Move key database backends into their own directory

[onak.git] / cleankey.c

diff --git a/cleankey.c b/cleankey.c
index afe5a06a82b7cb2aacf53c18e4d06cfebc03f7e0..52d482a486dac01eed5adab5b84f150f7a0ca222 100644 (file)
--- a/cleankey.c
+++ b/cleankey.c
@@ -26,7 +26,7 @@
 #include "log.h"
 #include "mem.h"
 #include "merge.h"
-#include "onak-conf.h"
+#include "openpgp.h"
 #include "sigcheck.h"
 
 /**
@@ -137,10 +137,28 @@ int clean_sighashes(struct openpgp_publickey *key,
                struct openpgp_packet_list **sigs)
 {
        struct openpgp_packet_list *tmpsig;
+       onak_status_t ret;
+       uint8_t hashtype;
+       uint8_t hash[64];
+       uint8_t *sighash;
        int removed = 0;
+       uint64_t keyid;
 
        while (*sigs != NULL) {
-               if (check_packet_sighash(key, sigdata, (*sigs)->packet) == 0) {
+               ret = calculate_packet_sighash(key, sigdata, (*sigs)->packet,
+                               &hashtype, hash, &sighash);
+
+               if (ret == ONAK_E_UNSUPPORTED_FEATURE) {
+                       get_keyid(key, &keyid);
+                       logthing(LOGTHING_ERROR,
+                               "Unsupported signature hash type %d on 0x%016"
+                               PRIX64,
+                               hashtype,
+                               keyid);
+                       sigs = &(*sigs)->next;
+               } else if (ret != ONAK_E_OK ||
+                               !(hash[0] == sighash[0] &&
+                                       hash[1] == sighash[1])) {
                        tmpsig = *sigs;
                        *sigs = (*sigs)->next;
                        tmpsig->next = NULL;
@@ -179,28 +197,97 @@ int clean_key_sighashes(struct openpgp_publickey *key)
        return removed;
 }
 
+#define UAT_LIMIT      0xFFFF
+#define UID_LIMIT      1024
+#define PACKET_LIMIT   8383            /* Fits in 2 byte packet length */
+int clean_large_packets(struct openpgp_publickey *key)
+{
+       struct openpgp_signedpacket_list **curuid = NULL;
+       struct openpgp_signedpacket_list *tmp = NULL;
+       bool                              drop;
+       int                               dropped = 0;
+
+       log_assert(key != NULL);
+       curuid = &key->uids;
+       while (*curuid != NULL) {
+               drop = false;
+               switch ((*curuid)->packet->tag) {
+               case OPENPGP_PACKET_UID:
+                       if ((*curuid)->packet->length > UID_LIMIT)
+                               drop = true;
+                       break;
+               case OPENPGP_PACKET_UAT:
+                       if ((*curuid)->packet->length > UAT_LIMIT)
+                               drop = true;
+                       break;
+               default:
+                       if ((*curuid)->packet->length > PACKET_LIMIT)
+                               drop = true;
+                       break;
+               }
+
+               if (drop) {
+                       logthing(LOGTHING_INFO,
+                                       "Dropping large (%d) packet, type %d",
+                                       (*curuid)->packet->length,
+                                       (*curuid)->packet->tag);
+                       /* Remove the entire large signed packet list */
+                       tmp = *curuid;
+                       *curuid = (*curuid)->next;
+                       tmp->next = NULL;
+                       free_signedpacket_list(tmp);
+                       dropped++;
+               } else {
+                       curuid = &(*curuid)->next;
+               }
+       }
+
+       return dropped;
+}
+
 /**
  *     cleankeys - Apply all available cleaning options on a list of keys.
- *     @keys: The list of keys to clean.
+ *     @policies: The cleaning policies to apply.
  *
- *     Applies all the cleaning options we can (eg duplicate key ids) to a
- *     list of keys. Returns 0 if no changes were made, otherwise the number
- *     of keys cleaned.
+ *     Applies the requested cleaning policies to a list of keys. These are
+ *     specified from the ONAK_CLEAN_* set of flags, or ONAK_CLEAN_ALL to
+ *     apply all available cleaning options. Returns 0 if no changes were
+ *     made, otherwise the number of keys cleaned. Note that some options
+ *     may result in keys being removed entirely from the list.
  */
-int cleankeys(struct openpgp_publickey *keys)
+int cleankeys(struct openpgp_publickey **keys, uint64_t policies)
 {
-       int changed = 0, count;
+       struct openpgp_publickey **curkey, *tmp;
+       int changed = 0, count = 0;
 
-       while (keys != NULL) {
-               count = dedupuids(keys);
-               count += dedupsubkeys(keys);
-               if (config.check_sighash) {
-                       count += clean_key_sighashes(keys);
+       if (keys == NULL)
+               return 0;
+
+       curkey = keys;
+       while (*curkey != NULL) {
+               if (policies & ONAK_CLEAN_DROP_V3_KEYS) {
+                       if ((*curkey)->publickey->data[0] < 4) {
+                               /* Remove the key from the list */
+                               tmp = *curkey;
+                               *curkey = tmp->next;
+                               tmp->next = NULL;
+                               free_publickey(tmp);
+                               changed++;
+                               continue;
+                       }
+               }
+               if (policies & ONAK_CLEAN_LARGE_PACKETS) {
+                       count += clean_large_packets(*curkey);
+               }
+               count += dedupuids(*curkey);
+               count += dedupsubkeys(*curkey);
+               if (policies & ONAK_CLEAN_CHECK_SIGHASH) {
+                       count += clean_key_sighashes(*curkey);
                }
                if (count > 0) {
                        changed++;
                }
-               keys = keys->next;
+               curkey = &(*curkey)->next;
        }
 
        return changed;