-/* export.c
- * Copyright (C) 2002, 2003, 2004 Free Software Foundation, Inc.
+/* export.c - Export certificates and private keys.
+ * Copyright (C) 2002, 2003, 2004, 2007, 2009,
+ * 2010 Free Software Foundation, Inc.
*
* This file is part of GnuPG.
*
* GnuPG is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
+ * the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* GnuPG is distributed in the hope that it will be useful,
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ * along with this program; if not, see <https://www.gnu.org/licenses/>.
*/
#include <config.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
-#include <unistd.h>
#include <time.h>
#include <assert.h>
-#include <signal.h>
-#include <fcntl.h>
-#include <sys/wait.h>
#include "gpgsm.h"
#include <gcrypt.h>
#include <ksba.h>
#include "keydb.h"
-#include "i18n.h"
-
-#ifdef _POSIX_OPEN_MAX
-#define MAX_OPEN_FDS _POSIX_OPEN_MAX
-#else
-#define MAX_OPEN_FDS 20
-#endif
-
+#include "../common/exechelp.h"
+#include "../common/i18n.h"
+#include "../common/sysutils.h"
+#include "minip12.h"
/* A table to store a fingerprint as used in a duplicates table. We
- don't need to hash here because a fingerprint is alrady a perfect
+ don't need to hash here because a fingerprint is already a perfect
hash value. This we use the most significant bits to index the
table and then use a linked list for the overflow. Possible
- enhancement for very large number of certictates: Add a second
- level table and then resort to a linked list. */
+ enhancement for very large number of certificates: Add a second
+ level table and then resort to a linked list. */
struct duptable_s
{
struct duptable_s *next;
#define DUPTABLE_SIZE (1 << DUPTABLE_BITS)
-static void print_short_info (ksba_cert_t cert, FILE *fp);
-static gpg_error_t export_p12 (const unsigned char *certimg, size_t certimglen,
+static void print_short_info (ksba_cert_t cert, estream_t stream);
+static gpg_error_t export_p12 (ctrl_t ctrl,
+ const unsigned char *certimg, size_t certimglen,
const char *prompt, const char *keygrip,
- FILE **retfp);
+ int rawmode,
+ void **r_result, size_t *r_resultlen);
/* Create a table used to indetify duplicated certificates. */
if (table)
{
- for (idx=0; idx < DUPTABLE_SIZE; idx++)
+ for (idx=0; idx < DUPTABLE_SIZE; idx++)
for (t = table[idx]; t; t = t2)
{
t2 = t->next;
{
size_t idx;
duptable_t t;
-
+
*exists = 0;
idx = fpr[0];
#if DUPTABLE_BITS > 16 || DUPTABLE_BITS < 8
#error cannot handle a table larger than 16 bits or smaller than 8 bits
#elif DUPTABLE_BITS > 8
- idx <<= (DUPTABLE_BITS - 8);
- idx |= (fpr[1] & ~(~0 << 4));
-#endif
+ idx <<= (DUPTABLE_BITS - 8);
+ idx |= (fpr[1] & ~(~0U << 4));
+#endif
for (t = table[idx]; t; t = t->next)
if (!memcmp (t->fpr, fpr+1, 19))
/* Insert that fingerprint. */
t = xtrymalloc (sizeof *t);
if (!t)
- return gpg_error_from_errno (errno);
+ return gpg_error_from_syserror ();
memcpy (t->fpr, fpr+1, 19);
t->next = table[idx];
table[idx] = t;
}
-
-
-/* Export all certificates or just those given in NAMES. */
+/* Export all certificates or just those given in NAMES. The output
+ is written to STREAM. */
void
-gpgsm_export (CTRL ctrl, STRLIST names, FILE *fp)
+gpgsm_export (ctrl_t ctrl, strlist_t names, estream_t stream)
{
KEYDB_HANDLE hd = NULL;
KEYDB_SEARCH_DESC *desc = NULL;
int ndesc;
- Base64Context b64writer = NULL;
+ gnupg_ksba_io_t b64writer = NULL;
ksba_writer_t writer;
- STRLIST sl;
+ strlist_t sl;
ksba_cert_t cert = NULL;
int rc=0;
int count = 0;
int i;
duptable_t *dtable;
-
+
dtable = create_duptable ();
if (!dtable)
{
goto leave;
}
- hd = keydb_new (0);
+ hd = keydb_new ();
if (!hd)
{
log_error ("keydb_new failed\n");
ndesc = 1;
else
{
- for (sl=names, ndesc=0; sl; sl = sl->next, ndesc++)
+ for (sl=names, ndesc=0; sl; sl = sl->next, ndesc++)
;
}
if (!ndesc)
{
log_error ("allocating memory for export failed: %s\n",
- gpg_strerror (OUT_OF_CORE (errno)));
+ gpg_strerror (out_of_core ()));
goto leave;
}
if (!names)
desc[0].mode = KEYDB_SEARCH_MODE_FIRST;
- else
+ else
{
- for (ndesc=0, sl=names; sl; sl = sl->next)
+ for (ndesc=0, sl=names; sl; sl = sl->next)
{
- rc = keydb_classify_name (sl->d, desc+ndesc);
+ rc = classify_user_id (sl->d, desc+ndesc, 0);
if (rc)
{
- log_error ("key `%s' not found: %s\n",
+ log_error ("key '%s' not found: %s\n",
sl->d, gpg_strerror (rc));
rc = 0;
}
}
}
- /* If all specifications are done by fingerprint, we switch to
- ephemeral mode so that _all_ currently available and matching
- certificates are exported.
-
- fixme: we should in this case keep a list of certificates to
- avoid accidential export of duplicate certificates. */
+ /* If all specifications are done by fingerprint or keygrip, we
+ switch to ephemeral mode so that _all_ currently available and
+ matching certificates are exported. */
if (names && ndesc)
{
for (i=0; (i < ndesc
&& (desc[i].mode == KEYDB_SEARCH_MODE_FPR
|| desc[i].mode == KEYDB_SEARCH_MODE_FPR20
- || desc[i].mode == KEYDB_SEARCH_MODE_FPR16)); i++)
+ || desc[i].mode == KEYDB_SEARCH_MODE_FPR16
+ || desc[i].mode == KEYDB_SEARCH_MODE_KEYGRIP)); i++)
;
if (i == ndesc)
keydb_set_ephemeral (hd, 1);
}
-
- while (!(rc = keydb_search (hd, desc, ndesc)))
+
+ while (!(rc = keydb_search (ctrl, hd, desc, ndesc)))
{
unsigned char fpr[20];
int exists;
- if (!names)
+ if (!names)
desc[0].mode = KEYDB_SEARCH_MODE_NEXT;
rc = keydb_get_cert (hd, &cert);
- if (rc)
+ if (rc)
{
log_error ("keydb_get_cert failed: %s\n", gpg_strerror (rc));
goto leave;
rc = insert_duptable (dtable, fpr, &exists);
if (rc)
{
- log_error ("inserting into duplicates table fauiled: %s\n",
+ log_error ("inserting into duplicates table failed: %s\n",
gpg_strerror (rc));
goto leave;
}
if (ctrl->create_pem)
{
if (count)
- putc ('\n', fp);
- print_short_info (cert, fp);
- putc ('\n', fp);
+ es_putc ('\n', stream);
+ print_short_info (cert, stream);
+ es_putc ('\n', stream);
}
count++;
if (!b64writer)
{
ctrl->pem_name = "CERTIFICATE";
- rc = gpgsm_create_writer (&b64writer, ctrl, fp, &writer);
+ rc = gnupg_ksba_create_writer
+ (&b64writer, ((ctrl->create_pem? GNUPG_KSBA_IO_PEM : 0)
+ | (ctrl->create_base64? GNUPG_KSBA_IO_BASE64 :0)),
+ ctrl->pem_name, stream, &writer);
if (rc)
{
log_error ("can't create writer: %s\n", gpg_strerror (rc));
if (ctrl->create_pem)
{
/* We want one certificate per PEM block */
- rc = gpgsm_finish_writer (b64writer);
- if (rc)
+ rc = gnupg_ksba_finish_writer (b64writer);
+ if (rc)
{
log_error ("write failed: %s\n", gpg_strerror (rc));
goto leave;
}
- gpgsm_destroy_writer (b64writer);
+ gnupg_ksba_destroy_writer (b64writer);
b64writer = NULL;
}
}
- ksba_cert_release (cert);
+ ksba_cert_release (cert);
cert = NULL;
}
if (rc && rc != -1)
log_error ("keydb_search failed: %s\n", gpg_strerror (rc));
else if (b64writer)
{
- rc = gpgsm_finish_writer (b64writer);
- if (rc)
+ rc = gnupg_ksba_finish_writer (b64writer);
+ if (rc)
{
log_error ("write failed: %s\n", gpg_strerror (rc));
goto leave;
}
}
-
+
leave:
- gpgsm_destroy_writer (b64writer);
+ gnupg_ksba_destroy_writer (b64writer);
ksba_cert_release (cert);
xfree (desc);
keydb_release (hd);
}
-/* Export a certificates and its private key. */
+/* Export a certificate and its private key. RAWMODE controls the
+ actual output:
+ 0 - Private key and certifciate in PKCS#12 format
+ 1 - Only unencrypted private key in PKCS#8 format
+ 2 - Only unencrypted private key in PKCS#1 format
+ */
void
-gpgsm_p12_export (ctrl_t ctrl, const char *name, FILE *fp)
+gpgsm_p12_export (ctrl_t ctrl, const char *name, estream_t stream, int rawmode)
{
+ gpg_error_t err = 0;
KEYDB_HANDLE hd;
KEYDB_SEARCH_DESC *desc = NULL;
- Base64Context b64writer = NULL;
+ gnupg_ksba_io_t b64writer = NULL;
ksba_writer_t writer;
ksba_cert_t cert = NULL;
- int rc=0;
const unsigned char *image;
size_t imagelen;
char *keygrip = NULL;
char *prompt;
- char buffer[1024];
- int nread;
- FILE *datafp = NULL;
+ void *data;
+ size_t datalen;
-
- hd = keydb_new (0);
+ hd = keydb_new ();
if (!hd)
{
log_error ("keydb_new failed\n");
if (!desc)
{
log_error ("allocating memory for export failed: %s\n",
- gpg_strerror (OUT_OF_CORE (errno)));
+ gpg_strerror (out_of_core ()));
goto leave;
}
- rc = keydb_classify_name (name, desc);
- if (rc)
+ err = classify_user_id (name, desc, 0);
+ if (err)
{
- log_error ("key `%s' not found: %s\n",
- name, gpg_strerror (rc));
+ log_error ("key '%s' not found: %s\n",
+ name, gpg_strerror (err));
goto leave;
}
- /* Lookup the certificate an make sure that it is unique. */
- rc = keydb_search (hd, desc, 1);
- if (!rc)
+ /* Lookup the certificate and make sure that it is unique. */
+ err = keydb_search (ctrl, hd, desc, 1);
+ if (!err)
{
- rc = keydb_get_cert (hd, &cert);
- if (rc)
+ err = keydb_get_cert (hd, &cert);
+ if (err)
{
- log_error ("keydb_get_cert failed: %s\n", gpg_strerror (rc));
+ log_error ("keydb_get_cert failed: %s\n", gpg_strerror (err));
goto leave;
}
-
- rc = keydb_search (hd, desc, 1);
- if (!rc)
- rc = gpg_error (GPG_ERR_AMBIGUOUS_NAME);
- else if (rc == -1 || gpg_err_code (rc) == GPG_ERR_EOF)
- rc = 0;
- if (rc)
+
+ next_ambiguous:
+ err = keydb_search (ctrl, hd, desc, 1);
+ if (!err)
{
- log_error ("key `%s' not found: %s\n",
- name, gpg_strerror (rc));
+ ksba_cert_t cert2 = NULL;
+
+ if (!keydb_get_cert (hd, &cert2))
+ {
+ if (gpgsm_certs_identical_p (cert, cert2))
+ {
+ ksba_cert_release (cert2);
+ goto next_ambiguous;
+ }
+ ksba_cert_release (cert2);
+ }
+ err = gpg_error (GPG_ERR_AMBIGUOUS_NAME);
+ }
+ else if (err == -1 || gpg_err_code (err) == GPG_ERR_EOF)
+ err = 0;
+ if (err)
+ {
+ log_error ("key '%s' not found: %s\n",
+ name, gpg_strerror (err));
goto leave;
}
}
-
+
keygrip = gpgsm_get_keygrip_hexstring (cert);
if (!keygrip || gpgsm_agent_havekey (ctrl, keygrip))
{
/* Note, that the !keygrip case indicates a bad certificate. */
- rc = gpg_error (GPG_ERR_NO_SECKEY);
- log_error ("can't export key `%s': %s\n", name, gpg_strerror (rc));
+ err = gpg_error (GPG_ERR_NO_SECKEY);
+ log_error ("can't export key '%s': %s\n", name, gpg_strerror (err));
goto leave;
}
-
+
image = ksba_cert_get_image (cert, &imagelen);
if (!image)
{
if (ctrl->create_pem)
{
- print_short_info (cert, fp);
- putc ('\n', fp);
+ print_short_info (cert, stream);
+ es_putc ('\n', stream);
}
- ctrl->pem_name = "PKCS12";
- rc = gpgsm_create_writer (&b64writer, ctrl, fp, &writer);
- if (rc)
+ if (opt.p12_charset && ctrl->create_pem && !rawmode)
{
- log_error ("can't create writer: %s\n", gpg_strerror (rc));
- goto leave;
+ es_fprintf (stream, "The passphrase is %s encoded.\n\n",
+ opt.p12_charset);
}
+ if (rawmode == 0)
+ ctrl->pem_name = "PKCS12";
+ else if (rawmode == 1)
+ ctrl->pem_name = "PRIVATE KEY";
+ else
+ ctrl->pem_name = "RSA PRIVATE KEY";
+ err = gnupg_ksba_create_writer
+ (&b64writer, ((ctrl->create_pem? GNUPG_KSBA_IO_PEM : 0)
+ | (ctrl->create_base64? GNUPG_KSBA_IO_BASE64 : 0)),
+ ctrl->pem_name, stream, &writer);
+ if (err)
+ {
+ log_error ("can't create writer: %s\n", gpg_strerror (err));
+ goto leave;
+ }
prompt = gpgsm_format_keydesc (cert);
- rc = export_p12 (image, imagelen, prompt, keygrip, &datafp);
+ err = export_p12 (ctrl, image, imagelen, prompt, keygrip, rawmode,
+ &data, &datalen);
xfree (prompt);
- if (rc)
+ if (err)
goto leave;
- rewind (datafp);
- while ( (nread = fread (buffer, 1, sizeof buffer, datafp)) > 0 )
- if ((rc = ksba_writer_write (writer, buffer, nread)))
- {
- log_error ("write failed: %s\n", gpg_strerror (rc));
- goto leave;
- }
- if (ferror (datafp))
+ err = ksba_writer_write (writer, data, datalen);
+ xfree (data);
+ if (err)
{
- rc = gpg_error_from_errno (rc);
- log_error ("error reading temporary file: %s\n", gpg_strerror (rc));
+ log_error ("write failed: %s\n", gpg_strerror (err));
goto leave;
}
if (ctrl->create_pem)
{
/* We want one certificate per PEM block */
- rc = gpgsm_finish_writer (b64writer);
- if (rc)
+ err = gnupg_ksba_finish_writer (b64writer);
+ if (err)
{
- log_error ("write failed: %s\n", gpg_strerror (rc));
+ log_error ("write failed: %s\n", gpg_strerror (err));
goto leave;
}
- gpgsm_destroy_writer (b64writer);
+ gnupg_ksba_destroy_writer (b64writer);
b64writer = NULL;
}
-
- ksba_cert_release (cert);
+
+ ksba_cert_release (cert);
cert = NULL;
leave:
- if (datafp)
- fclose (datafp);
- gpgsm_destroy_writer (b64writer);
+ gnupg_ksba_destroy_writer (b64writer);
ksba_cert_release (cert);
xfree (desc);
keydb_release (hd);
}
-/* Print some info about the certifciate CERT to FP */
+/* Print some info about the certifciate CERT to FP or STREAM */
static void
-print_short_info (ksba_cert_t cert, FILE *fp)
+print_short_info (ksba_cert_t cert, estream_t stream)
{
char *p;
ksba_sexp_t sexp;
for (idx=0; (p = ksba_cert_get_issuer (cert, idx)); idx++)
{
- fputs (!idx? "Issuer ...: "
- : "\n aka ...: ", fp);
- gpgsm_print_name (fp, p);
+ es_fputs ((!idx
+ ? "Issuer ...: "
+ : "\n aka ...: "), stream);
+ gpgsm_es_print_name (stream, p);
xfree (p);
}
- putc ('\n', fp);
+ es_putc ('\n', stream);
- fputs ("Serial ...: ", fp);
+ es_fputs ("Serial ...: ", stream);
sexp = ksba_cert_get_serial (cert);
if (sexp)
{
int len;
const unsigned char *s = sexp;
-
+
if (*s == '(')
{
s++;
for (len=0; *s && *s != ':' && digitp (s); s++)
len = len*10 + atoi_1 (s);
if (*s == ':')
- for (s++; len; len--, s++)
- fprintf (fp, "%02X", *s);
+ es_write_hexstring (stream, s+1, len, 0, NULL);
}
xfree (sexp);
}
- putc ('\n', fp);
+ es_putc ('\n', stream);
for (idx=0; (p = ksba_cert_get_subject (cert, idx)); idx++)
{
- fputs (!idx? "Subject ..: "
- : "\n aka ..: ", fp);
- gpgsm_print_name (fp, p);
+ es_fputs ((!idx
+ ? "Subject ..: "
+ : "\n aka ..: "), stream);
+ gpgsm_es_print_name (stream, p);
+ xfree (p);
+ }
+ es_putc ('\n', stream);
+
+ p = gpgsm_get_keygrip_hexstring (cert);
+ if (p)
+ {
+ es_fprintf (stream, "Keygrip ..: %s\n", p);
xfree (p);
}
- putc ('\n', fp);
}
-static gpg_error_t
-popen_protect_tool (const char *pgmname,
- FILE *infile, FILE *outfile, FILE **statusfile,
- const char *prompt, const char *keygrip,
- pid_t *pid)
+\f
+/* Parse a private key S-expression and return a malloced array with
+ the RSA parameters in pkcs#12 order. The caller needs to
+ deep-release this array. */
+static gcry_mpi_t *
+sexp_to_kparms (gcry_sexp_t sexp)
{
- gpg_error_t err;
- int fd, fdout, rp[2];
- int n, i;
-
- fflush (infile);
- rewind (infile);
- fd = fileno (infile);
- fdout = fileno (outfile);
- if (fd == -1 || fdout == -1)
- log_fatal ("no file descriptor for temporary file: %s\n",
- strerror (errno));
-
- /* Now start the protect-tool. */
- if (pipe (rp) == -1)
- {
- err = gpg_error_from_errno (errno);
- log_error (_("error creating a pipe: %s\n"), strerror (errno));
- return err;
- }
-
- *pid = fork ();
- if (*pid == -1)
- {
- err = gpg_error_from_errno (errno);
- log_error (_("error forking process: %s\n"), strerror (errno));
- close (rp[0]);
- close (rp[1]);
- return err;
- }
-
- if (!*pid)
- { /* Child. */
- const char *arg0;
-
- arg0 = strrchr (pgmname, '/');
- if (arg0)
- arg0++;
- else
- arg0 = pgmname;
-
- /* Connect the infile to stdin. */
- if (fd != 0 && dup2 (fd, 0) == -1)
- log_fatal ("dup2 stdin failed: %s\n", strerror (errno));
-
- /* Connect the outfile to stdout. */
- if (fdout != 1 && dup2 (fdout, 1) == -1)
- log_fatal ("dup2 stdout failed: %s\n", strerror (errno));
-
- /* Connect stderr to our pipe. */
- if (rp[1] != 2 && dup2 (rp[1], 2) == -1)
- log_fatal ("dup2 stderr failed: %s\n", strerror (errno));
-
- /* Close all other files. */
- n = sysconf (_SC_OPEN_MAX);
- if (n < 0)
- n = MAX_OPEN_FDS;
- for (i=3; i < n; i++)
- close(i);
- errno = 0;
-
- setup_pinentry_env ();
-
- execlp (pgmname, arg0,
- "--homedir", opt.homedir,
- "--p12-export",
- "--prompt", prompt?prompt:"",
- "--",
- keygrip,
- NULL);
- /* No way to print anything, as we have closed all streams. */
- _exit (31);
- }
-
- /* Parent. */
- close (rp[1]);
- *statusfile = fdopen (rp[0], "r");
- if (!*statusfile)
- {
- err = gpg_error_from_errno (errno);
- log_error ("can't fdopen pipe for reading: %s", strerror (errno));
- kill (*pid, SIGTERM);
- return err;
+ gcry_sexp_t list, l2;
+ const char *name;
+ const char *s;
+ size_t n;
+ int idx;
+ const char *elems;
+ gcry_mpi_t *array;
+
+ list = gcry_sexp_find_token (sexp, "private-key", 0 );
+ if(!list)
+ return NULL;
+ l2 = gcry_sexp_cadr (list);
+ gcry_sexp_release (list);
+ list = l2;
+ name = gcry_sexp_nth_data (list, 0, &n);
+ if(!name || n != 3 || memcmp (name, "rsa", 3))
+ {
+ gcry_sexp_release (list);
+ return NULL;
}
- return 0;
+ /* Parameter names used with RSA in the pkcs#12 order. */
+ elems = "nedqp--u";
+ array = xtrycalloc (strlen(elems) + 1, sizeof *array);
+ if (!array)
+ {
+ gcry_sexp_release (list);
+ return NULL;
+ }
+ for (idx=0, s=elems; *s; s++, idx++ )
+ {
+ if (*s == '-')
+ continue; /* Computed below */
+ l2 = gcry_sexp_find_token (list, s, 1);
+ if (l2)
+ {
+ array[idx] = gcry_sexp_nth_mpi (l2, 1, GCRYMPI_FMT_USG);
+ gcry_sexp_release (l2);
+ }
+ if (!array[idx]) /* Required parameter not found or invalid. */
+ {
+ for (idx=0; array[idx]; idx++)
+ gcry_mpi_release (array[idx]);
+ xfree (array);
+ gcry_sexp_release (list);
+ return NULL;
+ }
+ }
+ gcry_sexp_release (list);
+
+ array[5] = gcry_mpi_snew (0); /* compute d mod (q-1) */
+ gcry_mpi_sub_ui (array[5], array[3], 1);
+ gcry_mpi_mod (array[5], array[2], array[5]);
+
+ array[6] = gcry_mpi_snew (0); /* compute d mod (p-1) */
+ gcry_mpi_sub_ui (array[6], array[4], 1);
+ gcry_mpi_mod (array[6], array[3], array[6]);
+
+ return array;
}
static gpg_error_t
-export_p12 (const unsigned char *certimg, size_t certimglen,
- const char *prompt, const char *keygrip,
- FILE **retfp)
+export_p12 (ctrl_t ctrl, const unsigned char *certimg, size_t certimglen,
+ const char *prompt, const char *keygrip, int rawmode,
+ void **r_result, size_t *r_resultlen)
{
- const char *pgmname;
- gpg_error_t err = 0, child_err = 0;
- int i, c, cont_line;
- unsigned int pos;
- FILE *infp = NULL, *outfp = NULL, *fp = NULL;
- char buffer[1024];
- pid_t pid = -1;
-
- if (!opt.protect_tool_program || !*opt.protect_tool_program)
- pgmname = GNUPG_DEFAULT_PROTECT_TOOL;
- else
- pgmname = opt.protect_tool_program;
+ gpg_error_t err = 0;
+ void *kek = NULL;
+ size_t keklen;
+ unsigned char *wrappedkey = NULL;
+ size_t wrappedkeylen;
+ gcry_cipher_hd_t cipherhd = NULL;
+ gcry_sexp_t s_skey = NULL;
+ gcry_mpi_t *kparms = NULL;
+ unsigned char *key = NULL;
+ size_t keylen;
+ char *passphrase = NULL;
+ unsigned char *result = NULL;
+ size_t resultlen;
+ int i;
+
+ *r_result = NULL;
- infp = tmpfile ();
- if (!infp)
+ /* Get the current KEK. */
+ err = gpgsm_agent_keywrap_key (ctrl, 1, &kek, &keklen);
+ if (err)
{
- err = gpg_error_from_errno (errno);
- log_error (_("error creating temporary file: %s\n"), strerror (errno));
- goto cleanup;
+ log_error ("error getting the KEK: %s\n", gpg_strerror (err));
+ goto leave;
}
- if (fwrite (certimg, certimglen, 1, infp) != 1)
+ /* Receive the wrapped key from the agent. */
+ err = gpgsm_agent_export_key (ctrl, keygrip, prompt,
+ &wrappedkey, &wrappedkeylen);
+ if (err)
+ goto leave;
+
+
+ /* Unwrap the key. */
+ err = gcry_cipher_open (&cipherhd, GCRY_CIPHER_AES128,
+ GCRY_CIPHER_MODE_AESWRAP, 0);
+ if (err)
+ goto leave;
+ err = gcry_cipher_setkey (cipherhd, kek, keklen);
+ if (err)
+ goto leave;
+ xfree (kek);
+ kek = NULL;
+
+ if (wrappedkeylen < 24)
{
- err = gpg_error_from_errno (errno);
- log_error (_("error writing to temporary file: %s\n"),
- strerror (errno));
- goto cleanup;
+ err = gpg_error (GPG_ERR_INV_LENGTH);
+ goto leave;
}
-
- outfp = tmpfile ();
- if (!outfp)
+ keylen = wrappedkeylen - 8;
+ key = xtrymalloc_secure (keylen);
+ if (!key)
{
- err = gpg_error_from_errno (errno);
- log_error (_("error creating temporary file: %s\n"), strerror (errno));
- goto cleanup;
+ err = gpg_error_from_syserror ();
+ goto leave;
}
+ err = gcry_cipher_decrypt (cipherhd, key, keylen, wrappedkey, wrappedkeylen);
+ if (err)
+ goto leave;
+ xfree (wrappedkey);
+ wrappedkey = NULL;
+ gcry_cipher_close (cipherhd);
+ cipherhd = NULL;
+
- err = popen_protect_tool (pgmname, infp, outfp, &fp, prompt, keygrip, &pid);
+ /* Convert to a gcrypt S-expression. */
+ err = gcry_sexp_create (&s_skey, key, keylen, 0, xfree_fnc);
if (err)
- {
- pid = -1;
- goto cleanup;
- }
- fclose (infp);
- infp = NULL;
+ goto leave;
+ key = NULL; /* Key is now owned by S_KEY. */
- /* Read stderr of the protect tool. */
- pos = 0;
- cont_line = 0;
- while ((c=getc (fp)) != EOF)
+ /* Get the parameters from the S-expression. */
+ kparms = sexp_to_kparms (s_skey);
+ gcry_sexp_release (s_skey);
+ s_skey = NULL;
+ if (!kparms)
{
- /* fixme: We could here grep for status information of the
- protect tool to figure out better error codes for
- CHILD_ERR. */
- buffer[pos++] = c;
- if (pos >= 5 /*sizeof buffer - 1*/ || c == '\n')
- {
- buffer[pos - (c == '\n')] = 0;
- if (cont_line)
- log_printf ("%s", buffer);
- else
- log_info ("%s", buffer);
- pos = 0;
- cont_line = (c != '\n');
- }
+ log_error ("error converting key parameters\n");
+ err = GPG_ERR_BAD_SECKEY;
+ goto leave;
}
- if (pos)
+ if (rawmode)
{
- buffer[pos] = 0;
- if (cont_line)
- log_printf ("%s\n", buffer);
- else
- log_info ("%s\n", buffer);
+ /* Export in raw mode, that is only the pkcs#1/#8 private key. */
+ result = p12_raw_build (kparms, rawmode, &resultlen);
+ if (!result)
+ err = gpg_error (GPG_ERR_GENERAL);
}
- else if (cont_line)
- log_printf ("\n");
+ else
+ {
+ err = gpgsm_agent_ask_passphrase
+ (ctrl,
+ i18n_utf8 ("Please enter the passphrase to protect the "
+ "new PKCS#12 object."),
+ 1, &passphrase);
+ if (err)
+ goto leave;
- /* If we found no error in the output of the child, setup a suitable
- error code, which will later be reset if the exit status of the
- child is 0. */
- if (!child_err)
- child_err = gpg_error (GPG_ERR_DECRYPT_FAILED);
+ result = p12_build (kparms, certimg, certimglen, passphrase,
+ opt.p12_charset, &resultlen);
+ xfree (passphrase);
+ passphrase = NULL;
+ if (!result)
+ err = gpg_error (GPG_ERR_GENERAL);
+ }
- cleanup:
- if (infp)
- fclose (infp);
- if (fp)
- fclose (fp);
- if (pid != -1)
+ leave:
+ xfree (key);
+ gcry_sexp_release (s_skey);
+ if (kparms)
{
- int status;
+ for (i=0; kparms[i]; i++)
+ gcry_mpi_release (kparms[i]);
+ xfree (kparms);
+ }
+ gcry_cipher_close (cipherhd);
+ xfree (wrappedkey);
+ xfree (kek);
- while ( (i=waitpid (pid, &status, 0)) == -1 && errno == EINTR)
- ;
- if (i == -1)
- log_error (_("waiting for protect-tools to terminate failed: %s\n"),
- strerror (errno));
- else if (WIFEXITED (status) && WEXITSTATUS (status) == 31)
- log_error (_("error running `%s': probably not installed\n"), pgmname);
- else if (WIFEXITED (status) && WEXITSTATUS (status))
- log_error (_("error running `%s': exit status %d\n"), pgmname,
- WEXITSTATUS (status));
- else if (!WIFEXITED (status))
- log_error (_("error running `%s': terminated\n"), pgmname);
- else
- child_err = 0;
+ if (gpg_err_code (err) == GPG_ERR_BAD_PASSPHRASE)
+ {
+ /* During export this is the passphrase used to unprotect the
+ key and not the pkcs#12 thing as in export. Therefore we can
+ issue the regular passphrase status. FIXME: replace the all
+ zero keyid by a regular one. */
+ gpgsm_status (ctrl, STATUS_BAD_PASSPHRASE, "0000000000000000");
}
- if (!err)
- err = child_err;
+
if (err)
{
- if (outfp)
- fclose (outfp);
+ xfree (result);
}
else
- *retfp = outfp;
+ {
+ *r_result = result;
+ *r_resultlen = resultlen;
+ }
return err;
}
-
projects / gnupg.git / blobdiff