2 Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013
3 Ben Kibbey <bjk@luxsci.net>
5 This file is part of pwmd.
7 Pwmd is free software: you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation, either version 2 of the License, or
10 (at your option) any later version.
12 Pwmd is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with Pwmd. If not, see <http://www.gnu.org/licenses/>.
27 #include <sys/types.h>
37 #include "pwmd-error.h"
38 #include "util-misc.h"
43 #include "util-string.h"
51 mem_realloc_cb (void *data
, const void *buffer
, size_t len
)
53 membuf_t
*mem
= (membuf_t
*) data
;
59 if ((p
= xrealloc (mem
->buf
, mem
->len
+ len
)) == NULL
)
63 memcpy ((char *) mem
->buf
+ mem
->len
, buffer
, len
);
68 /* Forward status messages from gpg-agent to the client. */
70 status_cb (void *data
, const char *line
)
72 struct agent_s
*agent
= data
;
74 agent
->inquire_maxlen
= 0;
76 if (!strncmp (line
, "INQUIRE_MAXLEN ", 15))
78 agent
->inquire_maxlen
= atoi (line
+ 15);
79 if (!agent
->client_ctx
)
83 return send_status (agent
->client_ctx
, STATUS_AGENT
, "%s", line
);
87 assuan_command (struct agent_s
*a
, char **result
,
88 size_t * len
, const char *cmd
)
99 rc
= assuan_transact (a
->ctx
, cmd
, mem_realloc_cb
, &a
->data
,
100 a
->inquire_cb
, a
->inquire_data
, status_cb
, a
);
107 mem_realloc_cb (&a
->data
, "", 1);
109 *result
= (char *) a
->data
.buf
;
121 /* This commands are sent from launch_agent() after reconnecting to the agent
122 * and also from the initial client connection. */
124 send_agent_common_options (struct agent_s
*agent
)
128 rc
= send_to_agent (agent
, NULL
, NULL
, "OPTION cache-ttl-opt-preset=-1");
133 launch_agent (struct agent_s
*agent
)
136 assuan_context_t ctx
= NULL
;
137 const char *t
= NULL
;
138 static struct assuan_malloc_hooks mhooks
= { xmalloc
, xrealloc
, xfree
};
139 char *s
, buf
[LINE_MAX
];
142 agent
->did_restart
= 0;
143 s
= config_get_string ("global", "agent_env_file");
146 char *ss
= expand_homedir (s
);
149 fp
= fopen (ss
, "r");
154 while ((p
= fgets (buf
, sizeof (buf
), fp
)))
157 if (!strncmp (p
, "GPG_AGENT_INFO=", strlen ("GPG_AGENT_INFO=")))
159 setenv ("GPG_AGENT_INFO", p
+ strlen ("GPG_AGENT_INFO="),
168 log_write ("%s: %s", s
, pwmd_strerror (gpg_error_from_errno (errno
)));
173 t
= getenv ("GPG_AGENT_INFO");
175 return gpg_error (GPG_ERR_NO_AGENT
);
177 rc
= assuan_new_ext (&ctx
, GPG_ERR_SOURCE_DEFAULT
, &mhooks
,
178 debug_level
? assuan_log_cb
: NULL
, "AGENT ");
182 char **fields
= str_split (t
, ":", 0);
183 rc
= assuan_socket_connect (ctx
, fields
[0], ASSUAN_INVALID_PID
, 0);
188 assuan_release (ctx
);
193 assuan_release (agent
->ctx
);
196 rc
= send_agent_common_options (agent
);
197 if (!rc
&& agent
->pinentry_opts
.display
)
198 rc
= set_agent_option (agent
, "display", agent
->pinentry_opts
.display
);
200 if (!rc
&& agent
->pinentry_opts
.ttyname
)
201 rc
= set_agent_option (agent
, "ttyname", agent
->pinentry_opts
.ttyname
);
203 if (!rc
&& agent
->pinentry_opts
.ttytype
)
204 rc
= set_agent_option (agent
, "ttytype", agent
->pinentry_opts
.ttytype
);
206 if (!rc
&& agent
->pinentry_opts
.lc_messages
)
207 rc
= set_agent_option (agent
, "lc-messages",
208 agent
->pinentry_opts
.lc_messages
);
210 if (!rc
&& agent
->pinentry_opts
.lc_ctype
)
211 rc
= set_agent_option (agent
, "lc-ctype", agent
->pinentry_opts
.lc_ctype
);
217 send_to_agent (struct agent_s
* agent
, char **result
, size_t * len
,
218 const char *fmt
, ...)
226 rc
= launch_agent (agent
);
232 if (str_vasprintf (&cmd
, fmt
, ap
) > 0)
234 rc
= assuan_command (agent
, result
, len
, cmd
);
235 if (!agent
->restart
&& gpg_err_source (rc
) == GPG_ERR_SOURCE_DEFAULT
236 && (gpg_err_code (rc
) == GPG_ERR_ASS_CONNECT_FAILED
237 || gpg_err_code (rc
) == GPG_ERR_EPIPE
))
239 log_write (_ ("gpg-agent connection died (rc=%i), reconnecting"), rc
);
241 rc
= launch_agent (agent
);
244 agent
->did_restart
= 1;
245 rc
= assuan_command (agent
, result
, len
, cmd
);
260 agent_disconnect (struct agent_s
*agent
)
266 assuan_release (agent
->ctx
);
272 cleanup_agent (struct agent_s
*agent
)
277 pinentry_free_opts (&agent
->pinentry_opts
);
278 agent_disconnect (agent
);
283 agent_init (struct agent_s
**agent
)
285 struct agent_s
*new = xcalloc (1, sizeof (struct agent_s
));
288 return GPG_ERR_ENOMEM
;
295 inquire_cb (void *user
, const char *keyword
)
297 struct inquire_data_s
*idata
= user
;
299 if (!idata
->preset
&& (!strcmp (keyword
, "PASSPHRASE")
300 || !strcmp (keyword
, "NEW_PASSPHRASE")))
302 return agent_loopback_cb (idata
->crypto
, keyword
);
304 // SAVE --inquire-keyparam
305 else if (idata
->preset
&& !strcmp (keyword
, "KEYPARAM"))
308 return agent_loopback_cb (idata
->crypto
, keyword
);
311 if (idata
->crypto
->agent
->inquire_maxlen
312 && idata
->len
> idata
->crypto
->agent
->inquire_maxlen
)
314 log_write (_("Inquired data too large: have=%u, max=%u"), idata
->len
,
315 idata
->crypto
->agent
->inquire_maxlen
);
316 return GPG_ERR_TOO_LARGE
;
319 idata
->crypto
->agent
->inquire_maxlen
= 0;
320 return assuan_send_data (idata
->crypto
->agent
->ctx
, idata
->line
,
324 /* Retrieve the passphrase needed to decrypt the XML from the secret
325 * key using gpg-agent. */
327 agent_extract_key (struct crypto_s
*crypto
, unsigned char **result
,
331 gcry_sexp_t enc_sexp
= NULL
, tmp_sexp
;
332 struct inquire_data_s idata
= { 0 };
333 char *hexgrip
= NULL
;
335 size_t keylen
, keysize
;
337 int algo
= cipher_to_gcrypt (crypto
->hdr
.flags
);
340 rc
= gcry_cipher_algo_info (algo
, GCRYCTL_GET_KEYLEN
, NULL
, &keysize
);
344 tmp_sexp
= gcry_sexp_find_token (crypto
->ciphertext_sexp
, "enc-val", 0);
346 return gpg_error (GPG_ERR_BAD_DATA
);
348 hexgrip
= bin2hex (crypto
->grip
, sizeof (crypto
->grip
));
355 rc
= cache_is_shadowed (hexgrip
);
356 if (rc
&& rc
!= GPG_ERR_NO_DATA
)
359 shadowed
= !rc
? 1 : 0;
362 /* The key is not on a smartcard. */
363 gcry_sexp_t tmp2_sexp
= gcry_sexp_cdr (tmp_sexp
);
364 gcry_sexp_release (tmp_sexp
);
365 tmp_sexp
= gcry_sexp_nth (tmp2_sexp
, 0);
366 gcry_sexp_release (tmp2_sexp
);
367 rc
= gcry_sexp_build (&enc_sexp
, NULL
, "(enc-val (flags pkcs1) %S)",
371 rc
= gcry_sexp_build (&enc_sexp
, NULL
, "%S", tmp_sexp
);
373 gcry_sexp_release (tmp_sexp
);
377 crypto
->agent
->inquire_cb
= inquire_cb
;
378 idata
.crypto
= crypto
;
379 idata
.len
= gcry_sexp_sprint (enc_sexp
, GCRYSEXP_FMT_CANON
, NULL
, 0);
380 idata
.line
= xmalloc (idata
.len
);
387 idata
.len
= gcry_sexp_sprint (enc_sexp
, GCRYSEXP_FMT_CANON
, idata
.line
,
389 crypto
->agent
->inquire_data
= &idata
;
390 gcry_sexp_release (enc_sexp
);
392 log_write1 (_("Keygrip is %s, bits=%i"), hexgrip
,
393 gcry_pk_get_nbits (crypto
->pkey_sexp
));
394 rc
= send_to_agent (crypto
->agent
, NULL
, NULL
, "SETKEY %s", hexgrip
);
398 if (!crypto
->agent
->pinentry_opts
.desc
)
402 ("A %s is required to unlock the secret key for the "
403 "encrypted data file \"%s\". Please enter the %s "
404 "below."), shadowed
? "PIN" : _("passphrase"),
405 crypto
->filename
, shadowed
? "PIN" : _("passphrase"));
408 tmp
= plus_escape (crypto
->agent
->pinentry_opts
.desc
);
410 rc
= send_to_agent (crypto
->agent
, NULL
, NULL
, "SETKEYDESC %s", tmp
);
415 assuan_begin_confidential (crypto
->agent
->ctx
);
416 rc
= send_to_agent (crypto
->agent
, &key
, &keylen
, "PKDECRYPT");
417 assuan_end_confidential (crypto
->agent
->ctx
);
421 rc
= gcry_sexp_new (&tmp_sexp
, key
, keylen
, 1);
426 key
= (char *) gcry_sexp_nth_data (tmp_sexp
, 1, result_len
);
429 *result
= gcry_malloc (*result_len
);
433 memcpy (*result
, key
, *result_len
);
436 rc
= GPG_ERR_BAD_DATA
;
438 gcry_sexp_release (tmp_sexp
);
445 gcry_sexp_release (enc_sexp
);
447 if (rc
&& gpg_err_source (rc
) == GPG_ERR_SOURCE_UNKNOWN
)
454 /* Return an error for public key algorithms other than RSA or
455 * DSA. Others are supported by libgcrypt but I dont know what to do
456 * for ECDA or ELG. Key generation works as does signing but
457 * decryption fails for unsupported algorithms so disable them. */
459 get_key_info (gcry_sexp_t pubkey
, char **hash_str
, int *hash_type
,
460 size_t *len
, int *pk_algo
)
462 unsigned nbits
= gcry_pk_get_nbits (pubkey
);
463 gcry_sexp_t sexp
, tmp
;
467 tmp
= gcry_sexp_find_token (pubkey
, "public-key", 0);
469 return GPG_ERR_NO_PUBKEY
;
471 sexp
= gcry_sexp_nth (tmp
, 1);
472 gcry_sexp_release (tmp
);
473 algo
= gcry_sexp_nth_string (sexp
, 0);
474 gcry_sexp_release (sexp
);
478 return GPG_ERR_BAD_PUBKEY
;
481 if (!strcmp (algo
, "rsa"))
483 *pk_algo
= GCRY_PK_RSA
;
484 *hash_str
= "sha256";
485 *hash_type
= GCRY_MD_SHA256
;
486 *len
= gcry_md_get_algo_dlen (GCRY_MD_SHA256
);
488 else if (!strcmp (algo
, "dsa"))
490 *pk_algo
= GCRY_PK_DSA
;
496 *hash_type
= GCRY_MD_SHA1
;
497 *len
= gcry_md_get_algo_dlen (GCRY_MD_SHA1
);
500 *hash_str
= "sha224";
501 *hash_type
= GCRY_MD_SHA224
;
502 *len
= gcry_md_get_algo_dlen (GCRY_MD_SHA224
);
505 *hash_str
= "sha256";
506 *hash_type
= GCRY_MD_SHA256
;
507 *len
= gcry_md_get_algo_dlen (GCRY_MD_SHA256
);
510 *hash_str
= "sha384";
511 *hash_type
= GCRY_MD_SHA384
;
512 *len
= gcry_md_get_algo_dlen (GCRY_MD_SHA384
);
515 *hash_str
= "sha512";
516 *hash_type
= GCRY_MD_SHA512
;
517 *len
= gcry_md_get_algo_dlen (GCRY_MD_SHA512
);
522 rc
= GPG_ERR_UNSUPPORTED_ALGORITHM
;
529 agent_verify (gcry_sexp_t pkey
, gcry_sexp_t sig_sexp
, const void *data
,
535 gcry_sexp_t data_sexp
;
536 char *hash_str
= NULL
;
538 gpg_error_t rc
= get_key_info (pkey
, &hash_str
, &hash_type
, &hashlen
,
544 hash
= gcry_malloc (hashlen
);
546 return GPG_ERR_ENOMEM
;
548 gcry_md_hash_buffer (hash_type
, hash
, data
, len
);
549 if (pk_algo
== GCRY_PK_RSA
)
550 rc
= gcry_sexp_build (&data_sexp
, NULL
,
551 "(data (flags pkcs1) (hash %s %b))", hash_str
,
554 rc
= gcry_sexp_build (&data_sexp
, NULL
,
555 "(data (flags raw) (value %b))", hashlen
, hash
);
560 rc
= gcry_pk_verify (sig_sexp
, data_sexp
, pkey
);
561 gcry_sexp_release (data_sexp
);
567 /* Inquire data from the client. The inquire initiated from gpg-agent. */
569 agent_loopback_cb (void *user
, const char *keyword
)
571 struct crypto_s
*crypto
= user
;
573 unsigned char *result
;
577 if (!strcmp (keyword
, "KEYPARAM"))
580 rc
= assuan_inquire (crypto
->client_ctx
, keyword
, &result
, &len
, 0);
583 { // PASSPHRASE or NEW_PASSPHRASE
584 assuan_begin_confidential (crypto
->client_ctx
);
585 rc
= assuan_inquire (crypto
->client_ctx
, keyword
, &result
, &len
, 0);
586 assuan_end_confidential (crypto
->client_ctx
);
588 if (!rc
&& len
== 1 && *result
== 0)
594 if (keyparam
&& !len
)
596 char *tmp
= default_key_params (crypto
);
599 return gpg_error (GPG_ERR_ENOMEM
);
603 result
= xmalloc (len
);
604 memcpy (result
, tmp
, len
);
608 pthread_cleanup_push (xfree
, result
);
611 rc
= assuan_send_data (crypto
->agent
->ctx
, result
, len
);
614 assuan_begin_confidential (crypto
->agent
->ctx
);
615 rc
= assuan_send_data (crypto
->agent
->ctx
, result
, len
);
616 assuan_end_confidential (crypto
->agent
->ctx
);
619 pthread_cleanup_pop (1);
621 else if (gpg_err_code (rc
) == GPG_ERR_ASS_CANCELED
)
623 gpg_error_t arc
= assuan_write_line (crypto
->agent
->ctx
, "CAN");
630 arc
= assuan_read_line (crypto
->agent
->ctx
, &line
, &len
);
642 sign (gcry_sexp_t
* rsexp
, gcry_sexp_t sigpkey
, struct crypto_s
*crypto
,
643 const void *data
, size_t len
)
647 unsigned char grip
[20];
650 gcry_pk_get_keygrip (sigpkey
, grip
);
651 tmp
= bin2hex (grip
, sizeof(grip
));
652 pthread_cleanup_push (xfree
, tmp
);
653 log_write1 (_("Signed with keygrip %s"), tmp
);
654 rc
= send_to_agent (crypto
->agent
, NULL
, NULL
, "SIGKEY %s", tmp
);
655 pthread_cleanup_pop (1);
660 char *hash_str
= NULL
;
664 rc
= get_key_info (sigpkey
, &hash_str
, &hash_type
, &hashlen
, &pk_algo
);
667 hash
= gcry_malloc (hashlen
);
669 rc
= gpg_error (GPG_ERR_ENOMEM
);
673 gcry_md_hash_buffer (hash_type
, hash
, data
, len
);
674 tmp
= bin2hex (hash
, hashlen
);
676 pthread_cleanup_push (xfree
, tmp
);
677 rc
= send_to_agent (crypto
->agent
, NULL
, NULL
,
678 "SETHASH --hash=%s %s", hash_str
, tmp
);
679 pthread_cleanup_pop (1);
689 struct inquire_data_s idata
= { 0 };
691 idata
.crypto
= crypto
;
692 crypto
->agent
->inquire_data
= &idata
;
693 crypto
->agent
->inquire_cb
= inquire_cb
;
694 rc
= send_to_agent (crypto
->agent
, &result
, &len
, "PKSIGN");
697 rc
= gcry_sexp_sscan (rsexp
, NULL
, result
, len
);
702 if (rc
&& gpg_err_source (rc
) == GPG_ERR_SOURCE_UNKNOWN
)
708 /* Encrypt the data file to 'pubkey' and sign with 'sigpkey'. */
710 encrypt_data_file (assuan_context_t ctx
, struct crypto_s
* crypto
,
711 gcry_sexp_t pubkey
, gcry_sexp_t sigpkey
,
712 const char *filename
, const void *xml
, size_t len
)
717 void *enc_xml
= NULL
;
718 size_t enc_xml_len
= 0;
719 unsigned char *iv
= NULL
;
721 int algo
= cipher_to_gcrypt (crypto
->save
.hdr
.flags
);
724 unsigned char sig_grip
[20];
725 unsigned char grip
[20];
727 rc
= gcry_cipher_algo_info (algo
, GCRYCTL_GET_KEYLEN
, NULL
, &keysize
);
731 pthread_cleanup_push (gcry_free
, key
);
732 key
= gcry_random_bytes_secure (keysize
, GCRY_STRONG_RANDOM
);
733 #ifdef HAVE_PTHREAD_TESTCANCEL
734 pthread_testcancel (); // may have been a long operation
736 pthread_cleanup_pop (0);
738 return gpg_error (GPG_ERR_ENOMEM
);
740 gcry_pk_get_keygrip (pubkey
, grip
);
741 gcry_pk_get_keygrip (sigpkey
, sig_grip
);
742 pthread_cleanup_push (gcry_free
, key
);
743 rc
= encrypt_xml (ctx
, key
, keysize
, algo
, xml
, len
, &enc_xml
, &enc_xml_len
,
744 &iv
, &iv_len
, crypto
->save
.hdr
.iterations
);
747 gcry_sexp_t sig_sexp
= NULL
;
748 char *hexgrip
= bin2hex (grip
, 20);
750 pthread_cleanup_push (xfree
, iv
);
751 log_write1 (_("Encrypted with keygrip %s"), hexgrip
);
753 hexgrip
= bin2hex (sig_grip
, 20);
754 pthread_cleanup_push (gcry_free
, enc_xml
);
755 rc
= sign (&sig_sexp
, sigpkey
, crypto
, enc_xml
, enc_xml_len
);
760 rc
= agent_verify (sigpkey
, sig_sexp
, enc_xml
, enc_xml_len
);
763 gcry_sexp_t tmp_sexp
;
765 rc
= gcry_sexp_build (&tmp_sexp
, NULL
,
766 "(data (flags pkcs1) (value %b))",
770 gcry_sexp_t key_sexp
;
772 pthread_cleanup_push ((void (*)(void *)) gcry_sexp_release
,
774 rc
= gcry_pk_encrypt (&key_sexp
, tmp_sexp
, pubkey
);
775 pthread_cleanup_pop (0);
776 gcry_sexp_release (tmp_sexp
);
780 memcpy (crypto
->save
.hdr
.iv
, iv
, iv_len
);
781 crypto
->save
.hdr
.datalen
= enc_xml_len
;
782 rc
= gcry_sexp_build (&tmp_sexp
, NULL
, "%S%S", key_sexp
,
784 gcry_sexp_release (key_sexp
);
788 data_len
= gcry_sexp_sprint (tmp_sexp
,
791 data
= xmalloc (data_len
);
793 gcry_sexp_sprint (tmp_sexp
, GCRYSEXP_FMT_CANON
,
798 gcry_sexp_release (tmp_sexp
);
805 pthread_cleanup_pop (0); // enc_xml
806 pthread_cleanup_pop (1); // iv
809 gcry_sexp_release (sig_sexp
);
812 pthread_cleanup_pop (1); // key
816 pthread_cleanup_push (gcry_free
, enc_xml
);
817 rc
= write_file (crypto
, filename
, enc_xml
, enc_xml_len
, data
, data_len
,
819 pthread_cleanup_pop (1); // enc_xml
821 memcpy (&crypto
->hdr
, &crypto
->save
.hdr
, sizeof (file_header_t
));
825 if (rc
&& gpg_err_source (rc
) == GPG_ERR_SOURCE_UNKNOWN
)
831 /* Generated a new keypair from the key parameters in 'sexpstr'. */
833 generate_key (struct crypto_s
* crypto
, char *sexpstr
, int empty
, int preset
)
839 if (crypto
->save
.s2k_count
)
841 rc
= send_to_agent (crypto
->agent
, NULL
, NULL
,
842 "OPTION s2k-count=%lu", crypto
->save
.s2k_count
);
847 if (!crypto
->agent
->inquire_cb
)
848 crypto
->agent
->inquire_cb
= inquire_cb
;
850 rc
= send_to_agent (crypto
->agent
, &pkey
, &plen
, "GENKEY %s%s",
851 preset
? "--preset " : "",
852 empty
? "--no-protection" : "");
856 if (crypto
->save
.pkey
)
857 gcry_sexp_release (crypto
->save
.pkey
);
859 crypto
->save
.pkey
= NULL
;
860 rc
= gcry_sexp_new (&crypto
->save
.pkey
, pkey
, plen
, 1);
863 unsigned char grip
[20];
865 gcry_pk_get_keygrip (crypto
->save
.pkey
, grip
);
866 char *hexgrip
= bin2hex (grip
, sizeof (grip
));
867 log_write (_("Keygrip is %s"), hexgrip
);
870 if (!crypto
->save
.sigpkey
)
872 gcry_sexp_build ((gcry_sexp_t
*) & crypto
->save
.sigpkey
, NULL
, "%S",
882 set_agent_option (struct agent_s
* agent
, const char *name
, const char *value
)
884 return send_to_agent (agent
, NULL
, NULL
, "OPTION %s=%s", name
, value
);
888 set_agent_passphrase (struct crypto_s
* crypto
, const char *key
, size_t len
)
891 struct inquire_data_s idata
;
895 /* This is for use with key files or passphrases obtained from an inquire.
896 * gpg-agent uses strings as passphrases and will truncate the passphrase
897 * at the first encountered null byte. It's only a warning because the
898 * passphrase may belong to a key shared outside of pwmd. */
899 for (i
= 0; i
< len
; i
++)
903 log_write (_("WARNING: keylen=%i, truncated to %i."), len
, i
);
908 hexgrip
= bin2hex (crypto
->grip
, 20);
909 crypto
->agent
->inquire_cb
= inquire_cb
;
910 crypto
->agent
->inquire_data
= &idata
;
911 idata
.crypto
= crypto
;
912 idata
.line
= (char *) key
, idata
.len
= len
;
914 assuan_begin_confidential (crypto
->agent
->ctx
);
915 rc
= send_to_agent (crypto
->agent
, NULL
, NULL
,
916 "PRESET_PASSPHRASE --inquire %s -1", hexgrip
);
917 assuan_end_confidential (crypto
->agent
->ctx
);
924 set_pinentry_mode (struct agent_s
* agent
, const char *mode
)
926 return set_agent_option (agent
, "pinentry-mode", mode
);
930 get_pubkey_bin (struct crypto_s
* crypto
, const unsigned char *grip
,
931 gcry_sexp_t
* result
)
933 char *hexgrip
= bin2hex (grip
, 20);
937 return GPG_ERR_ENOMEM
;
939 rc
= get_pubkey (crypto
, hexgrip
, result
);
945 get_pubkey (struct crypto_s
* crypto
, const char *grip
, gcry_sexp_t
* result
)
951 rc
= send_to_agent (crypto
->agent
, &pkey
, &plen
, "READKEY %s", grip
);
953 rc
= gcry_sexp_new (result
, pkey
, plen
, 1);
960 agent_set_pinentry_options (struct agent_s
* agent
)
963 struct pinentry_option_s
*opts
= &agent
->pinentry_opts
;
965 if (!opts
->display
&& getenv ("DISPLAY"))
967 rc
= set_agent_option (agent
, "display", getenv ("DISPLAY"));
970 opts
->display
= str_dup (getenv ("DISPLAY"));
973 else if (!opts
->ttyname
&& ttyname (STDOUT_FILENO
))
975 rc
= set_agent_option (agent
, "ttyname", ttyname (STDOUT_FILENO
));
978 rc
= set_agent_option (agent
, "ttytype",
979 opts
->ttytype
? opts
->ttytype
: getenv ("TERM"));
982 xfree (opts
->ttyname
);
983 xfree (opts
->ttytype
);
984 opts
->ttyname
= str_dup (ttyname (STDOUT_FILENO
));
985 opts
->ttytype
= str_dup (getenv ("TERM"));
994 inquire_keyfile (void *user
, const char *keyword
)
996 struct crypto_s
*crypto
= user
;
997 char *filename
= crypto
->agent
->inquire_data2
;
998 char *params
= crypto
->agent
->inquire_data3
;
1005 if (!strcmp (keyword
, "KEYPARAM"))
1006 return assuan_send_data (crypto
->agent
->ctx
, params
, strlen (params
));
1008 // This function is only used when generating a new keypair.
1009 if (strcmp (keyword
, "NEW_PASSPHRASE"))
1010 return gpg_error (GPG_ERR_ASS_UNKNOWN_INQUIRE
);
1012 if (stat (filename
, &st
) == -1)
1013 return gpg_error_from_errno (errno
);
1015 if (crypto
->agent
->inquire_maxlen
1016 && st
.st_size
> crypto
->agent
->inquire_maxlen
)
1018 log_write (_("The passphrase is too large: have=%u, max=%u."),
1019 (unsigned) st
.st_size
, crypto
->agent
->inquire_maxlen
);
1020 return GPG_ERR_TOO_LARGE
;
1023 buf
= gcry_malloc_secure (st
.st_size
);
1025 return GPG_ERR_ENOMEM
;
1027 fd
= open (filename
, O_RDONLY
);
1029 rc
= gpg_error_from_errno (errno
);
1032 len
= read (fd
, buf
, st
.st_size
);
1033 if (len
== st
.st_size
)
1035 assuan_begin_confidential (crypto
->agent
->ctx
);
1036 rc
= assuan_send_data (crypto
->agent
->ctx
, buf
, len
);
1037 assuan_end_confidential (crypto
->agent
->ctx
);
1040 rc
= gpg_error_from_errno (errno
);
1042 rc
= GPG_ERR_BUFFER_TOO_SHORT
;
1051 agent_export_common (struct crypto_s
* crypto
, const char *hexgrip
,
1052 const char *sign_hexgrip
, int no_passphrase
,
1053 const void *data
, size_t datalen
, const char *outfile
,
1054 const char *keyparams
, const char *keyfile
)
1058 if (!sign_hexgrip
&& hexgrip
)
1059 sign_hexgrip
= hexgrip
;
1063 if (crypto
->sigpkey_sexp
)
1064 gcry_sexp_release (crypto
->sigpkey_sexp
);
1066 crypto
->sigpkey_sexp
= NULL
;
1067 rc
= get_pubkey (crypto
, sign_hexgrip
, &crypto
->save
.sigpkey
);
1071 gcry_pk_get_keygrip (crypto
->save
.sigpkey
, crypto
->sign_grip
);
1076 rc
= get_pubkey (crypto
, hexgrip
, &crypto
->save
.pkey
);
1078 gcry_pk_get_keygrip (crypto
->save
.pkey
, crypto
->grip
);
1082 struct inquire_data_s idata
= { 0 };
1083 char *params
= keyparams
? str_dup (keyparams
)
1084 : default_key_params (crypto
);
1086 pthread_cleanup_push (xfree
, params
);
1087 log_write (_("Generating a new keypair ..."));
1090 log_write (_("Using passphrase obtained from file '%s'"), keyfile
);
1091 rc
= set_pinentry_mode (crypto
->agent
, "loopback");
1092 crypto
->agent
->inquire_cb
= inquire_keyfile
;
1093 crypto
->agent
->inquire_data
= crypto
;
1094 crypto
->agent
->inquire_data2
= (char *) keyfile
;
1095 crypto
->agent
->inquire_data3
= params
;
1099 idata
.line
= params
;
1100 idata
.len
= strlen (params
);
1101 idata
.crypto
= crypto
;
1102 crypto
->agent
->inquire_cb
= inquire_cb
;
1103 crypto
->agent
->inquire_data
= &idata
;
1108 rc
= generate_key (crypto
, params
, no_passphrase
, 1);
1110 gcry_pk_get_keygrip (crypto
->save
.pkey
, crypto
->grip
);
1113 (void) set_pinentry_mode (crypto
->agent
, "ask");
1114 pthread_cleanup_pop (1);
1119 rc
= encrypt_data_file (NULL
, crypto
, crypto
->save
.pkey
,
1120 crypto
->save
.sigpkey
, outfile
, data
, datalen
);
1123 char *tmp
= bin2hex (crypto
->grip
, sizeof (crypto
->grip
));
1125 log_write (_("Success! Keygrip is %s."), tmp
);
1126 rc
= send_to_agent (crypto
->agent
, NULL
, NULL
,
1127 "CLEAR_PASSPHRASE --mode=normal %s", tmp
);
1132 tmp
= bin2hex (crypto
->sign_grip
, sizeof (crypto
->sign_grip
));
1133 log_write (_("Signed with keygrip %s."), tmp
);
1139 if (rc
&& gpg_err_source (rc
) == GPG_ERR_SOURCE_UNKNOWN
)
1140 rc
= gpg_error (rc
);
1146 default_key_params (struct crypto_s
*crypto
)
1148 return config_get_string (NULL
, "keyparam");
1152 agent_passwd (struct crypto_s
* crypto
)
1154 struct inquire_data_s idata
= { 0 };
1156 char *tmp
= bin2hex (crypto
->grip
, 20);
1158 idata
.crypto
= crypto
;
1159 crypto
->agent
->inquire_cb
= inquire_cb
;
1160 crypto
->agent
->inquire_data
= &idata
;
1161 rc
= send_to_agent (crypto
->agent
, NULL
, NULL
, "PASSWD --preset %s", tmp
);
1167 kill_scd (struct agent_s
* agent
)
1174 if (config_get_boolean (NULL
, "kill_scd"))
1176 rc
= send_to_agent (agent
, NULL
, NULL
, "SCD KILLSCD");
1177 if (rc
&& gpg_err_code (rc
) != GPG_ERR_NO_SCDAEMON
)
1178 log_write ("%s: %s", __FUNCTION__
, pwmd_strerror (rc
));