static void geanypg_encrypt(encrypt_data * ed, gpgme_key_t * recp, int sign, int flags)
{ /* FACTORIZE */
gpgme_data_t plain, cipher;
gpgme_error_t err;
FILE * tempfile;
tempfile = tmpfile();
if (!(tempfile))
{
g_warning("%s: %s.", _("couldn't create tempfile"), strerror(errno));
return ;
}
gpgme_data_new_from_stream(&cipher, tempfile);
gpgme_data_set_encoding(cipher, GPGME_DATA_ENCODING_ARMOR);
geanypg_load_buffer(&plain);
/* do the actual encryption */
if (sign)
err = gpgme_op_encrypt_sign(ed->ctx, recp, flags, plain, cipher);
else
err = gpgme_op_encrypt(ed->ctx, recp, flags, plain, cipher);
if (err != GPG_ERR_NO_ERROR && gpgme_err_code(err) != GPG_ERR_CANCELED)
geanypg_show_err_msg(err);
else if(gpgme_err_code(err) != GPG_ERR_CANCELED)
{
rewind(tempfile);
geanypg_write_file(tempfile);
}
fclose(tempfile);
/* release buffers */
gpgme_data_release(plain);
gpgme_data_release(cipher);
}
void crypto_asym::encrypt(const vector<string> & recipients_email, generic_file & clear, generic_file & ciphered)
{
#if GPGME_SUPPORT
gpgme_key_t *ciphering_keys = NULL;
build_key_list(recipients_email, ciphering_keys, false);
try
{
generic_file_overlay_for_gpgme o_clear = &clear;
generic_file_overlay_for_gpgme o_ciphered = &ciphered;
gpgme_error_t err;
if(!has_signatories)
err = gpgme_op_encrypt(context,
ciphering_keys,
(gpgme_encrypt_flags_t)(GPGME_ENCRYPT_NO_ENCRYPT_TO|GPGME_ENCRYPT_ALWAYS_TRUST),
o_clear.get_gpgme_handle(),
o_ciphered.get_gpgme_handle());
else
err = gpgme_op_encrypt_sign(context,
ciphering_keys,
(gpgme_encrypt_flags_t)(GPGME_ENCRYPT_NO_ENCRYPT_TO|GPGME_ENCRYPT_ALWAYS_TRUST),
o_clear.get_gpgme_handle(),
o_ciphered.get_gpgme_handle());
switch(gpgme_err_code(err))
{
case GPG_ERR_NO_ERROR:
break;
case GPG_ERR_INV_VALUE:
throw SRC_BUG;
case GPG_ERR_UNUSABLE_PUBKEY:
throw Erange("crypto_asym::encrypt", gettext("Key found but users are not all trusted"));
default:
throw Erange("crypto_asym::encrypt", string(gettext("Unexpected error reported by GPGME: ")) + tools_gpgme_strerror_r(err));
}
}
catch(...)
{
release_key_list(ciphering_keys);
throw;
}
release_key_list(ciphering_keys);
#else
throw Efeature("Asymetric Strong encryption algorithms using GPGME");
#endif
}
/* #############################################################################
*
* Description encrypt the given buffer and return the encrypted data with
* an updated size information
* Author Harry Brueckner
* Date 2005-03-31
* Arguments char* buffer - buffer to encrypt
* int size - size of the buffer
* char** newbuffer - pointer to the new buffer which holds the
* encrypted data
* int* newsize - size of the returned buffer
* PASSPHRASE_FN password_cb - callback function pointer used
* to get the current passphrase
* SHOWERROR_FN showerror_cb - callback function pointer used
* to display errors
* Return 0 if ok, otherwise 1
*/
int gpgEncrypt(char* buffer, int size, char** newbuffer, int* newsize,
PASSPHRASE_FN password_cb, SHOWERROR_FN showerror_cb)
{
gpgme_ctx_t context;
gpgme_data_t input,
output;
gpgme_encrypt_result_t result;
gpgme_error_t error;
gpgme_key_t* key = NULL;
gpgme_key_t tkey = NULL;
gpgme_sign_result_t sign_result;
int i,
keys = 0,
showerror = 1;
char* agent;
char* fpr;
char* tmpbuffer = NULL;
TRACE(99, "gpgEncrypt()", NULL);
/* we set our passphrase callback function */
passphrase_callback = password_cb;
/* we initialize the external size data */
newsize[0] = 0;
error = gpgme_new(&context);
if (!error)
{
gpgme_set_textmode(context, 1);
gpgme_set_armor(context, 1);
/* Flawfinder: ignore */
agent = getenv("GPG_AGENT_INFO");
if (!(agent && strchr(agent, ':')))
{
retries = 0;
gpgme_set_passphrase_cb(context, gpgRequestPassphrase, NULL);
}
}
if (!error)
{ error = gpgme_data_new_from_mem(&input, buffer, size, 0); }
if (!error)
{ error = gpgme_data_new(&output); }
if (!error)
{ gpgme_signers_clear(context); }
if (!error)
{
/* allocate the keys */
keys = keyCount();
key = memAlloc(__FILE__, __LINE__, sizeof(gpgme_key_t) * (keys + 1));
key[keys] = NULL;
signers = 0;
for (i = 0; i < keys && !error; i++)
{ /* add all keys */
fpr = gpgGetFingerprint(keyGet(i), LIST_SECRET);
if (fpr)
{
error = gpgme_get_key(context, fpr, &tkey, LIST_SECRET);
if (tkey -> secret);
{
error = gpgme_signers_add(context, tkey);
signers++;
}
memFreeString(__FILE__, __LINE__, fpr);
}
fpr = gpgGetFingerprint(keyGet(i), LIST_ALL);
if (fpr)
{
error = gpgme_get_key(context, fpr, &key[i], LIST_ALL);
memFreeString(__FILE__, __LINE__, fpr);
}
}
}
if (signers > 1)
{ /* as soon as we get two signers, we must no longer cache anything */
config -> keeppassphrase = 0;
clearPassphrase(1);
}
/* encrypt and sign the data */
if (!error)
{
error = gpgme_op_encrypt_sign(context, key, GPGME_ENCRYPT_ALWAYS_TRUST,
input, output);
}
/* we don't need the passphrase any longer */
clearPassphrase(0);
if (!error)
{ result = gpgme_op_encrypt_result(context); }
if (!error &&
result -> invalid_recipients)
{
tmpbuffer = memAlloc(__FILE__, __LINE__, STDBUFFERLENGTH);
snprintf(tmpbuffer, STDBUFFERLENGTH,
_("Invalid recipient encountered: %s"),
result -> invalid_recipients -> fpr);
(showerror_cb)(_("GpgMe error"), tmpbuffer);
memFree(__FILE__, __LINE__, tmpbuffer, STDBUFFERLENGTH);
showerror = 0;
error = 1;
}
if (!error)
{
sign_result = gpgme_op_sign_result(context);
error = gpgCheckSignResult(showerror_cb, sign_result,
GPGME_SIG_MODE_NORMAL);
showerror = !error;
}
if (!error)
{ tmpbuffer = gpgData2Char(output, newsize); }
/* free the keys again */
i = 0;
while (key && keys && key[i])
{ gpgme_key_unref(key[i++]); }
memFree(__FILE__, __LINE__, key, sizeof(gpgme_key_t) * (keys + 1));
gpgme_data_release(input);
gpgme_data_release(output);
gpgme_release(context);
*newbuffer = tmpbuffer;
if (error)
{
if (showerror)
{ (showerror_cb)(_("GpgMe encrypt error"), gpgme_strerror(error)); }
return 1;
}
else
return 0;
}
/* The main GPG encryption routine for libfko.
*/
int
gpgme_encrypt(fko_ctx_t fko_ctx, unsigned char *indata, size_t in_len,
const char *pw, unsigned char **out, size_t *out_len)
{
char *tmp_buf;
int res;
gpgme_ctx_t gpg_ctx = NULL;
gpgme_data_t cipher = NULL;
gpgme_data_t plaintext = NULL;
gpgme_key_t key[2] = { NULL, NULL };
gpgme_error_t err;
/* Initialize gpgme
*/
res = init_gpgme(fko_ctx);
if(res != FKO_SUCCESS)
return(res);
gpg_ctx = fko_ctx->gpg_ctx;
/* Initialize the plaintext data (place into gpgme_data object)
*/
err = gpgme_data_new_from_mem(&plaintext, (char*)indata, in_len, 1);
if(gpg_err_code(err) != GPG_ERR_NO_ERROR)
{
gpgme_release(gpg_ctx);
fko_ctx->gpg_ctx = NULL;
fko_ctx->gpg_err = err;
return(FKO_ERROR_GPGME_PLAINTEXT_DATA_OBJ);
}
/* Set protocol
*/
err = gpgme_set_protocol(gpg_ctx, GPGME_PROTOCOL_OpenPGP);
if(gpg_err_code(err) != GPG_ERR_NO_ERROR)
{
gpgme_data_release(plaintext);
gpgme_release(gpg_ctx);
fko_ctx->gpg_ctx = NULL;
fko_ctx->gpg_err = err;
return(FKO_ERROR_GPGME_SET_PROTOCOL);
}
/* Set ascii-armor off (we will be base64-encoding the encrypted data
* ourselves.
*/
gpgme_set_armor(gpg_ctx, 0);
/* The gpgme_encrypt.... functions take a recipient key array, so we add
* our single key here.
*/
key[0] = fko_ctx->recipient_key;
/* Create the buffer for our encrypted data.
*/
err = gpgme_data_new(&cipher);
if(gpg_err_code(err) != GPG_ERR_NO_ERROR)
{
gpgme_data_release(plaintext);
gpgme_release(gpg_ctx);
fko_ctx->gpg_ctx = NULL;
fko_ctx->gpg_err = err;
return(FKO_ERROR_GPGME_CIPHER_DATA_OBJ);
}
/* Here we add the signer to the gpgme context if there is one.
*/
if(fko_ctx->gpg_signer != NULL) {
gpgme_signers_clear(gpg_ctx);
err = gpgme_signers_add(gpg_ctx, fko_ctx->signer_key);
if(gpg_err_code(err) != GPG_ERR_NO_ERROR)
{
gpgme_data_release(plaintext);
gpgme_data_release(cipher);
gpgme_release(gpg_ctx);
fko_ctx->gpg_ctx = NULL;
fko_ctx->gpg_err = err;
return(FKO_ERROR_GPGME_ADD_SIGNER);
}
}
/* Set the passphrase callback.
*/
gpgme_set_passphrase_cb(gpg_ctx, my_passphrase_cb, (void*)pw);
/* Encrypt and sign (if a sig was provided) the SPA data.
*/
if(fko_ctx->gpg_signer == NULL)
err = gpgme_op_encrypt(
gpg_ctx, key, GPGME_ENCRYPT_ALWAYS_TRUST, plaintext, cipher
);
else
err = gpgme_op_encrypt_sign(
gpg_ctx, key, GPGME_ENCRYPT_ALWAYS_TRUST, plaintext, cipher
);
if(gpg_err_code(err) != GPG_ERR_NO_ERROR)
{
gpgme_data_release(plaintext);
gpgme_data_release(cipher);
gpgme_release(gpg_ctx);
fko_ctx->gpg_ctx = NULL;
fko_ctx->gpg_err = err;
if(gpgme_err_code(err) == GPG_ERR_CANCELED)
return(FKO_ERROR_GPGME_BAD_PASSPHRASE);
return(FKO_ERROR_GPGME_ENCRYPT_SIGN);
}
/* Done with the plaintext.
*/
gpgme_data_release(plaintext);
/* Get the encrypted data and its length from the gpgme data object.
* BTW, this does free the memory used by cipher.
*/
tmp_buf = gpgme_data_release_and_get_mem(cipher, out_len);
*out = malloc(*out_len); /* This is freed upon fko_ctx destruction. */
if(*out == NULL)
res = FKO_ERROR_MEMORY_ALLOCATION;
else
{
memcpy(*out, tmp_buf, *out_len);
res = FKO_SUCCESS;
}
gpgme_free(tmp_buf);
return(res);
}
/** \brief Encrypt data
*
* \param recipients Array of User ID for which the matter shall be
* encrypted using their public keys.
* \param sign_for User ID of the signer or NULL if the matter shall not be
* signed. Note that combined signing and encryption is allowed \em
* only in OpenPGP single-part (i.e. RFC 2440) mode.
* \param istream GMime input stream.
* \param ostream GMime output stream.
* \param protocol GpgME crypto protocol to use for encryption.
* \param singlepart_mode TRUE indicates single-part mode (integrated
* signature), FALSE a detached signature.
* \param trust_all_keys TRUE if all low-truct keys shall be accepted for
* encryption. Otherwise, the function will use the global callback
* to ask the user whether a low-trust key shall be accepted.
* \param parent Parent window to be passed to the callback functions.
* \param error Filled with error information on error.
* \return 0 on success, or -1 on error.
*
* Encrypt the passed matter and write the result to the output stream.
* Combined signing and encryption is allowed for single-part OpenPGP mode
* only.
*/
int
libbalsa_gpgme_encrypt(GPtrArray * recipients, const char *sign_for,
GMimeStream * istream, GMimeStream * ostream,
gpgme_protocol_t protocol, gboolean singlepart_mode,
gboolean trust_all_keys, GtkWindow * parent,
GError ** error)
{
gpgme_ctx_t ctx;
gpgme_error_t err;
gpgme_key_t *rcpt_keys;
gpgme_data_t plain;
gpgme_data_t crypt;
struct gpgme_data_cbs cbs = {
(gpgme_data_read_cb_t) g_mime_gpgme_stream_rd, /* read method */
(gpgme_data_write_cb_t) g_mime_gpgme_stream_wr, /* write method */
NULL, /* seek method */
cb_data_release /* release method */
};
/* paranoia checks */
g_return_val_if_fail(recipients != NULL, -1);
g_return_val_if_fail(GMIME_IS_STREAM(istream), -1);
g_return_val_if_fail(GMIME_IS_STREAM(ostream), GPGME_MD_NONE);
g_return_val_if_fail(protocol == GPGME_PROTOCOL_OpenPGP ||
protocol == GPGME_PROTOCOL_CMS, -1);
/* create the GpgME context */
if ((err =
gpgme_new_with_protocol(&ctx, protocol, parent,
error)) != GPG_ERR_NO_ERROR)
return -1;
/* sign & encrypt is valid only for single-part OpenPGP */
if (sign_for != NULL
&& (!singlepart_mode || protocol != GPGME_PROTOCOL_OpenPGP)) {
if (error)
g_set_error(error, GPGME_ERROR_QUARK, GPG_ERR_INV_ENGINE,
_
("combined signing and encryption is defined only for RFC 2440"));
gpgme_release(ctx);
return -1;
}
/* if requested, find the secret key for "userid" */
if (sign_for && !gpgme_add_signer(ctx, sign_for, parent, error)) {
gpgme_release(ctx);
return -1;
}
/* build the list of recipients */
if (!
(rcpt_keys =
gpgme_build_recipients(ctx, recipients, trust_all_keys, parent,
error))) {
gpgme_release(ctx);
return -1;
}
/* create the data objects */
if (protocol == GPGME_PROTOCOL_OpenPGP) {
gpgme_set_armor(ctx, 1);
gpgme_set_textmode(ctx, singlepart_mode);
} else {
gpgme_set_armor(ctx, 0);
gpgme_set_textmode(ctx, 0);
}
if ((err =
gpgme_data_new_from_cbs(&plain, &cbs,
istream)) != GPG_ERR_NO_ERROR) {
g_set_error_from_gpgme(error, err,
_("could not get data from stream"));
release_keylist(rcpt_keys);
gpgme_release(ctx);
return -1;
}
if ((err =
gpgme_data_new_from_cbs(&crypt, &cbs,
ostream)) != GPG_ERR_NO_ERROR) {
g_set_error_from_gpgme(error, err,
_("could not create new data object"));
release_keylist(rcpt_keys);
gpgme_data_release(plain);
gpgme_release(ctx);
return -1;
}
/* do the encrypt or sign and encrypt operation
* Note: we set "always trust" here, as if we detected an untrusted key
* earlier, the user already accepted it */
if (sign_for)
err =
gpgme_op_encrypt_sign(ctx, rcpt_keys,
GPGME_ENCRYPT_ALWAYS_TRUST, plain,
crypt);
else
err =
gpgme_op_encrypt(ctx, rcpt_keys, GPGME_ENCRYPT_ALWAYS_TRUST,
plain, crypt);
release_keylist(rcpt_keys);
gpgme_data_release(plain);
gpgme_data_release(crypt);
gpgme_release(ctx);
if (err != GPG_ERR_NO_ERROR) {
if (sign_for)
g_set_error_from_gpgme(error, err,
_("signing and encryption failed"));
else
g_set_error_from_gpgme(error, err, _("encryption failed"));
return -1;
} else
return 0;
}
static PyObject *
pygpgme_context_encrypt_sign(PyGpgmeContext *self, PyObject *args)
{
PyObject *py_recp, *py_plain, *py_cipher, *recp_seq = NULL, *result = NULL;
int flags, i, length;
gpgme_key_t *recp = NULL;
gpgme_data_t plain = NULL, cipher = NULL;
gpgme_error_t err;
gpgme_sign_result_t sign_result;
if (!PyArg_ParseTuple(args, "OiOO", &py_recp, &flags,
&py_plain, &py_cipher))
goto end;
recp_seq = PySequence_Fast(py_recp, "first argument must be a sequence");
if (recp_seq == NULL)
goto end;
length = PySequence_Fast_GET_SIZE(recp_seq);
recp = malloc((length + 1) * sizeof (gpgme_key_t));
for (i = 0; i < length; i++) {
PyObject *item = PySequence_Fast_GET_ITEM(recp_seq, i);
if (!PyObject_TypeCheck(item, &PyGpgmeKey_Type)) {
PyErr_SetString(PyExc_TypeError, "items in first argument "
"must be gpgme.Key objects");
goto end;
}
recp[i] = ((PyGpgmeKey *)item)->key;
}
recp[i] = NULL;
if (pygpgme_data_new(&plain, py_plain))
goto end;
if (pygpgme_data_new(&cipher, py_cipher))
goto end;
Py_BEGIN_ALLOW_THREADS;
err = gpgme_op_encrypt_sign(self->ctx, recp, flags, plain, cipher);
Py_END_ALLOW_THREADS;
sign_result = gpgme_op_sign_result(self->ctx);
/* annotate exception */
if (pygpgme_check_error(err)) {
PyObject *err_type, *err_value, *err_traceback;
PyObject *list;
gpgme_invalid_key_t key;
decode_encrypt_result(self);
PyErr_Fetch(&err_type, &err_value, &err_traceback);
PyErr_NormalizeException(&err_type, &err_value, &err_traceback);
if (sign_result == NULL)
goto error_end;
if (!PyErr_GivenExceptionMatches(err_type, pygpgme_error))
goto error_end;
list = PyList_New(0);
for (key = sign_result->invalid_signers; key != NULL; key = key->next) {
PyObject *item, *py_fpr, *err;
if (key->fpr)
py_fpr = PyUnicode_DecodeASCII(key->fpr, strlen(key->fpr),
"replace");
else {
py_fpr = Py_None;
Py_INCREF(py_fpr);
}
err = pygpgme_error_object(key->reason);
item = Py_BuildValue("(NN)", py_fpr, err);
PyList_Append(list, item);
Py_DECREF(item);
}
PyObject_SetAttrString(err_value, "invalid_signers", list);
Py_DECREF(list);
list = pygpgme_newsiglist_new(sign_result->signatures);
PyObject_SetAttrString(err_value, "signatures", list);
Py_DECREF(list);
error_end:
PyErr_Restore(err_type, err_value, err_traceback);
goto end;
}
if (sign_result)
result = pygpgme_newsiglist_new(sign_result->signatures);
else
result = PyList_New(0);
end:
if (recp != NULL)
free(recp);
Py_XDECREF(recp_seq);
if (plain != NULL)
gpgme_data_release(plain);
if (cipher != NULL)
gpgme_data_release(cipher);
return result;
}
