X-Git-Url: https://the.earth.li/gitweb/?a=blobdiff_plain;f=cleankey.c;h=fe24c3b6a31a7502de8554ce12bf692b3d18dbb5;hb=adc800dbc424a1e246dd4a82a0c2e88eeda25531;hp=7d0bfe4b8cb16315926399f395f58b2142061aad;hpb=4c8bebffd4bc105ebaa09256b7a57f4a6201bd52;p=onak.git

diff --git a/cleankey.c b/cleankey.c
index 7d0bfe4..fe24c3b 100644
--- a/cleankey.c
+++ b/cleankey.c
@@ -13,8 +13,7 @@
  * more details.
  *
  * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 51
- * Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ * this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
 #include <stdbool.h>
@@ -22,11 +21,12 @@
 #include <stdlib.h>
 
 #include "cleankey.h"
+#include "keyid.h"
 #include "keystructs.h"
 #include "log.h"
 #include "mem.h"
 #include "merge.h"
-#include "onak-conf.h"
+#include "openpgp.h"
 #include "sigcheck.h"
 
 /**
@@ -73,6 +73,53 @@ int dedupuids(struct openpgp_publickey *key)
 	return merged;
 }
 
+/**
+ *	dedupsubkeys - Merge duplicate subkeys on a key.
+ *	@key: The key to de-dup subkeys on.
+ *
+ *	This function attempts to merge duplicate subkeys on a key. It returns
+ *	0 if the key is unchanged, otherwise the number of dups merged.
+ */
+int dedupsubkeys(struct openpgp_publickey *key)
+{
+	struct openpgp_signedpacket_list *cursubkey = NULL;
+	struct openpgp_signedpacket_list *dup = NULL;
+	struct openpgp_signedpacket_list *tmp = NULL;
+	int                               merged = 0;
+	uint64_t                          subkeyid;
+
+	log_assert(key != NULL);
+	cursubkey = key->subkeys;
+	while (cursubkey != NULL) {
+		dup = find_signed_packet(cursubkey->next, cursubkey->packet);
+		while (dup != NULL) {
+			get_packetid(cursubkey->packet, &subkeyid);
+			logthing(LOGTHING_INFO,
+				"Found duplicate subkey: 0x%016" PRIX64,
+				subkeyid);
+			merged++;
+			merge_packet_sigs(cursubkey, dup);
+			/*
+			 * Remove the duplicate uid.
+			 */
+			tmp = cursubkey;
+			while (tmp != NULL && tmp->next != dup) {
+				tmp = tmp->next;
+			}
+			log_assert(tmp != NULL);
+			tmp->next = dup->next;
+			dup->next = NULL;
+			free_signedpacket_list(dup);
+
+			dup = find_signed_packet(cursubkey->next,
+				cursubkey->packet);
+		}
+		cursubkey = cursubkey->next;
+	}
+
+	return merged;
+}
+
 /**
  *	check_sighashes - Check that sig hashes are correct.
  *	@key - the check to check the sig hashes of.
@@ -132,27 +179,86 @@ int clean_key_sighashes(struct openpgp_publickey *key)
 	return removed;
 }
 
+#define UAT_LIMIT	0xFFFF
+#define UID_LIMIT	1024
+#define PACKET_LIMIT	8383		/* Fits in 2 byte packet length */
+int clean_large_packets(struct openpgp_publickey *key)
+{
+	struct openpgp_signedpacket_list **curuid = NULL;
+	struct openpgp_signedpacket_list *tmp = NULL;
+	bool                              drop;
+	int                               dropped = 0;
+
+	log_assert(key != NULL);
+	curuid = &key->uids;
+	while (*curuid != NULL) {
+		drop = false;
+		switch ((*curuid)->packet->tag) {
+		case OPENPGP_PACKET_UID:
+			if ((*curuid)->packet->length > UID_LIMIT)
+				drop = true;
+			break;
+		case OPENPGP_PACKET_UAT:
+			if ((*curuid)->packet->length > UAT_LIMIT)
+				drop = true;
+			break;
+		default:
+			if ((*curuid)->packet->length > PACKET_LIMIT)
+				drop = true;
+			break;
+		}
+
+		if (drop) {
+			logthing(LOGTHING_INFO,
+					"Dropping large (%d) packet, type %d",
+					(*curuid)->packet->length,
+					(*curuid)->packet->tag);
+			/* Remove the entire large signed packet list */
+			tmp = *curuid;
+			*curuid = (*curuid)->next;
+			tmp->next = NULL;
+			free_signedpacket_list(tmp);
+			dropped++;
+		} else {
+			curuid = &(*curuid)->next;
+		}
+	}
+
+	return dropped;
+}
+
 /**
  *	cleankeys - Apply all available cleaning options on a list of keys.
- *	@keys: The list of keys to clean.
+ *	@policies: The cleaning policies to apply.
  *
- *	Applies all the cleaning options we can (eg duplicate key ids) to a
- *	list of keys. Returns 0 if no changes were made, otherwise the number
- *	of keys cleaned.
+ *	Applies the requested cleaning policies to a list of keys. These are
+ *	specified from the ONAK_CLEAN_* set of flags, or ONAK_CLEAN_ALL to
+ *	apply all available cleaning options. Returns 0 if no changes were
+ *	made, otherwise the number of keys cleaned. Note that some options
+ *	may result in keys being removed entirely from the list.
  */
-int cleankeys(struct openpgp_publickey *keys)
+int cleankeys(struct openpgp_publickey **keys, uint64_t policies)
 {
-	int changed = 0, count;
+	struct openpgp_publickey *curkey;
+	int changed = 0, count = 0;
 
-	while (keys != NULL) {
-		count = dedupuids(keys);
-		if (config.check_sighash) {
-			count += clean_key_sighashes(keys);
+	if (keys == NULL)
+		return 0;
+
+	curkey = *keys;
+	while (curkey != NULL) {
+		if (policies & ONAK_CLEAN_LARGE_PACKETS) {
+			count += clean_large_packets(curkey);
+		}
+		count += dedupuids(curkey);
+		count += dedupsubkeys(curkey);
+		if (policies & ONAK_CLEAN_CHECK_SIGHASH) {
+			count += clean_key_sighashes(curkey);
 		}
 		if (count > 0) {
 			changed++;
 		}
-		keys = keys->next;
+		curkey = curkey->next;
 	}
 
 	return changed;