Skip to content

Commit 053a626

Browse files
zapuzapu
committed
Bring back old Flag* API in Signature
KeyFlagBits can still be used when passing keys around and potentially merging key flags from multiple signatures.
1 parent 9727ba8 commit 053a626

File tree

3 files changed

+68
-31
lines changed

3 files changed

+68
-31
lines changed

‎openpgp/keys.go‎

Lines changed: 26 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -133,8 +133,8 @@ func (e *Entity) encryptionKey(now time.Time) (Key, bool) {
133133
// One more note: old DSA/ElGamal keys tend not to have the Flags subpacket,
134134
// so this sort of thing is pretty important for encrypting to older keys.
135135
//
136-
if ((subkey.Sig.KeyFlags.Valid && subkey.Sig.KeyFlags.HasFlagEncryptCommunications()) ||
137-
(!subkey.Sig.KeyFlags.Valid && subkey.PublicKey.PubKeyAlgo == packet.PubKeyAlgoElGamal)) &&
136+
if ((subkey.Sig.FlagsValid && subkey.Sig.FlagEncryptCommunications) ||
137+
(!subkey.Sig.FlagsValid && subkey.PublicKey.PubKeyAlgo == packet.PubKeyAlgoElGamal)) &&
138138
subkey.PublicKey.PubKeyAlgo.CanEncrypt() &&
139139
!subkey.Sig.KeyExpired(now) &&
140140
subkey.Revocation == nil &&
@@ -146,7 +146,7 @@ func (e *Entity) encryptionKey(now time.Time) (Key, bool) {
146146

147147
if candidateSubkey != -1 {
148148
subkey := e.Subkeys[candidateSubkey]
149-
return Key{e, subkey.PublicKey, subkey.PrivateKey, subkey.Sig, subkey.Sig.KeyFlags}, true
149+
return Key{e, subkey.PublicKey, subkey.PrivateKey, subkey.Sig, subkey.Sig.GetKeyFlags()}, true
150150
}
151151

152152
// If we don't have any candidate subkeys for encryption and
@@ -157,10 +157,10 @@ func (e *Entity) encryptionKey(now time.Time) (Key, bool) {
157157
// NOTE(maxtaco) - see note above, how this policy is a little too open-ended
158158
// for my liking, but leave it for now.
159159
i := e.primaryIdentity()
160-
if (!i.SelfSignature.KeyFlags.Valid || i.SelfSignature.KeyFlags.HasFlagEncryptCommunications()) &&
160+
if (!i.SelfSignature.FlagsValid || i.SelfSignature.FlagEncryptCommunications) &&
161161
e.PrimaryKey.PubKeyAlgo.CanEncrypt() &&
162162
!i.SelfSignature.KeyExpired(now) {
163-
return Key{e, e.PrimaryKey, e.PrivateKey, i.SelfSignature, i.SelfSignature.KeyFlags}, true
163+
return Key{e, e.PrimaryKey, e.PrivateKey, i.SelfSignature, i.SelfSignature.GetKeyFlags()}, true
164164
}
165165

166166
// This Entity appears to be signing only.
@@ -173,7 +173,7 @@ func (e *Entity) signingKey(now time.Time) (Key, bool) {
173173
candidateSubkey := -1
174174

175175
for i, subkey := range e.Subkeys {
176-
if (!subkey.Sig.KeyFlags.Valid || subkey.Sig.KeyFlags.HasFlagSign()) &&
176+
if (!subkey.Sig.FlagsValid || subkey.Sig.FlagSign) &&
177177
subkey.PrivateKey.PrivateKey != nil &&
178178
subkey.PublicKey.PubKeyAlgo.CanSign() &&
179179
subkey.Revocation == nil &&
@@ -185,17 +185,17 @@ func (e *Entity) signingKey(now time.Time) (Key, bool) {
185185

186186
if candidateSubkey != -1 {
187187
subkey := e.Subkeys[candidateSubkey]
188-
return Key{e, subkey.PublicKey, subkey.PrivateKey, subkey.Sig, subkey.Sig.KeyFlags}, true
188+
return Key{e, subkey.PublicKey, subkey.PrivateKey, subkey.Sig, subkey.Sig.GetKeyFlags()}, true
189189
}
190190

191191
// If we have no candidate subkey then we assume that it's ok to sign
192192
// with the primary key.
193193
i := e.primaryIdentity()
194-
if (!i.SelfSignature.KeyFlags.Valid || i.SelfSignature.KeyFlags.HasFlagSign()) &&
194+
if (!i.SelfSignature.FlagsValid || i.SelfSignature.FlagSign) &&
195195
e.PrimaryKey.PubKeyAlgo.CanSign() &&
196196
!i.SelfSignature.KeyExpired(now) &&
197197
e.PrivateKey.PrivateKey != nil {
198-
return Key{e, e.PrimaryKey, e.PrivateKey, i.SelfSignature, i.SelfSignature.KeyFlags}, true
198+
return Key{e, e.PrimaryKey, e.PrivateKey, i.SelfSignature, i.SelfSignature.GetKeyFlags()}, true
199199
}
200200

201201
return Key{}, false
@@ -227,13 +227,13 @@ func (el EntityList) KeysById(id uint64, fp []byte) (keys []Key) {
227227
selfSig = ident.SelfSignature
228228
} else if ident.SelfSignature.IsPrimaryId != nil && *ident.SelfSignature.IsPrimaryId {
229229
selfSig = ident.SelfSignature
230-
break;
230+
break
231231
}
232232
}
233233

234234
var keyFlags packet.KeyFlagBits
235235
for _, ident := range e.Identities {
236-
keyFlags.Merge(ident.SelfSignature.KeyFlags)
236+
keyFlags.Merge(ident.SelfSignature.GetKeyFlags())
237237
}
238238

239239
keys = append(keys, Key{e, e.PrimaryKey, e.PrivateKey, selfSig, keyFlags})
@@ -249,7 +249,7 @@ func (el EntityList) KeysById(id uint64, fp []byte) (keys []Key) {
249249
sig = subKey.Sig
250250
}
251251

252-
keys = append(keys, Key{e, subKey.PublicKey, subKey.PrivateKey, sig, sig.KeyFlags})
252+
keys = append(keys, Key{e, subKey.PublicKey, subKey.PrivateKey, sig, sig.GetKeyFlags()})
253253
}
254254
}
255255
}
@@ -314,8 +314,8 @@ func (el EntityList) KeysByIdUsage(id uint64, fp []byte, requiredUsage byte) (ke
314314
func (el EntityList) DecryptionKeys() (keys []Key) {
315315
for _, e := range el {
316316
for _, subKey := range e.Subkeys {
317-
if subKey.PrivateKey != nil && subKey.PrivateKey.PrivateKey != nil && (!subKey.Sig.KeyFlags.Valid || subKey.Sig.KeyFlags.HasFlagEncryptStorage() || subKey.Sig.KeyFlags.HasFlagEncryptCommunications()) {
318-
keys = append(keys, Key{e, subKey.PublicKey, subKey.PrivateKey, subKey.Sig, subKey.Sig.KeyFlags})
317+
if subKey.PrivateKey != nil && subKey.PrivateKey.PrivateKey != nil && (!subKey.Sig.FlagsValid || subKey.Sig.FlagEncryptStorage || subKey.Sig.FlagEncryptCommunications) {
318+
keys = append(keys, Key{e, subKey.PublicKey, subKey.PrivateKey, subKey.Sig, subKey.Sig.GetKeyFlags()})
319319
}
320320
}
321321
}
@@ -491,7 +491,7 @@ EachPacket:
491491
if current != nil &&
492492
(current.SelfSignature == nil ||
493493
(!pkt.CreationTime.Before(current.SelfSignature.CreationTime) &&
494-
(pkt.KeyFlags.Valid || !current.SelfSignature.KeyFlags.Valid))) &&
494+
(pkt.FlagsValid || !current.SelfSignature.FlagsValid))) &&
495495
(pkt.SigType == packet.SigTypePositiveCert || pkt.SigType == packet.SigTypeGenericCert) &&
496496
pkt.IssuerKeyId != nil &&
497497
*pkt.IssuerKeyId == e.PrimaryKey.KeyId {
@@ -698,7 +698,9 @@ func NewEntity(name, comment, email string, config *packet.Config) (*Entity, err
698698
PubKeyAlgo: packet.PubKeyAlgoRSA,
699699
Hash: config.Hash(),
700700
IsPrimaryId: &isPrimaryId,
701-
KeyFlags: packet.KeyFlagBits{true, packet.KeyFlagEncryptStorage | packet.KeyFlagEncryptCommunications},
701+
FlagsValid: true,
702+
FlagSign: true,
703+
FlagCertify: true,
702704
IssuerKeyId: &e.PrimaryKey.KeyId,
703705
},
704706
}
@@ -708,12 +710,14 @@ func NewEntity(name, comment, email string, config *packet.Config) (*Entity, err
708710
PublicKey: packet.NewRSAPublicKey(currentTime, &encryptingPriv.PublicKey),
709711
PrivateKey: packet.NewRSAPrivateKey(currentTime, encryptingPriv),
710712
Sig: &packet.Signature{
711-
CreationTime: currentTime,
712-
SigType: packet.SigTypeSubkeyBinding,
713-
PubKeyAlgo: packet.PubKeyAlgoRSA,
714-
Hash: config.Hash(),
715-
KeyFlags: packet.KeyFlagBits{true, packet.KeyFlagEncryptStorage | packet.KeyFlagEncryptCommunications},
716-
IssuerKeyId: &e.PrimaryKey.KeyId,
713+
CreationTime: currentTime,
714+
SigType: packet.SigTypeSubkeyBinding,
715+
PubKeyAlgo: packet.PubKeyAlgoRSA,
716+
Hash: config.Hash(),
717+
FlagsValid: true,
718+
FlagEncryptStorage: true,
719+
FlagEncryptCommunications: true,
720+
IssuerKeyId: &e.PrimaryKey.KeyId,
717721
},
718722
}
719723
e.Subkeys[0].PublicKey.IsSubkey = true

‎openpgp/packet/public_key.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ type edDSAkey struct {
6666

6767
func copyFrontFill(dst, src []byte, length int) int {
6868
if srcLen := len(src); srcLen < length {
69-
return copy(dst[length - srcLen:], src[:])
69+
return copy(dst[length-srcLen:], src[:])
7070
} else {
7171
return copy(dst[:], src[:])
7272
}
@@ -748,7 +748,7 @@ func (pk *PublicKey) VerifyKeySignature(signed *PublicKey, sig *Signature) error
748748
return err
749749
}
750750

751-
if sig.KeyFlags.HasFlagSign() {
751+
if sig.FlagSign {
752752

753753
// BUG(maxtaco)
754754
//

‎openpgp/packet/signature.go‎

Lines changed: 40 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -82,10 +82,10 @@ type Signature struct {
8282
IsPrimaryId *bool
8383
IssuerFingerprint []byte
8484

85-
// KeyFlags is set if any flags were given. See RFC 4880, section
86-
// 5.2.3.21 for details. To see if there were any flags, check
87-
// KeyFlags.Valid boolean field.
88-
KeyFlags KeyFlagBits
85+
// FlagsValid is set if any flags were given. See RFC 4880, section
86+
// 5.2.3.21 for details.
87+
FlagsValid bool
88+
FlagCertify, FlagSign, FlagEncryptCommunications, FlagEncryptStorage bool
8989

9090
// RevocationReason is set if this signature has been revoked.
9191
// See RFC 4880, section 5.2.3.23 for details.
@@ -384,7 +384,19 @@ func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (r
384384
err = errors.StructuralError("empty key flags subpacket")
385385
return
386386
}
387-
sig.KeyFlags = KeyFlagBits{true, byte(subpacket[0] & (KeyFlagCertify | KeyFlagSign | KeyFlagEncryptCommunications | KeyFlagEncryptStorage))}
387+
sig.FlagsValid = true
388+
if subpacket[0]&KeyFlagCertify != 0 {
389+
sig.FlagCertify = true
390+
}
391+
if subpacket[0]&KeyFlagSign != 0 {
392+
sig.FlagSign = true
393+
}
394+
if subpacket[0]&KeyFlagEncryptCommunications != 0 {
395+
sig.FlagEncryptCommunications = true
396+
}
397+
if subpacket[0]&KeyFlagEncryptStorage != 0 {
398+
sig.FlagEncryptStorage = true
399+
}
388400
case reasonForRevocationSubpacket:
389401
// Reason For Revocation, section 5.2.3.23
390402
if !isHashed {
@@ -792,8 +804,8 @@ func (sig *Signature) buildSubpackets() (subpackets []outputSubpacket) {
792804

793805
// Key flags may only appear in self-signatures or certification signatures.
794806

795-
if sig.KeyFlags.Valid {
796-
subpackets = append(subpackets, outputSubpacket{true, keyFlagsSubpacket, false, []byte{sig.KeyFlags.BitField}})
807+
if sig.FlagsValid {
808+
subpackets = append(subpackets, outputSubpacket{true, keyFlagsSubpacket, false, []byte{sig.GetKeyFlags().BitField}})
797809
}
798810

799811
// The following subpackets may only appear in self-signatures
@@ -823,6 +835,27 @@ func (sig *Signature) buildSubpackets() (subpackets []outputSubpacket) {
823835
return
824836
}
825837

838+
func (sig *Signature) GetKeyFlags() (ret KeyFlagBits) {
839+
if !sig.FlagsValid {
840+
return ret
841+
}
842+
843+
ret.Valid = true
844+
if sig.FlagCertify {
845+
ret.BitField |= KeyFlagCertify
846+
}
847+
if sig.FlagSign {
848+
ret.BitField |= KeyFlagSign
849+
}
850+
if sig.FlagEncryptCommunications {
851+
ret.BitField |= KeyFlagEncryptCommunications
852+
}
853+
if sig.FlagEncryptStorage {
854+
ret.BitField |= KeyFlagEncryptStorage
855+
}
856+
return ret
857+
}
858+
826859
func (f *KeyFlagBits) HasFlagCertify() bool {
827860
return f.BitField&KeyFlagCertify != 0
828861
}

0 commit comments

Comments
 (0)