X-Git-Url: https://git.distorted.org.uk/u/mdw/catacomb/blobdiff_plain/ada5514153f5d2935fc82e8c787a12cffa5953d9..c65df27983057ec76ed0e72bb370f9a5ae7dad28:/catcrypt.c

diff --git a/catcrypt.c b/catcrypt.c
index 546b6c3..cc1ab39 100644
--- a/catcrypt.c
+++ b/catcrypt.c
@@ -1,6 +1,6 @@
 /* -*-c-*-
  *
- * $Id: catcrypt.c,v 1.2 2004/05/09 13:03:46 mdw Exp $
+ * $Id$
  *
  * Command-line encryption tool
  *
@@ -50,6 +50,9 @@
 #include "key.h"
 #include "cc.h"
 
+#include "ectab.h"
+#include "ptab.h"
+
 /*----- Utilities ---------------------------------------------------------*/
 
 /* --- @keyreport@ --- *
@@ -142,12 +145,13 @@ err:
 
 static int encrypt(int argc, char *argv[])
 {
-  const char *of = 0, *kn = "ccrypt";
+  const char *of = 0, *kn = "ccrypt", *skn = 0;
   FILE *ofp = 0;
   FILE *fp = 0;
   const char *ef = "binary";
   const char *err;
   int i;
+  int en;
   size_t n;
   dstr d = DSTR_INIT;
   octet *tag, *ct;
@@ -157,7 +161,9 @@ static int encrypt(int argc, char *argv[])
   unsigned f = 0;
   key_file kf;
   key *k;
+  key *sk = 0;
   kem *km;
+  sig *s = 0;
   gcipher *cx, *c;
   gmac *m;
   ghash *h;
@@ -169,16 +175,18 @@ static int encrypt(int argc, char *argv[])
   for (;;) {
     static const struct option opt[] = {
       { "key",		OPTF_ARGREQ,	0,	'k' },
+      { "sign-key",	OPTF_ARGREQ,	0,	's' },
       { "armour",	0,		0,	'a' },
       { "armor",	0,		0,	'a' },
       { "format", 	OPTF_ARGREQ,	0,	'f' },
       { "output", 	OPTF_ARGREQ,	0,	'o' },
       { 0,		0,		0,	0 }
     };
-    i = mdwopt(argc, argv, "k:af:o:", opt, 0, 0, 0);
+    i = mdwopt(argc, argv, "k:s:af:o:", opt, 0, 0, 0);
     if (i < 0) break;
     switch (i) {
       case 'k': kn = optarg; break;
+      case 's': skn = optarg; break;
       case 'a': ef = "pem"; break;
       case 'f': ef = optarg; break;
       case 'o': of = optarg; break;
@@ -186,12 +194,14 @@ static int encrypt(int argc, char *argv[])
     }
   }
   if (argc - optind > 1 || (f & f_bogus))
-    die(EXIT_FAILURE, "Usage: encrypt [-options] [file]");
+    die(EXIT_FAILURE, "Usage: encrypt [-OPTIONS] [FILE]");
 
   if (key_open(&kf, keyring, KOPEN_READ, keyreport, 0))
     die(EXIT_FAILURE, "can't open keyring `%s'", keyring);
   if ((k = key_bytag(&kf, kn)) == 0)
     die(EXIT_FAILURE, "key `%s' not found", kn);
+  if (skn && (sk = key_bytag(&kf, skn)) == 0)
+    die(EXIT_FAILURE, "key `%s' not found", skn);
 
   if ((eo = getenc(ef)) == 0)
     die(EXIT_FAILURE, "encoding `%s' not found", ef);
@@ -214,11 +224,19 @@ static int encrypt(int argc, char *argv[])
 	ofp, strerror(errno));
   }
 
+  dstr_reset(&d);
   key_fulltag(k, &d);
   e = initenc(eo, ofp, "CATCRYPT ENCRYPTED MESSAGE", 1);
-  km = getkem(k, "ccrypt", 0);
+  km = getkem(k, "cckem", 0);
   if ((err = km->ops->check(km)) != 0)
     moan("key `%s' fails check: %s", d.buf, err);
+  if (sk) {
+    dstr_reset(&d);
+    key_fulltag(sk, &d);
+    s = getsig(sk, "ccsig", 1);
+    if ((err = s->ops->check(s)) != 0)
+      moan("key `%s' fails check: %s", d.buf, err);
+  }
 
   /* --- Build the header chunk --- */
 
@@ -226,6 +244,7 @@ static int encrypt(int argc, char *argv[])
   dstr_ensure(&d, 256);
   buf_init(&b, d.buf, 256);
   buf_putu32(&b, k->id);
+  if (sk) buf_putu32(&b, sk->id);
   assert(BOK(&b));
   chunk_write(e, &b);
 
@@ -238,6 +257,19 @@ static int encrypt(int argc, char *argv[])
   BSTEP(&b, d.len);
   chunk_write(e, &b);
 
+  /* --- Write the signature chunk --- */
+
+  if (s) {
+    GC_ENCRYPT(cx, 0, bb, 1024);
+    GH_HASH(s->h, bb, 1024);
+    dstr_reset(&d);
+    if ((en = s->ops->doit(s, &d)) != 0)
+      die(EXIT_FAILURE, "error creating signature: %s", key_strerror(en));
+    buf_init(&b, d.buf, d.len);
+    BSTEP(&b, d.len);
+    chunk_write(e, &b);
+  }  
+
   /* --- Now do the main crypto --- */
 
   assert(GC_CLASS(c)->blksz <= sizeof(bb));
@@ -281,6 +313,7 @@ static int encrypt(int argc, char *argv[])
   GC_DESTROY(c);
   GC_DESTROY(cx);
   freeenc(e);
+  if (s) freesig(s);
   freekem(km);
   if (of) fclose(ofp);
   key_close(&kf);
@@ -305,7 +338,9 @@ static int decrypt(int argc, char *argv[])
   size_t seq;
   uint32 id;
   key *k;
+  key *sk = 0;
   kem *km;
+  sig *s = 0;
   gcipher *cx;
   gcipher *c;
   ghash *h;
@@ -313,6 +348,8 @@ static int decrypt(int argc, char *argv[])
   octet *tag;
   unsigned f = 0;
   const encops *eo;
+  const char *err;
+  int verb = 1;
   enc *e;
 
 #define f_bogus 1u
@@ -321,21 +358,25 @@ static int decrypt(int argc, char *argv[])
     static const struct option opt[] = {
       { "armour",	0,		0,	'a' },
       { "armor",	0,		0,	'a' },
+      { "verbose",	0,		0,	'v' },
+      { "quiet",	0,		0,	'q' },
       { "format", 	OPTF_ARGREQ,	0,	'f' },
       { "output", 	OPTF_ARGREQ,	0,	'o' },
       { 0,		0,		0,	0 }
     };
-    i = mdwopt(argc, argv, "af:o:", opt, 0, 0, 0);
+    i = mdwopt(argc, argv, "af:o:qv", opt, 0, 0, 0);
     if (i < 0) break;
     switch (i) {
       case 'a': ef = "pem"; break;
+      case 'v': verb++; break;
+      case 'q': if (verb) verb--; break;
       case 'f': ef = optarg; break;
       case 'o': of = optarg; break;
       default: f |= f_bogus; break;
     }
   }
   if (argc - optind > 1 || (f & f_bogus))
-    die(EXIT_FAILURE, "Usage: decrypt [-options] [file]");
+    die(EXIT_FAILURE, "Usage: decrypt [-OPTIONS] [FILE]");
 
   if ((eo = getenc(ef)) == 0)
     die(EXIT_FAILURE, "encoding `%s' not found", ef);
@@ -359,28 +400,72 @@ static int decrypt(int argc, char *argv[])
   /* --- Read the header chunk --- */
 
   chunk_read(e, &d, &b);
-  if (buf_getu32(&b, &id))
-    die(EXIT_FAILURE, "malformed header: missing keyid");
-  if (BLEFT(&b))
-    die(EXIT_FAILURE, "malformed header: junk at end");
+  if (buf_getu32(&b, &id)) {
+    if (verb) printf("FAIL malformed header: missing keyid\n");
+    exit(EXIT_FAILURE);
+  }
+  if ((k = key_byid(&kf, id)) == 0) {
+    if (verb) printf("FAIL key id %08lx not found\n", (unsigned long)id);
+    exit(EXIT_FAILURE);
+  }
+  if (BLEFT(&b)) {
+    if (buf_getu32(&b, &id)) {
+      if (verb) printf("FAIL malformed header: missing signature keyid\n");
+      exit(EXIT_FAILURE);
+    }
+    if ((sk = key_byid(&kf, id)) == 0) {
+      if (verb) printf("FAIL key id %08lx not found\n", (unsigned long)id);
+      exit(EXIT_FAILURE);
+    }
+  }
+  if (BLEFT(&b)) {
+    if (verb) printf("FAIL malformed header: junk at end\n");
+    exit(EXIT_FAILURE);
+  }
 
   /* --- Find the key --- */
 
-  if ((k = key_byid(&kf, id)) == 0)
-    die(EXIT_FAILURE, "key id %08lx not found", (unsigned long)id);
-  km = getkem(k, "ccrypt", 1);
+  km = getkem(k, "cckem", 1);
 
   /* --- Read the KEM chunk --- */
 
   chunk_read(e, &d, &b);
-  if (setupkem(km, &d, &cx, &c, &m))
-    die(EXIT_FAILURE, "failed to decapsulate key");
+  if (setupkem(km, &d, &cx, &c, &m)) {
+    if (verb) printf("FAIL failed to decapsulate key\n");
+    exit(EXIT_FAILURE);
+  }
+
+  /* --- Verify the signature, if there is one --- */
+
+  if (sk) {
+    s = getsig(sk, "ccsig", 0);
+    dstr_reset(&d);
+    key_fulltag(sk, &d);
+    if (verb && (err = s->ops->check(s)) != 0)
+      printf("WARN verification key %s fails check: %s\n", d.buf, err);
+    dstr_reset(&d);
+    dstr_ensure(&d, 1024);
+    GC_ENCRYPT(cx, 0, d.buf, 1024);
+    GH_HASH(s->h, d.buf, 1024);
+    chunk_read(e, &d, &b);
+    if (s->ops->doit(s, &d)) {
+      if (verb) printf("FAIL signature verification failed\n");
+      exit(EXIT_FAILURE);
+    }
+    if (verb) {
+      dstr_reset(&d);
+      key_fulltag(sk, &d);
+      printf("INFO good signature from %s\n", d.buf);
+    }
+  } else if (verb)
+    printf("INFO no signature packet\n");
 
   /* --- Now decrypt the main body --- */
 
-  if (!of || strcmp(of, "-") == 0)
+  if (!of || strcmp(of, "-") == 0) {
     ofp = stdout;
-  else if ((ofp = fopen(of, "wb")) == 0) {
+    if (verb) printf("DATA\n");
+  } else if ((ofp = fopen(of, "wb")) == 0) {
     die(EXIT_FAILURE, "couldn't open file `%s' for output: %s",
 	ofp, strerror(errno));
   }
@@ -398,22 +483,37 @@ static int decrypt(int argc, char *argv[])
     GH_HASH(h, d.buf, 4);
     seq++;
     chunk_read(e, &d, &b);
-    if ((tag = buf_get(&b, GM_CLASS(m)->hashsz)) == 0)
-      die(EXIT_FAILURE, "bad ciphertext chunk: no tag");
+    if ((tag = buf_get(&b, GM_CLASS(m)->hashsz)) == 0) {
+      if (verb) printf("%sFAIL bad ciphertext chunk: no tag\n",
+		       ofp == stdout ? "\n" : "");
+      exit(EXIT_FAILURE);
+    }
     GH_HASH(h, BCUR(&b), BLEFT(&b));
-    if (memcmp(tag, GH_DONE(h, 0), GM_CLASS(m)->hashsz) != 0)
-      die(EXIT_FAILURE, "bad ciphertext chunk: authentication failure");
+    if (memcmp(tag, GH_DONE(h, 0), GM_CLASS(m)->hashsz) != 0) {
+      if (verb)
+	printf("%sFAIL bad ciphertext chunk: authentication failure\n",
+	       ofp == stdout ? "\n" : "");
+      exit(EXIT_FAILURE);
+    }
     if (!BLEFT(&b))
       break;
     GC_DECRYPT(c, BCUR(&b), BCUR(&b), BLEFT(&b));
-    if (fwrite(BCUR(&b), 1, BLEFT(&b), ofp) != BLEFT(&b))
-      die(EXIT_FAILURE, "error writing output: %s", strerror(errno));
+    if (fwrite(BCUR(&b), 1, BLEFT(&b), ofp) != BLEFT(&b)) {
+      if (verb) printf("%sFAIL error writing output: %s\n",
+		       ofp == stdout ? "\n" : "", strerror(errno));
+      exit(EXIT_FAILURE);
+    }
+  }
+
+  if (fflush(ofp) || ferror(ofp)) {
+    if (verb) printf("%sFAIL error writing output: %s\n",
+		     ofp == stdout ? "\n" : "", strerror(errno));
+    exit(EXIT_FAILURE);
   }
 
-  if (fflush(ofp) || ferror(ofp))
-    die(EXIT_FAILURE, "error writing output: %s", strerror(errno));
-    
   e->ops->decdone(e);
+  if (verb && ofp != stdout)
+    printf("OK decrypted successfully\n");
   freeenc(e);
   GC_DESTROY(c);
   GC_DESTROY(cx);
@@ -462,7 +562,7 @@ static int encode(int argc, char *argv[])
     }
   }
   if (argc - optind > 1 || (f & f_bogus))
-    die(EXIT_FAILURE, "Usage: encode [-options] [file]");
+    die(EXIT_FAILURE, "Usage: encode [-OPTIONS] [FILE]");
 
   if ((eo = getenc(ef)) == 0)
     die(EXIT_FAILURE, "encoding `%s' not found", ef);
@@ -531,7 +631,7 @@ static int decode(int argc, char *argv[])
     }
   }
   if (argc - optind > 1 || (f & f_bogus))
-    die(EXIT_FAILURE, "Usage: decode [-options] [file]");
+    die(EXIT_FAILURE, "Usage: decode [-OPTIONS] [FILE]");
 
   if ((eo = getenc(ef)) == 0)
     die(EXIT_FAILURE, "encoding `%s' not found", ef);
@@ -571,16 +671,36 @@ static int decode(int argc, char *argv[])
 
 /*----- Main code ---------------------------------------------------------*/
 
-typedef struct cmd {
-  const char *name;
-  int (*func)(int /*argc*/, char */*argv*/[]);
-  const char *usage;
-  const char *help;
-} cmd;
+#define LISTS(LI)							\
+  LI("Lists", list,							\
+     listtab[i].name, listtab[i].name)					\
+  LI("Key-encapsulation mechanisms", kem,				\
+     kemtab[i].name, kemtab[i].name)					\
+  LI("Signature schemes", sig,						\
+     sigtab[i].name, sigtab[i].name)					\
+  LI("Encodings", enc,							\
+     enctab[i].name, enctab[i].name)					\
+  LI("Symmetric encryption algorithms", cipher,				\
+     gciphertab[i], gciphertab[i]->name)				\
+  LI("Hash functions", hash,						\
+     ghashtab[i], ghashtab[i]->name)					\
+  LI("Message authentication codes", mac,				\
+     gmactab[i], gmactab[i]->name)
+
+MAKELISTTAB(listtab, LISTS)
+
+int cmd_show(int argc, char *argv[])
+{
+  return (displaylists(listtab, argv + 1));
+}
+
+static int cmd_help(int, char **);
 
 static cmd cmdtab[] = {
+  { "help", cmd_help, "help [COMMAND...]" },
+  { "show", cmd_show, "show [ITEM...]" },
   { "encode", encode,
-    "encode [-f format] [-b label] [-o output] [file]",
+    "encode [-f FORMAT] [-b LABEL] [-o OUTPUT] [FILE]",
     "\
 Options:\n\
 \n\
@@ -589,7 +709,7 @@ Options:\n\
 -o, --output=FILE	Write output to FILE.\n\
 " },
   { "decode", decode,
-    "decode [-f format] [-b label] [-o output] [file]",
+    "decode [-f FORMAT] [-b LABEL] [-o OUTPUT] [FILE]",
     "\
 Options:\n\
 \n\
@@ -598,87 +718,59 @@ Options:\n\
 -o, --output=FILE	Write output to FILE.\n\
 " },
   { "encrypt", encrypt,
-    "encrypt [-a] [-k tag] [f format]] [-o output] [file]",
-    "\
+    "encrypt [-a] [-k TAG] [-s TAG] [-f FORMAT]\n\t\
+[-o OUTPUT] [FILE]", "\
 Options:\n\
 \n\
 -a, --armour		Same as `-f pem'.\n\
 -f, --format=FORMAT	Encode as FORMAT.\n\
--k, --key=TAG		Use public key named by TAG.\n\
+-k, --key=TAG		Use public encryption key named by TAG.\n\
+-s, --sign-key=TAG	Use private signature key named by TAG.\n\
 -o, --output=FILE	Write output to FILE.\n\
 " },
   { "decrypt", decrypt,
-    "decrypt [-t] [-o output] [file]", "\
+    "decrypt [-aqv] [-f FORMAT] [-o OUTPUT] [FILE]", "\
 Options:\n\
 \n\
--t, --text		Read PEM-encoded input.\n\
+-a, --armour		Same as `-f pem'.\n\
+-v, --verbose		Produce more verbose messages.\n\
+-q, --quiet		Produce fewer messages.\n\
+-f, --format=FORMAT	Decode as FORMAT.\n\
 -o, --output=FILE	Write output to FILE.\n\
 " },
   { 0, 0, 0 }
 };
 
-/* --- @findcmd@ --- *
- *
- * Arguments:	@const char *name@ = a command name
- *
- * Returns:	Pointer to the command structure.
- *
- * Use:		Looks up a command by name.  If the command isn't found, an
- *		error is reported and the program is terminated.
- */
-
-static cmd *findcmd(const char *name)
+static int cmd_help(int argc, char **argv)
 {
-  cmd *c, *chosen = 0;
-  size_t sz = strlen(name);
-
-  for (c = cmdtab; c->name; c++) {
-    if (strncmp(name, c->name, sz) == 0) {
-      if (c->name[sz] == 0) {
-	chosen = c;
-	break;
-      } else if (chosen)
-	die(EXIT_FAILURE, "ambiguous command name `%s'", name);
-      else
-	chosen = c;
-    }
-  }
-  if (!chosen)
-    die(EXIT_FAILURE, "unknown command name `%s'", name);
-  return (chosen);
+  sc_help(cmdtab, stdout, argv + 1);
+  return (0);
 }
 
-static void version(FILE *fp)
+void version(FILE *fp)
 {
   pquis(fp, "$, Catacomb version " VERSION "\n");
 }
 
 static void usage(FILE *fp)
 {
-  pquis(fp, "Usage: $ [-k keyring] command [args]\n");
+  pquis(fp, "Usage: $ [-k KEYRING] COMMAND [ARGS]\n");
 }
 
-static void help(FILE *fp, char **argv)
+void help_global(FILE *fp)
 {
-  cmd *c;
-
-  if (*argv) {
-    c = findcmd(*argv);
-    fprintf(fp, "Usage: %s [-k keyring] %s\n", QUIS, c->usage);
-    if (c->help) {
-      fputc('\n', fp);	
-      fputs(c->help, fp);
-    }
-  } else {
-    version(fp);
-    fputc('\n', fp);
-    usage(fp);
-    fputs("\n\
+  usage(fp);
+  fputs("\n\
 Encrypt and decrypt files.\n\
-\n", fp);
-    for (c = cmdtab; c->name; c++)
-      fprintf(fp, "%s\n", c->usage);
-  }
+\n\
+Global command-line options:\n\
+\n\
+-h, --help [COMMAND...]	Show this help message, or help for COMMANDs.\n\
+-v, --version		Show program version number.\n\
+-u, --usage		Show a terse usage message.\n\
+\n\
+-k, --keyring=FILE	Read keys from FILE.\n",
+	fp);
 }
 
 /* --- @main@ --- *
@@ -688,8 +780,7 @@ Encrypt and decrypt files.\n\
  *
  * Returns:	Zero if successful, nonzero otherwise.
  *
- * Use:		Signs or verifies signatures on lists of files.  Useful for
- *		ensuring that a distribution is unmolested.
+ * Use:		Encrypts or decrypts files.
  */
 
 int main(int argc, char *argv[])
@@ -720,7 +811,7 @@ int main(int argc, char *argv[])
       break;
     switch (i) {
       case 'h':
-	help(stdout, argv + optind);
+	sc_help(cmdtab, stdout, argv + optind);
 	exit(0);
 	break;
       case 'v':
@@ -749,7 +840,7 @@ int main(int argc, char *argv[])
 
   /* --- Dispatch to the correct subcommand handler --- */
 
-  return (findcmd(argv[0])->func(argc, argv));
+  return (findcmd(cmdtab, argv[0])->cmd(argc, argv));
 
 #undef f_bogus
 }