); nss->ecdsasig = NULL; } - nss->digest = _free(nss->digest); - nss->digestlen = 0; /*...@=moduncon@*/ } } @@ -478,11 +617,8 @@ void * rpmnssFree(/*...@only@*/ void * impl) /*...@*/ { - rpmnss nss = impl; - if (nss != NULL) { - rpmnssClean(impl); - nss = _free(nss); - } + rpmnssClean(impl); + impl = _free(impl); return NULL; } @@ -502,10 +638,15 @@ } struct pgpImplVecs_s rpmnssImplVecs = { - rpmnssSetRSA, rpmnssVerifyRSA, NULL, NULL, - rpmnssSetDSA, rpmnssVerifyDSA, NULL, NULL, - rpmnssSetELG, NULL, NULL, NULL, - rpmnssSetECDSA, rpmnssVerifyECDSA, NULL, NULL, + rpmnssSetRSA, rpmnssVerifyRSA, rpmnssSign, rpmnssGenerate, + rpmnssSetDSA, rpmnssVerifyDSA, rpmnssSign, rpmnssGenerate, + rpmnssSetELG, rpmnssVerify, rpmnssSign, rpmnssGenerate, + rpmnssSetECDSA, rpmnssVerifyECDSA, rpmnssSign, rpmnssGenerate, + + rpmnssErrChk, + rpmnssAvailableCipher, rpmnssAvailableDigest, rpmnssAvailablePubkey, + rpmnssVerify, rpmnssSign, rpmnssGenerate, + rpmnssMpiItem, rpmnssClean, rpmnssFree, rpmnssInit }; @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmnss.h ============================================================================ $ cvs diff -u -r1.8 -r1.9 rpmnss.h --- rpm/rpmio/rpmnss.h 28 May 2010 21:48:58 -0000 1.8 +++ rpm/rpmio/rpmnss.h 1 Jun 2010 20:08:37 -0000 1.9 @@ -27,6 +27,14 @@ */ #if defined(_RPMNSS_INTERNAL) struct rpmnss_s { + int in_fips_mode; /* XXX trsa */ + int nbits; /* XXX trsa */ + int qbits; /* XXX trsa */ + int badok; /* XXX trsa */ + int err; + + void * digest; + size_t digestlen; SECOidTag sigalg; SECItem item; @@ -46,8 +54,6 @@ SECKEYPublicKey * ecdsa; SECItem * ecdsasig; - void * digest; - size_t digestlen; }; #endif @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmpgp.c ============================================================================ $ cvs diff -u -r2.119 -r2.120 rpmpgp.c --- rpm/rpmio/rpmpgp.c 31 May 2010 21:13:27 -0000 2.119 +++ rpm/rpmio/rpmpgp.c 1 Jun 2010 20:08:37 -0000 2.120 @@ -23,10 +23,13 @@ /*...@access rpmiob @*/ /*...@unchecked@*/ -int _pgp_debug = 0; +int _pgp_debug; /*...@unchecked@*/ -int _pgp_print = 0; +int _pgp_print; + +/*...@unchecked@*/ +int _pgp_error_count; /*...@unchecked@*/ pgpImplVecs_t * pgpImplVecs = @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmpgp.h ============================================================================ $ cvs diff -u -r2.98 -r2.99 rpmpgp.h --- rpm/rpmio/rpmpgp.h 1 Jun 2010 14:55:12 -0000 2.98 +++ rpm/rpmio/rpmpgp.h 1 Jun 2010 20:08:37 -0000 2.99 @@ -18,6 +18,9 @@ #if defined(_RPMPGP_INTERNAL) #include <rpmsw.h> +/*...@unchecked@*/ +extern int _pgp_error_count; + /** \ingroup rpmpgp * Values parsed from OpenPGP signature/pubkey packet(s). */ @@ -1654,6 +1657,16 @@ /** */ +typedef int (*pgpImplErrChk_t) (pgpDig dig, const char * msg, int rc, unsigned expected) + /*...@*/; + +/** + */ +typedef int (*pgpImplAvailable_t) (pgpDig dig, int algo) + /*...@*/; + +/** + */ typedef int (*pgpImplGenerate_t) (pgpDig dig) /*...@*/; @@ -1709,6 +1722,16 @@ pgpImplVerify_t _pgpVerifyECDSA; pgpImplSign_t _pgpSignECDSA; pgpImplGenerate_t _pgpGenerateECDSA; + + pgpImplErrChk_t _pgpErrChk; + pgpImplAvailable_t _pgpAvailableCipher; + pgpImplAvailable_t _pgpAvailableDigest; + pgpImplAvailable_t _pgpAvailablePubkey; + + pgpImplVerify_t _pgpVerify; + pgpImplSign_t _pgpSign; + pgpImplGenerate_t _pgpGenerate; + pgpImplMpiItem_t _pgpMpiItem; pgpImplClean_t _pgpClean; pgpImplFree_t _pgpFree; @@ -1892,6 +1915,83 @@ /** */ /*...@unused@*/ static inline +int pgpImplErrChk(pgpDig dig, const char * msg, int rc, unsigned expected) + /*...@*/ +{ + return (pgpImplVecs->_pgpErrChk + ? (*pgpImplVecs->_pgpErrChk) (dig, msg, rc, expected) + : rc); +} + +/** + */ +/*...@unused@*/ static inline +int pgpImplAvailableCipher(pgpDig dig, int algo) + /*...@*/ +{ + return (pgpImplVecs->_pgpAvailableCipher + ? (*pgpImplVecs->_pgpAvailableCipher) (dig, algo) + : 0); +} + +/** + */ +/*...@unused@*/ static inline +int pgpImplAvailableDigest(pgpDig dig, int algo) + /*...@*/ +{ + return (pgpImplVecs->_pgpAvailableDigest + ? (*pgpImplVecs->_pgpAvailableDigest) (dig, algo) + : 0); +} + +/** + */ +/*...@unused@*/ static inline +int pgpImplAvailablePubkey(pgpDig dig, int algo) + /*...@*/ +{ + return (pgpImplVecs->_pgpAvailablePubkey + ? (*pgpImplVecs->_pgpAvailablePubkey) (dig, algo) + : 0); +} + +/** + */ +/*...@unused@*/ static inline +int pgpImplVerify(pgpDig dig) + /*...@*/ +{ + return (pgpImplVecs->_pgpVerify + ? (*pgpImplVecs->_pgpVerify) (dig) + : 0); +} + +/** + */ +/*...@unused@*/ static inline +int pgpImplSign(pgpDig dig) + /*...@*/ +{ + return (pgpImplVecs->_pgpSign + ? (*pgpImplVecs->_pgpSign) (dig) + : 0); +} + +/** + */ +/*...@unused@*/ static inline +int pgpImplGenerate(pgpDig dig) + /*...@*/ +{ + return (pgpImplVecs->_pgpGenerate + ? (*pgpImplVecs->_pgpGenerate) (dig) + : 0); +} + +/** + */ +/*...@unused@*/ static inline int pgpImplMpiItem(const char * pre, pgpDig dig, int itemno, const rpmuint8_t * p, /*...@null@*/ const rpmuint8_t * pend) /*...@modifies dig @*/ @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmssl.c ============================================================================ $ cvs diff -u -r2.31 -r2.32 rpmssl.c --- rpm/rpmio/rpmssl.c 1 Jun 2010 14:55:12 -0000 2.31 +++ rpm/rpmio/rpmssl.c 1 Jun 2010 20:08:37 -0000 2.32 @@ -326,6 +326,137 @@ return rc; } +static int rpmsslErrChk(pgpDig dig, const char * msg, int rc, unsigned expected) +{ +#ifdef NOTYET +rpmgc gc = dig->impl; + /* Was the return code the expected result? */ + rc = (gcry_err_code(gc->err) != expected); + if (rc) + fail("%s failed: %s\n", msg, gpg_strerror(gc->err)); +#endif +/* XXX FIXME: rpmsslStrerror */ + return rc; /* XXX 0 on success */ +} + +static int rpmsslAvailableCipher(pgpDig dig, int algo) +{ + int rc = 0; /* assume available */ +#ifdef NOTYET + rc = rpmgsslvailable(dig->impl, algo, + (gcry_md_test_algo(algo) || algo == PGPHASHALGO_MD5)); +#endif /* _RPMGC_INTERNAL */ + return rc; +} + +static int rpmsslAvailableDigest(pgpDig dig, int algo) +{ + int rc = 0; /* assume available */ +#ifdef NOTYET + rc = rpmgsslvailable(dig->impl, algo, + (gcry_md_test_algo(algo) || algo == PGPHASHALGO_MD5)); +#endif /* _RPMGC_INTERNAL */ + return rc; +} + +static int rpmsslAvailablePubkey(pgpDig dig, int algo) +{ + int rc = 0; /* assume available */ +#ifdef NOTYET + rc = rpmsslAvailable(dig->impl, algo, gcry_pk_test_algo(algo)); +#endif /* _RPMGC_INTERNAL */ + return rc; +} + +static int rpmsslVerify(pgpDig dig) +{ + int rc = 0; /* assume failure */ +pgpDigParams pubp = pgpGetPubkey(dig); + switch (pubp->pubkey_algo) { + default: + break; + case PGPPUBKEYALGO_RSA: + rc = rpmsslVerifyRSA(dig); + break; + case PGPPUBKEYALGO_DSA: + rc = rpmsslVerifyDSA(dig); + break; + case PGPPUBKEYALGO_ELGAMAL: +#ifdef NOTYET + rc = rpmsslVerifyELG(dig); +#endif + break; + case PGPPUBKEYALGO_ECDSA: + rc = rpmsslVerifyECDSA(dig); + break; + } +if (1 || _pgp_debug < 0) +fprintf(stderr, "<-- %s(%p) rc %d\t%s\n", __FUNCTION__, dig, rc, dig->pubkey_algoN); + return rc; +} + +static int rpmsslSign(pgpDig dig) +{ + int rc = 0; /* assume failure */ +pgpDigParams pubp = pgpGetPubkey(dig); + switch (pubp->pubkey_algo) { + default: + break; + case PGPPUBKEYALGO_RSA: +#ifdef NOTYET + rc = rpmsslSignRSA(dig); +#endif + break; + case PGPPUBKEYALGO_DSA: +#ifdef NOTYET + rc = rpmsslSignDSA(dig); +#endif + break; + case PGPPUBKEYALGO_ELGAMAL: +#ifdef NOTYET + rc = rpmsslSignELG(dig); +#endif + break; + case PGPPUBKEYALGO_ECDSA: + rc = rpmsslSignECDSA(dig); + break; + } +if (1 || _pgp_debug < 0) +fprintf(stderr, "<-- %s(%p) rc %d\t%s\n", __FUNCTION__, dig, rc, dig->pubkey_algoN); + return rc; +} + +static int rpmsslGenerate(pgpDig dig) +{ + int rc = 0; /* assume failure */ +pgpDigParams pubp = pgpGetPubkey(dig); + switch (pubp->pubkey_algo) { + default: + break; + case PGPPUBKEYALGO_RSA: +#ifdef NOTYET + rc = rpmsslGenerateRSA(dig); +#endif + break; + case PGPPUBKEYALGO_DSA: +#ifdef NOTYET + rc = rpmsslGenerateDSA(dig); +#endif + break; + case PGPPUBKEYALGO_ELGAMAL: +#ifdef NOTYET + rc = rpmsslGenerateELG(dig); +#endif + break; + case PGPPUBKEYALGO_ECDSA: + rc = rpmsslGenerateECDSA(dig); + break; + } +if (1 || _pgp_debug < 0) +fprintf(stderr, "<-- %s(%p) rc %d\t%s\n", __FUNCTION__, dig, rc, dig->pubkey_algoN); + return rc; +} + static int rpmsslMpiItem(/*...@unused@*/ const char * pre, pgpDig dig, int itemno, const rpmuint8_t * p, @@ -393,6 +524,11 @@ rpmssl ssl = impl; /*...@-moduncon@*/ if (ssl != NULL) { + ssl->nbits = 0; + ssl->err = 0; + ssl->badok = 0; + ssl->digest = _free(ssl->digest); + ssl->digestlen = 0; if (ssl->dsa) DSA_free(ssl->dsa); @@ -415,9 +551,6 @@ ECDSA_SIG_free(ssl->ecdsasig); ssl->ecdsasig = NULL; - ssl->digest = _free(ssl->digest); - ssl->digestlen = 0; - /* XXX tecdsa only */ if (ssl->r) BN_free(ssl->r); @@ -439,9 +572,8 @@ void * rpmsslFree(/*...@only@*/ void * impl) /*...@modifies impl @*/ { - rpmssl ssl = impl; rpmsslClean(impl); - ssl = _free(ssl); + impl = _free(impl); return NULL; } @@ -457,10 +589,15 @@ } struct pgpImplVecs_s rpmsslImplVecs = { - rpmsslSetRSA, rpmsslVerifyRSA, NULL, NULL, - rpmsslSetDSA, rpmsslVerifyDSA, NULL, NULL, - rpmsslSetELG, NULL, NULL, NULL, + rpmsslSetRSA, rpmsslVerifyRSA, rpmsslSign, rpmsslGenerate, + rpmsslSetDSA, rpmsslVerifyDSA, rpmsslSign, rpmsslGenerate, + rpmsslSetELG, rpmsslVerify, rpmsslSign, rpmsslGenerate, rpmsslSetECDSA, rpmsslVerifyECDSA, rpmsslSignECDSA, rpmsslGenerateECDSA, + + rpmsslErrChk, + rpmsslAvailableCipher, rpmsslAvailableDigest, rpmsslAvailablePubkey, + rpmsslVerify, rpmsslSign, rpmsslGenerate, + rpmsslMpiItem, rpmsslClean, rpmsslFree, rpmsslInit }; @@ . patch -p0 <<'@@ .' Index: rpm/rpmio/rpmssl.h ============================================================================ $ cvs diff -u -r2.9 -r2.10 rpmssl.h --- rpm/rpmio/rpmssl.h 26 May 2010 13:33:03 -0000 2.9 +++ rpm/rpmio/rpmssl.h 1 Jun 2010 20:08:37 -0000 2.10 @@ -26,6 +26,15 @@ */ #if defined(_RPMSSL_INTERNAL) struct rpmssl_s { + int in_fips_mode; /* XXX trsa */ + int nbits; /* XXX trsa */ + int qbits; /* XXX trsa */ + int badok; /* XXX trsa */ + int err; + + void * digest; + size_t digestlen; + BIO * out; /* XXX tecdsa */ EC_builtin_curve * curves; /* XXX tecdsa */ size_t ncurves; @@ -47,9 +56,6 @@ EC_KEY * ecdsakey; ECDSA_SIG * ecdsasig; - void * digest; - size_t digestlen; - BIGNUM * r; /* XXX tecdsa */ BIGNUM * s; /* XXX tecdsa */ }; @@ . patch -p0 <<'@@ .' Index: rpm/tests/trsa.c ============================================================================ $ cvs diff -u -r1.19 -r1.20 trsa.c --- rpm/tests/trsa.c 1 Jun 2010 16:08:32 -0000 1.19 +++ rpm/tests/trsa.c 1 Jun 2010 20:08:36 -0000 1.20 @@ -205,8 +205,6 @@ const unsigned char grip[20]; } AFKP_t; -static int error_count; - static void fail(const char *format, ...) { va_list arg_ptr; @@ -214,7 +212,7 @@ va_start(arg_ptr, format); vfprintf(stderr, format, arg_ptr); va_end(arg_ptr); - error_count++; + _pgp_error_count++; } static void die(const char *format, ...) @@ -229,8 +227,12 @@ #define MAX_DATA_LEN 100 +/*==============================================================*/ + +#if defined(_RPMGC_INTERNAL) + static void -progress_handler(void *cb_data, const char *what, int printchar, +rpmgcProgress(void *cb_data, const char *what, int printchar, int current, int total) { (void) cb_data; @@ -245,10 +247,6 @@ fflush(stdout); } -/*==============================================================*/ - -#if defined(_RPMGC_INTERNAL) - static void rpmgcDump(const char * msg, gcry_sexp_t sexp) /*...@*/ @@ -275,41 +273,6 @@ return err; } -static int rpmgcErrChk(rpmgc gc, const char * msg, int rc, unsigned expected) -{ - /* Was the return code the expected result? */ - rc = (gcry_err_code(gc->err) != expected); - if (rc) - fail("%s failed: %s\n", msg, gpg_strerror(gc->err)); - return rc; /* XXX 0 on success */ -} - -static int rpmgcAvailable(rpmgc gc, int algo, int rc) -{ - /* Permit non-certified algo's if not in FIPS mode. */ - if (rc && !gc->in_fips_mode) - rc = 0; - if (rc) - rpmlog(RPMLOG_INFO," algorithm %d not available in fips mode\n", algo); - return rc; /* XXX 0 on success */ -} - -static int rpmgcAvailableCipher(pgpDig dig, int algo) -{ - return rpmgcAvailable(dig->impl, algo, gcry_cipher_test_algo(algo)); -} - -static int rpmgcAvailableDigest(pgpDig dig, int algo) -{ - return rpmgcAvailable(dig->impl, algo, - (gcry_md_test_algo(algo) || algo == PGPHASHALGO_MD5)); -} - -static int rpmgcAvailablePubkey(pgpDig dig, int algo) -{ - return rpmgcAvailable(dig->impl, algo, gcry_pk_test_algo(algo)); -} - static int rpmgcSetRSA(/*...@only@*/ DIGEST_CTX ctx, pgpDig dig, pgpDigParams sigp) /*...@modifies dig @*/ @@ -536,83 +499,6 @@ /*==============================================================*/ -static int pgpImplVerify(pgpDig dig) -{ - int rc = 0; /* assume failure */ -pgpDigParams pubp = pgpGetPubkey(dig); - switch (pubp->pubkey_algo) { - default: - break; - case PGPPUBKEYALGO_RSA: - rc = pgpImplVerifyRSA(dig); - break; - case PGPPUBKEYALGO_DSA: - rc = pgpImplVerifyDSA(dig); - break; - case PGPPUBKEYALGO_ELGAMAL: - rc = pgpImplVerifyELG(dig); - break; - case PGPPUBKEYALGO_ECDSA: - rc = pgpImplVerifyECDSA(dig); - break; - } -if (1 || _pgp_debug < 0) -fprintf(stderr, "<-- %s(%p) rc %d\t%s\n", __FUNCTION__, dig, rc, dig->pubkey_algoN); - return rc; -} - -static int pgpImplSign(pgpDig dig) -{ - int rc = 0; /* assume failure */ -pgpDigParams pubp = pgpGetPubkey(dig); - switch (pubp->pubkey_algo) { - default: - break; - case PGPPUBKEYALGO_RSA: - rc = pgpImplSignRSA(dig); - break; - case PGPPUBKEYALGO_DSA: - rc = pgpImplSignDSA(dig); - break; - case PGPPUBKEYALGO_ELGAMAL: - rc = pgpImplSignELG(dig); - break; - case PGPPUBKEYALGO_ECDSA: - rc = pgpImplSignECDSA(dig); - break; - } -if (1 || _pgp_debug < 0) -fprintf(stderr, "<-- %s(%p) rc %d\t%s\n", __FUNCTION__, dig, rc, dig->pubkey_algoN); - return rc; -} - -static int pgpImplGenerate(pgpDig dig) -{ - int rc = 0; /* assume failure */ -pgpDigParams pubp = pgpGetPubkey(dig); - switch (pubp->pubkey_algo) { - default: - break; - case PGPPUBKEYALGO_RSA: - rc = pgpImplGenerateRSA(dig); - break; - case PGPPUBKEYALGO_DSA: - rc = pgpImplGenerateDSA(dig); - break; - case PGPPUBKEYALGO_ELGAMAL: - rc = pgpImplGenerateELG(dig); - break; - case PGPPUBKEYALGO_ECDSA: - rc = pgpImplGenerateECDSA(dig); - break; - } -if (1 || _pgp_debug < 0) -fprintf(stderr, "<-- %s(%p) rc %d\t%s\n", __FUNCTION__, dig, rc, dig->pubkey_algoN); - return rc; -} - -/*==============================================================*/ - #if defined(_RPMGC_INTERNAL) static void check_cbc_mac_cipher(pgpDig dig) @@ -649,7 +535,7 @@ for (i = 0; i < sizeof(tv) / sizeof(tv[0]); i++) { /* Lookup & FIPS check. */ - if (rpmgcAvailableCipher(dig, tv[i].algo)) + if (pgpImplAvailableCipher(dig, tv[i].algo)) continue; err = gcry_cipher_open(&hd, @@ -1611,7 +1497,7 @@ for (i = 0; algos[i]; i++) { /* Lookup & FIPS check. */ - if (rpmgcAvailableCipher(dig, algos[i])) + if (pgpImplAvailableCipher(dig, algos[i])) continue; rpmlog(RPMLOG_INFO, " checking %s [%i]\n", @@ -1629,7 +1515,7 @@ for (i = 0; algos2[i]; i++) { - if (rpmgcAvailableCipher(dig, algos[i])) + if (pgpImplAvailableCipher(dig, algos[i])) continue; rpmlog(RPMLOG_INFO, " checking `%s'\n", @@ -1662,7 +1548,7 @@ /*==============================================================*/ static void -pgpDigTestDigest(pgpDig dig, int algo, int flags, +pgpTestDigest(pgpDig dig, int algo, int flags, const char *data, int datalen, const char *expect) { DIGEST_CTX nctx = NULL; @@ -1735,7 +1621,7 @@ } -static void pgpDigTestDigests(pgpDig dig) +static void pgpTestDigests(pgpDig dig) { static struct algos { int md; @@ -1980,10 +1866,10 @@ for (i = 0; algos[i].md; i++) { /* Lookup & FIPS check. */ - if (rpmgcAvailableDigest(dig, algos[i].md)) + if (pgpImplAvailableDigest(dig, algos[i].md)) continue; - pgpDigTestDigest(dig, algos[i].md, 0, + pgpTestDigest(dig, algos[i].md, 0, algos[i].data, strlen(algos[i].data), algos[i].expect); } @@ -1992,7 +1878,7 @@ } static void -pgpDigTestHMAC(pgpDig dig, int algo, int flags, const char *data, int datalen, +pgpTestHMAC(pgpDig dig, int algo, int flags, const char *data, int datalen, const char *key, int keylen, const char *expect) { DIGEST_CTX nctx = NULL; @@ -2067,7 +1953,7 @@ } -static void pgpDigTestHMACS(pgpDig dig) +static void pgpTestHMACS(pgpDig dig) { static struct algos { @@ -2357,10 +2243,10 @@ for (i = 0; algos[i].md; i++) { /* Lookup & FIPS check. */ - if (rpmgcAvailableDigest(dig, algos[i].md)) + if (pgpImplAvailableDigest(dig, algos[i].md)) continue; - pgpDigTestHMAC(dig, algos[i].md, 0, + pgpTestHMAC(dig, algos[i].md, 0, algos[i].data, strlen(algos[i].data), algos[i].key, strlen(algos[i].key), algos[i].expect); @@ -2516,30 +2402,33 @@ public key used for the verification. BADHASH is a hashvalue which should; result in a bad signature status. */ static int -verify_one_signature(pgpDig dig, gcry_sexp_t badhash) +pgpCheckVerify(pgpDig dig, void * _badhash) { int rc = 0; /* assume success */ const char * msg = rpmExpand(dig->pubkey_algoN, "-", dig->hash_algoN, " verify", NULL); -#if defined(_RPMGC_INTERNAL) - rpmgc gc = dig->impl; -gcry_sexp_t hash; + int xx; -xx = rpmgcErrChk(gc, "verify GOOD", pgpImplVerify(dig), 0); +xx = pgpImplErrChk(dig, "verify GOOD", pgpImplVerify(dig), 0); if (xx && !rc) rc = 1; -gc->badok = GPG_ERR_BAD_SIGNATURE; -hash = gc->hash; -gc->hash = badhash; -xx = rpmgcErrChk(gc, "detect BAD", pgpImplVerify(dig), gc->badok); -if (xx && !rc) rc = 1; -gc->hash = hash; -gc->badok = 0; - +#if defined(_RPMGC_INTERNAL) + { + rpmgc gc = dig->impl; + gcry_sexp_t badhash = _badhash; + gcry_sexp_t hash; + gc->badok = GPG_ERR_BAD_SIGNATURE; + hash = gc->hash; + gc->hash = badhash; + xx = pgpImplErrChk(dig, "detect BAD", pgpImplVerify(dig), gc->badok); + if (xx && !rc) rc = 1; + gc->hash = hash; + gc->badok = 0; + } #endif /* _RPMGC_INTERNAL */ if (_pgp_debug < 0) -fprintf(stderr, "<== %s(%p,%p) rc %d\t%s\n", __FUNCTION__, dig, badhash, rc, msg); +fprintf(stderr, "<== %s(%p,%p) rc %d\t%s\n", __FUNCTION__, dig, _badhash, rc, msg); msg = _free(msg); @@ -2548,13 +2437,13 @@ /* Test the public key sign function using the private ket SKEY. PKEY is used for verification. */ -static int check_pubkey_sign(pgpDig dig, int n) +static int pgpCheckSignVerify(pgpDig dig, int n) { int rc = 0; /* assume success */ -uint32_t dalgo = PGPHASHALGO_SHA1; /* XXX FIXME */ -pgpDigParams sigp = pgpGetSignature(dig); const char * msg = NULL; #if defined(_RPMGC_INTERNAL) +uint32_t dalgo = PGPHASHALGO_SHA1; /* XXX FIXME */ +pgpDigParams sigp = pgpGetSignature(dig); rpmgc gc = dig->impl; gcry_error_t err; gcry_sexp_t badhash; @@ -2615,11 +2504,11 @@ die("converting data failed: %s\n", gpg_strerror(err)); gc->badok = datas[dataidx].expected_rc; -xx = rpmgcErrChk(gc, msg, pgpImplSign(dig), datas[dataidx].expected_rc); +xx = pgpImplErrChk(dig, msg, pgpImplSign(dig), datas[dataidx].expected_rc); gc->badok = 0; -/* XXX FIXME: test rpmgcErrChk() rc to prevent error cascade or not? */ +/* XXX FIXME: test pgpImplErrChk() rc to prevent error cascade or not? */ if (!xx && !datas[dataidx].expected_rc) { - xx = verify_one_signature(dig, badhash); + xx = pgpCheckVerify(dig, badhash); if (xx && !rc) rc = 1; } @@ -2643,7 +2532,7 @@ } static int -check_pubkey_grip(pgpDig dig, int n, const unsigned char *grip) +pgpCheckGrip(pgpDig dig, int n, const unsigned char *grip) { int rc = 0; /* assume success */ unsigned char pgrip[20] = ""; @@ -2673,21 +2562,21 @@ } static int -do_check_one_pubkey(pgpDig dig, int n, +pgpCheckSignVerifyGrip(pgpDig dig, int n, const unsigned char *grip, int flags) { int rc = 0; /* assume success */ int xx; if (flags & FLAG_SIGN) { - xx = check_pubkey_sign(dig, n); + xx = pgpCheckSignVerify(dig, n); if (xx && !rc) rc = 1; } /* XXX FLAG_CRYPT */ if (grip && (flags & FLAG_GRIP)) { - xx = check_pubkey_grip(dig, n, grip); + xx = pgpCheckGrip(dig, n, grip); if (xx && !rc) rc = 1; } @@ -2698,7 +2587,7 @@ } static int -check_one_pubkey(pgpDig dig, int n, AFKP_t * afkp) +pgpCheckLoadSignVerify(pgpDig dig, int n, AFKP_t * afkp) { int rc = 0; /* assume success */ #if defined(_RPMGC_INTERNAL) @@ -2723,7 +2612,7 @@ if (gc->err) die("converting sample key failed: %s\n", gpg_strerror(gc->err)); else - rc = do_check_one_pubkey(dig, n, afkp->grip, afkp->flags); + rc = pgpCheckSignVerifyGrip(dig, n, afkp->grip, afkp->flags); #endif /* _RPMGC_INTERNAL */ pgpDigClean(dig); @@ -2734,7 +2623,7 @@ return rc; } -static int get_keys_new(pgpDig dig) +static int pgpCheckGenerate(pgpDig dig) { int rc = 0; /* assume success */ #if defined(_RPMGC_INTERNAL) @@ -2762,15 +2651,15 @@ return rc; } -static int check_one_pubkey_new(pgpDig dig, int n) +static int pgpCheckGenerateSignVerifyGrip(pgpDig dig, int n) { int rc = 0; /* assume success */ #if defined(_RPMGC_INTERNAL) int xx; - xx = get_keys_new(dig); + xx = pgpCheckGenerate(dig); if (xx && !rc) rc = 1; - xx = do_check_one_pubkey(dig, n, NULL, FLAG_SIGN | FLAG_CRYPT); + xx = pgpCheckSignVerifyGrip(dig, n, NULL, FLAG_SIGN | FLAG_CRYPT); if (xx && !rc) rc = 1; #endif /* _RPMGC_INTERNAL */ pgpDigClean(dig); @@ -2879,12 +2768,11 @@ }; /* Run all tests for the public key functions. */ -static int check_pubkey(pgpDig dig) +static int pgpTestPubkeys(pgpDig dig) { int rc = 0; /* assume success */ pgpDigParams pubp = pgpGetPubkey(dig); pgpDigParams sigp = pgpGetSignature(dig); -rpmgc gc = dig->impl; AFKP_t * afkp; size_t i; int xx; @@ -2900,8 +2788,12 @@ fprintf(stderr, "==> %s #1\n", _pgpPubkeyAlgo2Name(afkp->algo)); pubp->pubkey_algo = sigp->pubkey_algo = afkp->algo; dig->pubkey_algoN = _pgpPubkeyAlgo2Name(afkp->algo); -gc->nbits = afkp->nbits; -gc->qbits = afkp->qbits; +#if defined(_RPMGC_INTERNAL) +{ rpmgc gc = dig->impl; + gc->nbits = afkp->nbits; + gc->qbits = afkp->qbits; +} +#endif #ifndef DYING /* XXX FIXME: no sec_key parameters. */ @@ -2910,10 +2802,10 @@ #endif /* Lookup & FIPS check. */ - if (rpmgcAvailablePubkey(dig, afkp->algo)) + if (pgpImplAvailablePubkey(dig, afkp->algo)) continue; - xx = check_one_pubkey(dig, i, afkp); + xx = pgpCheckLoadSignVerify(dig, i, afkp); if (xx && !rc) rc = 1; /* XXX FIXME: pgpDigClean */ @@ -2932,14 +2824,18 @@ fprintf(stderr, "==> %s #2\n", _pgpPubkeyAlgo2Name(afkp->algo)); pubp->pubkey_algo = sigp->pubkey_algo = afkp->algo; dig->pubkey_algoN = _pgpPubkeyAlgo2Name(afkp->algo); -gc->nbits = afkp->nbits; -gc->qbits = afkp->qbits; +#if defined(_RPMGC_INTERNAL) +{ rpmgc gc = dig->impl; + gc->nbits = afkp->nbits; + gc->qbits = afkp->qbits; +} +#endif /* Lookup & FIPS check. */ - if (rpmgcAvailablePubkey(dig, afkp->algo)) + if (pgpImplAvailablePubkey(dig, afkp->algo)) continue; - xx = check_one_pubkey_new(dig, i); + xx = pgpCheckGenerateSignVerifyGrip(dig, i); if (xx && !rc) rc = 1; /* XXX FIXME: pgpDigClean */ @@ -2954,9 +2850,11 @@ } -static int rpmgcBasicTests(pgpDig dig) +static int pgpBasicTests(pgpDig dig) { +#if defined(_RPMGC_INTERNAL) rpmgc gc = dig->impl; +#endif /* _RPMGC_INTERNAL */ int xx; fprintf(stderr, "%s: use_fips %d selftest_only %d\n", @@ -2984,7 +2882,7 @@ gcry_control(GCRYCTL_DISABLE_SECMEM, 0); if (rpmIsVerbose()) - gcry_set_progress_handler(progress_handler, NULL); + gcry_set_progress_handler(rpmgcProgress, NULL); gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0); @@ -3000,9 +2898,9 @@ check_ciphers(dig); check_cipher_modes(dig); #endif /* _RPMGC_INTERNAL */ - pgpDigTestDigests(dig); - pgpDigTestHMACS(dig); - xx = check_pubkey(dig); + pgpTestDigests(dig); + pgpTestHMACS(dig); + xx = pgpTestPubkeys(dig); } /* If we are in fips mode do some more tests. */ @@ -3055,14 +2953,14 @@ } #endif /* _RPMGC_INTERNAL */ - rpmlog(RPMLOG_INFO, "\nAll tests completed. Errors: %i\n", error_count); + rpmlog(RPMLOG_INFO, "\nAll tests completed. Errors: %i\n", _pgp_error_count); #if defined(_RPMGC_INTERNAL) if (gc->in_fips_mode && !gcry_fips_mode_active()) fprintf(stderr, "FIPS mode is not anymore active\n"); #endif /* _RPMGC_INTERNAL */ - return error_count ? 1 : 0; /* XXX 0 on success */ + return _pgp_error_count ? 1 : 0; /* XXX 0 on success */ } /*==============================================================*/ @@ -3705,7 +3603,7 @@ /*==============================================================*/ #ifdef NOTYET -static int pgpDigTestOne(pgpDig dig, +static int rpmsslTestOne(pgpDig dig, const char * msg, const char *r_in, const char *s_in) { pgpDigParams sigp = pgpGetSignature(dig); @@ -3806,7 +3704,7 @@ rpmlog(RPMLOG_INFO, "%s:\t", v->name); - rc = pgpDigTestOne(dig, v->msg, v->r, v->s); + rc = rpmsslTestOne(dig, v->msg, v->r, v->s); rpmlog(RPMLOG_INFO, "%s %s\n", &dots[strlen(dots)-rc], (rc >= 4 ? " ok" : " failed")); @@ -4021,6 +3919,8 @@ rc = 1; /* assume success */ if (rpmsslRSATests(dig) <= 0) rc = 0; + if (pgpBasicTests(dig)) + rc = 0; dig = _rpmsslFini(dig); if (rc <= 0) goto exit; @@ -4029,7 +3929,7 @@ #if defined(_RPMGC_INTERNAL) dig = _rpmgcInit(); rc = 1; /* assume success */ - if (rpmgcBasicTests(dig)) + if (pgpBasicTests(dig)) rc = 0; dig = _rpmgcFini(dig); if (rc <= 0) @@ . ______________________________________________________________________ RPM Package Manager http://rpm5.org CVS Sources Repository [email protected]
