X-Git-Url: https://git.notmuchmail.org/git?p=notmuch;a=blobdiff_plain;f=util%2Fcrypto.c;h=066dea6e1a0380fa8b3844380269669c987e90ab;hp=c51d67ed0d2c96a669227753d42dfa38adbb353b;hb=29648a137c5807135ab168917b4a51d5e19e51c2;hpb=197d67959bf459fc0f1f63a202d162a569535bf3 diff --git a/util/crypto.c b/util/crypto.c index c51d67ed..066dea6e 100644 --- a/util/crypto.c +++ b/util/crypto.c @@ -25,85 +25,86 @@ #define ARRAY_SIZE(arr) (sizeof (arr) / sizeof (arr[0])) #if (GMIME_MAJOR_VERSION < 3) -/* Create a GPG context (GMime 2.6) */ -static GMimeCryptoContext * -create_gpg_context (_notmuch_crypto_t *crypto) +/* Create or pass on a GPG context (GMime 2.6) */ +static notmuch_status_t +get_gpg_context (_notmuch_crypto_t *crypto, GMimeCryptoContext **ctx) { - GMimeCryptoContext *gpgctx; + if (ctx == NULL || crypto == NULL) + return NOTMUCH_STATUS_NULL_POINTER; - if (crypto->gpgctx) - return crypto->gpgctx; + if (crypto->gpgctx) { + *ctx = crypto->gpgctx; + return NOTMUCH_STATUS_SUCCESS; + } /* TODO: GMimePasswordRequestFunc */ - gpgctx = g_mime_gpg_context_new (NULL, crypto->gpgpath ? crypto->gpgpath : "gpg"); - if (! gpgctx) { - fprintf (stderr, "Failed to construct gpg context.\n"); - return NULL; + crypto->gpgctx = g_mime_gpg_context_new (NULL, crypto->gpgpath ? crypto->gpgpath : "gpg"); + if (! crypto->gpgctx) { + return NOTMUCH_STATUS_FAILED_CRYPTO_CONTEXT_CREATION; } - crypto->gpgctx = gpgctx; - g_mime_gpg_context_set_use_agent ((GMimeGpgContext *) gpgctx, true); - g_mime_gpg_context_set_always_trust ((GMimeGpgContext *) gpgctx, false); + g_mime_gpg_context_set_use_agent ((GMimeGpgContext *) crypto->gpgctx, true); + g_mime_gpg_context_set_always_trust ((GMimeGpgContext *) crypto->gpgctx, false); - return gpgctx; + *ctx = crypto->gpgctx; + return NOTMUCH_STATUS_SUCCESS; } -/* Create a PKCS7 context (GMime 2.6) */ -static GMimeCryptoContext * -create_pkcs7_context (_notmuch_crypto_t *crypto) +/* Create or pass on a PKCS7 context (GMime 2.6) */ +static notmuch_status_t +get_pkcs7_context (_notmuch_crypto_t *crypto, GMimeCryptoContext **ctx) { - GMimeCryptoContext *pkcs7ctx; + if (ctx == NULL || crypto == NULL) + return NOTMUCH_STATUS_NULL_POINTER; - if (crypto->pkcs7ctx) - return crypto->pkcs7ctx; + if (crypto->pkcs7ctx) { + *ctx = crypto->pkcs7ctx; + return NOTMUCH_STATUS_SUCCESS; + } /* TODO: GMimePasswordRequestFunc */ - pkcs7ctx = g_mime_pkcs7_context_new (NULL); - if (! pkcs7ctx) { - fprintf (stderr, "Failed to construct pkcs7 context.\n"); - return NULL; + crypto->pkcs7ctx = g_mime_pkcs7_context_new (NULL); + if (! crypto->pkcs7ctx) { + return NOTMUCH_STATUS_FAILED_CRYPTO_CONTEXT_CREATION; } - crypto->pkcs7ctx = pkcs7ctx; - g_mime_pkcs7_context_set_always_trust ((GMimePkcs7Context *) pkcs7ctx, + g_mime_pkcs7_context_set_always_trust ((GMimePkcs7Context *) crypto->pkcs7ctx, false); - return pkcs7ctx; + *ctx = crypto->pkcs7ctx; + return NOTMUCH_STATUS_SUCCESS; } static const struct { const char *protocol; - GMimeCryptoContext *(*get_context) (_notmuch_crypto_t *crypto); + notmuch_status_t (*get_context) (_notmuch_crypto_t *crypto, GMimeCryptoContext **ctx); } protocols[] = { { .protocol = "application/pgp-signature", - .get_context = create_gpg_context, + .get_context = get_gpg_context, }, { .protocol = "application/pgp-encrypted", - .get_context = create_gpg_context, + .get_context = get_gpg_context, }, { .protocol = "application/pkcs7-signature", - .get_context = create_pkcs7_context, + .get_context = get_pkcs7_context, }, { .protocol = "application/x-pkcs7-signature", - .get_context = create_pkcs7_context, + .get_context = get_pkcs7_context, }, }; /* for the specified protocol return the context pointer (initializing * if needed) */ -GMimeCryptoContext * -_notmuch_crypto_get_gmime_context (_notmuch_crypto_t *crypto, const char *protocol) +notmuch_status_t +_notmuch_crypto_get_gmime_ctx_for_protocol (_notmuch_crypto_t *crypto, + const char *protocol, + GMimeCryptoContext **ctx) { - GMimeCryptoContext *cryptoctx = NULL; - size_t i; - - if (! protocol) { - fprintf (stderr, "Cryptographic protocol is empty.\n"); - return cryptoctx; - } + if (! protocol) + return NOTMUCH_STATUS_MALFORMED_CRYPTO_PROTOCOL; /* As per RFC 1847 section 2.1: "the [protocol] value token is * comprised of the type and sub-type tokens of the Content-Type". @@ -111,15 +112,12 @@ _notmuch_crypto_get_gmime_context (_notmuch_crypto_t *crypto, const char *protoc * parameter names as defined in this document are * case-insensitive." Thus, we use strcasecmp for the protocol. */ - for (i = 0; i < ARRAY_SIZE (protocols); i++) { + for (size_t i = 0; i < ARRAY_SIZE (protocols); i++) { if (strcasecmp (protocol, protocols[i].protocol) == 0) - return protocols[i].get_context (crypto); + return protocols[i].get_context (crypto, ctx); } - fprintf (stderr, "Unknown or unsupported cryptographic protocol %s.\n", - protocol); - - return NULL; + return NOTMUCH_STATUS_UNKNOWN_CRYPTO_PROTOCOL; } void @@ -140,3 +138,84 @@ void _notmuch_crypto_cleanup (unused(_notmuch_crypto_t *crypto)) { } #endif + +GMimeObject * +_notmuch_crypto_decrypt (bool *attempted, + notmuch_decryption_policy_t decrypt, + notmuch_message_t *message, + g_mime_3_unused(GMimeCryptoContext* crypto_ctx), + GMimeMultipartEncrypted *part, + GMimeDecryptResult **decrypt_result, + GError **err) +{ + GMimeObject *ret = NULL; + if (decrypt == NOTMUCH_DECRYPT_FALSE) + return NULL; + + /* the versions of notmuch that can support session key decryption */ +#if HAVE_GMIME_SESSION_KEYS + if (message) { + notmuch_message_properties_t *list = NULL; + + for (list = notmuch_message_get_properties (message, "session-key", TRUE); + notmuch_message_properties_valid (list); notmuch_message_properties_move_to_next (list)) { + if (err && *err) { + g_error_free (*err); + *err = NULL; + } + if (attempted) + *attempted = true; +#if (GMIME_MAJOR_VERSION < 3) + ret = g_mime_multipart_encrypted_decrypt_session (part, + crypto_ctx, + notmuch_message_properties_value (list), + decrypt_result, err); +#else + ret = g_mime_multipart_encrypted_decrypt (part, + GMIME_DECRYPT_NONE, + notmuch_message_properties_value (list), + decrypt_result, err); +#endif + if (ret) + break; + } + if (list) + notmuch_message_properties_destroy (list); + if (ret) + return ret; + } +#endif + + if (err && *err) { + g_error_free (*err); + *err = NULL; + } + + if (decrypt == NOTMUCH_DECRYPT_AUTO) + return ret; + + if (attempted) + *attempted = true; +#if (GMIME_MAJOR_VERSION < 3) +#if HAVE_GMIME_SESSION_KEYS + gboolean oldgetsk = g_mime_crypto_context_get_retrieve_session_key (crypto_ctx); + gboolean newgetsk = (decrypt_result); + if (newgetsk != oldgetsk) + /* This could return an error, but we can't do anything about it, so ignore it */ + g_mime_crypto_context_set_retrieve_session_key (crypto_ctx, newgetsk, NULL); +#endif + ret = g_mime_multipart_encrypted_decrypt(part, crypto_ctx, + decrypt_result, err); +#if HAVE_GMIME_SESSION_KEYS + if (newgetsk != oldgetsk) + g_mime_crypto_context_set_retrieve_session_key (crypto_ctx, oldgetsk, NULL); +#endif +#else + GMimeDecryptFlags flags = GMIME_DECRYPT_NONE; + if (decrypt_result) + flags |= GMIME_DECRYPT_EXPORT_SESSION_KEY; + ret = g_mime_multipart_encrypted_decrypt(part, flags, NULL, + decrypt_result, err); +#endif + return ret; +}