diff options
| -rw-r--r-- | AUTHORS | 8 | ||||
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | INSTALL | 10 | ||||
| -rw-r--r-- | Makefile.am | 3 | ||||
| -rw-r--r-- | NEWS | 15 | ||||
| -rw-r--r-- | README | 17 | ||||
| -rw-r--r-- | THANKS | 3 | ||||
| -rw-r--r-- | TODO | 5 | ||||
| -rw-r--r-- | VERSION | 2 | ||||
| -rw-r--r-- | acconfig.h | 2 | ||||
| -rw-r--r-- | acinclude.m4 | 44 | ||||
| -rwxr-xr-x | checks/conventional.test | 6 | ||||
| -rw-r--r-- | cipher/ChangeLog | 4 | ||||
| -rw-r--r-- | cipher/Makefile.am | 2 | ||||
| -rw-r--r-- | cipher/cipher.c | 12 | ||||
| -rw-r--r-- | cipher/des.c | 115 | ||||
| -rw-r--r-- | cipher/des.h | 34 | ||||
| -rw-r--r-- | configure.in | 4 | ||||
| -rw-r--r-- | doc/DETAILS | 6 | ||||
| -rw-r--r-- | g10/ChangeLog | 13 | ||||
| -rw-r--r-- | g10/encr-data.c | 5 | ||||
| -rw-r--r-- | g10/g10.c | 2 | ||||
| -rw-r--r-- | g10/getkey.c | 66 | ||||
| -rw-r--r-- | g10/keydb.h | 1 | ||||
| -rw-r--r-- | g10/keyedit.c | 4 | ||||
| -rw-r--r-- | g10/pkclist.c | 7 | ||||
| -rw-r--r-- | g10/seskey.c | 1 | ||||
| -rw-r--r-- | g10/sign.c | 3 | ||||
| -rw-r--r-- | g10/trustdb.c | 2 | ||||
| -rw-r--r-- | include/cipher.h | 2 | ||||
| -rw-r--r-- | include/errors.h | 3 | ||||
| -rw-r--r-- | mpi/ChangeLog | 4 | ||||
| -rw-r--r-- | mpi/hppa1.1/udiv-qrnnd.S | 4 | ||||
| -rw-r--r-- | scripts/distfiles | 1 | ||||
| -rw-r--r-- | scripts/gnupg.spec | 59 | ||||
| -rw-r--r-- | util/ChangeLog | 4 | ||||
| -rw-r--r-- | util/miscutil.c | 8 | ||||
| -rw-r--r-- | util/secmem.c | 13 |
38 files changed, 445 insertions, 54 deletions
@@ -3,16 +3,18 @@ Authors of GNU Privacy Guard (gnupg). Werner Koch. Designed and implemented gnupg. -GPG Matthew Skala 1998-08-10 +GNUPG Matthew Skala 1998-08-10 Disclaims changes (Twofish code). mskala@ansuz.sooke.bc.ca -GPG Natural Resources Canada 1998-08-11 +GNUPG Natural Resources Canada 1998-08-11 Disclaims changes by Matthew Skala. -GPG Niklas Hernaeus ?????????? +GNUPG Niklas Hernaeus ?????????? (Weak key patches) +GNUPG Michael Roth ?????????? +(DES code) TRANSLATIONS Marco d'Itri 1997-02-22 Disclaim @@ -1,3 +1,8 @@ +Thu Sep 17 18:49:40 1998 Werner Koch (wk@(none)) + + * Makefile.am (dist-hook): Now creates RPM file. + * scripts/gnupg.spec: New template file for RPMs + Thu Jul 30 19:17:07 1998 Werner Koch (wk@(none)) * acinclude.h (WK_CHECK_IPC): New @@ -77,12 +77,22 @@ You can create them with: Installation ============ gpg is not installed as suid:root; if you want to do it, do it manually. +We will use capabilities in the future. The ~/.gnupg directory will be created if it does not exist. Your first action should be to create a key pair: "gpg --gen-key". +Creating a RPM package +====================== +The file scripts/gnupg-x.x.x.spec is used to build a RPM package: + 1. As root, copy the spec file into /usr/src/redhat/SPECS + 2. copy the tar file into /usr/src/redhat/SOURCES + 3. type: rpm -ba SPECS/gnupg-x.x.x.spec + + + Basic Installation ================== diff --git a/Makefile.am b/Makefile.am index 258ec7003..0699aac6d 100644 --- a/Makefile.am +++ b/Makefile.am @@ -13,5 +13,8 @@ dist-hook: || cp -p $(srcdir)/$$dir/$$i $(distdir)/$$dir/$$i; \ done ; \ done + @set -e; \ + sed -e 's/@pkg_version@/$(VERSION)/g' $(srcdir)/scripts/gnupg.spec \ + > $(distdir)/scripts/gnupg-$(VERSION).spec @@ -1,3 +1,18 @@ +Noteworthy changes in version 0.4.0 +----------------------------------- + * Triple DES is now supported. Michael Roth did this piece of + needed work. We have now all the coded needed to be OpenPGP + compliant. + + * Added a simple rpm spec file (see INSTALL). + + * detached and armored signatures are now using "PGP SIGNATURE", + except when --rfc1991 is used. + + * All times which are not in the yyy-mm-dd format are now printed + in local time. + + Noteworthy changes in version 0.3.5 ----------------------------------- * New option --throw-keyid to create anonymous enciphered messages. @@ -2,12 +2,7 @@ GNUPG - The GNU Privacy Guard ------------------------------- - Version 0.3 - - WARNING: IF YOU ARE ALREADY USING GNUPG YOU SHOULD NOW MAKE A BACKUP - OF "gpg" BECAUSE YOU NEED IT TO CONVERT YOUR PASSPHRASE AND OTHER - THINGS - SEE "NEWS"! - + Version 0.4 As you can see from the version number, the program may have some bugs and some features may not work at all - please report this to @@ -336,11 +331,11 @@ please subscribe before posting). -----BEGIN PGP SIGNATURE----- -Version: GNUPG v0.3.2b (GNU/Linux) +Version: GNUPG v0.3.5a (GNU/Linux) Comment: Get GNUPG from ftp://ftp.guug.de/pub/gcrypt/ -iQB1AwUBNcy3yh0Z9MEMmFelAQEUXwMAg8h8GaecR1jWVwCqaWO4oGCyWgaxvi0yfQR1Y1GC -j6Hpo5Hwa3d2UAYETL3M42/M32uxe0Wh8PMgLTWTfhV9XjwxCNg3BBDm2Zb5Enpr9UEIFOdN -OCV3J4gED4jXDOtO -=oPV/ +iQB1AwUBNgJ6bB0Z9MEMmFelAQEBHgL+JhFVCrTAK2G3NVVVQBHXU5eucNx3tQQE3UucvSBA +YaKfX8dC5QU7wfgv8nFBXMK2mnAcJhJzBT6mZwxpzTZZTh7IS4qu//R9Vgy3A06ZddxKFf2M +YFelmgdpqTL6ntJC +=JZ3m -----END PGP SIGNATURE----- @@ -27,6 +27,8 @@ Mark Adler madler@alumni.caltech.edu Martin Schulte schulte@thp.uni-koeln.de Matthew Skala mskala@ansuz.sooke.bc.ca Max Valianskiy maxcom@maxcom.ml.org +Michael Roth mroth@nessie.de +Michael Sobolev mss@despair.transas.com Nicolas Graner Nicolas.Graner@cri.u-psud.fr Niklas Hernaeus nh@sleipner.df.lth.se Nimrod Zimerman zimerman@forfree.at @@ -37,6 +39,7 @@ QingLong qinglong@bolizm.ihep.su Ralph Gillen gillen@theochem.uni-duesseldorf.de Serge Munhoven munhoven@mema.ucl.ac.be Steffen Ullrich ccrlphr@xensei.com +Steffen Zahn Steffen.Zahn@oen.siemens.de Thomas Roessler roessler@guug.de Tom Spindler dogcow@home.merit.edu Tom Zerucha tzeruch@ceddec.com @@ -1,6 +1,4 @@ - * localize asctime() - * if --libdir is used, the extensions are put in a wrong place. How does GNOME handle this or make a new option for this directory. @@ -13,8 +11,6 @@ * add test cases for invalid data (scrambled armor or other random data) - * fix the expire stuff for v4 packets. - * add some sanity checks to read_keyblock, so that we are sure that the minimal requirements are met (?) @@ -52,4 +48,5 @@ * Use "user ID", "trustdb" and "WARNING". * armor.c cannot handle concatenated armored messages. + at least it should be possible to do this for "KEY BLOCK" @@ -1 +1 @@ -0.3.5a +0.4.0 diff --git a/acconfig.h b/acconfig.h index 89e367b7c..1956d3c97 100644 --- a/acconfig.h +++ b/acconfig.h @@ -64,6 +64,8 @@ #undef HAVE_U16_TYPEDEF #undef HAVE_U32_TYPEDEF +#undef HAVE_BROKEN_MLOCK + /* One of the following macros is defined to select which of * the cipher/rand-xxxx.c should be used */ #undef USE_RAND_DUMMY diff --git a/acinclude.m4 b/acinclude.m4 index 6fe4337f4..b6c1f656f 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -155,6 +155,50 @@ define(WK_CHECK_IPC, ###################################################################### +# Check whether mlock is broken (hpux 10.20 raises a SIGBUS if mlock +# is not called from uid 0 (not tested whether uid 0 works) +###################################################################### +dnl WK_CHECK_MLOCK +dnl +define(WK_CHECK_MLOCK, + [ AC_CHECK_FUNCS(mlock) + if test "$ac_cv_func_mlock" = "yes"; then + AC_MSG_CHECKING(whether mlock is broken) + AC_TRY_RUN([ + #include <unistd.h> + #include <errno.h> + #include <sys/mman.h> + #include <sys/types.h> + #include <fcntl.h> + + int main() + { + char *pool; + int err; + long int pgsize = getpagesize(); + + pool = malloc( 4096 + pgsize ); + if( !pool ) + return 2; + pool += (pgsize - ((long int)pool % pgsize)); + + err = mlock( pool, 4096 ); + if( !err || errno == EPERM ) + return 0; /* okay */ + + return 1; /* hmmm */ + } + + ], + AC_MSG_RESULT(no), + AC_DEFINE(HAVE_BROKEN_MLOCK) + AC_MSG_RESULT(yes), + AC_MSG_RESULT(assuming no)) + fi + ]) + + +###################################################################### # progtest.m4 from gettext 0.35 ###################################################################### # Search path for a program which passes the given test. diff --git a/checks/conventional.test b/checks/conventional.test index dbf831000..5492ac988 100755 --- a/checks/conventional.test +++ b/checks/conventional.test @@ -14,4 +14,10 @@ for i in plain-1 data-80000 ; do echo "Hier spricht HAL" | $srcdir/run-gpg --passphrase-fd 0 -o y --yes x cmp $i y || error "$i: mismatch" done +for i in plain-1 data-80000 ; do + echo "Hier spricht HAL" | $srcdir/run-gpg --passphrase-fd 0 \ + --cipher-algo 3des -c -o x --yes $i + echo "Hier spricht HAL" | $srcdir/run-gpg --passphrase-fd 0 -o y --yes x + cmp $i y || error "$i: mismatch" +done diff --git a/cipher/ChangeLog b/cipher/ChangeLog index da0c03ef7..cbcea5f9e 100644 --- a/cipher/ChangeLog +++ b/cipher/ChangeLog @@ -1,3 +1,7 @@ +Thu Sep 17 19:00:06 1998 Werner Koch (wk@(none)) + + * des.c : New file from Michael Roth <mroth@nessie.de> + Mon Sep 14 11:10:55 1998 Werner Koch (wk@(none)) * blowfish.c (bf_setkey): Niklas Hernaeus patch to detect weak keys. diff --git a/cipher/Makefile.am b/cipher/Makefile.am index 5f0784c67..09edd4df9 100644 --- a/cipher/Makefile.am +++ b/cipher/Makefile.am @@ -17,6 +17,8 @@ libcipher_a_SOURCES = cipher.c \ md.c \ dynload.c \ dynload.h \ + des.c \ + des.h \ blowfish.c \ blowfish.h \ cast5.c \ diff --git a/cipher/cipher.c b/cipher/cipher.c index 2326d1dd2..95c4b70df 100644 --- a/cipher/cipher.c +++ b/cipher/cipher.c @@ -29,6 +29,7 @@ #include "util.h" #include "errors.h" #include "cipher.h" +#include "des.h" #include "blowfish.h" #include "cast5.h" #include "dynload.h" @@ -106,6 +107,17 @@ setup_cipher_table() if( !cipher_table[i].name ) BUG(); i++; + cipher_table[i].algo = CIPHER_ALGO_3DES; + cipher_table[i].name = des_get_info( cipher_table[i].algo, + &cipher_table[i].keylen, + &cipher_table[i].blocksize, + &cipher_table[i].contextsize, + &cipher_table[i].setkey, + &cipher_table[i].encrypt, + &cipher_table[i].decrypt ); + if( !cipher_table[i].name ) + BUG(); + i++; cipher_table[i].algo = CIPHER_ALGO_BLOWFISH160; cipher_table[i].name = blowfish_get_info( cipher_table[i].algo, &cipher_table[i].keylen, diff --git a/cipher/des.c b/cipher/des.c index 460194bf5..f10716a2e 100644 --- a/cipher/des.c +++ b/cipher/des.c @@ -112,14 +112,39 @@ */ +#include <config.h> +#include <string.h> /* memcpy, memcmp */ +#include <assert.h> +#include "types.h" /* for byte and u32 typedefs */ +#include "util.h" /* for log_fatal() */ +#include "des.h" +/* Some defines/checks to support standalone modules */ -#include <string.h> /* memcpy, memcmp */ +#ifndef CIPHER_ALGO_3DES + #define CIPHER_ALGO_3DES 2 +#elif CIPHER_ALGO_3DES != 2 + #error CIPHER_ALGO_3DES is defined to a wrong value. +#endif -typedef unsigned long u32; -typedef unsigned char byte; +#ifndef G10ERR_WEAK_KEY + #define G10ERR_WEAK_KEY 43 +#elif G10ERR_WEAK_KEY != 43 + #error G10ERR_WEAK_KEY is defined to a wrong value. +#endif +#ifndef G10ERR_WRONG_KEYLEN + #define G10ERR_WRONG_KEYLEN 44 +#elif G10ERR_WRONG_KEYLEN != 44 + #error G10ERR_WRONG_KEYLEN is defined to a wrong value. +#endif + + + +/* Macros used by the info function. */ +#define FNCCAST_SETKEY(f) ((int(*)(void*, byte*, unsigned))(f)) +#define FNCCAST_CRYPT(f) ((void(*)(void*, byte*, byte*))(f)) /* @@ -127,6 +152,7 @@ typedef unsigned char byte; */ typedef struct _des_ctx { + int mode; u32 encrypt_subkeys[32]; u32 decrypt_subkeys[32]; } @@ -137,6 +163,7 @@ des_ctx[1]; */ typedef struct _tripledes_ctx { + int mode; u32 encrypt_subkeys[96]; u32 decrypt_subkeys[96]; } @@ -499,7 +526,8 @@ des_setkey (struct _des_ctx *ctx, const byte * key) /* - * Electronic Codebook Mode DES encryption/decryption of data according to 'mode'. + * Electronic Codebook Mode DES encryption/decryption of data according + * to 'mode'. */ static int des_ecb_crypt (struct _des_ctx *ctx, const byte * from, byte * to, int mode) @@ -638,6 +666,16 @@ tripledes_ecb_crypt (struct _tripledes_ctx *ctx, const byte * from, byte * to, i } +/* + * Check whether the 8 byte key is weak. + */ + +static int +is_weak_key ( byte *key ) +{ + return 0; /* FIXME */ +} + /* * Performs a selftest of this DES/Triple-DES implementation. @@ -652,8 +690,7 @@ selftest (void) * need this. */ if (sizeof (u32) != 4) - return "Wrong word size for DES configured."; - + return "Wrong word size for DES configured."; /* * DES Maintenance Test @@ -714,3 +751,69 @@ selftest (void) return 0; } + + +static int +do_tripledes_setkey ( struct _tripledes_ctx *ctx, byte *key, unsigned keylen ) +{ + if( keylen != 24 ) + return G10ERR_WRONG_KEYLEN; + + if( is_weak_key( key ) || is_weak_key( key+8 ) || is_weak_key( key+16 ) ) + return G10ERR_WEAK_KEY; + + tripledes_set3keys ( ctx, key, key+8, key+16); + + return 0; +} + + +static void +do_tripledes_encrypt( struct _tripledes_ctx *ctx, byte *outbuf, byte *inbuf ) +{ + tripledes_ecb_encrypt ( ctx, inbuf, outbuf ); +} + +static void +do_tripledes_decrypt( struct _tripledes_ctx *ctx, byte *outbuf, byte *inbuf ) +{ + tripledes_ecb_decrypt ( ctx, inbuf, outbuf ); +} + + +/**************** + * Return some information about the algorithm. We need algo here to + * distinguish different flavors of the algorithm. + * Returns: A pointer to string describing the algorithm or NULL if + * the ALGO is invalid. + */ +const char * +des_get_info( int algo, size_t *keylen, + size_t *blocksize, size_t *contextsize, + int (**r_setkey)( void *c, byte *key, unsigned keylen ), + void (**r_encrypt)( void *c, byte *outbuf, byte *inbuf ), + void (**r_decrypt)( void *c, byte *outbuf, byte *inbuf ) + ) +{ + static int did_selftest = 0; + + if( !did_selftest ) { + const char *s = selftest(); + if( s ) + log_fatal("selftest failed: %s", s ); + did_selftest = 1; + } + + + if( algo == CIPHER_ALGO_3DES ) { + *keylen = 192; + *blocksize = 8; + *contextsize = sizeof(struct _tripledes_ctx); + *r_setkey = FNCCAST_SETKEY(do_tripledes_setkey); + *r_encrypt= FNCCAST_CRYPT(do_tripledes_encrypt); + *r_decrypt= FNCCAST_CRYPT(do_tripledes_decrypt); + return "3DES"; + } + return NULL; +} + diff --git a/cipher/des.h b/cipher/des.h new file mode 100644 index 000000000..f3b95ba65 --- /dev/null +++ b/cipher/des.h @@ -0,0 +1,34 @@ +/* des.h + * Copyright (C) 1998 Free Software Foundation, Inc. + * + * This file is part of GNUPG. + * + * GNUPG is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * GNUPG is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA + */ +#ifndef G10_DES_H +#define G10_DES_H + +#include "types.h" + + +const char * +des_get_info( int algo, size_t *keylen, + size_t *blocksize, size_t *contextsize, + int (**setkey)( void *c, byte *key, unsigned keylen ), + void (**encrypt)( void *c, byte *outbuf, byte *inbuf ), + void (**decrypt)( void *c, byte *outbuf, byte *inbuf ) + ); + +#endif /*G10_DES_H*/ diff --git a/configure.in b/configure.in index 49bcf43fb..bbb3eb9a4 100644 --- a/configure.in +++ b/configure.in @@ -180,10 +180,12 @@ fi dnl Checks for library functions. AC_FUNC_VPRINTF -AC_CHECK_FUNCS(strerror stpcpy strlwr tcgetattr rand strtoul mlock mmap) +AC_CHECK_FUNCS(strerror stpcpy strlwr tcgetattr rand strtoul mmap) AC_CHECK_FUNCS(memmove gettimeofday getrusage gethrtime setrlimit) AC_CHECK_FUNCS(atexit raise getpagesize strftime) +WK_CHECK_MLOCK + WK_CHECK_IPC if test "$ac_cv_header_sys_shm_h" = "yes"; then AC_DEFINE(USE_SHM_COPROCESSING) diff --git a/doc/DETAILS b/doc/DETAILS index d09871ec1..d52527ce2 100644 --- a/doc/DETAILS +++ b/doc/DETAILS @@ -41,12 +41,10 @@ Layout of the TrustDB ===================== -FIXME: use a directory record as top node instead of the pubkey record - The TrustDB is built from fixed length records, where the first byte describes the record type. All numeric values are stored in network byte order. The length of each record is 40 bytes. The first record of -the DB is always of type 1 and this is the only record of this type. +the DB is always of type 2 and this is the only record of this type. Record type 0: -------------- @@ -56,7 +54,7 @@ Record type 1: -------------- Version information for this TrustDB. This is always the first record of the DB and the only one with type 1. - 1 byte value 1 + 1 byte value 2 3 bytes 'gpg' magic value 1 byte Version of the TrustDB 3 byte reserved diff --git a/g10/ChangeLog b/g10/ChangeLog index 3a4c2911e..84ebb78bd 100644 --- a/g10/ChangeLog +++ b/g10/ChangeLog @@ -1,3 +1,16 @@ +Fri Sep 18 16:50:32 1998 Werner Koch (wk@(none)) + + * getkey.c (merge_key_and_selfsig): New. + +Fri Sep 18 10:20:11 1998 Werner Koch (wk@(none)) + + * pkclist.c (select_algo_from_prefs): Removed 3DEs kludge. + + * seskey.c (make_session_key): Fixed SERIOUS bug introduced + by adding the weak key detection code. + + * sign.c (sign_file): Changed aremor header in certain cases. + Tue Sep 15 17:52:55 1998 Werner Koch (wk@(none)) * mainproc.c (check_sig_and_print): Replaced ascime by asctimestamp. diff --git a/g10/encr-data.c b/g10/encr-data.c index 03551be7b..c9fca4d81 100644 --- a/g10/encr-data.c +++ b/g10/encr-data.c @@ -69,9 +69,12 @@ decrypt_data( PKT_encrypted *ed, DEK *dek ) log_bug("Nanu\n"); /* oops: found a bug */ dfx.cipher_hd = cipher_open( dek->algo, CIPHER_MODE_AUTO_CFB, 1 ); - if( cipher_setkey( dfx.cipher_hd, dek->key, dek->keylen ) ) + rc = cipher_setkey( dfx.cipher_hd, dek->key, dek->keylen ); + if( rc == G10ERR_WEAK_KEY ) log_info(_("Warning: Message was encrypted with " "a weak key in the symmetric cipher.\n")); + else if( rc ) + log_error("key setup failed: %s\n", g10_errstr(rc) ); cipher_setiv( dfx.cipher_hd, NULL ); @@ -381,8 +381,8 @@ i18n_init(void) { #ifdef ENABLE_NLS #ifdef HAVE_LC_MESSAGES - setlocale( LC_MESSAGES, "" ); setlocale( LC_TIME, "" ); + setlocale( LC_MESSAGES, "" ); #else setlocale( LC_ALL, "" ); #endif diff --git a/g10/getkey.c b/g10/getkey.c index 189ef0be1..f9f4c9f43 100644 --- a/g10/getkey.c +++ b/g10/getkey.c @@ -613,7 +613,7 @@ compare_name( const char *uid, size_t uidlen, const char *name, int mode ) */ static void -add_stuff_from_selfsig( KBNODE keyblock, KBNODE knode ) +merge_one_pk_and_selfsig( KBNODE keyblock, KBNODE knode ) { PKT_public_key *pk = knode->pkt->pkt.public_key; PKT_signature *sig; @@ -643,9 +643,8 @@ add_stuff_from_selfsig( KBNODE keyblock, KBNODE knode ) && sig->keyid[1] == kid[1] && sig->version > 3 ) { /* okay this is (the first) self-signature which can be used - * fixme: Check how to handle subkey bindings * FIXME: We should only use this if the signature is valid - * but this is time consuming - we muts provide another + * but this is time consuming - we must provide another * way to handle this */ const byte *p; @@ -659,6 +658,63 @@ add_stuff_from_selfsig( KBNODE keyblock, KBNODE knode ) /**************** + * merge all selfsignatures with the keys. + */ +void +merge_keys_and_selfsig( KBNODE keyblock ) +{ + PKT_public_key *pk = NULL; + PKT_secret_key *sk = NULL; + PKT_signature *sig; + KBNODE k; + u32 kid[2]; + + for(k=keyblock; k; k = k->next ) { + if( k->pkt->pkttype == PKT_PUBLIC_KEY + || k->pkt->pkttype == PKT_PUBLIC_SUBKEY ) { + pk = k->pkt->pkt.public_key; sk = NULL; + if( pk->version < 4 ) + pk = NULL; /* not needed for old keys */ + else + keyid_from_pk( pk, kid ); + } + else if( k->pkt->pkttype == PKT_SECRET_KEY + || k->pkt->pkttype == PKT_SECRET_SUBKEY ) { + pk = NULL; sk = k->pkt->pkt.secret_key; + if( sk->version < 4 ) + sk = NULL; + else + keyid_from_sk( sk, kid ); + } + else if( (pk || sk ) && k->pkt->pkttype == PKT_SIGNATURE + && (sig=k->pkt->pkt.signature)->sig_class >= 0x10 + && sig->sig_class <= 0x13 && sig->version > 3 + && sig->keyid[0] == kid[0] && sig->keyid[1] == kid[1] ) { + /* okay this is (the first) self-signature which can be used + * FIXME: We should only use this if the signature is valid + * but this is time consuming - we must provide another + * way to handle this + */ + const byte *p; + p = parse_sig_subpkt( sig->hashed_data, SIGSUBPKT_KEY_EXPIRE, NULL ); + if( pk ) { + pk->valid_days = p? ((buffer_to_u32(p)+86399L)/86400L):0; + /* fixme: add usage etc. */ + pk = NULL; /* use only the first self signature */ + } + else { + sk->valid_days = p? ((buffer_to_u32(p)+86399L)/86400L):0; + sk = NULL; /* use only the first self signature */ + } + } + } +} + + + + + +/**************** * Lookup a key by scanning all keyrings * mode 1 = lookup by NAME (exact) * 2 = lookup by NAME (substring) @@ -808,12 +864,12 @@ lookup( PKT_public_key *pk, int mode, u32 *keyid, if( primary && !pk->pubkey_usage ) { copy_public_key_new_namehash( pk, keyblock->pkt->pkt.public_key, use_namehash? namehash:NULL); - add_stuff_from_selfsig( keyblock, keyblock ); + merge_one_pk_and_selfsig( keyblock, keyblock ); } else { copy_public_key_new_namehash( pk, k->pkt->pkt.public_key, use_namehash? namehash:NULL); - add_stuff_from_selfsig( keyblock, k ); + merge_one_pk_and_selfsig( keyblock, k ); } if( ret_keyblock ) { *ret_keyblock = keyblock; diff --git a/g10/keydb.h b/g10/keydb.h index c85f93787..c16dc4b80 100644 --- a/g10/keydb.h +++ b/g10/keydb.h @@ -120,6 +120,7 @@ int get_keyblock_byfprint( KBNODE *ret_keyblock, const byte *fprint, int seckey_available( u32 *keyid ); int get_seckey_byname( PKT_secret_key *sk, const char *name, int unlock ); int enum_secret_keys( void **context, PKT_secret_key *sk, int with_subkeys ); +void merge_keys_and_selfsig( KBNODE keyblock ); char*get_user_id_string( u32 *keyid ); char*get_user_id( u32 *keyid, size_t *rn ); diff --git a/g10/keyedit.c b/g10/keyedit.c index 2b3a02023..13fa24c8c 100644 --- a/g10/keyedit.c +++ b/g10/keyedit.c @@ -85,6 +85,9 @@ get_keyblock_byname( KBNODE *keyblock, KBPOS *kbpos, const char *username ) rc = read_keyblock( kbpos, keyblock ); if( rc ) log_error("%s: keyblock read problem: %s\n", username, g10_errstr(rc)); + else + merge_keys_and_selfsig( *keyblock ); + return rc; } @@ -490,6 +493,7 @@ keyedit_menu( const char *username, STRLIST locusr ) username, g10_errstr(rc)); goto leave; } + merge_keys_and_selfsig( sec_keyblock ); } /* and now get the public key */ diff --git a/g10/pkclist.c b/g10/pkclist.c index b4d79f281..4f52eebb7 100644 --- a/g10/pkclist.c +++ b/g10/pkclist.c @@ -599,13 +599,6 @@ select_algo_from_prefs( PK_LIST pk_list, int preftype ) i = 1; /* yep; we can use compression algo 1 */ } - if( preftype == PREFTYPE_SYM && i == CIPHER_ALGO_3DES ) { - i = CIPHER_ALGO_CAST5; - if( opt.verbose ) - log_info("replacing 3DES by CAST5\n"); - } - - m_free(pref); return i; } diff --git a/g10/seskey.c b/g10/seskey.c index c268d1559..b9dab28cc 100644 --- a/g10/seskey.c +++ b/g10/seskey.c @@ -42,6 +42,7 @@ make_session_key( DEK *dek ) dek->keylen = cipher_get_keylen( dek->algo ) / 8; chd = cipher_open( dek->algo, CIPHER_MODE_AUTO_CFB, 1 ); + randomize_buffer( dek->key, dek->keylen, 1 ); for(i=0; i < 16; i++ ) { rc = cipher_setkey( chd, dek->key, dek->keylen ); if( !rc ) { diff --git a/g10/sign.c b/g10/sign.c index 63b7c8248..349b2f34d 100644 --- a/g10/sign.c +++ b/g10/sign.c @@ -220,6 +220,9 @@ sign_file( STRLIST filenames, int detached, STRLIST locusr, if( !multifile ) iobuf_push_filter( inp, md_filter, &mfx ); + if( detached && !encrypt && !opt.rfc1991 ) + afx.what = 2; + if( opt.armor && !outfile ) iobuf_push_filter( out, armor_filter, &afx ); else { diff --git a/g10/trustdb.c b/g10/trustdb.c index 893c04304..bce0df0c9 100644 --- a/g10/trustdb.c +++ b/g10/trustdb.c @@ -1636,7 +1636,7 @@ check_trust( PKT_public_key *pk, unsigned *r_trustlevel ) pk->valid_days) < cur_time ) { log_info(_("key %08lX.%lu: expired at %s\n"), keyid[1], pk->local_id, - strtimestamp( add_days_to_timestamp(pk->timestamp, + asctimestamp( add_days_to_timestamp(pk->timestamp, pk->valid_days))); trustlevel = TRUST_EXPIRED; } diff --git a/include/cipher.h b/include/cipher.h index d26812647..14b99803e 100644 --- a/include/cipher.h +++ b/include/cipher.h @@ -60,7 +60,7 @@ typedef struct { int algo; int keylen; - byte key[20]; /* this is the largest used keylen */ + byte key[24]; /* this is the largest used keylen (3des) */ } DEK; typedef struct cipher_handle_s *CIPHER_HANDLE; diff --git a/include/errors.h b/include/errors.h index 40fffcb50..4cc235e6a 100644 --- a/include/errors.h +++ b/include/errors.h @@ -62,7 +62,8 @@ #define G10ERR_TIME_CONFLICT 40 #define G10ERR_WR_PUBKEY_ALGO 41 /* unusabe pubkey algo */ #define G10ERR_FILE_EXISTS 42 -#define G10ERR_WEAK_KEY 43 +#define G10ERR_WEAK_KEY 43 /* NOTE: hardcoded intothe cipher modules */ +#define G10ERR_WRONG_KEYLEN 44 /* NOTE: hardcoded intothe cipher modules */ #ifndef HAVE_STRERROR diff --git a/mpi/ChangeLog b/mpi/ChangeLog index aa9406f5a..696fba4dc 100644 --- a/mpi/ChangeLog +++ b/mpi/ChangeLog @@ -1,3 +1,7 @@ +Thu Sep 17 18:08:50 1998 Werner Koch (wk@(none)) + + * hppa1.1/udiv-qrnnd.S: Fix from Steffen Zahn for HPUX 10.20 + Thu Aug 6 16:39:28 1998 Werner Koch,mobil,,, (wk@tobold) * mpi-bit.c (mpi_set_bytes): Removed. diff --git a/mpi/hppa1.1/udiv-qrnnd.S b/mpi/hppa1.1/udiv-qrnnd.S index 2b0e8cf76..b48eee49a 100644 --- a/mpi/hppa1.1/udiv-qrnnd.S +++ b/mpi/hppa1.1/udiv-qrnnd.S @@ -50,8 +50,8 @@ __udiv_qrnnd stws %r25,-16(0,%r30) ; n_hi stws %r24,-12(0,%r30) ; n_lo - ldil L'L$0000,%r19 - ldo R'L$0000(%r19),%r19 + ldil L'L$0000,%r19 ; ' + ldo R'L$0000(%r19),%r19 ; ' fldds -16(0,%r30),%fr5 stws %r23,-12(0,%r30) comib,<= 0,%r25,L$1 diff --git a/scripts/distfiles b/scripts/distfiles index c6a8d740e..d2b99010b 100644 --- a/scripts/distfiles +++ b/scripts/distfiles @@ -4,3 +4,4 @@ install-sh mkinstalldirs mkdiff missing +gnupg.spec diff --git a/scripts/gnupg.spec b/scripts/gnupg.spec new file mode 100644 index 000000000..075f0bf69 --- /dev/null +++ b/scripts/gnupg.spec @@ -0,0 +1,59 @@ +# +# gnupg -- gnu privacy guard +# This is a template. The dist target uses it to create the real file. +# +Summary: GPL public key crypto +Name: gnupg +Version: @pkg_version@ +Release: 3 +Copyright: GPL +Group: Applications/Cryptography +Source: ftp://ftp.guug.de/pub/gcrypt/ +URL: http://www.d.shuttle.de/isil/crypt/gnupg.html +Vendor: TechnoCage +Packager: Caskey L. Dickson <caskey-at-technocage.com> +Provides: gpg openpgp + +%description +GNUPG is a complete and free replacement for PGP. Because it does not use +IDEA or RSA it can be used without any restrictions. GNUPG is nearly in +compliance with the OpenPGP draft. + +%prep +rm -rf $RPM_BUILD_DIR/gnupg-@pkg_version@ +tar -xvzf $RPM_SOURCE_DIR/gnupg-@pkg_version@.tar.gz + +%build +cd gnupg-@pkg_version@ +chown -R root.root * +./configure +make + +%install +cd gnupg-@pkg_version@ +make install +chmod +s /usr/local/bin/gpg +chmod +s /usr/local/bin/gpgm + +%files +%doc gnupg-@pkg_version@/doc/DETAILS +%doc gnupg-@pkg_version@/INSTALL +%doc gnupg-@pkg_version@/doc/rfcs +%doc gnupg-@pkg_version@/AUTHORS +%doc gnupg-@pkg_version@/ABOUT-NLS +%doc gnupg-@pkg_version@/COPYING +%doc gnupg-@pkg_version@/ChangeLog +%doc gnupg-@pkg_version@/NEWS +%doc gnupg-@pkg_version@/README +%doc gnupg-@pkg_version@/THANKS +%doc gnupg-@pkg_version@/TODO +/usr/local/man/man1/gpg.1 +/usr/local/bin/gpg +/usr/local/bin/gpgm +/usr/local/share/locale/en/LC_MESSAGES/gnupg.mo +/usr/local/share/locale/de/LC_MESSAGES/gnupg.mo +/usr/local/share/locale/it/LC_MESSAGES/gnupg.mo +/usr/local/share/locale/fr/LC_MESSAGES/gnupg.mo +/usr/local/lib/gnupg/tiger +/usr/local/lib/gnupg/twofish + diff --git a/util/ChangeLog b/util/ChangeLog index d282d9a3e..668c40fe5 100644 --- a/util/ChangeLog +++ b/util/ChangeLog @@ -1,3 +1,7 @@ +Fri Sep 18 16:25:47 1998 Werner Koch (wk@(none)) + + * secmem.c (lock_pool): Kludge for broken mlock on HPUX 10.20 + Tue Sep 15 17:52:21 1998 Werner Koch (wk@(none)) * miscutil.c (asctimestamp): New. diff --git a/util/miscutil.c b/util/miscutil.c index 00293089d..b9f8288d9 100644 --- a/util/miscutil.c +++ b/util/miscutil.c @@ -61,16 +61,16 @@ strtimestamp( u32 stamp ) const char * asctimestamp( u32 stamp ) { - static char buffer[30]; + static char buffer[50]; struct tm *tp; time_t atime = stamp; tp = localtime( &atime ); #ifdef HAVE_STRFTIME - mem2str( buffer, asctime(tp), DIM(buffer) ); - #else - strftime( buffer, DIM(buffer)-1, "%c", tp ); + strftime( buffer, DIM(buffer)-1, "%c %Z", tp ); buffer[DIM(buffer)-1] = 0; + #else + mem2str( buffer, asctime(tp), DIM(buffer) ); #endif return buffer; } diff --git a/util/secmem.c b/util/secmem.c index 44df08b16..e75a13512 100644 --- a/util/secmem.c +++ b/util/secmem.c @@ -75,11 +75,22 @@ lock_pool( void *p, size_t n ) uid_t uid; int err; + uid = getuid(); + + #ifdef HAVE_BROKEN_MLOCK + if( uid ) + err = EPERM; + else { + err = mlock( p, n ); + if( err && errno ) + err = errno; + } + #else err = mlock( p, n ); if( err && errno ) err = errno; + #endif - uid = getuid(); if( uid && !geteuid() ) { if( setuid( uid ) ) log_fatal("failed to reset uid: %s\n", strerror(errno)); |