/* decrypt.c - Decrypt function.

 * Copyright (C) 2000 Werner Koch (dd9jn)

 * Copyright (C) 2001, 2002, 2003, 2004, 2017 g10 Code GmbH

 *

 * This file is part of GPGME.

 *

 * GPGME is free software; you can redistribute it and/or modify it

 * under the terms of the GNU Lesser General Public License as

 * published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * GPGME is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this program; if not, see <https://gnu.org/licenses/>.

 * SPDX-License-Identifier: LGPL-2.1-or-later

 */

#if HAVE_CONFIG_H

#include <config.h>

#endif

#include <stdlib.h>

#include <string.h>

#include <errno.h>

#include <assert.h>

#include "debug.h"

#include "gpgme.h"

#include "util.h"

#include "context.h"

#include "ops.h"

#include "data.h"

typedef struct

{

  struct _gpgme_op_decrypt_result result;

  /* The error code from a FAILURE status line or 0.  */

  gpg_error_t failure_code;

  int okay;

  /* A flag telling that the a decryption failed and an optional error

   * code to further specify the failure.  */

  int failed;

  gpg_error_t pkdecrypt_failed;

  /* At least one secret key is not available.  gpg issues NO_SECKEY

   * status lines for each key the message has been encrypted to but

   * that secret key is not available.  This can't be done for hidden

   * recipients, though.  We track it here to allow for a better error

   * message than the general DECRYPTION_FAILED. */

  int any_no_seckey;

  /* If the engine emits a DECRYPTION_INFO status and that does not

   * indicate that an integrity protection mode is active, this flag

   * is set.  */

  int not_integrity_protected;

  /* The error code from the first ERROR line.  This is in some cases

   * used to return a better matching error code to the caller.  */

  gpg_error_t first_status_error;

  /* A pointer to the next pointer of the last recipient in the list.

     This makes appending new invalid signers painless while

     preserving the order.  */

  gpgme_recipient_t *last_recipient_p;

  /* The data object serial number of the plaintext.  */

  uint64_t plaintext_dserial;

} *op_data_t;

static void

release_op_data (void *hook)

{

  op_data_t opd = (op_data_t) hook;

  gpgme_recipient_t recipient = opd->result.recipients;

  free (opd->result.unsupported_algorithm);

  free (opd->result.file_name);

  free (opd->result.session_key);

  free (opd->result.symkey_algo);

  while (recipient)

    {

      gpgme_recipient_t next = recipient->next;

      free (recipient);

      recipient = next;

    }

}

gpgme_decrypt_result_t

gpgme_op_decrypt_result (gpgme_ctx_t ctx)

{

  void *hook;

  op_data_t opd;

  gpgme_error_t err;

  TRACE_BEG (DEBUG_CTX, "gpgme_op_decrypt_result", ctx, "");

  ctx->ignore_mdc_error = 0;  /* Always reset this flag.  */

  err = _gpgme_op_data_lookup (ctx, OPDATA_DECRYPT, &hook, -1, NULL);

  opd = hook;

  if (err || !opd)

    {

      TRACE_SUC ("result=(null)");

      return NULL;

    }

  /* Make sure that SYMKEY_ALGO has a value.  */

  if (!opd->result.symkey_algo)

    {

      opd->result.symkey_algo = strdup ("?.?");

      if (!opd->result.symkey_algo)

        {

          TRACE_SUC ("result=(null)");

          return NULL;

        }

    }

  if (_gpgme_debug_trace ())

    {

      gpgme_recipient_t rcp;

      if (opd->result.unsupported_algorithm)

	{

	  TRACE_LOG  ("result: unsupported_algorithm: %s",

		      opd->result.unsupported_algorithm);

	}

      if (opd->result.wrong_key_usage)

	{

	  TRACE_LOG ("result: wrong key usage");

	}

      rcp = opd->result.recipients;

      while (rcp)

	{

	  TRACE_LOG  ("result: recipient: keyid=%s, pubkey_algo=%i, "

		      "status=%s", rcp->keyid, rcp->pubkey_algo,

		      gpg_strerror (rcp->status));

	  rcp = rcp->next;

	}

      if (opd->result.file_name)

	{

	  TRACE_LOG  ("result: original file name: %s", opd->result.file_name);

	}

    }

  TRACE_SUC ("result=%p", &opd->result);

  return &opd->result;

}

/* Parse the ARGS of an error status line and record some error

 * conditions at OPD.  Returns 0 on success.  */

static gpgme_error_t

parse_status_error (char *args, op_data_t opd)

{

  gpgme_error_t err;

  char *field[3];

  int nfields;

  char *args2;

  if (!args)

    return trace_gpg_error (GPG_ERR_INV_ENGINE);

  args2 = strdup (args); /* Split modifies the input string. */

  nfields = _gpgme_split_fields (args2, field, DIM (field));

  if (nfields < 1)

    {

      free (args2);

      return trace_gpg_error (GPG_ERR_INV_ENGINE); /* Required arg missing.  */

    }

  err = nfields < 2 ? 0 : atoi (field[1]);

  if (!strcmp (field[0], "decrypt.algorithm"))

    {

      if (gpg_err_code (err) == GPG_ERR_UNSUPPORTED_ALGORITHM

          && nfields > 2

          && strcmp (field[2], "?"))

        {

          opd->result.unsupported_algorithm = strdup (field[2]);

          if (!opd->result.unsupported_algorithm)

            {

              free (args2);

              return gpg_error_from_syserror ();

            }

        }

    }

  else if (!strcmp (field[0], "decrypt.keyusage"))

    {

      if (gpg_err_code (err) == GPG_ERR_WRONG_KEY_USAGE)

        opd->result.wrong_key_usage = 1;

    }

  else if (!strcmp (field[0], "pkdecrypt_failed"))

    {

      switch (gpg_err_code (err))

        {

        case GPG_ERR_CANCELED:

        case GPG_ERR_FULLY_CANCELED:

          /* It is better to return with a cancel error code than the

           * general decryption failed error code.  */

          opd->pkdecrypt_failed = gpg_err_make (gpg_err_source (err),

                                                GPG_ERR_CANCELED);

          break;

        case GPG_ERR_BAD_PASSPHRASE:

          /* A bad passphrase is severe enough that we return this

           * error code.  */

          opd->pkdecrypt_failed = err;

          break;

        default:

          /* For now all other error codes are ignored and the

           * standard DECRYPT_FAILED is returned.  */

          break;

        }

    }

  else if (!strcmp (field[0], "nomdc_with_legacy_cipher"))

    {

      opd->result.legacy_cipher_nomdc = 1;

      opd->not_integrity_protected = 1;

    }

  /* Record the first error code.  */

  if (err && !opd->first_status_error)

    opd->first_status_error = err;

  free (args2);

  return 0;

}

static gpgme_error_t

parse_enc_to (char *args, gpgme_recipient_t *recp, gpgme_protocol_t protocol)

{

  gpgme_recipient_t rec;

  char *tail;

  int i;

  rec = malloc (sizeof (*rec));

  if (!rec)

    return gpg_error_from_syserror ();

  rec->next = NULL;

  rec->keyid = rec->_keyid;

  rec->status = 0;

  for (i = 0; i < sizeof (rec->_keyid) - 1; i++)

    {

      if (args[i] == '\0' || args[i] == ' ')

	break;

      rec->_keyid[i] = args[i];

    }

  rec->_keyid[i] = '\0';

  args = &args[i];

  if (*args != '\0' && *args != ' ')

    {

      free (rec);

      return trace_gpg_error (GPG_ERR_INV_ENGINE);

    }

  while (*args == ' ')

    args++;

  if (*args)

    {

      gpg_err_set_errno (0);

      rec->pubkey_algo = _gpgme_map_pk_algo (strtol (args, &tail, 0), protocol);

      if (errno || args == tail || *tail != ' ')

	{

	  /* The crypto backend does not behave.  */

	  free (rec);

	  return trace_gpg_error (GPG_ERR_INV_ENGINE);

	}

    }

  /* FIXME: The key length is always 0 right now, so no need to parse

     it.  */

  *recp = rec;

  return 0;

}

/* Parse the ARGS of a

 *   DECRYPTION_INFO <mdc_method> <sym_algo> [<aead_algo>]

 * status.  Returns 0 on success and updates the OPD.

 */

static gpgme_error_t

parse_decryption_info (char *args, op_data_t opd, gpgme_protocol_t protocol)

{

  char *field[3];

  int nfields;

  char *args2;

  int mdc, aead_algo;

  const char *algostr, *modestr;

  if (!args)

    return trace_gpg_error (GPG_ERR_INV_ENGINE);

  args2 = strdup (args); /* Split modifies the input string. */

  nfields = _gpgme_split_fields (args2, field, DIM (field));

  if (nfields < 2)

    {

      free (args2);

      return trace_gpg_error (GPG_ERR_INV_ENGINE); /* Required arg missing.  */

    }

  mdc     = atoi (field[0]);

  algostr = _gpgme_cipher_algo_name (atoi (field[1]), protocol);

  aead_algo    = nfields < 3? 0 : atoi (field[2]);

  modestr = _gpgme_cipher_mode_name (aead_algo, protocol);

  free (args2);

  free (opd->result.symkey_algo);

  if (!aead_algo && mdc != 2)

    opd->result.symkey_algo = _gpgme_strconcat (algostr, ".PGPCFB", NULL);

  else

    opd->result.symkey_algo = _gpgme_strconcat (algostr, ".", modestr, NULL);

  if (!opd->result.symkey_algo)

    return gpg_error_from_syserror ();

  if (!mdc && !aead_algo)

    opd->not_integrity_protected = 1;

  return 0;

}

gpgme_error_t

_gpgme_decrypt_status_handler (void *priv, gpgme_status_code_t code,

			       char *args)

{

  gpgme_ctx_t ctx = (gpgme_ctx_t) priv;

  gpgme_error_t err;

  void *hook;

  op_data_t opd;

  err = _gpgme_passphrase_status_handler (priv, code, args);

  if (err)

    return err;

  err = _gpgme_op_data_lookup (ctx, OPDATA_DECRYPT, &hook, -1, NULL);

  opd = hook;

  if (err)

    return err;

  switch (code)

    {

    case GPGME_STATUS_FAILURE:

      opd->failure_code = _gpgme_parse_failure (args);

      break;

    case GPGME_STATUS_EOF:

      /* We force an encryption failure if we know that integrity

       * protection is missing.  For modern version of gpg using

       * modern cipher algorithms this is not required because gpg

       * will issue a failure anyway.  However older gpg versions emit

       * only a warning.

       * Fixme: These error values should probably be attributed to

       * the underlying crypto engine (as error source).  */

      if (opd->failed)

        {

          /* This comes from a specialized ERROR status line.  */

          if (opd->pkdecrypt_failed)

            return opd->pkdecrypt_failed;

          /* For an integrity failure return just DECRYPTION_FAILED;

           * the actual cause can be taken from an already set

           * decryption result flag.  */

          if ((opd->not_integrity_protected && !ctx->ignore_mdc_error))

            return gpg_error (GPG_ERR_DECRYPT_FAILED);

          /* If we have any other ERROR code we prefer that over

           * NO_SECKEY because it is probably the better matching

           * code.  For example a garbled message with multiple

           * plaintext will return BAD_DATA here but may also have

           * indicated a NO_SECKEY.  */

          if (opd->first_status_error)

            return opd->first_status_error;

          /* No secret key is pretty common reason.  */

          if (opd->any_no_seckey)

            return gpg_error (GPG_ERR_NO_SECKEY);

          /* Generic decryption failed error code.  */

          return gpg_error (GPG_ERR_DECRYPT_FAILED);

        }

      else if (!opd->okay)

        {

          /* No data was found.  */

          return gpg_error (GPG_ERR_NO_DATA);

        }

      else if (opd->failure_code)

        {

          /* The engine returned failure code at program exit.  */

          return opd->failure_code;

        }

      break;

    case GPGME_STATUS_DECRYPTION_INFO:

      err = parse_decryption_info (args, opd, ctx->protocol);

      if (err)

	return err;

      break;

    case GPGME_STATUS_DECRYPTION_OKAY:

      opd->okay = 1;

      break;

    case GPGME_STATUS_DECRYPTION_FAILED:

      opd->failed = 1;

      /* Tell the data object that it shall not return any data.  We

       * use the serial number because the data object may be owned by

       * another thread.  We also don't check for an error because it

       * is possible that the data object has already been destroyed

       * and we are then not interested in returning an error.  */

      if (!ctx->ignore_mdc_error)

        _gpgme_data_set_prop (NULL, opd->plaintext_dserial,

                              DATA_PROP_BLANKOUT, 1);

      break;

    case GPGME_STATUS_ERROR:

      /* Note that this is an informational status code which should

       * not lead to an error return unless it is something not

       * related to the backend.  However, it is used to return a

       * better matching final error code.  */

      err = parse_status_error (args, opd);

      if (err)

        return err;

      break;

    case GPGME_STATUS_ENC_TO:

      err = parse_enc_to (args, opd->last_recipient_p, ctx->protocol);

      if (err)

	return err;

      opd->last_recipient_p = &(*opd->last_recipient_p)->next;

      break;

    case GPGME_STATUS_SESSION_KEY:

      if (opd->result.session_key)

        free (opd->result.session_key);

      opd->result.session_key = strdup(args);

      break;

    case GPGME_STATUS_NO_SECKEY:

      {

	gpgme_recipient_t rec = opd->result.recipients;

	while (rec)

	  {

	    if (!strcmp (rec->keyid, args))

	      {

		rec->status = gpg_error (GPG_ERR_NO_SECKEY);

		break;

	      }

	    rec = rec->next;

	  }

	/* FIXME: Is this ok?  */

	if (!rec)

	  return trace_gpg_error (GPG_ERR_INV_ENGINE);

        opd->any_no_seckey = 1;

      }

      break;

    case GPGME_STATUS_PLAINTEXT:

      {

        int mime = 0;

        err = _gpgme_parse_plaintext (args, &opd->result.file_name, &mime);

        if (err)

          return err;

        opd->result.is_mime = !!mime;

      }

      break;

    case GPGME_STATUS_INQUIRE_MAXLEN:

      if (ctx->status_cb && !ctx->full_status)

        {

          err = ctx->status_cb (ctx->status_cb_value, "INQUIRE_MAXLEN", args);

          if (err)

            return err;

        }

      break;

    case GPGME_STATUS_DECRYPTION_COMPLIANCE_MODE:

      PARSE_COMPLIANCE_FLAGS (args, &opd->result);

      break;

    default:

      break;

    }

  return 0;

}

static gpgme_error_t

decrypt_status_handler (void *priv, gpgme_status_code_t code, char *args)

{

  gpgme_error_t err;

  err = _gpgme_progress_status_handler (priv, code, args);

  if (!err)

    err = _gpgme_decrypt_status_handler (priv, code, args);

  return err;

}

gpgme_error_t

_gpgme_op_decrypt_init_result (gpgme_ctx_t ctx, gpgme_data_t plaintext)

{

  gpgme_error_t err;

  void *hook;

  op_data_t opd;

  err = _gpgme_op_data_lookup (ctx, OPDATA_DECRYPT, &hook,

			       sizeof (*opd), release_op_data);

  opd = hook;

  if (err)

    return err;

  opd->last_recipient_p = &opd->result.recipients;

  opd->plaintext_dserial = _gpgme_data_get_dserial (plaintext);

  return 0;

}

gpgme_error_t

_gpgme_decrypt_start (gpgme_ctx_t ctx, int synchronous,

                      gpgme_decrypt_flags_t flags,

                      gpgme_data_t cipher, gpgme_data_t plain)

{

  gpgme_error_t err;

  assert (!(flags & GPGME_DECRYPT_VERIFY));

  err = _gpgme_op_reset (ctx, synchronous);

  if (err)

    return err;

  err = _gpgme_op_decrypt_init_result (ctx, plain);

  if (err)

    return err;

  if (!cipher)

    return gpg_error (GPG_ERR_NO_DATA);

  if (!plain)

    return gpg_error (GPG_ERR_INV_VALUE);

  if (err)

    return err;

  if (ctx->passphrase_cb)

    {

      err = _gpgme_engine_set_command_handler

	(ctx->engine, _gpgme_passphrase_command_handler, ctx);

      if (err)

	return err;

    }

  _gpgme_engine_set_status_handler (ctx->engine, decrypt_status_handler, ctx);

  return _gpgme_engine_op_decrypt (ctx->engine,

                                   flags,

                                   cipher, plain,

                                   ctx->export_session_keys,

                                   ctx->override_session_key,

                                   ctx->auto_key_retrieve);

}

gpgme_error_t

gpgme_op_decrypt_start (gpgme_ctx_t ctx, gpgme_data_t cipher,

			gpgme_data_t plain)

{

  gpgme_error_t err;

  TRACE_BEG  (DEBUG_CTX, "gpgme_op_decrypt_start", ctx,

	      "cipher=%p, plain=%p", cipher, plain);

  if (!ctx)

    return TRACE_ERR (gpg_error (GPG_ERR_INV_VALUE));

  err = _gpgme_decrypt_start (ctx, 0, 0, cipher, plain);

  return TRACE_ERR (err);

}

/* Decrypt ciphertext CIPHER within CTX and store the resulting

   plaintext in PLAIN.  */

gpgme_error_t

gpgme_op_decrypt (gpgme_ctx_t ctx, gpgme_data_t cipher, gpgme_data_t plain)

{

  gpgme_error_t err;

  TRACE_BEG  (DEBUG_CTX, "gpgme_op_decrypt", ctx,

	      "cipher=%p, plain=%p", cipher, plain);

  if (!ctx)

    return TRACE_ERR (gpg_error (GPG_ERR_INV_VALUE));

  err = _gpgme_decrypt_start (ctx, 1, 0, cipher, plain);

  if (!err)

    err = _gpgme_wait_one (ctx);

  ctx->ignore_mdc_error = 0;  /* Always reset.  */

  return TRACE_ERR (err);

}