See ChangeLog: Fri Feb 19 15:49:15 CET 1999 Werner Koch
[gnupg.git] / g10 / import.c
index 075ecd3..640c234 100644 (file)
@@ -1,14 +1,14 @@
 /* import.c
  *     Copyright (C) 1998 Free Software Foundation, Inc.
  *
- * This file is part of GNUPG.
+ * This file is part of GnuPG.
  *
- * GNUPG is free software; you can redistribute it and/or modify
+ * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
  *
- * GNUPG is distributed in the hope that it will be useful,
+ * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
@@ -51,8 +51,8 @@ static struct {
 } stats;
 
 
-static int read_block( IOBUF a, compress_filter_context_t *cfx,
-                            PACKET **pending_pkt, KBNODE *ret_root );
+static int import( IOBUF inp, int fast, const char* fname );
+static int read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root );
 static int import_one( const char *fname, KBNODE keyblock, int fast );
 static int import_secret_one( const char *fname, KBNODE keyblock );
 static int import_revoke_cert( const char *fname, KBNODE node );
@@ -64,8 +64,12 @@ static int merge_blocks( const char *fname, KBNODE keyblock_orig,
                         int *n_uids, int *n_sigs, int *n_subk );
 static int append_uid( KBNODE keyblock, KBNODE node, int *n_sigs,
                             const char *fname, u32 *keyid );
+static int append_key( KBNODE keyblock, KBNODE node, int *n_sigs,
+                            const char *fname, u32 *keyid );
 static int merge_sigs( KBNODE dst, KBNODE src, int *n_sigs,
                             const char *fname, u32 *keyid );
+static int merge_keysigs( KBNODE dst, KBNODE src, int *n_sigs,
+                            const char *fname, u32 *keyid );
 
 
 /****************
@@ -102,22 +106,9 @@ static int merge_sigs( KBNODE dst, KBNODE src, int *n_sigs,
 int
 import_keys( const char *fname, int fast )
 {
-    armor_filter_context_t afx;
-    compress_filter_context_t cfx;
-    PACKET *pending_pkt = NULL;
     IOBUF inp = NULL;
-    KBNODE keyblock;
-    int rc = 0;
-    ulong count=0;
-
-    memset( &afx, 0, sizeof afx);
-    memset( &cfx, 0, sizeof cfx);
-    afx.only_keyblocks = 1;
-
-    /* fixme: don't use static variables */
-    memset( &stats, 0, sizeof( stats ) );
+    int rc;
 
-    /* open file */
     inp = iobuf_open(fname);
     if( !fname )
        fname = "[stdin]";
@@ -126,10 +117,38 @@ import_keys( const char *fname, int fast )
        return G10ERR_OPEN_FILE;
     }
 
-    if( !opt.no_armor ) /* armored reading is not disabled */
-       iobuf_push_filter( inp, armor_filter, &afx );
+    rc = import( inp, fast, fname );
 
-    while( !(rc = read_block( inp, &cfx, &pending_pkt, &keyblock) )) {
+    iobuf_close(inp);
+    return rc;
+}
+
+int
+import_keys_stream( IOBUF inp, int fast )
+{
+    return import( inp, fast, "[stream]" );
+}
+
+static int
+import( IOBUF inp, int fast, const char* fname )
+{
+    PACKET *pending_pkt = NULL;
+    KBNODE keyblock;
+    int rc = 0;
+    ulong count=0;
+
+    /* fixme: don't use static variables */
+    memset( &stats, 0, sizeof( stats ) );
+
+    getkey_disable_caches();
+
+    if( !opt.no_armor ) { /* armored reading is not disabled */
+       armor_filter_context_t *afx = m_alloc_clear( sizeof *afx );
+       afx->only_keyblocks = 1;
+       iobuf_push_filter2( inp, armor_filter, afx, 1 );
+    }
+
+    while( !(rc = read_block( inp, &pending_pkt, &keyblock) )) {
        if( keyblock->pkt->pkttype == PKT_PUBLIC_KEY )
            rc = import_one( fname, keyblock, fast );
        else if( keyblock->pkt->pkttype == PKT_SECRET_KEY )
@@ -178,21 +197,18 @@ import_keys( const char *fname, int fast )
     if( stats.secret_dups )
        log_info(_(" secret keys unchanged: %lu\n"), stats.secret_dups );
 
-
-    iobuf_close(inp);
     return rc;
 }
 
 
 /****************
- * Read the next keyblock from stream A, CFX is used to handle
- * compressed keyblocks. PENDING_PKT should be initialzed to NULL
+ * Read the next keyblock from stream A.
+ * PENDING_PKT should be initialzed to NULL
  * and not chnaged form the caller.
  * Retunr: 0 = okay, -1 no more blocks or another errorcode.
  */
 static int
-read_block( IOBUF a, compress_filter_context_t *cfx,
-           PACKET **pending_pkt, KBNODE *ret_root )
+read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root )
 {
     int rc;
     PACKET *pkt;
@@ -237,9 +253,12 @@ read_block( IOBUF a, compress_filter_context_t *cfx,
                rc = G10ERR_COMPR_ALGO;
                goto ready;
            }
-           cfx->algo = pkt->pkt.compressed->algorithm;
-           pkt->pkt.compressed->buf = NULL;
-           iobuf_push_filter( a, compress_filter, cfx );
+           {
+               compress_filter_context_t *cfx = m_alloc_clear( sizeof *cfx );
+               cfx->algo = pkt->pkt.compressed->algorithm;
+               pkt->pkt.compressed->buf = NULL;
+               iobuf_push_filter2( a, compress_filter, cfx, 1 );
+           }
            free_packet( pkt );
            init_packet(pkt);
            break;
@@ -352,7 +371,7 @@ import_one( const char *fname, KBNODE keyblock, int fast )
            return G10ERR_GENERAL;
        }
        if( opt.verbose > 1 )
-           log_info_f( fname, _("writing to '%s'\n"),
+           log_info_f( fname, _("writing to `%s'\n"),
                                keyblock_resource_name(&kbpos) );
        if( (rc=lock_keyblock( &kbpos )) )
            log_error_f( keyblock_resource_name(&kbpos),
@@ -465,7 +484,7 @@ import_one( const char *fname, KBNODE keyblock, int fast )
                                        (ulong)keyid[1], g10_errstr(rc) );
        }
        else if( mod_key )
-           rc = update_trust_record( keyblock_orig, NULL );
+           rc = update_trust_record( keyblock_orig, 1, NULL );
        else
            rc = clear_trust_checked_flag( new_key? pk : pk_orig );
     }
@@ -654,12 +673,13 @@ import_revoke_cert( const char *fname, KBNODE node )
  * loop over the keyblock and check all self signatures.
  * Mark all user-ids with a self-signature by setting flag bit 0.
  * Mark all user-ids with an invalid self-signature by setting bit 1.
+ * This works allso for subkeys, here the subkey is marked.
  */
 static int
 chk_self_sigs( const char *fname, KBNODE keyblock,
               PKT_public_key *pk, u32 *keyid )
 {
-    KBNODE n, unode;
+    KBNODE n;
     PKT_signature *sig;
     int rc;
 
@@ -668,22 +688,51 @@ chk_self_sigs( const char *fname, KBNODE keyblock,
            continue;
        sig = n->pkt->pkt.signature;
        if( keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1] ) {
-           unode = find_prev_kbnode( keyblock, n, PKT_USER_ID );
-           if( !unode )  {
-               log_error_f(fname, _("key %08lX: no user-id for signature\n"),
-                                       (ulong)keyid[1]);
-               return -1;  /* the complete keyblock is invalid */
+           if( (sig->sig_class&~3) == 0x10 ) {
+               KBNODE unode = find_prev_kbnode( keyblock, n, PKT_USER_ID );
+               if( !unode )  {
+                   log_error_f(fname,
+                               _("key %08lX: no user-id for signature\n"),
+                                           (ulong)keyid[1]);
+                   return -1;  /* the complete keyblock is invalid */
+               }
+               rc = check_key_signature( keyblock, n, NULL);
+               if( rc ) {
+                   log_error_f( fname,  rc == G10ERR_PUBKEY_ALGO ?
+                        _("key %08lX: unsupported public key algorithm\n"):
+                        _("key %08lX: invalid self-signature\n"),
+                                    (ulong)keyid[1]);
+
+                   unode->flag |= 2; /* mark as invalid */
+               }
+               unode->flag |= 1; /* mark that signature checked */
            }
-           rc = check_key_signature( keyblock, n, NULL);
-           if( rc ) {
-               log_error_f( fname,  rc == G10ERR_PUBKEY_ALGO ?
-                         _("key %08lX: unsupported public key algorithm\n"):
-                         _("key %08lX: invalid self-signature\n"),
-                                (ulong)keyid[1]);
-
-               unode->flag |= 2; /* mark as invalid */
+           else if( sig->sig_class == 0x18 ) {
+               KBNODE knode = find_prev_kbnode( keyblock,
+                                                n, PKT_PUBLIC_SUBKEY );
+               if( !knode )
+                   knode = find_prev_kbnode( keyblock,
+                                                n, PKT_SECRET_SUBKEY );
+
+               if( !knode )  {
+                   log_error_f(fname,
+                             _("key %08lX: no subkey for key binding\n"),
+                                           (ulong)keyid[1]);
+                   n->flag |= 4; /* delete this */
+               }
+               else {
+                   rc = check_key_signature( keyblock, n, NULL);
+                   if( rc ) {
+                       log_error_f( fname,  rc == G10ERR_PUBKEY_ALGO ?
+                          _("key %08lX: unsupported public key algorithm\n"):
+                          _("key %08lX: invalid subkey binding\n"),
+                                        (ulong)keyid[1]);
+
+                       knode->flag |= 2; /* mark as invalid */
+                   }
+                   knode->flag |= 1; /* mark that signature checked */
+               }
            }
-           unode->flag |= 1; /* mark that user-id checked */
        }
     }
     return 0;
@@ -723,6 +772,22 @@ delete_inv_parts( const char *fname, KBNODE keyblock, u32 *keyid )
            else
                nvalid++;
        }
+       else if(    node->pkt->pkttype == PKT_PUBLIC_SUBKEY
+                || node->pkt->pkttype == PKT_SECRET_SUBKEY ) {
+           if( (node->flag & 2) || !(node->flag & 1) ) {
+               if( opt.verbose ) {
+                   log_info_f(fname, _("key %08lX: skipped subkey\n"),
+                                                        (ulong)keyid[1]);
+               }
+               delete_kbnode( node ); /* the subkey */
+               /* and all following signature packets */
+               while( node->next
+                      && node->next->pkt->pkttype == PKT_SIGNATURE ) {
+                   delete_kbnode( node->next );
+                   node = node->next;
+               }
+           }
+       }
        else if( node->pkt->pkttype == PKT_SIGNATURE
                 && check_pubkey_algo( node->pkt->pkt.signature->pubkey_algo)
                 && node->pkt->pkt.signature->pubkey_algo != PUBKEY_ALGO_RSA )
@@ -745,6 +810,8 @@ delete_inv_parts( const char *fname, KBNODE keyblock, u32 *keyid )
                }
            }
        }
+       else if( (node->flag & 4) ) /* marked for deletion */
+           delete_kbnode( node );
     }
 
     /* note: because keyblock is the public key, it is never marked
@@ -759,8 +826,6 @@ delete_inv_parts( const char *fname, KBNODE keyblock, u32 *keyid )
  *
  * o compare the signatures: If we already have this signature, check
  *   that they compare okay; if not, issue a warning and ask the user.
- *   FIXME: add the check that we don't have duplicate signatures and the
- *   warning in cases where the old/new signatures don't match.
  * o Simply add the signature. Can't verify here because we may not have
  *   the signature's public key yet; verification is done when putting it
  *   into the trustdb, which is done automagically as soon as this pubkey
@@ -799,20 +864,18 @@ merge_blocks( const char *fname, KBNODE keyblock_orig, KBNODE keyblock,
                KBNODE n2 = clone_kbnode(node);
                insert_kbnode( keyblock_orig, n2, 0 );
                n2->flag |= 1;
-               node->flag |= 1;
                log_info_f(fname, _("key %08lX: revocation certificate added\n"),
                                         (ulong)keyid[1]);
            }
        }
     }
 
-    /* 2nd: try to merge new ones in */
+    /* 2nd: try to merge new certificates in */
     for(onode=keyblock_orig->next; onode; onode=onode->next ) {
        if( !(onode->flag & 1) && onode->pkt->pkttype == PKT_USER_ID) {
            /* find the user id in the imported keyblock */
            for(node=keyblock->next; node; node=node->next )
-               if( !(node->flag & 1)
-                   && node->pkt->pkttype == PKT_USER_ID
+               if( node->pkt->pkttype == PKT_USER_ID
                    && !cmp_user_ids( onode->pkt->pkt.user_id,
                                          node->pkt->pkt.user_id ) )
                    break;
@@ -826,15 +889,14 @@ merge_blocks( const char *fname, KBNODE keyblock_orig, KBNODE keyblock,
 
     /* 3rd: add new user-ids */
     for(node=keyblock->next; node; node=node->next ) {
-       if( !(node->flag & 1) && node->pkt->pkttype == PKT_USER_ID) {
+       if( node->pkt->pkttype == PKT_USER_ID) {
            /* do we have this in the original keyblock */
            for(onode=keyblock_orig->next; onode; onode=onode->next )
-               if( !(onode->flag & 1)
-                   && onode->pkt->pkttype == PKT_USER_ID
-                   && cmp_user_ids( onode->pkt->pkt.user_id,
-                                    node->pkt->pkt.user_id ) )
+               if( onode->pkt->pkttype == PKT_USER_ID
+                   && !cmp_user_ids( onode->pkt->pkt.user_id,
+                                     node->pkt->pkt.user_id ) )
                    break;
-           if( !node ) { /* this is a new user id: append */
+           if( !onode ) { /* this is a new user id: append */
                rc = append_uid( keyblock_orig, node, n_sigs, fname, keyid);
                if( rc )
                    return rc;
@@ -843,8 +905,62 @@ merge_blocks( const char *fname, KBNODE keyblock_orig, KBNODE keyblock,
        }
     }
 
-    /* 4th: add new subkeys */
-    /* FIXME */
+    /* merge subkey certificates */
+    for(onode=keyblock_orig->next; onode; onode=onode->next ) {
+       if( !(onode->flag & 1)
+           &&  (   onode->pkt->pkttype == PKT_PUBLIC_SUBKEY
+                || onode->pkt->pkttype == PKT_SECRET_SUBKEY) ) {
+           /* find the subkey in the imported keyblock */
+           for(node=keyblock->next; node; node=node->next ) {
+               if( node->pkt->pkttype == PKT_PUBLIC_SUBKEY
+                   && !cmp_public_keys( onode->pkt->pkt.public_key,
+                                         node->pkt->pkt.public_key ) )
+                   break;
+               else if( node->pkt->pkttype == PKT_SECRET_SUBKEY
+                   && !cmp_secret_keys( onode->pkt->pkt.secret_key,
+                                         node->pkt->pkt.secret_key ) )
+                   break;
+           }
+           if( node ) { /* found: merge */
+               rc = merge_keysigs( onode, node, n_sigs, fname, keyid );
+               if( rc )
+                   return rc;
+           }
+       }
+    }
+
+    /* add new subkeys */
+    for(node=keyblock->next; node; node=node->next ) {
+       onode = NULL;
+       if( node->pkt->pkttype == PKT_PUBLIC_SUBKEY ) {
+           /* do we have this in the original keyblock? */
+           for(onode=keyblock_orig->next; onode; onode=onode->next )
+               if( onode->pkt->pkttype == PKT_PUBLIC_SUBKEY
+                   && !cmp_public_keys( onode->pkt->pkt.public_key,
+                                        node->pkt->pkt.public_key ) )
+                   break;
+           if( !onode ) { /* this is a new subkey: append */
+               rc = append_key( keyblock_orig, node, n_sigs, fname, keyid);
+               if( rc )
+                   return rc;
+               ++*n_subk;
+           }
+       }
+       else if( node->pkt->pkttype == PKT_SECRET_SUBKEY ) {
+           /* do we have this in the original keyblock? */
+           for(onode=keyblock_orig->next; onode; onode=onode->next )
+               if( onode->pkt->pkttype == PKT_SECRET_SUBKEY
+                   && !cmp_secret_keys( onode->pkt->pkt.secret_key,
+                                        node->pkt->pkt.secret_key ) )
+                   break;
+           if( !onode ) { /* this is a new subkey: append */
+               rc = append_key( keyblock_orig, node, n_sigs, fname, keyid);
+               if( rc )
+                   return rc;
+               ++*n_subk;
+           }
+       }
+    }
 
     return 0;
 }
@@ -858,25 +974,43 @@ static int
 append_uid( KBNODE keyblock, KBNODE node, int *n_sigs,
                                          const char *fname, u32 *keyid )
 {
-    KBNODE n;
+    KBNODE n, n_where=NULL;
 
     assert(node->pkt->pkttype == PKT_USER_ID );
-    /* at lease a self signature comes next to the user-id */
     if( node->next->pkt->pkttype == PKT_USER_ID ) {
        log_error_f(fname, _("key %08lX: our copy has no self-signature\n"),
                                                  (ulong)keyid[1]);
        return G10ERR_GENERAL;
     }
 
-    for( ;node && node->pkt->pkttype != PKT_USER_ID; node = node->next ) {
+    /* find the position */
+    for( n = keyblock; n; n_where = n, n = n->next ) {
+       if( n->pkt->pkttype == PKT_PUBLIC_SUBKEY
+           || n->pkt->pkttype == PKT_SECRET_SUBKEY )
+           break;
+    }
+    if( !n )
+       n_where = NULL;
+
+    /* and append/insert */
+    while( node ) {
        /* we add a clone to the original keyblock, because this
         * one is released first */
        n = clone_kbnode(node);
-       add_kbnode( keyblock, n );
-       node->flag |= 1;
+       if( n_where ) {
+           insert_kbnode( n_where, n, 0 );
+           n_where = n;
+       }
+       else
+           add_kbnode( keyblock, n );
        n->flag |= 1;
+       node->flag |= 1;
        if( n->pkt->pkttype == PKT_SIGNATURE )
            ++*n_sigs;
+
+       node = node->next;
+       if( node && node->pkt->pkttype != PKT_SIGNATURE )
+           break;
     }
 
     return 0;
@@ -909,33 +1043,113 @@ merge_sigs( KBNODE dst, KBNODE src, int *n_sigs,
        if( n->pkt->pkttype != PKT_SIGNATURE )
            continue;
        found = 0;
-       for(n2=dst->next; n2 && n2->pkt->pkttype != PKT_USER_ID; n2 = n2->next)
+       for(n2=dst->next; n2 && n2->pkt->pkttype != PKT_USER_ID; n2 = n2->next){
            if( n2->pkt->pkttype == PKT_SIGNATURE
                && n->pkt->pkt.signature->keyid[0]
                   == n2->pkt->pkt.signature->keyid[0]
                && n->pkt->pkt.signature->keyid[1]
-                  == n2->pkt->pkt.signature->keyid[1] ) {
-           found++;
-           break;
+                  == n2->pkt->pkt.signature->keyid[1]
+               && n->pkt->pkt.signature->timestamp
+                  <= n2->pkt->pkt.signature->timestamp
+               && n->pkt->pkt.signature->sig_class
+                  == n2->pkt->pkt.signature->sig_class ) {
+               found++;
+               break;
+           }
        }
+       if( !found ) {
+           /* This signature is new or newer, append N to DST.
+            * We add a clone to the original keyblock, because this
+            * one is released first */
+           n2 = clone_kbnode(n);
+           insert_kbnode( dst, n2, PKT_SIGNATURE );
+           n2->flag |= 1;
+           n->flag |= 1;
+           ++*n_sigs;
+       }
+    }
 
-       if( found ) { /* we already have this signature */
-           /* Hmmm: should we compare the timestamp etc?
-            * but then we have first to see whether this signature is valid
-            * - or simply add it in such a case and let trustdb logic
-            * decide whether to remove the old one
-            */
+    return 0;
+}
+
+/****************
+ * Merge the sigs from SRC onto DST. SRC and DST are both a PKT_xxx_SUBKEY.
+ */
+static int
+merge_keysigs( KBNODE dst, KBNODE src, int *n_sigs,
+                                   const char *fname, u32 *keyid )
+{
+    KBNODE n, n2;
+    int found=0;
+
+    assert(   dst->pkt->pkttype == PKT_PUBLIC_SUBKEY
+          || dst->pkt->pkttype == PKT_SECRET_SUBKEY );
+
+    for(n=src->next; n ; n = n->next ) {
+       if( n->pkt->pkttype == PKT_PUBLIC_SUBKEY
+           || n->pkt->pkttype == PKT_PUBLIC_KEY )
+           break;
+       if( n->pkt->pkttype != PKT_SIGNATURE )
            continue;
+       found = 0;
+       for(n2=dst->next; n2; n2 = n2->next){
+           if( n2->pkt->pkttype == PKT_PUBLIC_SUBKEY
+               || n2->pkt->pkttype == PKT_PUBLIC_KEY )
+               break;
+           if( n2->pkt->pkttype == PKT_SIGNATURE
+               && n->pkt->pkt.signature->keyid[0]
+                  == n2->pkt->pkt.signature->keyid[0]
+               && n->pkt->pkt.signature->keyid[1]
+                  == n2->pkt->pkt.signature->keyid[1]
+               && n->pkt->pkt.signature->timestamp
+                  <= n2->pkt->pkt.signature->timestamp
+               && n->pkt->pkt.signature->sig_class
+                  == n2->pkt->pkt.signature->sig_class ) {
+               found++;
+               break;
+           }
+       }
+       if( !found ) {
+           /* This signature is new or newer, append N to DST.
+            * We add a clone to the original keyblock, because this
+            * one is released first */
+           n2 = clone_kbnode(n);
+           insert_kbnode( dst, n2, PKT_SIGNATURE );
+           n2->flag |= 1;
+           n->flag |= 1;
+           ++*n_sigs;
        }
+    }
+
+    return 0;
+}
 
-       /* This signature is new, append N to DST it.
-        * We add a clone to the original keyblock, because this
+/****************
+ * append the subkey starting with NODE and all signatures to KEYBLOCK.
+ * Mark all new and copied packets by setting flag bit 0.
+ */
+static int
+append_key( KBNODE keyblock, KBNODE node, int *n_sigs,
+                                         const char *fname, u32 *keyid )
+{
+    KBNODE n;
+
+    assert( node->pkt->pkttype == PKT_PUBLIC_SUBKEY
+          || node->pkt->pkttype == PKT_SECRET_SUBKEY );
+
+    while(  node ) {
+       /* we add a clone to the original keyblock, because this
         * one is released first */
-       n2 = clone_kbnode(n);
-       insert_kbnode( dst, n2, PKT_SIGNATURE );
-       n2->flag |= 1;
+       n = clone_kbnode(node);
+       add_kbnode( keyblock, n );
        n->flag |= 1;
-       ++*n_sigs;
+       node->flag |= 1;
+       if( n->pkt->pkttype == PKT_SIGNATURE )
+           ++*n_sigs;
+
+       node = node->next;
+       if( node && node->pkt->pkttype != PKT_SIGNATURE )
+           break;
     }
 
     return 0;