2003-08-05 17:11:04 +00:00
|
|
|
|
/* import.c - Import certificates
|
2009-07-07 16:52:12 +00:00
|
|
|
|
* Copyright (C) 2001, 2003, 2004, 2009 Free Software Foundation, Inc.
|
2003-08-05 17:11:04 +00:00
|
|
|
|
*
|
|
|
|
|
* This file is part of GnuPG.
|
|
|
|
|
*
|
|
|
|
|
* GnuPG is free software; you can redistribute it and/or modify
|
|
|
|
|
* it under the terms of the GNU General Public License as published by
|
2007-07-04 19:49:40 +00:00
|
|
|
|
* the Free Software Foundation; either version 3 of the License, or
|
2003-08-05 17:11:04 +00:00
|
|
|
|
* (at your option) any later version.
|
|
|
|
|
*
|
|
|
|
|
* GnuPG is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU General Public License
|
2007-07-04 19:49:40 +00:00
|
|
|
|
* along with this program; if not, see <http://www.gnu.org/licenses/>.
|
2003-08-05 17:11:04 +00:00
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#include <config.h>
|
|
|
|
|
#include <stdio.h>
|
|
|
|
|
#include <stdlib.h>
|
|
|
|
|
#include <string.h>
|
|
|
|
|
#include <errno.h>
|
|
|
|
|
#include <time.h>
|
|
|
|
|
#include <assert.h>
|
2004-12-20 16:17:25 +00:00
|
|
|
|
#include <unistd.h>
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
|
|
|
|
#include "gpgsm.h"
|
|
|
|
|
#include <gcrypt.h>
|
|
|
|
|
#include <ksba.h>
|
|
|
|
|
|
|
|
|
|
#include "keydb.h"
|
2004-12-06 18:28:56 +00:00
|
|
|
|
#include "exechelp.h"
|
2003-08-05 17:11:04 +00:00
|
|
|
|
#include "i18n.h"
|
2007-08-22 10:55:07 +00:00
|
|
|
|
#include "sysutils.h"
|
2009-07-07 16:52:12 +00:00
|
|
|
|
#include "../kbx/keybox.h" /* for KEYBOX_FLAG_* */
|
|
|
|
|
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
|
|
|
|
struct stats_s {
|
|
|
|
|
unsigned long count;
|
|
|
|
|
unsigned long imported;
|
|
|
|
|
unsigned long unchanged;
|
|
|
|
|
unsigned long not_imported;
|
2004-04-30 15:24:33 +00:00
|
|
|
|
unsigned long secret_read;
|
|
|
|
|
unsigned long secret_imported;
|
|
|
|
|
unsigned long secret_dups;
|
|
|
|
|
};
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
|
|
|
|
|
2004-09-29 13:50:31 +00:00
|
|
|
|
static gpg_error_t parse_p12 (ctrl_t ctrl, ksba_reader_t reader, FILE **retfp,
|
2004-04-30 15:24:33 +00:00
|
|
|
|
struct stats_s *stats);
|
2004-02-13 12:40:23 +00:00
|
|
|
|
|
|
|
|
|
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
|
|
|
|
static void
|
2006-09-06 16:35:52 +00:00
|
|
|
|
print_imported_status (ctrl_t ctrl, ksba_cert_t cert, int new_cert)
|
2003-08-05 17:11:04 +00:00
|
|
|
|
{
|
|
|
|
|
char *fpr;
|
2004-02-17 15:05:04 +00:00
|
|
|
|
|
2003-08-05 17:11:04 +00:00
|
|
|
|
fpr = gpgsm_get_fingerprint_hexstring (cert, GCRY_MD_SHA1);
|
2004-02-17 15:05:04 +00:00
|
|
|
|
if (new_cert)
|
|
|
|
|
gpgsm_status2 (ctrl, STATUS_IMPORTED, fpr, "[X.509]", NULL);
|
|
|
|
|
|
|
|
|
|
gpgsm_status2 (ctrl, STATUS_IMPORT_OK,
|
|
|
|
|
new_cert? "1":"0", fpr, NULL);
|
|
|
|
|
|
2003-08-05 17:11:04 +00:00
|
|
|
|
xfree (fpr);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* Print an IMPORT_PROBLEM status. REASON is one of:
|
|
|
|
|
0 := "No specific reason given".
|
|
|
|
|
1 := "Invalid Certificate".
|
|
|
|
|
2 := "Issuer Certificate missing".
|
|
|
|
|
3 := "Certificate Chain too long".
|
|
|
|
|
4 := "Error storing certificate".
|
|
|
|
|
*/
|
|
|
|
|
static void
|
2006-09-06 16:35:52 +00:00
|
|
|
|
print_import_problem (ctrl_t ctrl, ksba_cert_t cert, int reason)
|
2003-08-05 17:11:04 +00:00
|
|
|
|
{
|
|
|
|
|
char *fpr = NULL;
|
|
|
|
|
char buf[25];
|
|
|
|
|
int i;
|
|
|
|
|
|
|
|
|
|
sprintf (buf, "%d", reason);
|
|
|
|
|
if (cert)
|
|
|
|
|
{
|
|
|
|
|
fpr = gpgsm_get_fingerprint_hexstring (cert, GCRY_MD_SHA1);
|
|
|
|
|
/* detetect an error (all high) value */
|
|
|
|
|
for (i=0; fpr[i] == 'F'; i++)
|
|
|
|
|
;
|
|
|
|
|
if (!fpr[i])
|
|
|
|
|
{
|
|
|
|
|
xfree (fpr);
|
|
|
|
|
fpr = NULL;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
gpgsm_status2 (ctrl, STATUS_IMPORT_PROBLEM, buf, fpr, NULL);
|
|
|
|
|
xfree (fpr);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
void
|
2006-09-06 16:35:52 +00:00
|
|
|
|
print_imported_summary (ctrl_t ctrl, struct stats_s *stats)
|
2003-08-05 17:11:04 +00:00
|
|
|
|
{
|
|
|
|
|
char buf[14*25];
|
|
|
|
|
|
|
|
|
|
if (!opt.quiet)
|
|
|
|
|
{
|
|
|
|
|
log_info (_("total number processed: %lu\n"), stats->count);
|
|
|
|
|
if (stats->imported)
|
|
|
|
|
{
|
|
|
|
|
log_info (_(" imported: %lu"), stats->imported );
|
|
|
|
|
log_printf ("\n");
|
|
|
|
|
}
|
|
|
|
|
if (stats->unchanged)
|
|
|
|
|
log_info (_(" unchanged: %lu\n"), stats->unchanged);
|
2004-04-30 15:24:33 +00:00
|
|
|
|
if (stats->secret_read)
|
|
|
|
|
log_info (_(" secret keys read: %lu\n"), stats->secret_read );
|
|
|
|
|
if (stats->secret_imported)
|
|
|
|
|
log_info (_(" secret keys imported: %lu\n"), stats->secret_imported );
|
|
|
|
|
if (stats->secret_dups)
|
|
|
|
|
log_info (_(" secret keys unchanged: %lu\n"), stats->secret_dups );
|
2003-08-05 17:11:04 +00:00
|
|
|
|
if (stats->not_imported)
|
|
|
|
|
log_info (_(" not imported: %lu\n"), stats->not_imported);
|
|
|
|
|
}
|
|
|
|
|
|
2004-04-30 15:24:33 +00:00
|
|
|
|
sprintf(buf, "%lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu",
|
|
|
|
|
stats->count,
|
|
|
|
|
0l /*stats->no_user_id*/,
|
|
|
|
|
stats->imported,
|
|
|
|
|
0l /*stats->imported_rsa*/,
|
|
|
|
|
stats->unchanged,
|
|
|
|
|
0l /*stats->n_uids*/,
|
|
|
|
|
0l /*stats->n_subk*/,
|
|
|
|
|
0l /*stats->n_sigs*/,
|
|
|
|
|
0l /*stats->n_revoc*/,
|
|
|
|
|
stats->secret_read,
|
|
|
|
|
stats->secret_imported,
|
|
|
|
|
stats->secret_dups,
|
|
|
|
|
0l /*stats->skipped_new_keys*/,
|
|
|
|
|
stats->not_imported
|
|
|
|
|
);
|
2003-08-05 17:11:04 +00:00
|
|
|
|
gpgsm_status (ctrl, STATUS_IMPORT_RES, buf);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static void
|
2007-03-20 16:57:40 +00:00
|
|
|
|
check_and_store (ctrl_t ctrl, struct stats_s *stats,
|
|
|
|
|
ksba_cert_t cert, int depth)
|
2003-08-05 17:11:04 +00:00
|
|
|
|
{
|
|
|
|
|
int rc;
|
|
|
|
|
|
2004-04-30 03:27:10 +00:00
|
|
|
|
if (stats)
|
|
|
|
|
stats->count++;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
if ( depth >= 50 )
|
|
|
|
|
{
|
|
|
|
|
log_error (_("certificate chain too long\n"));
|
2004-04-30 03:27:10 +00:00
|
|
|
|
if (stats)
|
|
|
|
|
stats->not_imported++;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
print_import_problem (ctrl, cert, 3);
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
2004-02-03 16:27:51 +00:00
|
|
|
|
/* Some basic checks, but don't care about missing certificates;
|
|
|
|
|
this is so that we are able to import entire certificate chains
|
2004-08-17 15:26:22 +00:00
|
|
|
|
w/o requiring a special order (i.e. root-CA first). This used
|
2004-02-17 15:05:04 +00:00
|
|
|
|
to be different but because gpgsm_verify even imports
|
2004-02-03 16:27:51 +00:00
|
|
|
|
certificates without any checks, it doesn't matter much and the
|
|
|
|
|
code gets much cleaner. A housekeeping function to remove
|
2004-08-17 15:26:22 +00:00
|
|
|
|
certificates w/o an anchor would be nice, though.
|
|
|
|
|
|
|
|
|
|
Optionally we do a full validation in addition to the basic test.
|
|
|
|
|
*/
|
2008-02-13 16:47:14 +00:00
|
|
|
|
rc = gpgsm_basic_cert_check (ctrl, cert);
|
2004-08-17 15:26:22 +00:00
|
|
|
|
if (!rc && ctrl->with_validation)
|
2007-08-10 16:52:05 +00:00
|
|
|
|
rc = gpgsm_validate_chain (ctrl, cert, "", NULL, 0, NULL, 0, NULL);
|
2004-08-17 20:06:24 +00:00
|
|
|
|
if (!rc || (!ctrl->with_validation
|
2004-08-17 15:26:22 +00:00
|
|
|
|
&& gpg_err_code (rc) == GPG_ERR_MISSING_CERT) )
|
2003-08-05 17:11:04 +00:00
|
|
|
|
{
|
|
|
|
|
int existed;
|
|
|
|
|
|
|
|
|
|
if (!keydb_store_cert (cert, 0, &existed))
|
|
|
|
|
{
|
2003-12-17 12:28:24 +00:00
|
|
|
|
ksba_cert_t next = NULL;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
|
|
|
|
if (!existed)
|
|
|
|
|
{
|
2004-02-17 15:05:04 +00:00
|
|
|
|
print_imported_status (ctrl, cert, 1);
|
2004-04-30 03:27:10 +00:00
|
|
|
|
if (stats)
|
|
|
|
|
stats->imported++;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
}
|
|
|
|
|
else
|
2004-02-17 15:05:04 +00:00
|
|
|
|
{
|
|
|
|
|
print_imported_status (ctrl, cert, 0);
|
2004-04-30 03:27:10 +00:00
|
|
|
|
if (stats)
|
|
|
|
|
stats->unchanged++;
|
2004-02-17 15:05:04 +00:00
|
|
|
|
}
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
|
|
|
|
if (opt.verbose > 1 && existed)
|
|
|
|
|
{
|
|
|
|
|
if (depth)
|
|
|
|
|
log_info ("issuer certificate already in DB\n");
|
|
|
|
|
else
|
|
|
|
|
log_info ("certificate already in DB\n");
|
|
|
|
|
}
|
|
|
|
|
else if (opt.verbose && !existed)
|
|
|
|
|
{
|
|
|
|
|
if (depth)
|
|
|
|
|
log_info ("issuer certificate imported\n");
|
|
|
|
|
else
|
|
|
|
|
log_info ("certificate imported\n");
|
|
|
|
|
}
|
2004-02-03 16:27:51 +00:00
|
|
|
|
|
2003-08-05 17:11:04 +00:00
|
|
|
|
/* Now lets walk up the chain and import all certificates up
|
2004-02-03 16:27:51 +00:00
|
|
|
|
the chain. This is required in case we already stored
|
2004-04-30 03:27:10 +00:00
|
|
|
|
parent certificates in the ephemeral keybox. Do not
|
|
|
|
|
update the statistics, though. */
|
2008-02-13 16:47:14 +00:00
|
|
|
|
if (!gpgsm_walk_cert_chain (ctrl, cert, &next))
|
2003-08-05 17:11:04 +00:00
|
|
|
|
{
|
2004-04-30 03:27:10 +00:00
|
|
|
|
check_and_store (ctrl, NULL, next, depth+1);
|
2003-08-05 17:11:04 +00:00
|
|
|
|
ksba_cert_release (next);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
log_error (_("error storing certificate\n"));
|
2004-04-30 03:27:10 +00:00
|
|
|
|
if (stats)
|
|
|
|
|
stats->not_imported++;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
print_import_problem (ctrl, cert, 4);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
log_error (_("basic certificate checks failed - not imported\n"));
|
2004-04-30 03:27:10 +00:00
|
|
|
|
if (stats)
|
|
|
|
|
stats->not_imported++;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
print_import_problem (ctrl, cert,
|
|
|
|
|
gpg_err_code (rc) == GPG_ERR_MISSING_CERT? 2 :
|
|
|
|
|
gpg_err_code (rc) == GPG_ERR_BAD_CERT? 1 : 0);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static int
|
2006-09-06 16:35:52 +00:00
|
|
|
|
import_one (ctrl_t ctrl, struct stats_s *stats, int in_fd)
|
2003-08-05 17:11:04 +00:00
|
|
|
|
{
|
|
|
|
|
int rc;
|
|
|
|
|
Base64Context b64reader = NULL;
|
2003-12-17 12:28:24 +00:00
|
|
|
|
ksba_reader_t reader;
|
|
|
|
|
ksba_cert_t cert = NULL;
|
|
|
|
|
ksba_cms_t cms = NULL;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
FILE *fp = NULL;
|
2003-12-17 12:28:24 +00:00
|
|
|
|
ksba_content_type_t ct;
|
2004-02-13 12:40:23 +00:00
|
|
|
|
int any = 0;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
|
|
|
|
fp = fdopen ( dup (in_fd), "rb");
|
|
|
|
|
if (!fp)
|
|
|
|
|
{
|
|
|
|
|
rc = gpg_error (gpg_err_code_from_errno (errno));
|
|
|
|
|
log_error ("fdopen() failed: %s\n", strerror (errno));
|
2004-02-04 19:13:16 +00:00
|
|
|
|
goto leave;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
}
|
|
|
|
|
|
2004-02-13 12:40:23 +00:00
|
|
|
|
rc = gpgsm_create_reader (&b64reader, ctrl, fp, 1, &reader);
|
2003-08-05 17:11:04 +00:00
|
|
|
|
if (rc)
|
|
|
|
|
{
|
|
|
|
|
log_error ("can't create reader: %s\n", gpg_strerror (rc));
|
|
|
|
|
goto leave;
|
|
|
|
|
}
|
2004-02-13 12:40:23 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* We need to loop here to handle multiple PEM objects in one
|
|
|
|
|
file. */
|
|
|
|
|
do
|
|
|
|
|
{
|
|
|
|
|
ksba_cms_release (cms); cms = NULL;
|
|
|
|
|
ksba_cert_release (cert); cert = NULL;
|
|
|
|
|
|
|
|
|
|
ct = ksba_cms_identify (reader);
|
|
|
|
|
if (ct == KSBA_CT_SIGNED_DATA)
|
|
|
|
|
{ /* This is probably a signed-only message - import the certs */
|
|
|
|
|
ksba_stop_reason_t stopreason;
|
|
|
|
|
int i;
|
|
|
|
|
|
|
|
|
|
rc = ksba_cms_new (&cms);
|
|
|
|
|
if (rc)
|
|
|
|
|
goto leave;
|
|
|
|
|
|
|
|
|
|
rc = ksba_cms_set_reader_writer (cms, reader, NULL);
|
2003-08-05 17:11:04 +00:00
|
|
|
|
if (rc)
|
|
|
|
|
{
|
2004-02-13 12:40:23 +00:00
|
|
|
|
log_error ("ksba_cms_set_reader_writer failed: %s\n",
|
|
|
|
|
gpg_strerror (rc));
|
2003-08-05 17:11:04 +00:00
|
|
|
|
goto leave;
|
|
|
|
|
}
|
|
|
|
|
|
2004-02-13 12:40:23 +00:00
|
|
|
|
do
|
|
|
|
|
{
|
|
|
|
|
rc = ksba_cms_parse (cms, &stopreason);
|
|
|
|
|
if (rc)
|
|
|
|
|
{
|
|
|
|
|
log_error ("ksba_cms_parse failed: %s\n", gpg_strerror (rc));
|
|
|
|
|
goto leave;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (stopreason == KSBA_SR_BEGIN_DATA)
|
|
|
|
|
log_info ("not a certs-only message\n");
|
|
|
|
|
}
|
|
|
|
|
while (stopreason != KSBA_SR_READY);
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
2004-02-13 12:40:23 +00:00
|
|
|
|
for (i=0; (cert=ksba_cms_get_cert (cms, i)); i++)
|
|
|
|
|
{
|
|
|
|
|
check_and_store (ctrl, stats, cert, 0);
|
|
|
|
|
ksba_cert_release (cert);
|
|
|
|
|
cert = NULL;
|
|
|
|
|
}
|
|
|
|
|
if (!i)
|
|
|
|
|
log_error ("no certificate found\n");
|
|
|
|
|
else
|
|
|
|
|
any = 1;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
}
|
2004-02-13 12:40:23 +00:00
|
|
|
|
else if (ct == KSBA_CT_PKCS12)
|
|
|
|
|
{ /* This seems to be a pkcs12 message. We use an external
|
|
|
|
|
tool to parse the message and to store the private keys.
|
|
|
|
|
We need to use a another reader here to parse the
|
|
|
|
|
certificate we included in the p12 file; then we continue
|
|
|
|
|
to look for other pkcs12 files (works only if they are in
|
|
|
|
|
PEM format. */
|
|
|
|
|
FILE *certfp;
|
|
|
|
|
Base64Context b64p12rdr;
|
|
|
|
|
ksba_reader_t p12rdr;
|
|
|
|
|
|
2004-09-29 13:50:31 +00:00
|
|
|
|
rc = parse_p12 (ctrl, reader, &certfp, stats);
|
2004-02-13 12:40:23 +00:00
|
|
|
|
if (!rc)
|
|
|
|
|
{
|
|
|
|
|
any = 1;
|
|
|
|
|
|
|
|
|
|
rewind (certfp);
|
|
|
|
|
rc = gpgsm_create_reader (&b64p12rdr, ctrl, certfp, 1, &p12rdr);
|
|
|
|
|
if (rc)
|
|
|
|
|
{
|
|
|
|
|
log_error ("can't create reader: %s\n", gpg_strerror (rc));
|
|
|
|
|
fclose (certfp);
|
|
|
|
|
goto leave;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
do
|
|
|
|
|
{
|
|
|
|
|
ksba_cert_release (cert); cert = NULL;
|
|
|
|
|
rc = ksba_cert_new (&cert);
|
|
|
|
|
if (!rc)
|
|
|
|
|
{
|
|
|
|
|
rc = ksba_cert_read_der (cert, p12rdr);
|
|
|
|
|
if (!rc)
|
|
|
|
|
check_and_store (ctrl, stats, cert, 0);
|
|
|
|
|
}
|
|
|
|
|
ksba_reader_clear (p12rdr, NULL, NULL);
|
|
|
|
|
}
|
|
|
|
|
while (!rc && !gpgsm_reader_eof_seen (b64p12rdr));
|
|
|
|
|
|
|
|
|
|
if (gpg_err_code (rc) == GPG_ERR_EOF)
|
|
|
|
|
rc = 0;
|
|
|
|
|
gpgsm_destroy_reader (b64p12rdr);
|
|
|
|
|
fclose (certfp);
|
|
|
|
|
if (rc)
|
|
|
|
|
goto leave;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
else if (ct == KSBA_CT_NONE)
|
|
|
|
|
{ /* Failed to identify this message - assume a certificate */
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
2004-02-13 12:40:23 +00:00
|
|
|
|
rc = ksba_cert_new (&cert);
|
|
|
|
|
if (rc)
|
|
|
|
|
goto leave;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
2004-02-13 12:40:23 +00:00
|
|
|
|
rc = ksba_cert_read_der (cert, reader);
|
|
|
|
|
if (rc)
|
|
|
|
|
goto leave;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
2004-02-13 12:40:23 +00:00
|
|
|
|
check_and_store (ctrl, stats, cert, 0);
|
|
|
|
|
any = 1;
|
|
|
|
|
}
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
log_error ("can't extract certificates from input\n");
|
|
|
|
|
rc = gpg_error (GPG_ERR_NO_DATA);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
ksba_reader_clear (reader, NULL, NULL);
|
2003-08-05 17:11:04 +00:00
|
|
|
|
}
|
2004-02-13 12:40:23 +00:00
|
|
|
|
while (!gpgsm_reader_eof_seen (b64reader));
|
|
|
|
|
|
2003-08-05 17:11:04 +00:00
|
|
|
|
leave:
|
2004-02-13 12:40:23 +00:00
|
|
|
|
if (any && gpg_err_code (rc) == GPG_ERR_EOF)
|
|
|
|
|
rc = 0;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
ksba_cms_release (cms);
|
|
|
|
|
ksba_cert_release (cert);
|
|
|
|
|
gpgsm_destroy_reader (b64reader);
|
|
|
|
|
if (fp)
|
|
|
|
|
fclose (fp);
|
|
|
|
|
return rc;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
2009-07-07 16:52:12 +00:00
|
|
|
|
|
|
|
|
|
/* Re-import certifciates. IN_FD is a list of linefeed delimited
|
|
|
|
|
fingerprints t re-import. The actual re-import is done by clearing
|
|
|
|
|
the ephemeral flag. */
|
|
|
|
|
static int
|
|
|
|
|
reimport_one (ctrl_t ctrl, struct stats_s *stats, int in_fd)
|
|
|
|
|
{
|
|
|
|
|
gpg_error_t err = 0;
|
|
|
|
|
estream_t fp = NULL;
|
|
|
|
|
char line[100]; /* Sufficient for a fingerprint. */
|
|
|
|
|
KEYDB_HANDLE kh;
|
|
|
|
|
KEYDB_SEARCH_DESC desc;
|
|
|
|
|
ksba_cert_t cert = NULL;
|
|
|
|
|
unsigned int flags;
|
|
|
|
|
|
|
|
|
|
kh = keydb_new (0);
|
|
|
|
|
if (!kh)
|
|
|
|
|
{
|
|
|
|
|
err = gpg_error (GPG_ERR_ENOMEM);;
|
|
|
|
|
log_error (_("failed to allocate keyDB handle\n"));
|
|
|
|
|
goto leave;
|
|
|
|
|
}
|
|
|
|
|
keydb_set_ephemeral (kh, 1);
|
|
|
|
|
|
|
|
|
|
fp = es_fdopen_nc (in_fd, "r");
|
|
|
|
|
if (!fp)
|
|
|
|
|
{
|
|
|
|
|
err = gpg_error_from_syserror ();
|
|
|
|
|
log_error ("es_fdopen(%d) failed: %s\n", in_fd, gpg_strerror (err));
|
|
|
|
|
goto leave;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
while (es_fgets (line, DIM(line)-1, fp) )
|
|
|
|
|
{
|
|
|
|
|
if (*line && line[strlen(line)-1] != '\n')
|
|
|
|
|
{
|
|
|
|
|
err = gpg_error (GPG_ERR_LINE_TOO_LONG);
|
|
|
|
|
goto leave;
|
|
|
|
|
}
|
|
|
|
|
trim_spaces (line);
|
|
|
|
|
if (!*line)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
stats->count++;
|
|
|
|
|
|
|
|
|
|
err = keydb_classify_name (line, &desc);
|
|
|
|
|
if (err)
|
|
|
|
|
{
|
|
|
|
|
print_import_problem (ctrl, NULL, 0);
|
|
|
|
|
stats->not_imported++;
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
keydb_search_reset (kh);
|
|
|
|
|
err = keydb_search (kh, &desc, 1);
|
|
|
|
|
if (err)
|
|
|
|
|
{
|
|
|
|
|
print_import_problem (ctrl, NULL, 0);
|
|
|
|
|
stats->not_imported++;
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
ksba_cert_release (cert);
|
|
|
|
|
cert = NULL;
|
|
|
|
|
err = keydb_get_cert (kh, &cert);
|
|
|
|
|
if (err)
|
|
|
|
|
{
|
|
|
|
|
log_error ("keydb_get_cert() failed: %s\n", gpg_strerror (err));
|
|
|
|
|
print_import_problem (ctrl, NULL, 1);
|
|
|
|
|
stats->not_imported++;
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
err = keydb_get_flags (kh, KEYBOX_FLAG_BLOB, 0, &flags);
|
|
|
|
|
if (err)
|
|
|
|
|
{
|
|
|
|
|
log_error (_("error getting stored flags: %s\n"), gpg_strerror (err));
|
|
|
|
|
print_imported_status (ctrl, cert, 0);
|
|
|
|
|
stats->not_imported++;
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
if ( !(flags & KEYBOX_FLAG_BLOB_EPHEMERAL) )
|
|
|
|
|
{
|
|
|
|
|
print_imported_status (ctrl, cert, 0);
|
|
|
|
|
stats->unchanged++;
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
err = keydb_set_cert_flags (cert, 1, KEYBOX_FLAG_BLOB, 0,
|
|
|
|
|
KEYBOX_FLAG_BLOB_EPHEMERAL, 0);
|
|
|
|
|
if (err)
|
|
|
|
|
{
|
|
|
|
|
log_error ("clearing ephemeral flag failed: %s\n",
|
|
|
|
|
gpg_strerror (err));
|
|
|
|
|
print_import_problem (ctrl, cert, 0);
|
|
|
|
|
stats->not_imported++;
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
print_imported_status (ctrl, cert, 1);
|
|
|
|
|
stats->imported++;
|
|
|
|
|
}
|
|
|
|
|
err = 0;
|
|
|
|
|
if (es_ferror (fp))
|
|
|
|
|
{
|
|
|
|
|
err = gpg_error_from_syserror ();
|
|
|
|
|
log_error ("error reading fd %d: %s\n", in_fd, gpg_strerror (err));
|
|
|
|
|
goto leave;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
leave:
|
|
|
|
|
ksba_cert_release (cert);
|
|
|
|
|
keydb_release (kh);
|
|
|
|
|
es_fclose (fp);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-08-05 17:11:04 +00:00
|
|
|
|
int
|
2009-07-07 16:52:12 +00:00
|
|
|
|
gpgsm_import (ctrl_t ctrl, int in_fd, int reimport_mode)
|
2003-08-05 17:11:04 +00:00
|
|
|
|
{
|
|
|
|
|
int rc;
|
|
|
|
|
struct stats_s stats;
|
|
|
|
|
|
|
|
|
|
memset (&stats, 0, sizeof stats);
|
2009-07-07 16:52:12 +00:00
|
|
|
|
if (reimport_mode)
|
|
|
|
|
rc = reimport_one (ctrl, &stats, in_fd);
|
|
|
|
|
else
|
|
|
|
|
rc = import_one (ctrl, &stats, in_fd);
|
2003-08-05 17:11:04 +00:00
|
|
|
|
print_imported_summary (ctrl, &stats);
|
|
|
|
|
/* If we never printed an error message do it now so that a command
|
|
|
|
|
line invocation will return with an error (log_error keeps a
|
|
|
|
|
global errorcount) */
|
|
|
|
|
if (rc && !log_get_errorcount (0))
|
|
|
|
|
log_error (_("error importing certificate: %s\n"), gpg_strerror (rc));
|
|
|
|
|
return rc;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
int
|
2006-09-06 16:35:52 +00:00
|
|
|
|
gpgsm_import_files (ctrl_t ctrl, int nfiles, char **files,
|
2003-08-05 17:11:04 +00:00
|
|
|
|
int (*of)(const char *fname))
|
|
|
|
|
{
|
|
|
|
|
int rc = 0;
|
|
|
|
|
struct stats_s stats;
|
|
|
|
|
|
|
|
|
|
memset (&stats, 0, sizeof stats);
|
|
|
|
|
|
|
|
|
|
if (!nfiles)
|
|
|
|
|
rc = import_one (ctrl, &stats, 0);
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
for (; nfiles && !rc ; nfiles--, files++)
|
|
|
|
|
{
|
|
|
|
|
int fd = of (*files);
|
|
|
|
|
rc = import_one (ctrl, &stats, fd);
|
|
|
|
|
close (fd);
|
|
|
|
|
if (rc == -1)
|
|
|
|
|
rc = 0;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
print_imported_summary (ctrl, &stats);
|
|
|
|
|
/* If we never printed an error message do it now so that a command
|
|
|
|
|
line invocation will return with an error (log_error keeps a
|
|
|
|
|
global errorcount) */
|
|
|
|
|
if (rc && !log_get_errorcount (0))
|
|
|
|
|
log_error (_("error importing certificate: %s\n"), gpg_strerror (rc));
|
|
|
|
|
return rc;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
2004-02-13 12:40:23 +00:00
|
|
|
|
/* Fork and exec the protecttool, connect the file descriptor of
|
|
|
|
|
INFILE to stdin, return a new stream in STATUSFILE, write the
|
|
|
|
|
output to OUTFILE and the pid of the process in PID. Returns 0 on
|
|
|
|
|
success or an error code. */
|
|
|
|
|
static gpg_error_t
|
2008-10-23 09:41:41 +00:00
|
|
|
|
popen_protect_tool (ctrl_t ctrl, const char *pgmname,
|
2004-02-13 12:40:23 +00:00
|
|
|
|
FILE *infile, FILE *outfile, FILE **statusfile, pid_t *pid)
|
|
|
|
|
{
|
2009-04-01 10:51:53 +00:00
|
|
|
|
const char *argv[22];
|
2004-12-06 18:28:56 +00:00
|
|
|
|
int i=0;
|
|
|
|
|
|
2008-10-23 09:41:41 +00:00
|
|
|
|
/* Make sure that the agent is running so that the protect tool is
|
|
|
|
|
able to ask for a passphrase. This has only an effect under W32
|
|
|
|
|
where the agent is started on demand; sending a NOP does not harm
|
2009-04-01 10:51:53 +00:00
|
|
|
|
on other platforms. This is not really necessary anymore because
|
|
|
|
|
the protect tool does this now by itself; it does not harm either. */
|
2008-10-23 09:41:41 +00:00
|
|
|
|
gpgsm_agent_send_nop (ctrl);
|
|
|
|
|
|
2004-12-06 18:28:56 +00:00
|
|
|
|
argv[i++] = "--homedir";
|
|
|
|
|
argv[i++] = opt.homedir;
|
|
|
|
|
argv[i++] = "--p12-import";
|
|
|
|
|
argv[i++] = "--store";
|
|
|
|
|
argv[i++] = "--no-fail-on-exist";
|
|
|
|
|
argv[i++] = "--enable-status-msg";
|
|
|
|
|
if (opt.fixed_passphrase)
|
2004-02-13 12:40:23 +00:00
|
|
|
|
{
|
2004-12-06 18:28:56 +00:00
|
|
|
|
argv[i++] = "--passphrase";
|
|
|
|
|
argv[i++] = opt.fixed_passphrase;
|
2004-02-13 12:40:23 +00:00
|
|
|
|
}
|
2009-04-01 10:51:53 +00:00
|
|
|
|
if (opt.agent_program)
|
|
|
|
|
{
|
|
|
|
|
argv[i++] = "--agent-program";
|
|
|
|
|
argv[i++] = opt.agent_program;
|
|
|
|
|
}
|
2004-12-06 18:28:56 +00:00
|
|
|
|
argv[i++] = "--",
|
|
|
|
|
argv[i] = NULL;
|
|
|
|
|
assert (i < sizeof argv);
|
2004-02-13 12:40:23 +00:00
|
|
|
|
|
2004-12-06 18:28:56 +00:00
|
|
|
|
return gnupg_spawn_process (pgmname, argv, infile, outfile,
|
2009-04-01 10:51:53 +00:00
|
|
|
|
setup_pinentry_env, (128 | 64),
|
2004-12-06 18:28:56 +00:00
|
|
|
|
statusfile, pid);
|
2004-02-13 12:40:23 +00:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* Assume that the reader is at a pkcs#12 message and try to import
|
2004-09-29 13:50:31 +00:00
|
|
|
|
certificates from that stupid format. We will also store secret
|
2004-02-13 12:40:23 +00:00
|
|
|
|
keys. All of the pkcs#12 parsing and key storing is handled by the
|
|
|
|
|
gpg-protect-tool, we merely have to take care of receiving the
|
|
|
|
|
certificates. On success RETFP returns a temporary file with
|
|
|
|
|
certificates. */
|
|
|
|
|
static gpg_error_t
|
2004-09-29 13:50:31 +00:00
|
|
|
|
parse_p12 (ctrl_t ctrl, ksba_reader_t reader,
|
|
|
|
|
FILE **retfp, struct stats_s *stats)
|
2004-02-13 12:40:23 +00:00
|
|
|
|
{
|
|
|
|
|
const char *pgmname;
|
|
|
|
|
gpg_error_t err = 0, child_err = 0;
|
2004-12-06 18:28:56 +00:00
|
|
|
|
int c, cont_line;
|
2004-02-13 12:40:23 +00:00
|
|
|
|
unsigned int pos;
|
|
|
|
|
FILE *tmpfp, *certfp = NULL, *fp = NULL;
|
|
|
|
|
char buffer[1024];
|
|
|
|
|
size_t nread;
|
|
|
|
|
pid_t pid = -1;
|
2004-09-29 13:50:31 +00:00
|
|
|
|
int bad_pass = 0;
|
2004-02-13 12:40:23 +00:00
|
|
|
|
|
|
|
|
|
if (!opt.protect_tool_program || !*opt.protect_tool_program)
|
2007-06-14 17:05:07 +00:00
|
|
|
|
pgmname = gnupg_module_name (GNUPG_MODULE_NAME_PROTECT_TOOL);
|
2004-02-13 12:40:23 +00:00
|
|
|
|
else
|
|
|
|
|
pgmname = opt.protect_tool_program;
|
|
|
|
|
|
|
|
|
|
*retfp = NULL;
|
|
|
|
|
|
|
|
|
|
/* To avoid an extra feeder process or doing selects and because
|
|
|
|
|
gpg-protect-tool will anyway parse the entire pkcs#12 message in
|
|
|
|
|
memory, we simply use tempfiles here and pass them to
|
|
|
|
|
the gpg-protect-tool. */
|
2007-08-22 10:55:07 +00:00
|
|
|
|
tmpfp = gnupg_tmpfile ();
|
2004-02-13 12:40:23 +00:00
|
|
|
|
if (!tmpfp)
|
|
|
|
|
{
|
2006-09-14 16:50:33 +00:00
|
|
|
|
err = gpg_error_from_syserror ();
|
2004-02-13 12:40:23 +00:00
|
|
|
|
log_error (_("error creating temporary file: %s\n"), strerror (errno));
|
|
|
|
|
goto cleanup;
|
|
|
|
|
}
|
|
|
|
|
while (!(err = ksba_reader_read (reader, buffer, sizeof buffer, &nread)))
|
|
|
|
|
{
|
2004-02-19 16:26:32 +00:00
|
|
|
|
if (nread && fwrite (buffer, nread, 1, tmpfp) != 1)
|
2004-02-13 12:40:23 +00:00
|
|
|
|
{
|
2006-09-14 16:50:33 +00:00
|
|
|
|
err = gpg_error_from_syserror ();
|
2004-02-13 12:40:23 +00:00
|
|
|
|
log_error (_("error writing to temporary file: %s\n"),
|
|
|
|
|
strerror (errno));
|
|
|
|
|
goto cleanup;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
if (gpg_err_code (err) == GPG_ERR_EOF)
|
|
|
|
|
err = 0;
|
|
|
|
|
if (err)
|
|
|
|
|
{
|
|
|
|
|
log_error (_("error reading input: %s\n"), gpg_strerror (err));
|
|
|
|
|
goto cleanup;
|
|
|
|
|
}
|
|
|
|
|
|
2007-08-22 10:55:07 +00:00
|
|
|
|
certfp = gnupg_tmpfile ();
|
2004-02-13 12:40:23 +00:00
|
|
|
|
if (!certfp)
|
|
|
|
|
{
|
2006-09-14 16:50:33 +00:00
|
|
|
|
err = gpg_error_from_syserror ();
|
2004-02-13 12:40:23 +00:00
|
|
|
|
log_error (_("error creating temporary file: %s\n"), strerror (errno));
|
|
|
|
|
goto cleanup;
|
|
|
|
|
}
|
|
|
|
|
|
2008-10-23 09:41:41 +00:00
|
|
|
|
err = popen_protect_tool (ctrl, pgmname, tmpfp, certfp, &fp, &pid);
|
2004-02-13 12:40:23 +00:00
|
|
|
|
if (err)
|
|
|
|
|
{
|
|
|
|
|
pid = -1;
|
|
|
|
|
goto cleanup;
|
|
|
|
|
}
|
|
|
|
|
fclose (tmpfp);
|
|
|
|
|
tmpfp = NULL;
|
|
|
|
|
|
|
|
|
|
/* Read stderr of the protect tool. */
|
|
|
|
|
pos = 0;
|
|
|
|
|
cont_line = 0;
|
|
|
|
|
while ((c=getc (fp)) != EOF)
|
|
|
|
|
{
|
|
|
|
|
/* fixme: We could here grep for status information of the
|
|
|
|
|
protect tool to figure out better error codes for
|
|
|
|
|
CHILD_ERR. */
|
|
|
|
|
buffer[pos++] = c;
|
2004-04-30 15:24:33 +00:00
|
|
|
|
if (pos >= sizeof buffer - 5 || c == '\n')
|
2004-02-13 12:40:23 +00:00
|
|
|
|
{
|
|
|
|
|
buffer[pos - (c == '\n')] = 0;
|
|
|
|
|
if (cont_line)
|
|
|
|
|
log_printf ("%s", buffer);
|
|
|
|
|
else
|
2004-04-30 15:24:33 +00:00
|
|
|
|
{
|
|
|
|
|
if (!strncmp (buffer, "gpg-protect-tool: [PROTECT-TOOL:] ",34))
|
|
|
|
|
{
|
|
|
|
|
char *p, *pend;
|
|
|
|
|
|
|
|
|
|
p = buffer + 34;
|
|
|
|
|
pend = strchr (p, ' ');
|
|
|
|
|
if (pend)
|
|
|
|
|
*pend = 0;
|
|
|
|
|
if ( !strcmp (p, "secretkey-stored"))
|
|
|
|
|
{
|
|
|
|
|
stats->count++;
|
|
|
|
|
stats->secret_read++;
|
|
|
|
|
stats->secret_imported++;
|
|
|
|
|
}
|
|
|
|
|
else if ( !strcmp (p, "secretkey-exists"))
|
|
|
|
|
{
|
|
|
|
|
stats->count++;
|
|
|
|
|
stats->secret_read++;
|
|
|
|
|
stats->secret_dups++;
|
|
|
|
|
}
|
|
|
|
|
else if ( !strcmp (p, "bad-passphrase"))
|
2008-10-20 13:53:23 +00:00
|
|
|
|
{
|
|
|
|
|
|
|
|
|
|
}
|
2004-04-30 15:24:33 +00:00
|
|
|
|
}
|
2004-09-29 13:50:31 +00:00
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
log_info ("%s", buffer);
|
|
|
|
|
if (!strncmp (buffer, "gpg-protect-tool: "
|
|
|
|
|
"possibly bad passphrase given",46))
|
|
|
|
|
bad_pass++;
|
|
|
|
|
}
|
2004-04-30 15:24:33 +00:00
|
|
|
|
}
|
2004-02-13 12:40:23 +00:00
|
|
|
|
pos = 0;
|
|
|
|
|
cont_line = (c != '\n');
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (pos)
|
|
|
|
|
{
|
|
|
|
|
buffer[pos] = 0;
|
|
|
|
|
if (cont_line)
|
|
|
|
|
log_printf ("%s\n", buffer);
|
|
|
|
|
else
|
|
|
|
|
log_info ("%s\n", buffer);
|
|
|
|
|
}
|
|
|
|
|
|
2004-09-29 13:50:31 +00:00
|
|
|
|
|
2007-08-29 16:59:20 +00:00
|
|
|
|
/* If we found no error in the output of the child, setup a suitable
|
2004-02-13 12:40:23 +00:00
|
|
|
|
error code, which will later be reset if the exit status of the
|
|
|
|
|
child is 0. */
|
|
|
|
|
if (!child_err)
|
|
|
|
|
child_err = gpg_error (GPG_ERR_DECRYPT_FAILED);
|
|
|
|
|
|
|
|
|
|
cleanup:
|
|
|
|
|
if (tmpfp)
|
|
|
|
|
fclose (tmpfp);
|
|
|
|
|
if (fp)
|
|
|
|
|
fclose (fp);
|
|
|
|
|
if (pid != -1)
|
|
|
|
|
{
|
2007-08-29 09:51:37 +00:00
|
|
|
|
if (!gnupg_wait_process (pgmname, pid, NULL))
|
2004-02-13 12:40:23 +00:00
|
|
|
|
child_err = 0;
|
|
|
|
|
}
|
|
|
|
|
if (!err)
|
|
|
|
|
err = child_err;
|
|
|
|
|
if (err)
|
|
|
|
|
{
|
|
|
|
|
if (certfp)
|
|
|
|
|
fclose (certfp);
|
|
|
|
|
}
|
|
|
|
|
else
|
|
|
|
|
*retfp = certfp;
|
2004-09-29 13:50:31 +00:00
|
|
|
|
|
|
|
|
|
if (bad_pass)
|
|
|
|
|
{
|
|
|
|
|
/* We only write a plain error code and not direct
|
|
|
|
|
BAD_PASSPHRASE because the pkcs12 parser might issue this
|
2008-05-20 08:00:40 +00:00
|
|
|
|
message multiple times, BAD_PASSPHRASE in general requires a
|
2004-09-29 13:50:31 +00:00
|
|
|
|
keyID and parts of the import might actually succeed so that
|
|
|
|
|
IMPORT_PROBLEM is also not appropriate. */
|
|
|
|
|
gpgsm_status_with_err_code (ctrl, STATUS_ERROR,
|
|
|
|
|
"import.parsep12", GPG_ERR_BAD_PASSPHRASE);
|
|
|
|
|
}
|
|
|
|
|
|
2004-02-13 12:40:23 +00:00
|
|
|
|
return err;
|
|
|
|
|
}
|