g13/create.c

   1 /* create.c - Create a new crypto container
   2  * Copyright (C) 2009 Free Software Foundation, Inc.
   3  *
   4  * This file is part of GnuPG.
   5  *
   6  * GnuPG is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * GnuPG is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include <config.h>
  21 #include <stdio.h>
  22 #include <stdlib.h>
  23 #include <string.h>
  24 #include <errno.h>
  25 #include <unistd.h>
  26 #include <sys/stat.h>
  27 #include <assert.h>
  28
  29 #include "g13.h"
  30 #include "i18n.h"
  31 #include "create.h"
  32
  33 #include "keyblob.h"
  34 #include "backend.h"
  35 #include "utils.h"
  36 #include "call-gpg.h"
  37 #include "estream.h"
  38
  39 /* Create a new blob with all the session keys and other meta
  40    information which are to be stored encrypted in the crypto
  41    container header.  On success the malloced blob is stored at R_BLOB
  42    and its length at R_BLOBLEN.  On error an error code is returned
  43    and (R_BLOB,R_BLOBLEN) are set to (NULL,0).
  44
  45    The format of this blob is a sequence of tag-length-value tuples.
  46    All tuples have this format:
  47
  48      2 byte TAG           Big endian unsigned integer (0..65535)
  49                           described by the KEYBLOB_TAG_ constants.
  50      2 byte LENGTH        Big endian unsigned integer (0..65535)
  51                           giving the length of the value.
  52      length bytes VALUE   The value described by the tag.
  53
  54    The first tag in a keyblob must be a BLOBVERSION.  The other tags
  55    depend on the type of the container as described by the CONTTYPE
  56    tag.  See keyblob.h for details.  */
  57 static gpg_error_t
  58 create_new_keyblob (ctrl_t ctrl, int is_detached,
  59                     void **r_blob, size_t *r_bloblen)
  60 {
  61   gpg_error_t err;
  62   unsigned char twobyte[2];
  63   membuf_t mb;
  64
  65   *r_blob = NULL;
  66   *r_bloblen = 0;
  67
  68   init_membuf_secure (&mb, 512);
  69
  70   append_tuple (&mb, KEYBLOB_TAG_BLOBVERSION, "\x01", 1);
  71
  72   twobyte[0] = (ctrl->conttype >> 8);
  73   twobyte[1] = (ctrl->conttype);
  74   append_tuple (&mb, KEYBLOB_TAG_CONTTYPE, twobyte, 2);
  75   if (is_detached)
  76     append_tuple (&mb, KEYBLOB_TAG_DETACHED, NULL, 0);
  77
  78   err = be_create_new_keys (ctrl->conttype, &mb);
  79   if (err)
  80     goto leave;
  81
  82   /* Just for testing.  */
  83   append_tuple (&mb, KEYBLOB_TAG_FILLER, "filler", 6);
  84
  85   *r_blob = get_membuf (&mb, r_bloblen);
  86   if (!*r_blob)
  87     {
  88       err = gpg_error_from_syserror ();
  89       *r_bloblen = 0;
  90     }
  91   else
  92     log_debug ("used keyblob size is %zu\n", *r_bloblen);
  93
  94  leave:
  95   xfree (get_membuf (&mb, NULL));
  96   return err;
  97 }
  98
  99
 100
 101 /* Encrypt the keyblob (KEYBLOB,KEYBLOBLEN) and store the result at
 102    (R_ENCBLOB, R_ENCBLOBLEN).  Returns 0 on success or an error code.
 103    On error R_EKYBLOB is set to NULL.  Depending on the keys set in
 104    CTRL the result is a single OpenPGP binary message, a single
 105    special OpenPGP packet encapsulating a CMS message or a
 106    concatenation of both with the CMS packet being the last.  */
 107 static gpg_error_t
 108 encrypt_keyblob (ctrl_t ctrl, void *keyblob, size_t keybloblen,
 109                  void **r_encblob, size_t *r_encbloblen)
 110 {
 111   gpg_error_t err;
 112
 113   /* FIXME:  For now we only implement OpenPGP.  */
 114   err = gpg_encrypt_blob (ctrl, keyblob, keybloblen,
 115                           r_encblob, r_encbloblen);
 116
 117   return err;
 118 }
 119
 120
 121 /* Write a new file under the name FILENAME with the keyblob and an
 122    appropriate header.  This fucntion is called with a lock file in
 123    place and after checking that the filename does not exists.  */
 124 static gpg_error_t
 125 write_keyblob (const char *filename,
 126                const void *keyblob, size_t keybloblen)
 127 {
 128   gpg_error_t err;
 129   estream_t fp;
 130   unsigned char packet[32];
 131   size_t headerlen, paddinglen;
 132
 133   fp = es_fopen (filename, "wbx");
 134   if (!fp)
 135     {
 136       err = gpg_error_from_syserror ();
 137       log_error ("error creating new container `%s': %s\n",
 138                  filename, gpg_strerror (err));
 139       return err;
 140     }
 141
 142   /* Allow for an least 8 times larger keyblob to accommodate for
 143      future key changes.  Round it up to 4096 byte. */
 144   headerlen = ((32 + 8 * keybloblen + 16) + 4095) / 4096 * 4096;
 145   paddinglen = headerlen - 32 - keybloblen;
 146   assert (paddinglen >= 16);
 147
 148   packet[0] = (0xc0|61); /* CTB for the private packet type 0x61.  */
 149   packet[1] = 0xff;      /* 5 byte length packet, value 20.  */
 150   packet[2] = 0;
 151   packet[3] = 0;
 152   packet[4] = 0;
 153   packet[5] = 26;
 154   memcpy (packet+6, "GnuPG/G13", 10); /* Packet subtype.  */
 155   packet[16] = 1;   /* G13 packet format version.  */
 156   packet[17] = 0;   /* Reserved.  */
 157   packet[18] = 0;   /* Reserved.  */
 158   packet[19] = 0;   /* OS Flag.  */
 159   packet[20] = (headerlen >> 24);  /* Total length of header.  */
 160   packet[21] = (headerlen >> 16);
 161   packet[22] = (headerlen >> 8);
 162   packet[23] = (headerlen);
 163   packet[24] = 1;   /* Number of header copies.  */
 164   packet[25] = 0;   /* Number of header copies at the end.  */
 165   packet[26] = 0;   /* Reserved.  */
 166   packet[27] = 0;   /* Reserved.  */
 167   packet[28] = 0;   /* Reserved.  */
 168   packet[29] = 0;   /* Reserved.  */
 169   packet[30] = 0;   /* Reserved.  */
 170   packet[31] = 0;   /* Reserved.  */
 171
 172   if (es_fwrite (packet, 32, 1, fp) != 1)
 173     goto writeerr;
 174
 175   if (es_fwrite (keyblob, keybloblen, 1, fp) != 1)
 176     goto writeerr;
 177
 178   /* Write the padding.  */
 179   packet[0] = (0xc0|61); /* CTB for Private packet type 0x61.  */
 180   packet[1] = 0xff;      /* 5 byte length packet, value 20.  */
 181   packet[2] = (paddinglen-6) >> 24;
 182   packet[3] = (paddinglen-6) >> 16;
 183   packet[4] = (paddinglen-6) >> 8;
 184   packet[5] = (paddinglen-6);
 185   memcpy (packet+6, "GnuPG/PAD", 10); /* Packet subtype.  */
 186   if (es_fwrite (packet, 16, 1, fp) != 1)
 187     goto writeerr;
 188   memset (packet, 0, 32);
 189   for (paddinglen-=16; paddinglen >= 32; paddinglen -= 32)
 190     if (es_fwrite (packet, 32, 1, fp) != 1)
 191       goto writeerr;
 192   if (paddinglen)
 193     if (es_fwrite (packet, paddinglen, 1, fp) != 1)
 194       goto writeerr;
 195
 196   if (es_fclose (fp))
 197     {
 198       err = gpg_error_from_syserror ();
 199       log_error ("error closing `%s': %s\n",
 200                  filename, gpg_strerror (err));
 201       remove (filename);
 202       return err;
 203     }
 204
 205   return 0;
 206
 207
 208  writeerr:
 209   err = gpg_error_from_syserror ();
 210   log_error ("error writing header to `%s': %s\n",
 211              filename, gpg_strerror (err));
 212   es_fclose (fp);
 213   remove (filename);
 214   return err;
 215 }
 216
 217
 218
 219 /* Create a new container under the name FILENAME and intialize it
 220    using the current settings.  If the file already exists an error is
 221    returned. */
 222 gpg_error_t
 223 g13_create_container (ctrl_t ctrl, const char *filename)
 224 {
 225   gpg_error_t err;
 226   dotlock_t lock;
 227   void *keyblob = NULL;
 228   size_t keybloblen;
 229   void *enckeyblob = NULL;
 230   size_t enckeybloblen;
 231   char *detachedname = NULL;
 232   int detachedisdir;
 233   tupledesc_t tuples = NULL;
 234   unsigned int dummy_rid;
 235
 236   /* A quick check to see that no container with that name already
 237      exists.  */
 238   if (!access (filename, F_OK))
 239     return gpg_error (GPG_ERR_EEXIST);
 240
 241   /* Take a lock and proceed with the creation.  If there is a lock we
 242      immediately return an error because for creation it does not make
 243      sense to wait.  */
 244   lock = create_dotlock (filename);
 245   if (!lock)
 246     return gpg_error_from_syserror ();
 247   if (make_dotlock (lock, 0))
 248     {
 249       err = gpg_error_from_syserror ();
 250       goto leave;
 251     }
 252   else
 253     err = 0;
 254
 255   /* Check again that the file does not exist.  */
 256   {
 257       struct stat sb;
 258
 259       if (!stat (filename, &sb))
 260         {
 261           err = gpg_error (GPG_ERR_EEXIST);
 262           goto leave;
 263         }
 264   }
 265   /* And a possible detached file or directory may not exist either.  */
 266   err = be_get_detached_name (ctrl->conttype, filename,
 267                               &detachedname, &detachedisdir);
 268   if (err)
 269     goto leave;
 270   if (detachedname)
 271     {
 272       struct stat sb;
 273
 274       if (!stat (detachedname, &sb))
 275         {
 276           err = gpg_error (GPG_ERR_EEXIST);
 277           goto leave;
 278         }
 279     }
 280
 281   /* Create a new keyblob.  */
 282   err = create_new_keyblob (ctrl, !!detachedname, &keyblob, &keybloblen);
 283   if (err)
 284     goto leave;
 285
 286   /* Encrypt that keyblob.  */
 287   err = encrypt_keyblob (ctrl, keyblob, keybloblen,
 288                          &enckeyblob, &enckeybloblen);
 289   if (err)
 290     goto leave;
 291
 292   /* Put a copy of the keyblob into a tuple structure.  */
 293   err = create_tupledesc (&tuples, keyblob, keybloblen);
 294   if (err)
 295     goto leave;
 296   keyblob = NULL;
 297   /* if (opt.verbose) */
 298   /*   dump_keyblob (tuples); */
 299
 300   /* Write out the header, the encrypted keyblob and some padding. */
 301   err = write_keyblob (filename, enckeyblob, enckeybloblen);
 302   if (err)
 303     goto leave;
 304
 305   /* Create and append the container.  FIXME: We should pass the
 306      estream object in addition to the filename, so that the backend
 307      can append the container to the g13 file.  */
 308   err = be_create_container (ctrl, ctrl->conttype, filename, -1, tuples,
 309                              &dummy_rid);
 310
 311
 312  leave:
 313   destroy_tupledesc (tuples);
 314   xfree (detachedname);
 315   xfree (enckeyblob);
 316   xfree (keyblob);
 317   destroy_dotlock (lock);
 318
 319   return err;
 320 }