No OneTemporary
Actions

Size

151 KB

Subscribers

None

View Options

	diff --git a/g10/mainproc.c b/g10/mainproc.c
	index f861a3ea2..716363f4c 100644
	--- a/g10/mainproc.c
	+++ b/g10/mainproc.c
	@@ -1,2456 +1,2472 @@
	/* mainproc.c - handle packets
	* Copyright (C) 1998-2009 Free Software Foundation, Inc.
	* Copyright (C) 2013-2014 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <http://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <time.h>

	#include "gpg.h"
	#include "util.h"
	#include "packet.h"
	#include "iobuf.h"
	#include "options.h"
	#include "keydb.h"
	#include "filter.h"
	#include "main.h"
	#include "status.h"
	#include "i18n.h"
	#include "trustdb.h"
	#include "keyserver-internal.h"
	#include "photoid.h"
	#include "mbox-util.h"
	#include "call-dirmngr.h"

	/* Put an upper limit on nested packets. The 32 is an arbitrary
	value, a much lower should actually be sufficient. */
	#define MAX_NESTING_DEPTH 32


	/* An object to build a list of keyid related info. */
	struct kidlist_item
	{
	struct kidlist_item *next;
	u32 kid[2];
	int pubkey_algo;
	int reason;
	};


	/*
	* Object to hold the processing context.
	*/
	typedef struct mainproc_context *CTX;
	struct mainproc_context
	{
	ctrl_t ctrl;
	struct mainproc_context anchor; / May be useful in the future. */
	PKT_public_key *last_pubkey;
	PKT_user_id *last_user_id;
	md_filter_context_t mfx;
	int sigs_only; /* Process only signatures and reject all other stuff. */
	int encrypt_only; /* Process only encryption messages. */

	/* Name of the file with the complete signature or the file with the
	detached signature. This is currently only used to deduce the
	file name of the data file if that has not been given. */
	const char *sigfilename;

	/* A structure to describe the signed data in case of a detached
	signature. */
	struct
	{
	/* A file descriptor of the the signed data. Only used if not -1. */
	int data_fd;
	/* A list of filenames with the data files or NULL. This is only
	used if DATA_FD is -1. */
	strlist_t data_names;
	/* Flag to indicated that either one of the next previous fields
	is used. This is only needed for better readability. */
	int used;
	} signed_data;

	DEK *dek;
	int last_was_session_key;
	kbnode_t list; /* The current list of packets. */
	iobuf_t iobuf; /* Used to get the filename etc. */
	int trustletter; /* Temporary usage in list_node. */
	ulong symkeys;
	struct kidlist_item pkenc_list; / List of encryption packets. */
	struct {
	unsigned int sig_seen:1; /* Set to true if a signature packet
	has been seen. */
	unsigned int data:1; /* Any data packet seen */
	unsigned int uncompress_failed:1;
	} any;
	};


	/* Local prototypes. */
	static int do_proc_packets (ctrl_t ctrl, CTX c, iobuf_t a);
	static void list_node (CTX c, kbnode_t node);
	static void proc_tree (CTX c, kbnode_t node);
	static int literals_seen;


	/* Functions. */


	void
	reset_literals_seen(void)
	{
	literals_seen = 0;
	}


	static void
	release_list( CTX c )
	{
	proc_tree (c, c->list);
	release_kbnode (c->list);
	while (c->pkenc_list)
	{
	struct kidlist_item *tmp = c->pkenc_list->next;
	xfree (c->pkenc_list);
	c->pkenc_list = tmp;
	}
	c->pkenc_list = NULL;
	c->list = NULL;
	c->any.data = 0;
	c->any.uncompress_failed = 0;
	c->last_was_session_key = 0;
	xfree (c->dek);
	c->dek = NULL;
	}


	static int
	add_onepass_sig (CTX c, PACKET *pkt)
	{
	kbnode_t node;

	if (c->list) /* Add another packet. */
	add_kbnode (c->list, new_kbnode (pkt));
	else /* Insert the first one. */
	c->list = node = new_kbnode (pkt);

	return 1;
	}


	static int
	add_gpg_control (CTX c, PACKET *pkt)
	{
	if ( pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START )
	{
	/* New clear text signature.
	* Process the last one and reset everything */
	release_list(c);
	}

	if (c->list) /* Add another packet. */
	add_kbnode (c->list, new_kbnode (pkt));
	else /* Insert the first one. */
	c->list = new_kbnode (pkt);

	return 1;
	}


	static int
	add_user_id (CTX c, PACKET *pkt)
	{
	if (!c->list)
	{
	log_error ("orphaned user ID\n");
	return 0;
	}
	add_kbnode (c->list, new_kbnode (pkt));
	return 1;
	}


	static int
	add_subkey (CTX c, PACKET *pkt)
	{
	if (!c->list)
	{
	log_error ("subkey w/o mainkey\n");
	return 0;
	}
	add_kbnode (c->list, new_kbnode (pkt));
	return 1;
	}


	static int
	add_ring_trust (CTX c, PACKET *pkt)
	{
	if (!c->list)
	{
	log_error ("ring trust w/o key\n");
	return 0;
	}
	add_kbnode (c->list, new_kbnode (pkt));
	return 1;
	}


	static int
	add_signature (CTX c, PACKET *pkt)
	{
	kbnode_t node;

	c->any.sig_seen = 1;
	if (pkt->pkttype == PKT_SIGNATURE && !c->list)
	{
	/* This is the first signature for the following datafile.
	* GPG does not write such packets; instead it always uses
	* onepass-sig packets. The drawback of PGP's method
	* of prepending the signature to the data is
	* that it is not possible to make a signature from data read
	* from stdin. (GPG is able to read PGP stuff anyway.) */
	node = new_kbnode (pkt);
	c->list = node;
	return 1;
	}
	else if (!c->list)
	return 0; /* oops (invalid packet sequence)*/
	else if (!c->list->pkt)
	BUG(); /* so nicht */

	/* Add a new signature node item at the end. */
	node = new_kbnode (pkt);
	add_kbnode (c->list, node);

	return 1;
	}

	static int
	symkey_decrypt_seskey (DEK dek, byte seskey, size_t slen)
	{
	gcry_cipher_hd_t hd;

	if(slen < 17 \|\| slen > 33)
	{
	log_error ( _("weird size for an encrypted session key (%d)\n"),
	(int)slen);
	return GPG_ERR_BAD_KEY;
	}

	if (openpgp_cipher_open (&hd, dek->algo, GCRY_CIPHER_MODE_CFB, 1))
	BUG ();
	if (gcry_cipher_setkey ( hd, dek->key, dek->keylen ))
	BUG ();
	gcry_cipher_setiv ( hd, NULL, 0 );
	gcry_cipher_decrypt ( hd, seskey, slen, NULL, 0 );
	gcry_cipher_close ( hd );

	/* Now we replace the dek components with the real session key to
	decrypt the contents of the sequencing packet. */

	dek->keylen=slen-1;
	dek->algo=seskey[0];

	if(dek->keylen > DIM(dek->key))
	BUG ();

	memcpy(dek->key, seskey + 1, dek->keylen);

	/log_hexdump( "thekey", dek->key, dek->keylen );/

	return 0;
	}


	static void
	proc_symkey_enc (CTX c, PACKET *pkt)
	{
	PKT_symkey_enc *enc;

	enc = pkt->pkt.symkey_enc;
	if (!enc)
	log_error ("invalid symkey encrypted packet\n");
	else if(!c->dek)
	{
	int algo = enc->cipher_algo;
	const char *s = openpgp_cipher_algo_name (algo);

	if (!openpgp_cipher_test_algo (algo))
	{
	if (!opt.quiet)
	{
	if (enc->seskeylen)
	log_info (_("%s encrypted session key\n"), s );
	else
	log_info (_("%s encrypted data\n"), s );
	}
	}
	else
	log_error (_("encrypted with unknown algorithm %d\n"), algo);

	if (openpgp_md_test_algo (enc->s2k.hash_algo))
	{
	log_error(_("passphrase generated with unknown digest"
	" algorithm %d\n"),enc->s2k.hash_algo);
	s = NULL;
	}

	c->last_was_session_key = 2;
	if (!s \|\| opt.list_only)
	goto leave;

	if (opt.override_session_key)
	{
	c->dek = xmalloc_clear (sizeof *c->dek);
	if (get_override_session_key (c->dek, opt.override_session_key))
	{
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	else
	{
	c->dek = passphrase_to_dek (algo, &enc->s2k, 0, 0, NULL, NULL);
	if (c->dek)
	{
	c->dek->symmetric = 1;

	/* FIXME: This doesn't work perfectly if a symmetric key
	comes before a public key in the message - if the
	user doesn't know the passphrase, then there is a
	chance that the "decrypted" algorithm will happen to
	be a valid one, which will make the returned dek
	appear valid, so we won't try any public keys that
	come later. */
	if (enc->seskeylen)
	{
	if (symkey_decrypt_seskey (c->dek,
	enc->seskey, enc->seskeylen))
	{
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	else
	c->dek->algo_info_printed = 1;
	}
	}
	}

	leave:
	c->symkeys++;
	free_packet (pkt);
	}


	static void
	proc_pubkey_enc (ctrl_t ctrl, CTX c, PACKET *pkt)
	{
	PKT_pubkey_enc *enc;
	int result = 0;

	/* Check whether the secret key is available and store in this case. */
	c->last_was_session_key = 1;
	enc = pkt->pkt.pubkey_enc;
	/printf("enc: encrypted by a pubkey with keyid %08lX\n", enc->keyid[1] );/
	/* Hmmm: why do I have this algo check here - anyway there is
	* function to check it. */
	if (opt.verbose)
	log_info (_("public key is %s\n"), keystr (enc->keyid));

	if (is_status_enabled())
	{
	char buf[50];
	/* FIXME: For ECC support we need to map the OpenPGP algo number
	to the Libgcrypt defined one. This is due a chicken-egg
	problem: We need to have code in Libgcrypt for a new
	algorithm so to implement a proposed new algorithm before the
	IANA will finally assign an OpenPGP identifier. */
	snprintf (buf, sizeof buf, "%08lX%08lX %d 0",
	(ulong)enc->keyid[0], (ulong)enc->keyid[1], enc->pubkey_algo);
	write_status_text (STATUS_ENC_TO, buf);
	}

	if (!opt.list_only && opt.override_session_key)
	{
	/* It does not make much sense to store the session key in
	* secure memory because it has already been passed on the
	* command line and the GCHQ knows about it. */
	c->dek = xmalloc_clear (sizeof *c->dek);
	result = get_override_session_key (c->dek, opt.override_session_key);
	if (result)
	{
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	else if (enc->pubkey_algo == PUBKEY_ALGO_ELGAMAL_E
	\|\| enc->pubkey_algo == PUBKEY_ALGO_ECDH
	\|\| enc->pubkey_algo == PUBKEY_ALGO_RSA
	\|\| enc->pubkey_algo == PUBKEY_ALGO_RSA_E
	\|\| enc->pubkey_algo == PUBKEY_ALGO_ELGAMAL)
	{
	/* Note that we also allow type 20 Elgamal keys for decryption.
	There are still a couple of those keys in active use as a
	subkey. */

	/* FIXME: Store this all in a list and process it later so that
	we can prioritize what key to use. This gives a better user
	experience if wildcard keyids are used. */
	if (!c->dek && ((!enc->keyid[0] && !enc->keyid[1])
	\|\| opt.try_all_secrets
	\|\| have_secret_key_with_kid (enc->keyid)))
	{
	if(opt.list_only)
	result = -1;
	else
	{
	c->dek = xmalloc_secure_clear (sizeof *c->dek);
	if ((result = get_session_key (ctrl, enc, c->dek)))
	{
	/* Error: Delete the DEK. */
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	}
	else
	result = GPG_ERR_NO_SECKEY;
	}
	else
	result = GPG_ERR_PUBKEY_ALGO;

	if (result == -1)
	;
	else
	{
	/* Store it for later display. */
	struct kidlist_item x = xmalloc (sizeof x);
	x->kid[0] = enc->keyid[0];
	x->kid[1] = enc->keyid[1];
	x->pubkey_algo = enc->pubkey_algo;
	x->reason = result;
	x->next = c->pkenc_list;
	c->pkenc_list = x;

	if (!result && opt.verbose > 1)
	log_info (_("public key encrypted data: good DEK\n"));
	}

	free_packet(pkt);
	}


	/*
	* Print the list of public key encrypted packets which we could
	* not decrypt.
	*/
	static void
	print_pkenc_list (struct kidlist_item *list, int failed)
	{
	for (; list; list = list->next)
	{
	PKT_public_key *pk;
	const char *algstr;

	if (failed && !list->reason)
	continue;
	if (!failed && list->reason)
	continue;

	algstr = openpgp_pk_algo_name (list->pubkey_algo);
	pk = xmalloc_clear (sizeof *pk);

	if (!algstr)
	algstr = "[?]";
	pk->pubkey_algo = list->pubkey_algo;
	if (!get_pubkey (pk, list->kid))
	{
	char *p;
	log_info (_("encrypted with %u-bit %s key, ID %s, created %s\n"),
	nbits_from_pk (pk), algstr, keystr_from_pk(pk),
	strtimestamp (pk->timestamp));
	p = get_user_id_native (list->kid);
	log_printf (_(" \"%s\"\n"), p);
	xfree (p);
	}
	else
	log_info (_("encrypted with %s key, ID %s\n"),
	algstr, keystr(list->kid));

	free_public_key (pk);

	if (gpg_err_code (list->reason) == GPG_ERR_NO_SECKEY)
	{
	if (is_status_enabled())
	{
	char buf[20];
	snprintf (buf, sizeof buf, "%08lX%08lX",
	(ulong)list->kid[0], (ulong)list->kid[1]);
	write_status_text (STATUS_NO_SECKEY, buf);
	}
	}
	else if (list->reason)
	{
	log_info (_("public key decryption failed: %s\n"),
	gpg_strerror (list->reason));
	write_status_error ("pkdecrypt_failed", list->reason);
	}
	}
	}


	static void
	proc_encrypted (CTX c, PACKET *pkt)
	{
	int result = 0;

	if (!opt.quiet)
	{
	if (c->symkeys>1)
	log_info (_("encrypted with %lu passphrases\n"), c->symkeys);
	else if (c->symkeys == 1)
	log_info (_("encrypted with 1 passphrase\n"));
	print_pkenc_list ( c->pkenc_list, 1 );
	print_pkenc_list ( c->pkenc_list, 0 );
	}

	/* FIXME: Figure out the session key by looking at all pkenc packets. */

	write_status (STATUS_BEGIN_DECRYPTION);

	/log_debug("dat: %sencrypted data\n", c->dek?"":"conventional ");/
	if (opt.list_only)
	result = -1;
	else if (!c->dek && !c->last_was_session_key)
	{
	int algo;
	STRING2KEY s2kbuf;
	STRING2KEY *s2k = NULL;
	int canceled;

	if (opt.override_session_key)
	{
	c->dek = xmalloc_clear (sizeof *c->dek);
	result = get_override_session_key (c->dek, opt.override_session_key);
	if (result)
	{
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	else
	{
	/* Assume this is old style conventional encrypted data. */
	algo = opt.def_cipher_algo;
	if (algo)
	log_info (_("assuming %s encrypted data\n"),
	openpgp_cipher_algo_name (algo));
	else if (openpgp_cipher_test_algo (CIPHER_ALGO_IDEA))
	{
	algo = opt.def_cipher_algo;
	if (!algo)
	algo = opt.s2k_cipher_algo;
	log_info (_("IDEA cipher unavailable, "
	"optimistically attempting to use %s instead\n"),
	openpgp_cipher_algo_name (algo));
	}
	else
	{
	algo = CIPHER_ALGO_IDEA;
	if (!opt.s2k_digest_algo)
	{
	/* If no digest is given we assume SHA-1. */
	s2kbuf.mode = 0;
	s2kbuf.hash_algo = DIGEST_ALGO_SHA1;
	s2k = &s2kbuf;
	}
	log_info (_("assuming %s encrypted data\n"), "IDEA");
	}

	c->dek = passphrase_to_dek (algo, s2k, 0, 0, NULL, &canceled);
	if (c->dek)
	c->dek->algo_info_printed = 1;
	else if (canceled)
	result = gpg_error (GPG_ERR_CANCELED);
	else
	result = gpg_error (GPG_ERR_INV_PASSPHRASE);
	}
	}
	else if (!c->dek)
	result = GPG_ERR_NO_SECKEY;

	if (!result)
	result = decrypt_data (c->ctrl, c, pkt->pkt.encrypted, c->dek );

	if (result == -1)
	;
	else if (!result
	&& !opt.ignore_mdc_error
	&& !pkt->pkt.encrypted->mdc_method
	&& openpgp_cipher_get_algo_blklen (c->dek->algo) != 8
	&& c->dek->algo != CIPHER_ALGO_TWOFISH)
	{
	/* The message has been decrypted but has no MDC despite that a
	modern cipher (blocklength != 64 bit, except for Twofish) is
	used and the option to ignore MDC errors is not used: To
	avoid attacks changing an MDC message to a non-MDC message,
	we fail here. */
	log_error (_("WARNING: message was not integrity protected\n"));
	if (opt.verbose > 1)
	log_info ("decryption forced to fail\n");
	write_status (STATUS_DECRYPTION_FAILED);
	}
	else if (!result \|\| (gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE
	&& opt.ignore_mdc_error))
	{
	write_status (STATUS_DECRYPTION_OKAY);
	if (opt.verbose > 1)
	log_info(_("decryption okay\n"));
	if (pkt->pkt.encrypted->mdc_method && !result)
	write_status (STATUS_GOODMDC);
	else if (!opt.no_mdc_warn)
	log_info (_("WARNING: message was not integrity protected\n"));
	}
	else if (gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE)
	{
	glo_ctrl.lasterr = result;
	log_error (_("WARNING: encrypted message has been manipulated!\n"));
	write_status (STATUS_BADMDC);
	write_status (STATUS_DECRYPTION_FAILED);
	}
	else
	{
	if (gpg_err_code (result) == GPG_ERR_BAD_KEY
	&& *c->dek->s2k_cacheid != '\0')
	{
	if (opt.debug)
	log_debug ("cleared passphrase cached with ID: %s\n",
	c->dek->s2k_cacheid);
	passphrase_clear_cache (c->dek->s2k_cacheid);
	}
	glo_ctrl.lasterr = result;
	write_status (STATUS_DECRYPTION_FAILED);
	log_error (_("decryption failed: %s\n"), gpg_strerror (result));
	/* Hmmm: does this work when we have encrypted using multiple
	* ways to specify the session key (symmmetric and PK). */
	}

	xfree (c->dek);
	c->dek = NULL;
	free_packet (pkt);
	c->last_was_session_key = 0;
	write_status (STATUS_END_DECRYPTION);
	}


	static void
	proc_plaintext( CTX c, PACKET *pkt )
	{
	PKT_plaintext *pt = pkt->pkt.plaintext;
	int any, clearsig, rc;
	kbnode_t n;

	literals_seen++;

	if (pt->namelen == 8 && !memcmp( pt->name, "_CONSOLE", 8))
	log_info (_("Note: sender requested \"for-your-eyes-only\"\n"));
	else if (opt.verbose)
	log_info (_("original file name='%.*s'\n"), pt->namelen, pt->name);

	free_md_filter_context (&c->mfx);
	if (gcry_md_open (&c->mfx.md, 0, 0))
	BUG ();
	/* fixme: we may need to push the textfilter if we have sigclass 1
	* and no armoring - Not yet tested
	* Hmmm, why don't we need it at all if we have sigclass 1
	* Should we assume that plaintext in mode 't' has always sigclass 1??
	* See: Russ Allbery's mail 1999-02-09
	*/
	any = clearsig = 0;
	for (n=c->list; n; n = n->next )
	{
	if (n->pkt->pkttype == PKT_ONEPASS_SIG)
	{
	/* The onepass signature case. */
	if (n->pkt->pkt.onepass_sig->digest_algo)
	{
	gcry_md_enable (c->mfx.md, n->pkt->pkt.onepass_sig->digest_algo);
	any = 1;
	}
	}
	else if (n->pkt->pkttype == PKT_GPG_CONTROL
	&& n->pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START)
	{
	/* The clearsigned message case. */
	size_t datalen = n->pkt->pkt.gpg_control->datalen;
	const byte *data = n->pkt->pkt.gpg_control->data;

	/* Check that we have at least the sigclass and one hash. */
	if (datalen < 2)
	log_fatal ("invalid control packet CTRLPKT_CLEARSIGN_START\n");
	/* Note that we don't set the clearsig flag for not-dash-escaped
	* documents. */
	clearsig = (*data == 0x01);
	for (data++, datalen--; datalen; datalen--, data++)
	gcry_md_enable (c->mfx.md, *data);
	any = 1;
	break; /* Stop here as one-pass signature packets are not
	expected. */
	}
	else if (n->pkt->pkttype == PKT_SIGNATURE)
	{
	/* The SIG+LITERAL case that PGP used to use. */
	gcry_md_enable ( c->mfx.md, n->pkt->pkt.signature->digest_algo );
	any = 1;
	}
	}

	if (!any && !opt.skip_verify)
	{
	/* This is for the old GPG LITERAL+SIG case. It's not legal
	according to 2440, so hopefully it won't come up that often.
	There is no good way to specify what algorithms to use in
	that case, so these there are the historical answer. */
	gcry_md_enable (c->mfx.md, DIGEST_ALGO_RMD160);
	gcry_md_enable (c->mfx.md, DIGEST_ALGO_SHA1);
	}
	if (DBG_HASHING)
	{
	gcry_md_debug (c->mfx.md, "verify");
	if (c->mfx.md2)
	gcry_md_debug (c->mfx.md2, "verify2");
	}

	rc=0;

	if (literals_seen > 1)
	{
	log_info (_("WARNING: multiple plaintexts seen\n"));

	if (!opt.flags.allow_multiple_messages)
	{
	write_status_text (STATUS_ERROR, "proc_pkt.plaintext 89_BAD_DATA");
	log_inc_errorcount ();
	rc = gpg_error (GPG_ERR_UNEXPECTED);
	}
	}

	if (!rc)
	{
	rc = handle_plaintext (pt, &c->mfx, c->sigs_only, clearsig);
	if (gpg_err_code (rc) == GPG_ERR_EACCES && !c->sigs_only)
	{
	/* Can't write output but we hash it anyway to check the
	signature. */
	rc = handle_plaintext( pt, &c->mfx, 1, clearsig );
	}
	}

	if (rc)
	log_error ("handle plaintext failed: %s\n", gpg_strerror (rc));

	free_packet(pkt);
	c->last_was_session_key = 0;

	/* We add a marker control packet instead of the plaintext packet.
	* This is so that we can later detect invalid packet sequences. */
	n = new_kbnode (create_gpg_control (CTRLPKT_PLAINTEXT_MARK, NULL, 0));
	if (c->list)
	add_kbnode (c->list, n);
	else
	c->list = n;
	}


	static int
	proc_compressed_cb (iobuf_t a, void *info)
	{
	if ( ((CTX)info)->signed_data.used
	&& ((CTX)info)->signed_data.data_fd != -1)
	return proc_signature_packets_by_fd (((CTX)info)->ctrl, info, a,
	((CTX)info)->signed_data.data_fd);
	else
	return proc_signature_packets (((CTX)info)->ctrl, info, a,
	((CTX)info)->signed_data.data_names,
	((CTX)info)->sigfilename );
	}


	static int
	proc_encrypt_cb (iobuf_t a, void *info )
	{
	CTX c = info;
	return proc_encryption_packets (c->ctrl, info, a );
	}


	static int
	proc_compressed (CTX c, PACKET *pkt)
	{
	PKT_compressed *zd = pkt->pkt.compressed;
	int rc;

	/printf("zip: compressed data packet\n");/
	if (c->sigs_only)
	rc = handle_compressed (c->ctrl, c, zd, proc_compressed_cb, c);
	else if( c->encrypt_only )
	rc = handle_compressed (c->ctrl, c, zd, proc_encrypt_cb, c);
	else
	rc = handle_compressed (c->ctrl, c, zd, NULL, NULL);

	if (gpg_err_code (rc) == GPG_ERR_BAD_DATA)
	{
	if (!c->any.uncompress_failed)
	{
	CTX cc;

	for (cc=c; cc; cc = cc->anchor)
	cc->any.uncompress_failed = 1;
	log_error ("uncompressing failed: %s\n", gpg_strerror (rc));
	}
	}
	else if (rc)
	log_error ("uncompressing failed: %s\n", gpg_strerror (rc));

	free_packet(pkt);
	c->last_was_session_key = 0;
	return rc;
	}


	/*
	- * check the signature
	- * Returns: 0 = valid signature or an error code
	+ * Check the signature. If R_PK is not NULL a copy of the public key
	+ * used to verify the signature will be stored tehre, or NULL if not
	+ * found. Returns: 0 = valid signature or an error code
	*/
	static int
	do_check_sig (CTX c, kbnode_t node, int *is_selfsig,
	- int is_expkey, int is_revkey)
	+ int is_expkey, int is_revkey, PKT_public_key **r_pk)
	{
	PKT_signature *sig;
	gcry_md_hd_t md = NULL;
	gcry_md_hd_t md2 = NULL;
	gcry_md_hd_t md_good = NULL;
	int algo, rc;

	+ if (r_pk)
	+ *r_pk = NULL;
	+
	log_assert (node->pkt->pkttype == PKT_SIGNATURE);
	if (is_selfsig)
	*is_selfsig = 0;
	sig = node->pkt->pkt.signature;

	algo = sig->digest_algo;
	rc = openpgp_md_test_algo (algo);
	if (rc)
	return rc;

	if (sig->sig_class == 0x00)
	{
	if (c->mfx.md)
	{
	if (gcry_md_copy (&md, c->mfx.md ))
	BUG ();
	}
	else /* detached signature */
	{
	/* check_signature() will enable the md. */
	if (gcry_md_open (&md, 0, 0 ))
	BUG ();
	}
	}
	else if (sig->sig_class == 0x01)
	{
	/* How do we know that we have to hash the (already hashed) text
	in canonical mode ??? (calculating both modes???) */
	if (c->mfx.md)
	{
	if (gcry_md_copy (&md, c->mfx.md ))
	BUG ();
	if (c->mfx.md2 && gcry_md_copy (&md2, c->mfx.md2))
	BUG ();
	}
	else /* detached signature */
	{
	log_debug ("Do we really need this here?");
	/* check_signature() will enable the md*/
	if (gcry_md_open (&md, 0, 0 ))
	BUG ();
	if (gcry_md_open (&md2, 0, 0 ))
	BUG ();
	}
	}
	else if ((sig->sig_class&~3) == 0x10
	\|\| sig->sig_class == 0x18
	\|\| sig->sig_class == 0x1f
	\|\| sig->sig_class == 0x20
	\|\| sig->sig_class == 0x28
	\|\| sig->sig_class == 0x30)
	{
	if (c->list->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| c->list->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	return check_key_signature( c->list, node, is_selfsig );
	}
	else if (sig->sig_class == 0x20)
	{
	log_error (_("standalone revocation - "
	"use \"gpg --import\" to apply\n"));
	return GPG_ERR_NOT_PROCESSED;
	}
	else
	{
	log_error ("invalid root packet for sigclass %02x\n", sig->sig_class);
	return GPG_ERR_SIG_CLASS;
	}
	}
	else
	return GPG_ERR_SIG_CLASS;

	/* We only get here if we are checking the signature of a binary
	(0x00) or text document (0x01). */
	- rc = check_signature2 (sig, md, NULL, is_expkey, is_revkey, NULL);
	+ rc = check_signature2 (sig, md, NULL, is_expkey, is_revkey, r_pk);
	if (! rc)
	md_good = md;
	else if (gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE && md2)
	{
	- rc = check_signature2 (sig, md2, NULL, is_expkey, is_revkey, NULL);
	- if (! rc)
	- md_good = md2;
	+ PKT_public_key *pk2;
	+
	+ rc = check_signature2 (sig, md2, NULL, is_expkey, is_revkey,
	+ r_pk? &pk2 : NULL);
	+ if (!rc)
	+ {
	+ md_good = md2;
	+ if (r_pk)
	+ {
	+ free_public_key (*r_pk);
	+ *r_pk = pk2;
	+ }
	+ }
	}

	if (md_good)
	{
	unsigned char *buffer = gcry_md_read (md_good, sig->digest_algo);
	sig->digest_len = gcry_md_get_algo_dlen (map_md_openpgp_to_gcry (algo));
	memcpy (sig->digest, buffer, sig->digest_len);
	}

	gcry_md_close (md);
	gcry_md_close (md2);

	return rc;
	}


	static void
	print_userid (PACKET *pkt)
	{
	if (!pkt)
	BUG();

	if (pkt->pkttype != PKT_USER_ID)
	{
	es_printf ("ERROR: unexpected packet type %d", pkt->pkttype );
	return;
	}
	if (opt.with_colons)
	{
	if (pkt->pkt.user_id->attrib_data)
	es_printf("%u %lu",
	pkt->pkt.user_id->numattribs,
	pkt->pkt.user_id->attrib_len);
	else
	es_write_sanitized (es_stdout, pkt->pkt.user_id->name,
	pkt->pkt.user_id->len, ":", NULL);
	}
	else
	print_utf8_buffer (es_stdout, pkt->pkt.user_id->name,
	pkt->pkt.user_id->len );
	}


	/*
	* List the keyblock in a user friendly way
	*/
	static void
	list_node (CTX c, kbnode_t node)
	{
	if (!node)
	;
	else if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	PKT_public_key *pk = node->pkt->pkt.public_key;

	if (opt.with_colons)
	{
	u32 keyid[2];

	keyid_from_pk( pk, keyid );
	if (pk->flags.primary)
	c->trustletter = (opt.fast_list_mode?
	0 : get_validity_info (c->ctrl, pk, NULL));
	es_printf ("%s:", pk->flags.primary? "pub":"sub" );
	if (c->trustletter)
	es_putc (c->trustletter, es_stdout);
	es_printf (":%u:%d:%08lX%08lX:%s:%s::",
	nbits_from_pk( pk ),
	pk->pubkey_algo,
	(ulong)keyid[0],(ulong)keyid[1],
	colon_datestr_from_pk( pk ),
	colon_strtime (pk->expiredate) );
	if (pk->flags.primary && !opt.fast_list_mode)
	es_putc (get_ownertrust_info (pk), es_stdout);
	es_putc (':', es_stdout);
	es_putc ('\n', es_stdout);
	}
	else
	{
	print_key_line (es_stdout, pk, 0);
	}

	if (opt.keyid_format == KF_NONE && !opt.with_colons)
	; /* Already printed. */
	else if ((pk->flags.primary && opt.fingerprint) \|\| opt.fingerprint > 1)
	print_fingerprint (NULL, pk, 0);

	if (opt.with_colons)
	{
	if (node->next && node->next->pkt->pkttype == PKT_RING_TRUST)
	es_printf ("rtv:1:%u:\n",
	node->next->pkt->pkt.ring_trust->trustval);
	}

	if (pk->flags.primary)
	{
	int kl = opt.keyid_format == KF_NONE? 0 : keystrlen ();

	/* Now list all userids with their signatures. */
	for (node = node->next; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	list_node (c, node );
	}
	else if (node->pkt->pkttype == PKT_USER_ID)
	{
	if (opt.with_colons)
	es_printf ("%s:::::::::",
	node->pkt->pkt.user_id->attrib_data?"uat":"uid");
	else
	es_printf ("uid%*s",
	kl + (opt.legacy_list_mode? 9:11),
	"" );
	print_userid (node->pkt);
	if (opt.with_colons)
	es_putc (':', es_stdout);
	es_putc ('\n', es_stdout);
	if (opt.with_colons
	&& node->next
	&& node->next->pkt->pkttype == PKT_RING_TRUST)
	{
	es_printf ("rtv:2:%u:\n",
	node->next->pkt->pkt.ring_trust?
	node->next->pkt->pkt.ring_trust->trustval : 0);
	}
	}
	else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	list_node(c, node );
	}
	}
	}
	}
	else if (node->pkt->pkttype == PKT_SECRET_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	{

	log_debug ("FIXME: No way to print secret key packets here\n");
	/* fixme: We may use a function to turn a secret key packet into
	a public key one and use that here. */
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	int is_selfsig = 0;
	int rc2 = 0;
	size_t n;
	char *p;
	int sigrc = ' ';

	if (!opt.verbose)
	return;

	if (sig->sig_class == 0x20 \|\| sig->sig_class == 0x30)
	es_fputs ("rev", es_stdout);
	else
	es_fputs ("sig", es_stdout);
	if (opt.check_sigs)
	{
	fflush (stdout);
	- rc2 = do_check_sig (c, node, &is_selfsig, NULL, NULL);
	+ rc2 = do_check_sig (c, node, &is_selfsig, NULL, NULL, NULL);
	switch (gpg_err_code (rc2))
	{
	case 0: sigrc = '!'; break;
	case GPG_ERR_BAD_SIGNATURE: sigrc = '-'; break;
	case GPG_ERR_NO_PUBKEY:
	case GPG_ERR_UNUSABLE_PUBKEY: sigrc = '?'; break;
	default: sigrc = '%'; break;
	}
	}
	else /* Check whether this is a self signature. */
	{
	u32 keyid[2];

	if (c->list->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| c->list->pkt->pkttype == PKT_SECRET_KEY )
	{
	keyid_from_pk (c->list->pkt->pkt.public_key, keyid);

	if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1])
	is_selfsig = 1;
	}
	}

	if (opt.with_colons)
	{
	es_putc (':', es_stdout);
	if (sigrc != ' ')
	es_putc (sigrc, es_stdout);
	es_printf ("::%d:%08lX%08lX:%s:%s:", sig->pubkey_algo,
	(ulong)sig->keyid[0], (ulong)sig->keyid[1],
	colon_datestr_from_sig (sig),
	colon_expirestr_from_sig (sig));

	if (sig->trust_depth \|\| sig->trust_value)
	es_printf ("%d %d",sig->trust_depth,sig->trust_value);
	es_putc (':', es_stdout);

	if (sig->trust_regexp)
	es_write_sanitized (es_stdout, sig->trust_regexp,
	strlen (sig->trust_regexp), ":", NULL);
	es_putc (':', es_stdout);
	}
	else
	es_printf ("%c %s %s ",
	sigrc, keystr (sig->keyid), datestr_from_sig(sig));
	if (sigrc == '%')
	es_printf ("[%s] ", gpg_strerror (rc2) );
	else if (sigrc == '?')
	;
	else if (is_selfsig)
	{
	if (opt.with_colons)
	es_putc (':', es_stdout);
	es_fputs (sig->sig_class == 0x18? "[keybind]":"[selfsig]", es_stdout);
	if (opt.with_colons)
	es_putc (':', es_stdout);
	}
	else if (!opt.fast_list_mode)
	{
	p = get_user_id (sig->keyid, &n);
	es_write_sanitized (es_stdout, p, n,
	opt.with_colons?":":NULL, NULL );
	xfree (p);
	}
	if (opt.with_colons)
	es_printf (":%02x%c:", sig->sig_class, sig->flags.exportable?'x':'l');
	es_putc ('\n', es_stdout);
	}
	else
	log_error ("invalid node with packet of type %d\n", node->pkt->pkttype);
	}


	int
	proc_packets (ctrl_t ctrl, void *anchor, iobuf_t a )
	{
	int rc;
	CTX c = xmalloc_clear (sizeof *c);

	c->ctrl = ctrl;
	c->anchor = anchor;
	rc = do_proc_packets (ctrl, c, a);
	xfree (c);

	return rc;
	}


	int
	proc_signature_packets (ctrl_t ctrl, void *anchor, iobuf_t a,
	strlist_t signedfiles, const char *sigfilename )
	{
	CTX c = xmalloc_clear (sizeof *c);
	int rc;

	c->ctrl = ctrl;
	c->anchor = anchor;
	c->sigs_only = 1;

	c->signed_data.data_fd = -1;
	c->signed_data.data_names = signedfiles;
	c->signed_data.used = !!signedfiles;

	c->sigfilename = sigfilename;
	rc = do_proc_packets (ctrl, c, a);

	/* If we have not encountered any signature we print an error
	messages, send a NODATA status back and return an error code.
	Using log_error is required because verify_files does not check
	error codes for each file but we want to terminate the process
	with an error. */
	if (!rc && !c->any.sig_seen)
	{
	write_status_text (STATUS_NODATA, "4");
	log_error (_("no signature found\n"));
	rc = GPG_ERR_NO_DATA;
	}

	/* Propagate the signature seen flag upward. Do this only on success
	so that we won't issue the nodata status several times. */
	if (!rc && c->anchor && c->any.sig_seen)
	c->anchor->any.sig_seen = 1;

	xfree (c);
	return rc;
	}


	int
	proc_signature_packets_by_fd (ctrl_t ctrl,
	void *anchor, iobuf_t a, int signed_data_fd )
	{
	int rc;
	CTX c;

	c = xtrycalloc (1, sizeof *c);
	if (!c)
	return gpg_error_from_syserror ();

	c->ctrl = ctrl;
	c->anchor = anchor;
	c->sigs_only = 1;

	c->signed_data.data_fd = signed_data_fd;
	c->signed_data.data_names = NULL;
	c->signed_data.used = (signed_data_fd != -1);

	rc = do_proc_packets (ctrl, c, a);

	/* If we have not encountered any signature we print an error
	messages, send a NODATA status back and return an error code.
	Using log_error is required because verify_files does not check
	error codes for each file but we want to terminate the process
	with an error. */
	if (!rc && !c->any.sig_seen)
	{
	write_status_text (STATUS_NODATA, "4");
	log_error (_("no signature found\n"));
	rc = gpg_error (GPG_ERR_NO_DATA);
	}

	/* Propagate the signature seen flag upward. Do this only on success
	so that we won't issue the nodata status several times. */
	if (!rc && c->anchor && c->any.sig_seen)
	c->anchor->any.sig_seen = 1;

	xfree ( c );
	return rc;
	}


	int
	proc_encryption_packets (ctrl_t ctrl, void *anchor, iobuf_t a )
	{
	CTX c = xmalloc_clear (sizeof *c);
	int rc;

	c->ctrl = ctrl;
	c->anchor = anchor;
	c->encrypt_only = 1;
	rc = do_proc_packets (ctrl, c, a);
	xfree (c);
	return rc;
	}


	static int
	check_nesting (CTX c)
	{
	int level;

	for (level=0; c; c = c->anchor)
	level++;

	if (level > MAX_NESTING_DEPTH)
	{
	log_error ("input data with too deeply nested packets\n");
	write_status_text (STATUS_UNEXPECTED, "1");
	return GPG_ERR_BAD_DATA;
	}

	return 0;
	}


	static int
	do_proc_packets (ctrl_t ctrl, CTX c, iobuf_t a)
	{
	PACKET *pkt;
	int rc = 0;
	int any_data = 0;
	int newpkt;

	rc = check_nesting (c);
	if (rc)
	return rc;

	pkt = xmalloc( sizeof *pkt );
	c->iobuf = a;
	init_packet(pkt);
	while ((rc=parse_packet(a, pkt)) != -1)
	{
	any_data = 1;
	if (rc)
	{
	free_packet (pkt);
	/* Stop processing when an invalid packet has been encountered
	* but don't do so when we are doing a --list-packets. */
	if (gpg_err_code (rc) == GPG_ERR_INV_PACKET
	&& opt.list_packets == 0)
	break;
	continue;
	}
	newpkt = -1;
	if (opt.list_packets)
	{
	switch (pkt->pkttype)
	{
	case PKT_PUBKEY_ENC: proc_pubkey_enc (ctrl, c, pkt); break;
	case PKT_SYMKEY_ENC: proc_symkey_enc (c, pkt); break;
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC: proc_encrypted (c, pkt); break;
	case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
	default: newpkt = 0; break;
	}
	}
	else if (c->sigs_only)
	{
	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_SECRET_KEY:
	case PKT_USER_ID:
	case PKT_SYMKEY_ENC:
	case PKT_PUBKEY_ENC:
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC:
	write_status_text( STATUS_UNEXPECTED, "0" );
	rc = GPG_ERR_UNEXPECTED;
	goto leave;

	case PKT_SIGNATURE: newpkt = add_signature (c, pkt); break;
	case PKT_PLAINTEXT: proc_plaintext (c, pkt); break;
	case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
	case PKT_ONEPASS_SIG: newpkt = add_onepass_sig (c, pkt); break;
	case PKT_GPG_CONTROL: newpkt = add_gpg_control (c, pkt); break;
	default: newpkt = 0; break;
	}
	}
	else if (c->encrypt_only)
	{
	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_SECRET_KEY:
	case PKT_USER_ID:
	write_status_text (STATUS_UNEXPECTED, "0");
	rc = GPG_ERR_UNEXPECTED;
	goto leave;

	case PKT_SIGNATURE: newpkt = add_signature (c, pkt); break;
	case PKT_SYMKEY_ENC: proc_symkey_enc (c, pkt); break;
	case PKT_PUBKEY_ENC: proc_pubkey_enc (ctrl, c, pkt); break;
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC: proc_encrypted (c, pkt); break;
	case PKT_PLAINTEXT: proc_plaintext (c, pkt); break;
	case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
	case PKT_ONEPASS_SIG: newpkt = add_onepass_sig (c, pkt); break;
	case PKT_GPG_CONTROL: newpkt = add_gpg_control (c, pkt); break;
	default: newpkt = 0; break;
	}
	}
	else
	{
	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_SECRET_KEY:
	release_list (c);
	c->list = new_kbnode (pkt);
	newpkt = 1;
	break;
	case PKT_PUBLIC_SUBKEY:
	case PKT_SECRET_SUBKEY:
	newpkt = add_subkey (c, pkt);
	break;
	case PKT_USER_ID: newpkt = add_user_id (c, pkt); break;
	case PKT_SIGNATURE: newpkt = add_signature (c, pkt); break;
	case PKT_PUBKEY_ENC: proc_pubkey_enc (ctrl, c, pkt); break;
	case PKT_SYMKEY_ENC: proc_symkey_enc (c, pkt); break;
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC: proc_encrypted (c, pkt); break;
	case PKT_PLAINTEXT: proc_plaintext (c, pkt); break;
	case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
	case PKT_ONEPASS_SIG: newpkt = add_onepass_sig (c, pkt); break;
	case PKT_GPG_CONTROL: newpkt = add_gpg_control(c, pkt); break;
	case PKT_RING_TRUST: newpkt = add_ring_trust (c, pkt); break;
	default: newpkt = 0; break;
	}
	}

	if (rc)
	goto leave;

	/* This is a very ugly construct and frankly, I don't remember why
	* I used it. Adding the MDC check here is a hack.
	* The right solution is to initiate another context for encrypted
	* packet and not to reuse the current one ... It works right
	* when there is a compression packet between which adds just
	* an extra layer.
	* Hmmm: Rewrite this whole module here??
	*/
	if (pkt->pkttype != PKT_SIGNATURE && pkt->pkttype != PKT_MDC)
	c->any.data = (pkt->pkttype == PKT_PLAINTEXT);

	if (newpkt == -1)
	;
	else if (newpkt)
	{
	pkt = xmalloc (sizeof *pkt);
	init_packet (pkt);
	}
	else
	free_packet(pkt);
	}

	if (rc == GPG_ERR_INV_PACKET)
	write_status_text (STATUS_NODATA, "3");

	if (any_data)
	rc = 0;
	else if (rc == -1)
	write_status_text (STATUS_NODATA, "2");


	leave:
	release_list (c);
	xfree(c->dek);
	free_packet (pkt);
	xfree (pkt);
	free_md_filter_context (&c->mfx);
	return rc;
	}


	/* Helper for pka_uri_from_sig to parse the to-be-verified address out
	of the notation data. */
	static pka_info_t *
	get_pka_address (PKT_signature *sig)
	{
	pka_info_t *pka = NULL;
	struct notation nd,notation;

	notation=sig_to_notation(sig);

	for(nd=notation;nd;nd=nd->next)
	{
	if(strcmp(nd->name,"pka-address@gnupg.org")!=0)
	continue; /* Not the notation we want. */

	/* For now we only use the first valid PKA notation. In future
	we might want to keep additional PKA notations in a linked
	list. */
	if (is_valid_mailbox (nd->value))
	{
	pka = xmalloc (sizeof *pka + strlen(nd->value));
	pka->valid = 0;
	pka->checked = 0;
	pka->uri = NULL;
	strcpy (pka->email, nd->value);
	break;
	}
	}

	free_notation(notation);

	return pka;
	}


	/* Return the URI from a DNS PKA record. If this record has already
	be retrieved for the signature we merely return it; if not we go
	out and try to get that DNS record. */
	static const char *
	pka_uri_from_sig (CTX c, PKT_signature *sig)
	{
	if (!sig->flags.pka_tried)
	{
	log_assert (!sig->pka_info);
	sig->flags.pka_tried = 1;
	sig->pka_info = get_pka_address (sig);
	if (sig->pka_info)
	{
	char *url;
	unsigned char *fpr;
	size_t fprlen;

	if (!gpg_dirmngr_get_pka (c->ctrl, sig->pka_info->email,
	&fpr, &fprlen, &url))
	{
	if (fpr && fprlen == sizeof sig->pka_info->fpr)
	{
	memcpy (sig->pka_info->fpr, fpr, fprlen);
	if (url)
	{
	sig->pka_info->valid = 1;
	if (!*url)
	xfree (url);
	else
	sig->pka_info->uri = url;
	url = NULL;
	}
	}
	xfree (fpr);
	xfree (url);
	}
	}
	}
	return sig->pka_info? sig->pka_info->uri : NULL;
	}


	/* Return true if the AKL has the WKD method specified. */
	static int
	akl_has_wkd_method (void)
	{
	struct akl *akl;

	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	if (akl->type == AKL_WKD)
	return 1;
	return 0;
	}


	/* Return the ISSUER fingerprint string in human readbale format if
	* available. Caller must release the string. */
	static char *
	issuer_fpr_string (PKT_signature *sig)
	{
	const byte *p;
	size_t n;

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_ISSUER_FPR, &n);
	if (p && n == 21 && p[0] == 4)
	return bin2hex (p+1, n-1, NULL);
	return NULL;
	}


	static void
	print_good_bad_signature (int statno, const char *keyid_str, kbnode_t un,
	PKT_signature *sig, int rc)
	{
	char *p;

	write_status_text_and_buffer (statno, keyid_str,
	un? un->pkt->pkt.user_id->name:"[?]",
	un? un->pkt->pkt.user_id->len:3,
	-1);

	if (un)
	p = utf8_to_native (un->pkt->pkt.user_id->name,
	un->pkt->pkt.user_id->len, 0);
	else
	p = xstrdup ("[?]");

	if (rc)
	log_info (_("BAD signature from \"%s\""), p);
	else if (sig->flags.expired)
	log_info (_("Expired signature from \"%s\""), p);
	else
	log_info (_("Good signature from \"%s\""), p);

	xfree (p);
	}


	static int
	check_sig_and_print (CTX c, kbnode_t node)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	const char *astr;
	int rc;
	int is_expkey = 0;
	int is_revkey = 0;
	- char pkstrbuf[PUBKEY_STRING_SIZE];
	char *issuer_fpr;
	-
	- *pkstrbuf = 0;
	+ PKT_public_key pk = NULL; / The public key for the signature or NULL. */

	if (opt.skip_verify)
	{
	log_info(_("signature verification suppressed\n"));
	return 0;
	}

	/* Check that the message composition is valid.
	*
	* Per RFC-2440bis (-15) allowed:
	*
	* S{1,n} -- detached signature.
	* S{1,n} P -- old style PGP2 signature
	* O{1,n} P S{1,n} -- standard OpenPGP signature.
	* C P S{1,n} -- cleartext signature.
	*
	*
	* O = One-Pass Signature packet.
	* S = Signature packet.
	* P = OpenPGP Message packet (Encrypted \| Compressed \| Literal)
	* (Note that the current rfc2440bis draft also allows
	* for a signed message but that does not work as it
	* introduces ambiguities.)
	* We keep track of these packages using the marker packet
	* CTRLPKT_PLAINTEXT_MARK.
	* C = Marker packet for cleartext signatures.
	*
	* We reject all other messages.
	*
	* Actually we are calling this too often, i.e. for verification of
	* each message but better have some duplicate work than to silently
	* introduce a bug here.
	*/
	{
	kbnode_t n;
	int n_onepass, n_sig;

	/* log_debug ("checking signature packet composition\n"); */
	/* dump_kbnode (c->list); */

	n = c->list;
	log_assert (n);
	if ( n->pkt->pkttype == PKT_SIGNATURE )
	{
	/* This is either "S{1,n}" case (detached signature) or
	"S{1,n} P" (old style PGP2 signature). */
	for (n = n->next; n; n = n->next)
	if (n->pkt->pkttype != PKT_SIGNATURE)
	break;
	if (!n)
	; /* Okay, this is a detached signature. */
	else if (n->pkt->pkttype == PKT_GPG_CONTROL
	&& (n->pkt->pkt.gpg_control->control
	== CTRLPKT_PLAINTEXT_MARK) )
	{
	if (n->next)
	goto ambiguous; /* We only allow one P packet. */
	}
	else
	goto ambiguous;
	}
	else if (n->pkt->pkttype == PKT_ONEPASS_SIG)
	{
	/* This is the "O{1,n} P S{1,n}" case (standard signature). */
	for (n_onepass=1, n = n->next;
	n && n->pkt->pkttype == PKT_ONEPASS_SIG; n = n->next)
	n_onepass++;
	if (!n \|\| !(n->pkt->pkttype == PKT_GPG_CONTROL
	&& (n->pkt->pkt.gpg_control->control
	== CTRLPKT_PLAINTEXT_MARK)))
	goto ambiguous;
	for (n_sig=0, n = n->next;
	n && n->pkt->pkttype == PKT_SIGNATURE; n = n->next)
	n_sig++;
	if (!n_sig)
	goto ambiguous;

	/* If we wanted to disallow multiple sig verification, we'd do
	something like this:

	if (n && !opt.allow_multisig_verification)
	goto ambiguous;

	However, now that we have --allow-multiple-messages, this
	can stay allowable as we can't get here unless multiple
	messages (i.e. multiple literals) are allowed. */

	if (n_onepass != n_sig)
	{
	log_info ("number of one-pass packets does not match "
	"number of signature packets\n");
	goto ambiguous;
	}
	}
	else if (n->pkt->pkttype == PKT_GPG_CONTROL
	&& n->pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START )
	{
	/* This is the "C P S{1,n}" case (clear text signature). */
	n = n->next;
	if (!n \|\| !(n->pkt->pkttype == PKT_GPG_CONTROL
	&& (n->pkt->pkt.gpg_control->control
	== CTRLPKT_PLAINTEXT_MARK)))
	goto ambiguous;
	for (n_sig=0, n = n->next;
	n && n->pkt->pkttype == PKT_SIGNATURE; n = n->next)
	n_sig++;
	if (n \|\| !n_sig)
	goto ambiguous;
	}
	else
	{
	ambiguous:
	log_error(_("can't handle this ambiguous signature data\n"));
	return 0;
	}
	}

	if (sig->signers_uid)
	write_status_buffer (STATUS_NEWSIG,
	sig->signers_uid, strlen (sig->signers_uid), 0);
	else
	write_status_text (STATUS_NEWSIG, NULL);

	astr = openpgp_pk_algo_name ( sig->pubkey_algo );
	if (opt.flags.rfc4880bis && (issuer_fpr = issuer_fpr_string (sig)))
	{
	log_info (_("Signature made %s\n"), asctimestamp(sig->timestamp));
	log_info (_(" using %s key %s\n"),
	astr? astr: "?", issuer_fpr);

	xfree (issuer_fpr);
	}
	else if (!keystrlen () \|\| keystrlen () > 8)
	{
	log_info (_("Signature made %s\n"), asctimestamp(sig->timestamp));
	log_info (_(" using %s key %s\n"),
	astr? astr: "?", keystr(sig->keyid));
	}
	else /* Legacy format. */
	log_info (_("Signature made %s using %s key ID %s\n"),
	asctimestamp(sig->timestamp), astr? astr: "?",
	keystr(sig->keyid));

	/* In verbose mode print the signers UID. */
	if (sig->signers_uid)
	log_info (_(" issuer \"%s\"\n"), sig->signers_uid);

	- rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey );
	+ rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey, &pk);

	/* If the key isn't found, check for a preferred keyserver. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY && sig->flags.pref_ks)
	{
	const byte *p;
	int seq = 0;
	size_t n;

	while ((p=enum_sig_subpkt (sig->hashed,SIGSUBPKT_PREF_KS,&n,&seq,NULL)))
	{
	/* According to my favorite copy editor, in English grammar,
	you say "at" if the key is located on a web page, but
	"from" if it is located on a keyserver. I'm not going to
	even try to make two strings here :) */
	log_info(_("Key available at: ") );
	print_utf8_buffer (log_get_stream(), p, n);
	log_printf ("\n");

	if (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE
	&& opt.keyserver_options.options&KEYSERVER_HONOR_KEYSERVER_URL)
	{
	struct keyserver_spec *spec;

	spec = parse_preferred_keyserver (sig);
	if (spec)
	{
	int res;

	+ free_public_key (pk);
	+ pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_keyid (c->ctrl, sig->keyid,spec);
	glo_ctrl.in_auto_key_retrieve--;
	if (!res)
	- rc = do_check_sig(c, node, NULL, &is_expkey, &is_revkey );
	+ rc = do_check_sig (c, node, NULL,
	+ &is_expkey, &is_revkey, &pk);
	free_keyserver_spec (spec);

	if (!rc)
	break;
	}
	}
	}
	}

	/* If the avove methods didn't work, our next try is to use the URI
	* from a DNS PKA record. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& (opt.keyserver_options.options & KEYSERVER_AUTO_KEY_RETRIEVE)
	&& (opt.keyserver_options.options & KEYSERVER_HONOR_PKA_RECORD))
	{
	const char *uri = pka_uri_from_sig (c, sig);

	if (uri)
	{
	/* FIXME: We might want to locate the key using the
	fingerprint instead of the keyid. */
	int res;
	struct keyserver_spec *spec;

	spec = parse_keyserver_uri (uri, 1);
	if (spec)
	{
	+ free_public_key (pk);
	+ pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_keyid (c->ctrl, sig->keyid, spec);
	glo_ctrl.in_auto_key_retrieve--;
	free_keyserver_spec (spec);
	if (!res)
	- rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey );
	+ rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey, &pk);
	}
	}
	}

	/* If the above methods didn't work, our next try is to use locate
	* the key via its fingerprint from a keyserver. This requires
	* that the signers fingerprint is encoded in the signature. We
	* favor this over the WKD method (to be tried next), because an
	* arbitrary keyserver is less subject to web bug like
	* monitoring. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& opt.flags.rfc4880bis
	&& (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE)
	&& keyserver_any_configured (c->ctrl))
	{
	int res;
	const byte *p;
	size_t n;

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_ISSUER_FPR, &n);
	if (p && n == 21 && p[0] == 4)
	{
	/* v4 packet with a SHA-1 fingerprint. */
	+ free_public_key (pk);
	+ pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_fprint (c->ctrl, p+1, n-1, opt.keyserver);
	glo_ctrl.in_auto_key_retrieve--;
	if (!res)
	- rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey );
	+ rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey, &pk);
	}
	}

	/* If the above methods didn't work, our next try is to retrieve the
	* key from the WKD. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& (opt.keyserver_options.options & KEYSERVER_AUTO_KEY_RETRIEVE)
	&& !opt.flags.disable_signer_uid
	&& akl_has_wkd_method ()
	&& sig->signers_uid)
	{
	int res;

	+ free_public_key (pk);
	+ pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_wkd (c->ctrl, sig->signers_uid, NULL, NULL);
	glo_ctrl.in_auto_key_retrieve--;
	/* Fixme: If the fingerprint is embedded in the signature,
	* compare it to the fingerprint of the returned key. */
	if (!res)
	- rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey );
	+ rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey, &pk);
	}

	/* If the above methods did't work, our next try is to use a
	* keyserver. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE)
	&& keyserver_any_configured (c->ctrl))
	{
	int res;

	+ free_public_key (pk);
	+ pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_keyid (c->ctrl, sig->keyid, opt.keyserver );
	glo_ctrl.in_auto_key_retrieve--;
	if (!res)
	- rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey );
	+ rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey, &pk);
	}

	if (!rc \|\| gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE)
	{
	kbnode_t un, keyblock;
	int count = 0;
	int statno;
	char keyid_str[50];
	- PKT_public_key *pk = NULL;
	+ PKT_public_key *mainpk = NULL;

	if (rc)
	statno = STATUS_BADSIG;
	else if (sig->flags.expired)
	statno = STATUS_EXPSIG;
	else if (is_expkey)
	statno = STATUS_EXPKEYSIG;
	else if(is_revkey)
	statno = STATUS_REVKEYSIG;
	else
	statno = STATUS_GOODSIG;

	+ /* FIXME: We should have the public key in PK and thus the
	+ * keyboock has already been fetched. Thus we could use the
	+ * fingerprint or PK itself to lookup the entire keyblock. That
	+ * would best be done with a cache. */
	keyblock = get_pubkeyblock (sig->keyid);

	snprintf (keyid_str, sizeof keyid_str, "%08lX%08lX [uncertain] ",
	(ulong)sig->keyid[0], (ulong)sig->keyid[1]);

	/* Find and print the primary user ID along with the
	"Good\|Expired\|Bad signature" line. */
	for (un=keyblock; un; un = un->next)
	{
	int valid;

	if (un->pkt->pkttype==PKT_PUBLIC_KEY)
	{
	- pk=un->pkt->pkt.public_key;
	+ mainpk = un->pkt->pkt.public_key;
	continue;
	}
	if (un->pkt->pkttype != PKT_USER_ID)
	continue;
	if (!un->pkt->pkt.user_id->created)
	continue;
	if (un->pkt->pkt.user_id->is_revoked)
	continue;
	if (un->pkt->pkt.user_id->is_expired)
	continue;
	if (!un->pkt->pkt.user_id->is_primary)
	continue;
	/* We want the textual primary user ID here */
	if (un->pkt->pkt.user_id->attrib_data)
	continue;

	- log_assert (pk);
	+ log_assert (mainpk);

	/* Since this is just informational, don't actually ask the
	user to update any trust information. (Note: we register
	the signature later.) Because print_good_bad_signature
	does not print a LF we need to compute the validity
	before calling that function. */
	if ((opt.verify_options & VERIFY_SHOW_UID_VALIDITY))
	- valid = get_validity (c->ctrl, pk, un->pkt->pkt.user_id, sig, 0);
	+ valid = get_validity (c->ctrl, mainpk, un->pkt->pkt.user_id,
	+ sig, 0);
	else
	valid = 0; /* Not used. */

	keyid_str[17] = 0; /* cut off the "[uncertain]" part */

	print_good_bad_signature (statno, keyid_str, un, sig, rc);

	if ((opt.verify_options & VERIFY_SHOW_UID_VALIDITY))
	log_printf (" [%s]\n",trust_value_to_string(valid));
	else
	log_printf ("\n");

	- /* Get a string description of the algo for informational
	- output we want to print later. It is convenient to do it
	- here because we already have the right public key. */
	- pubkey_string (pk, pkstrbuf, sizeof pkstrbuf);
	count++;
	}

	+ log_assert (mainpk);
	+
	/* In case we did not found a valid valid textual userid above
	we print the first user id packet or a "[?]" instead along
	with the "Good\|Expired\|Bad signature" line. */
	if (!count)
	{
	/* Try for an invalid textual userid */
	for (un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype == PKT_USER_ID
	&& !un->pkt->pkt.user_id->attrib_data)
	break;
	}

	/* Try for any userid at all */
	if (!un)
	{
	for (un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype == PKT_USER_ID)
	break;
	}
	}

	if (opt.trust_model==TM_ALWAYS \|\| !un)
	keyid_str[17] = 0; /* cut off the "[uncertain]" part */

	print_good_bad_signature (statno, keyid_str, un, sig, rc);

	if (opt.trust_model != TM_ALWAYS && un)
	log_printf (" %s",_("[uncertain]") );
	log_printf ("\n");
	}

	/* If we have a good signature and already printed
	* the primary user ID, print all the other user IDs */
	if (count
	&& !rc
	&& !(opt.verify_options & VERIFY_SHOW_PRIMARY_UID_ONLY))
	{
	char *p;
	for( un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype != PKT_USER_ID)
	continue;
	if ((un->pkt->pkt.user_id->is_revoked
	\|\| un->pkt->pkt.user_id->is_expired)
	&& !(opt.verify_options & VERIFY_SHOW_UNUSABLE_UIDS))
	continue;
	/* Skip textual primary user ids which we printed above. */
	if (un->pkt->pkt.user_id->is_primary
	&& !un->pkt->pkt.user_id->attrib_data )
	continue;

	/* If this user id has attribute data, print that. */
	if (un->pkt->pkt.user_id->attrib_data)
	{
	- dump_attribs (un->pkt->pkt.user_id, pk);
	+ dump_attribs (un->pkt->pkt.user_id, mainpk);

	if (opt.verify_options&VERIFY_SHOW_PHOTOS)
	show_photos (c->ctrl,
	un->pkt->pkt.user_id->attribs,
	un->pkt->pkt.user_id->numattribs,
	- pk ,un->pkt->pkt.user_id);
	+ mainpk ,un->pkt->pkt.user_id);
	}

	p = utf8_to_native (un->pkt->pkt.user_id->name,
	un->pkt->pkt.user_id->len, 0);
	log_info (_(" aka \"%s\""), p);
	xfree (p);

	if ((opt.verify_options & VERIFY_SHOW_UID_VALIDITY))
	{
	const char *valid;

	if (un->pkt->pkt.user_id->is_revoked)
	valid = _("revoked");
	else if (un->pkt->pkt.user_id->is_expired)
	valid = _("expired");
	else
	/* Since this is just informational, don't
	actually ask the user to update any trust
	information. */
	valid = (trust_value_to_string
	- (get_validity (c->ctrl, pk,
	+ (get_validity (c->ctrl, mainpk,
	un->pkt->pkt.user_id, sig, 0)));
	log_printf (" [%s]\n",valid);
	}
	else
	log_printf ("\n");
	}
	}
	- release_kbnode( keyblock );

	/* For good signatures print notation data. */
	if (!rc)
	{
	if ((opt.verify_options & VERIFY_SHOW_POLICY_URLS))
	show_policy_url (sig, 0, 1);
	else
	show_policy_url (sig, 0, 2);

	if ((opt.verify_options & VERIFY_SHOW_KEYSERVER_URLS))
	show_keyserver_url (sig, 0, 1);
	else
	show_keyserver_url (sig, 0, 2);

	if ((opt.verify_options & VERIFY_SHOW_NOTATIONS))
	show_notation
	(sig, 0, 1,
	(((opt.verify_options&VERIFY_SHOW_STD_NOTATIONS)?1:0)
	+ ((opt.verify_options&VERIFY_SHOW_USER_NOTATIONS)?2:0)));
	else
	show_notation (sig, 0, 2, 0);
	}

	/* For good signatures print the VALIDSIG status line. */
	if (!rc && is_status_enabled ())
	{
	- PKT_public_key vpk = xmalloc_clear (sizeof vpk);
	-
	- if (!get_pubkey (vpk, sig->keyid))
	+ if (pk)
	{
	byte array[MAX_FINGERPRINT_LEN], *p;
	char buf[MAX_FINGERPRINT_LEN4+90], bufp;
	size_t i, n;

	bufp = buf;
	- fingerprint_from_pk (vpk, array, &n);
	+ fingerprint_from_pk (pk, array, &n);
	p = array;
	for(i=0; i < n ; i++, p++, bufp += 2)
	sprintf (bufp, "%02X", *p );
	/* TODO: Replace the reserved '0' in the field below
	with bits for status flags (policy url, notation,
	etc.). Remember to make the buffer larger to match! */
	sprintf (bufp, " %s %lu %lu %d 0 %d %d %02X ",
	strtimestamp( sig->timestamp ),
	(ulong)sig->timestamp,(ulong)sig->expiredate,
	sig->version,sig->pubkey_algo,sig->digest_algo,
	sig->sig_class);
	bufp = bufp + strlen (bufp);
	- if (!vpk->flags.primary)
	- {
	- u32 akid[2];
	-
	- akid[0] = vpk->main_keyid[0];
	- akid[1] = vpk->main_keyid[1];
	- free_public_key (vpk);
	- vpk = xmalloc_clear (sizeof *vpk);
	- if (get_pubkey (vpk, akid))
	- {
	- /* Impossible error, we simply return a zeroed out fpr */
	- n = MAX_FINGERPRINT_LEN < 20? MAX_FINGERPRINT_LEN : 20;
	- memset (array, 0, n);
	- }
	- else
	- fingerprint_from_pk( vpk, array, &n );
	- }
	+ if (!pk->flags.primary)
	+ fingerprint_from_pk (mainpk, array, &n);
	p = array;
	for (i=0; i < n ; i++, p++, bufp += 2)
	sprintf(bufp, "%02X", *p );
	write_status_text (STATUS_VALIDSIG, buf);
	}
	- free_public_key (vpk);
	}

	/* For good signatures compute and print the trust information.
	Note that in the Tofu trust model this may ask the user on
	how to resolve a conflict. */
	if (!rc)
	{
	if ((opt.verify_options & VERIFY_PKA_LOOKUPS))
	pka_uri_from_sig (c, sig); /* Make sure PKA info is available. */
	rc = check_signatures_trust (c->ctrl, sig);
	}

	/* Print extra information about the signature. */
	if (sig->flags.expired)
	{
	log_info (_("Signature expired %s\n"), asctimestamp(sig->expiredate));
	rc = GPG_ERR_GENERAL; /* Need a better error here? */
	}
	else if (sig->expiredate)
	log_info (_("Signature expires %s\n"), asctimestamp(sig->expiredate));

	if (opt.verbose)
	- log_info (_("%s signature, digest algorithm %s%s%s\n"),
	- sig->sig_class==0x00?_("binary"):
	- sig->sig_class==0x01?_("textmode"):_("unknown"),
	- gcry_md_algo_name (sig->digest_algo),
	- *pkstrbuf?_(", key algorithm "):"",
	- pkstrbuf);
	+ {
	+ char pkstrbuf[PUBKEY_STRING_SIZE];
	+
	+ if (pk)
	+ pubkey_string (pk, pkstrbuf, sizeof pkstrbuf);
	+ else
	+ *pkstrbuf = 0;
	+
	+ log_info (_("%s signature, digest algorithm %s%s%s\n"),
	+ sig->sig_class==0x00?_("binary"):
	+ sig->sig_class==0x01?_("textmode"):_("unknown"),
	+ gcry_md_algo_name (sig->digest_algo),
	+ *pkstrbuf?_(", key algorithm "):"", pkstrbuf);
	+ }

	/* Print final warnings. */
	if (!rc && !c->signed_data.used)
	{
	/* Signature is basically good but we test whether the
	deprecated command
	gpg --verify FILE.sig
	was used instead of
	gpg --verify FILE.sig FILE
	to verify a detached signature. If we figure out that a
	data file with a matching name exists, we print a warning.

	The problem is that the first form would also verify a
	standard signature. This behavior could be used to
	create a made up .sig file for a tarball by creating a
	standard signature from a valid detached signature packet
	(for example from a signed git tag). Then replace the
	sig file on the FTP server along with a changed tarball.
	Using the first form the verify command would correctly
	verify the signature but don't even consider the tarball. */
	kbnode_t n;
	char *dfile;

	dfile = get_matching_datafile (c->sigfilename);
	if (dfile)
	{
	for (n = c->list; n; n = n->next)
	if (n->pkt->pkttype != PKT_SIGNATURE)
	break;
	if (n)
	{
	/* Not only signature packets in the tree thus this
	is not a detached signature. */
	log_info (_("WARNING: not a detached signature; "
	"file '%s' was NOT verified!\n"), dfile);
	}
	xfree (dfile);
	}
	}

	+ release_kbnode( keyblock );
	if (rc)
	g10_errors_seen = 1;
	if (opt.batch && rc)
	g10_exit (1);
	}
	else
	{
	char buf[50];

	snprintf (buf, sizeof buf, "%08lX%08lX %d %d %02x %lu %d",
	(ulong)sig->keyid[0], (ulong)sig->keyid[1],
	sig->pubkey_algo, sig->digest_algo,
	sig->sig_class, (ulong)sig->timestamp, rc);
	write_status_text (STATUS_ERRSIG, buf);
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY)
	{
	buf[16] = 0;
	write_status_text (STATUS_NO_PUBKEY, buf);
	}
	if (gpg_err_code (rc) != GPG_ERR_NOT_PROCESSED)
	log_error (_("Can't check signature: %s\n"), gpg_strerror (rc));
	}

	return rc;
	}


	/*
	* Process the tree which starts at node
	*/
	static void
	proc_tree (CTX c, kbnode_t node)
	{
	kbnode_t n1;
	int rc;

	if (opt.list_packets \|\| opt.list_only)
	return;

	/* We must skip our special plaintext marker packets here because
	they may be the root packet. These packets are only used in
	addional checks and skipping them here doesn't matter. */
	while (node
	&& node->pkt->pkttype == PKT_GPG_CONTROL
	&& node->pkt->pkt.gpg_control->control == CTRLPKT_PLAINTEXT_MARK)
	{
	node = node->next;
	}
	if (!node)
	return;

	c->trustletter = ' ';
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	merge_keys_and_selfsig (node);
	list_node (c, node);
	}
	else if (node->pkt->pkttype == PKT_SECRET_KEY)
	{
	merge_keys_and_selfsig (node);
	list_node (c, node);
	}
	else if (node->pkt->pkttype == PKT_ONEPASS_SIG)
	{
	/* Check all signatures. */
	if (!c->any.data)
	{
	int use_textmode = 0;

	free_md_filter_context (&c->mfx);
	/* Prepare to create all requested message digests. */
	rc = gcry_md_open (&c->mfx.md, 0, 0);
	if (rc)
	goto hash_err;

	/* Fixme: why looking for the signature packet and not the
	one-pass packet? */
	for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE));)
	gcry_md_enable (c->mfx.md, n1->pkt->pkt.signature->digest_algo);

	if (n1 && n1->pkt->pkt.onepass_sig->sig_class == 0x01)
	use_textmode = 1;

	/* Ask for file and hash it. */
	if (c->sigs_only)
	{
	if (c->signed_data.used && c->signed_data.data_fd != -1)
	rc = hash_datafile_by_fd (c->mfx.md, NULL,
	c->signed_data.data_fd,
	use_textmode);
	else
	rc = hash_datafiles (c->mfx.md, NULL,
	c->signed_data.data_names,
	c->sigfilename,
	use_textmode);
	}
	else
	{
	rc = ask_for_detached_datafile (c->mfx.md, c->mfx.md2,
	iobuf_get_real_fname (c->iobuf),
	use_textmode);
	}

	hash_err:
	if (rc)
	{
	log_error ("can't hash datafile: %s\n", gpg_strerror (rc));
	return;
	}
	}
	else if (c->signed_data.used)
	{
	log_error (_("not a detached signature\n"));
	return;
	}

	for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE));)
	check_sig_and_print (c, n1);

	}
	else if (node->pkt->pkttype == PKT_GPG_CONTROL
	&& node->pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START)
	{
	/* Clear text signed message. */
	if (!c->any.data)
	{
	log_error ("cleartext signature without data\n");
	return;
	}
	else if (c->signed_data.used)
	{
	log_error (_("not a detached signature\n"));
	return;
	}

	for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE));)
	check_sig_and_print (c, n1);

	}
	else if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	int multiple_ok = 1;

	n1 = find_next_kbnode (node, PKT_SIGNATURE);
	if (n1)
	{
	byte class = sig->sig_class;
	byte hash = sig->digest_algo;

	for (; n1; (n1 = find_next_kbnode(n1, PKT_SIGNATURE)))
	{
	/* We can't currently handle multiple signatures of
	different classes or digests (we'd pretty much have
	to run a different hash context for each), but if
	they are all the same, make an exception. */
	if (n1->pkt->pkt.signature->sig_class != class
	\|\| n1->pkt->pkt.signature->digest_algo != hash)
	{
	multiple_ok = 0;
	log_info (_("WARNING: multiple signatures detected. "
	"Only the first will be checked.\n"));
	break;
	}
	}
	}

	if (sig->sig_class != 0x00 && sig->sig_class != 0x01)
	{
	log_info(_("standalone signature of class 0x%02x\n"), sig->sig_class);
	}
	else if (!c->any.data)
	{
	/* Detached signature */
	free_md_filter_context (&c->mfx);
	rc = gcry_md_open (&c->mfx.md, sig->digest_algo, 0);
	if (rc)
	goto detached_hash_err;

	if (RFC2440 \|\| RFC4880)
	; /* Strict RFC mode. */
	else if (sig->digest_algo == DIGEST_ALGO_SHA1
	&& sig->pubkey_algo == PUBKEY_ALGO_DSA
	&& sig->sig_class == 0x01)
	{
	/* Enable a workaround for a pgp5 bug when the detached
	* signature has been created in textmode. */
	rc = gcry_md_open (&c->mfx.md2, sig->digest_algo, 0);
	if (rc)
	goto detached_hash_err;
	}

	/* Here we used to have another hack to work around a pgp
	* 2 bug: It worked by not using the textmode for detached
	* signatures; this would let the first signature check
	* (on md) fail but the second one (on md2), which adds an
	* extra CR would then have produced the "correct" hash.
	* This is very, very ugly hack but it may haved help in
	* some cases (and break others).
	* c->mfx.md2? 0 :(sig->sig_class == 0x01)
	*/

	if (DBG_HASHING)
	{
	gcry_md_debug (c->mfx.md, "verify");
	if (c->mfx.md2)
	gcry_md_debug (c->mfx.md2, "verify2");
	}

	if (c->sigs_only)
	{
	if (c->signed_data.used && c->signed_data.data_fd != -1)
	rc = hash_datafile_by_fd (c->mfx.md, c->mfx.md2,
	c->signed_data.data_fd,
	(sig->sig_class == 0x01));
	else
	rc = hash_datafiles (c->mfx.md, c->mfx.md2,
	c->signed_data.data_names,
	c->sigfilename,
	(sig->sig_class == 0x01));
	}
	else
	{
	rc = ask_for_detached_datafile (c->mfx.md, c->mfx.md2,
	iobuf_get_real_fname(c->iobuf),
	(sig->sig_class == 0x01));
	}

	detached_hash_err:
	if (rc)
	{
	log_error ("can't hash datafile: %s\n", gpg_strerror (rc));
	return;
	}
	}
	else if (c->signed_data.used)
	{
	log_error (_("not a detached signature\n"));
	return;
	}
	else if (!opt.quiet)
	log_info (_("old style (PGP 2.x) signature\n"));

	if (multiple_ok)
	{
	for (n1 = node; n1; (n1 = find_next_kbnode(n1, PKT_SIGNATURE)))
	check_sig_and_print (c, n1);
	}
	else
	check_sig_and_print (c, node);

	}
	else
	{
	dump_kbnode (c->list);
	log_error ("invalid root packet detected in proc_tree()\n");
	dump_kbnode (node);
	}
	}
	diff --git a/g10/packet.h b/g10/packet.h
	index 9c9e909d8..60af2a233 100644
	--- a/g10/packet.h
	+++ b/g10/packet.h
	@@ -1,853 +1,853 @@
	/* packet.h - OpenPGP packet definitions
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006,
	* 2007 Free Software Foundation, Inc.
	* Copyright (C) 2015 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <http://www.gnu.org/licenses/>.
	*/

	#ifndef G10_PACKET_H
	#define G10_PACKET_H

	#include "types.h"
	#include "../common/iobuf.h"
	#include "../common/strlist.h"
	#include "dek.h"
	#include "filter.h"
	#include "../common/openpgpdefs.h"
	#include "../common/userids.h"
	#include "util.h"

	#define DEBUG_PARSE_PACKET 1


	/* Constants to allocate static MPI arrays. */
	#define PUBKEY_MAX_NPKEY 5
	#define PUBKEY_MAX_NSKEY 7
	#define PUBKEY_MAX_NSIG 2
	#define PUBKEY_MAX_NENC 2

	/* Usage flags */
	#define PUBKEY_USAGE_SIG GCRY_PK_USAGE_SIGN /* Good for signatures. */
	#define PUBKEY_USAGE_ENC GCRY_PK_USAGE_ENCR /* Good for encryption. */
	#define PUBKEY_USAGE_CERT GCRY_PK_USAGE_CERT /* Also good to certify keys.*/
	#define PUBKEY_USAGE_AUTH GCRY_PK_USAGE_AUTH /* Good for authentication. */
	#define PUBKEY_USAGE_UNKNOWN GCRY_PK_USAGE_UNKN /* Unknown usage flag. */
	#define PUBKEY_USAGE_NONE 256 /* No usage given. */
	#if (GCRY_PK_USAGE_SIGN \| GCRY_PK_USAGE_ENCR \| GCRY_PK_USAGE_CERT \
	\| GCRY_PK_USAGE_AUTH \| GCRY_PK_USAGE_UNKN) >= 256
	# error Please choose another value for PUBKEY_USAGE_NONE
	#endif

	/* Helper macros. */
	#define is_RSA(a) ((a)==PUBKEY_ALGO_RSA \|\| (a)==PUBKEY_ALGO_RSA_E \
	\|\| (a)==PUBKEY_ALGO_RSA_S )
	#define is_ELGAMAL(a) ((a)==PUBKEY_ALGO_ELGAMAL_E)
	#define is_DSA(a) ((a)==PUBKEY_ALGO_DSA)

	/* A pointer to the packet object. */
	typedef struct packet_struct PACKET;

	/* PKT_GPG_CONTROL types */
	typedef enum {
	CTRLPKT_CLEARSIGN_START = 1,
	CTRLPKT_PIPEMODE = 2,
	CTRLPKT_PLAINTEXT_MARK =3
	} ctrlpkttype_t;

	typedef enum {
	PREFTYPE_NONE = 0,
	PREFTYPE_SYM = 1,
	PREFTYPE_HASH = 2,
	PREFTYPE_ZIP = 3
	} preftype_t;

	typedef struct {
	byte type;
	byte value;
	} prefitem_t;

	/* A string-to-key specifier as defined in RFC 4880, Section 3.7. */
	typedef struct
	{
	int mode; /* Must be an integer due to the GNU modes 1001 et al. */
	byte hash_algo;
	byte salt[8];
	/* The coded (i.e., the serialized version) iteration count. */
	u32 count;
	} STRING2KEY;

	/* A symmetric-key encrypted session key packet as defined in RFC
	4880, Section 5.3. All fields are serialized. */
	typedef struct {
	/* RFC 4880: this must be 4. */
	byte version;
	/* The cipher algorithm used. */
	byte cipher_algo;
	/* The string-to-key specifier. */
	STRING2KEY s2k;
	/* The length of SESKEY in bytes or 0 if this packet does not
	encrypt a session key. (In the latter case, the results of the
	S2K function on the password is the session key. See RFC 4880,
	Section 5.3.) */
	byte seskeylen;
	/* The session key as encrypted by the S2K specifier. */
	byte seskey[1];
	} PKT_symkey_enc;

	/* A public-key encrypted session key packet as defined in RFC 4880,
	Section 5.1. All fields are serialized. */
	typedef struct {
	/* The 64-bit keyid. */
	u32 keyid[2];
	/* The packet's version. Currently, only version 3 is defined. */
	byte version;
	/* The algorithm used for the public key encryption scheme. */
	byte pubkey_algo;
	/* Whether to hide the key id. This value is not directly
	serialized. */
	byte throw_keyid;
	/* The session key. */
	gcry_mpi_t data[PUBKEY_MAX_NENC];
	} PKT_pubkey_enc;


	/* A one-pass signature packet as defined in RFC 4880, Section
	5.4. All fields are serialized. */
	typedef struct {
	u32 keyid[2]; /* The 64-bit keyid */
	/* The signature's classification (RFC 4880, Section 5.2.1). */
	byte sig_class;
	byte digest_algo; /* algorithm used for digest */
	byte pubkey_algo; /* algorithm used for public key scheme */
	/* A message can be signed by multiple keys. In this case, there
	are n one-pass signature packets before the message to sign and
	n signatures packets after the message. It is conceivable that
	someone wants to not only sign the message, but all of the
	signatures. Now we need to distinguish between signing the
	message and signing the message plus the surrounding
	signatures. This is the point of this flag. If set, it means:
	I sign all of the data starting at the next packet. */
	byte last;
	} PKT_onepass_sig;


	/* A v4 OpenPGP signature has a hashed and unhashed area containing
	co-called signature subpackets (RFC 4880, Section 5.2.3). These
	areas are described by this data structure. Use enum_sig_subpkt to
	parse this area. */
	typedef struct {
	size_t size; /* allocated */
	size_t len; /* used (serialized) */
	byte data[1]; /* the serialized subpackes (serialized) */
	} subpktarea_t;

	/* The in-memory representation of a designated revoker signature
	subpacket (RFC 4880, Section 5.2.3.15). */
	struct revocation_key {
	/* A bit field. 0x80 must be set. 0x40 means this information is
	sensitive (and should not be uploaded to a keyserver by
	default). */
	byte class;
	/* The public-key algorithm ID. */
	byte algid;
	/* The fingerprint of the authorized key. */
	byte fpr[MAX_FINGERPRINT_LEN];
	};


	/* Object to keep information about a PKA DNS record. */
	typedef struct
	{
	int valid; /* An actual PKA record exists for EMAIL. */
	int checked; /* Set to true if the FPR has been checked against the
	actual key. */
	char uri; / Malloced string with the URI. NULL if the URI is
	not available.*/
	unsigned char fpr[20]; /* The fingerprint as stored in the PKA RR. */
	char email[1];/* The email address from the notation data. */
	} pka_info_t;


	/* A signature packet (RFC 4880, Section 5.2). Only a subset of these
	fields are directly serialized (these are marked as such); the rest
	are read from the subpackets, which are not synthesized when
	serializing this data structure (i.e., when using build_packet()).
	Instead, the subpackets must be created by hand. */
	typedef struct
	{
	struct
	{
	unsigned checked:1; /* Signature has been checked. */
	unsigned valid:1; /* Signature is good (if checked is set). */
	unsigned chosen_selfsig:1; /* A selfsig that is the chosen one. */
	unsigned unknown_critical:1;
	unsigned exportable:1;
	unsigned revocable:1;
	unsigned policy_url:1; /* At least one policy URL is present */
	unsigned notation:1; /* At least one notation is present */
	unsigned pref_ks:1; /* At least one preferred keyserver is present */
	unsigned expired:1;
	unsigned pka_tried:1; /* Set if we tried to retrieve the PKA record. */
	} flags;
	/* The key that allegedly generated this signature. (Directly
	serialized in v3 sigs; for v4 sigs, this must be explicitly added
	as an issuer subpacket (5.2.3.5.) */
	u32 keyid[2];
	/* When the signature was made (seconds since the Epoch). (Directly
	serialized in v3 sigs; for v4 sigs, this must be explicitly added
	as a signature creation time subpacket (5.2.3.4).) */
	u32 timestamp;
	u32 expiredate; /* Expires at this date or 0 if not at all. */
	/* The serialization format used / to use. If 0, then defaults to
	version 3. (Serialized.) */
	byte version;
	/* The signature type. (See RFC 4880, Section 5.2.1.) */
	byte sig_class;
	/* Algorithm used for public key scheme (e.g., PUBKEY_ALGO_RSA).
	(Serialized.) */
	byte pubkey_algo;
	/* Algorithm used for digest (e.g., DIGEST_ALGO_SHA1).
	(Serialized.) */
	byte digest_algo;
	byte trust_depth;
	byte trust_value;
	const byte *trust_regexp;
	struct revocation_key *revkey;
	int numrevkeys;
	pka_info_t pka_info; / Malloced PKA data or NULL if not
	available. See also flags.pka_tried. */
	char signers_uid; / Malloced value of the SIGNERS_UID
	* subpacket or NULL. This string has
	* already been sanitized. */
	subpktarea_t hashed; / All subpackets with hashed data (v4 only). */
	subpktarea_t unhashed; / Ditto for unhashed data. */
	/* First 2 bytes of the digest. (Serialized. Note: this is not
	automatically filled in when serializing a signature!) */
	byte digest_start[2];
	/* The signature. (Serialized.) */
	gcry_mpi_t data[PUBKEY_MAX_NSIG];
	/* The message digest and its length (in bytes). Note the maximum
	digest length is 512 bits (64 bytes). If DIGEST_LEN is 0, then
	the digest's value has not been saved here. */
	byte digest[512 / 8];
	int digest_len;
	} PKT_signature;

	#define ATTRIB_IMAGE 1

	/* This is the cooked form of attributes. */
	struct user_attribute {
	byte type;
	const byte *data;
	u32 len;
	};


	/* A user id (RFC 4880, Section 5.11) or a user attribute packet (RFC
	4880, Section 5.12). Only a subset of these fields are directly
	serialized (these are marked as such); the rest are read from the
	self-signatures in merge_keys_and_selfsig()). */
	typedef struct
	{
	int ref; /* reference counter */
	/* The length of NAME. */
	int len;
	struct user_attribute *attribs;
	int numattribs;
	/* If this is not NULL, the packet is a user attribute rather than a
	user id. (Serialized.) */
	byte *attrib_data;
	/* The length of ATTRIB_DATA. */
	unsigned long attrib_len;
	byte *namehash;
	int help_key_usage;
	u32 help_key_expire;
	int help_full_count;
	int help_marginal_count;
	int is_primary; /* 2 if set via the primary flag, 1 if calculated */
	int is_revoked;
	int is_expired;
	u32 expiredate; /* expires at this date or 0 if not at all */
	prefitem_t prefs; / list of preferences (may be NULL)*/
	u32 created; /* according to the self-signature */
	byte selfsigversion;
	struct
	{
	/* TODO: Move more flags here */
	unsigned int mdc:1;
	unsigned int ks_modify:1;
	unsigned int compacted:1;
	} flags;
	char mbox; / NULL or the result of mailbox_from_userid. */
	/* The text contained in the user id packet, which is normally the
	name and email address of the key holder (See RFC 4880 5.11).
	(Serialized.). For convenience an extra Nul is always appended. */
	char name[1];
	} PKT_user_id;



	struct revoke_info
	{
	/* revoked at this date */
	u32 date;
	/* the keyid of the revoking key (selfsig or designated revoker) */
	u32 keyid[2];
	/* the algo of the revoking key */
	byte algo;
	};


	/* Information pertaining to secret keys. */
	struct seckey_info
	{
	int is_protected:1; /* The secret info is protected and must */
	/* be decrypted before use, the protected */
	/* MPIs are simply (void) pointers to memory /
	/* and should never be passed to a mpi_xxx() */
	int sha1chk:1; /* SHA1 is used instead of a 16 bit checksum */
	u16 csum; /* Checksum for old protection modes. */
	byte algo; /* Cipher used to protect the secret information. */
	STRING2KEY s2k; /* S2K parameter. */
	byte ivlen; /* Used length of the IV. */
	byte iv[16]; /* Initialization vector for CFB mode. */
	};


	/****************
	* The in-memory representation of a public key (RFC 4880, Section
	* 5.5). Note: this structure contains significantly more information
	* than is contained in an OpenPGP public key packet. This
	* information is derived from the self-signed signatures (by
	* merge_keys_and_selfsig()) and is ignored when serializing the
	* packet. The fields that are actually written out when serializing
	* this packet are marked as accordingly.
	*
	* We assume that secret keys have the same number of parameters as
	* the public key and that the public parameters are the first items
	* in the PKEY array. Thus NPKEY is always less than NSKEY and it is
	* possible to compare the secret and public keys by comparing the
	* first NPKEY elements of the PKEY array. Note that since GnuPG 2.1
	* we don't use secret keys anymore directly because they are managed
	* by gpg-agent. However for parsing OpenPGP key files we need a way
	* to temporary store those secret keys. We do this by putting them
	* into the public key structure and extending the PKEY field to NSKEY
	* elements; the extra secret key information are stored in the
	* SECKEY_INFO field.
	*/
	typedef struct
	{
	/* When the key was created. (Serialized.) */
	u32 timestamp;
	u32 expiredate; /* expires at this date or 0 if not at all */
	u32 max_expiredate; /* must not expire past this date */
	struct revoke_info revoked;
	/* An OpenPGP packet consists of a header and a body. This is the
	size of the header. If this is 0, an appropriate size is
	automatically chosen based on the size of the body.
	(Serialized.) */
	byte hdrbytes;
	/* The serialization format. If 0, the default version (4) is used
	when serializing. (Serialized.) */
	byte version;
	byte selfsigversion; /* highest version of all of the self-sigs */
	/* The public key algorithm. (Serialized.) */
	byte pubkey_algo;
	byte pubkey_usage; /* for now only used to pass it to getkey() */
	byte req_usage; /* hack to pass a request to getkey() */
	u32 has_expired; /* set to the expiration date if expired */
	/* keyid of the primary key. Never access this value directly.
	Instead, use pk_main_keyid(). */
	u32 main_keyid[2];
	/* keyid of this key. Never access this value directly! Instead,
	use pk_keyid(). */
	u32 keyid[2];
	prefitem_t prefs; / list of preferences (may be NULL) */
	struct
	{
	unsigned int mdc:1; /* MDC feature set. */
	unsigned int disabled_valid:1;/* The next flag is valid. */
	unsigned int disabled:1; /* The key has been disabled. */
	unsigned int primary:1; /* This is a primary key. */
	unsigned int revoked:2; /* Key has been revoked.
	1 = revoked by the owner
	2 = revoked by designated revoker. */
	unsigned int maybe_revoked:1; /* A designated revocation is
	present, but without the key to
	check it. */
	unsigned int valid:1; /* Key (especially subkey) is valid. */
	unsigned int dont_cache:1; /* Do not cache this key. */
	unsigned int backsig:2; /* 0=none, 1=bad, 2=good. */
	unsigned int serialno_valid:1;/* SERIALNO below is valid. */
	unsigned int exact:1; /* Found via exact (!) search. */
	} flags;
	PKT_user_id user_id; / If != NULL: found by that uid. */
	struct revocation_key *revkey;
	int numrevkeys;
	u32 trust_timestamp;
	byte trust_depth;
	byte trust_value;
	const byte *trust_regexp;
	char serialno; / Malloced hex string or NULL if it is
	likely not on a card. See also
	flags.serialno_valid. */
	/* If not NULL this malloced structure describes a secret key.
	(Serialized.) */
	struct seckey_info *seckey_info;
	/* The public key. Contains pubkey_get_npkey (pubkey_algo) +
	pubkey_get_nskey (pubkey_algo) MPIs. (If pubkey_get_npkey
	returns 0, then the algorithm is not understood and the PKEY
	contains a single opaque MPI.) (Serialized.) */
	gcry_mpi_t pkey[PUBKEY_MAX_NSKEY]; /* Right, NSKEY elements. */
	} PKT_public_key;

	/* Evaluates as true if the pk is disabled, and false if it isn't. If
	there is no disable value cached, fill one in. */
	#define pk_is_disabled(a) \
	(((a)->flags.disabled_valid)? \
	((a)->flags.disabled):(cache_disabled_value((a))))


	typedef struct {
	int len; /* length of data */
	char data[1];
	} PKT_comment;

	/* A compression packet (RFC 4880, Section 5.6). */
	typedef struct {
	/* Not used. */
	u32 len;
	/* Whether the serialized version of the packet used / should use
	the new format. */
	byte new_ctb;
	/* The compression algorithm. */
	byte algorithm;
	/* An iobuf holding the data to be decompressed. (This is not used
	for compression!) */
	iobuf_t buf;
	} PKT_compressed;

	/* A symmetrically encrypted data packet (RFC 4880, Section 5.7) or a
	symmetrically encrypted integrity protected data packet (Section
	5.13) */
	typedef struct {
	/* Remaining length of encrypted data. */
	u32 len;
	/* When encrypting, the first block size bytes of data are random
	data and the following 2 bytes are copies of the last two bytes
	of the random data (RFC 4880, Section 5.7). This provides a
	simple check that the key is correct. extralen is the size of
	this extra data. This is used by build_packet when writing out
	the packet's header. */
	int extralen;
	/* Whether the serialized version of the packet used / should use
	the new format. */
	byte new_ctb;
	/* Whether the packet has an indeterminate length (old format) or
	was encoded using partial body length headers (new format).
	Note: this is ignored when encrypting. */
	byte is_partial;
	/* If 0, MDC is disabled. Otherwise, the MDC method that was used
	(currently, only DIGEST_ALGO_SHA1 is supported). */
	byte mdc_method;
	/* An iobuf holding the data to be decrypted. (This is not used for
	encryption!) */
	iobuf_t buf;
	} PKT_encrypted;

	typedef struct {
	byte hash[20];
	} PKT_mdc;

	typedef struct {
	unsigned int trustval;
	unsigned int sigcache;
	} PKT_ring_trust;

	/* A plaintext packet (see RFC 4880, 5.9). */
	typedef struct {
	/* The length of data in BUF or 0 if unknown. */
	u32 len;
	/* A buffer containing the data stored in the packet's body. */
	iobuf_t buf;
	byte new_ctb;
	byte is_partial; /* partial length encoded */
	/* The data's formatting. This is either 'b', 't', 'u', 'l' or '1'
	(however, the last two are deprecated). */
	int mode;
	u32 timestamp;
	/* The name of the file. This can be at most 255 characters long,
	since namelen is just a byte in the serialized format. */
	int namelen;
	char name[1];
	} PKT_plaintext;

	typedef struct {
	int control;
	size_t datalen;
	char data[1];
	} PKT_gpg_control;

	/* combine all packets into a union */
	struct packet_struct {
	pkttype_t pkttype;
	union {
	void *generic;
	PKT_symkey_enc symkey_enc; / PKT_SYMKEY_ENC */
	PKT_pubkey_enc pubkey_enc; / PKT_PUBKEY_ENC */
	PKT_onepass_sig onepass_sig; / PKT_ONEPASS_SIG */
	PKT_signature signature; / PKT_SIGNATURE */
	PKT_public_key public_key; / PKT_PUBLIC_[SUB]KEY */
	PKT_public_key secret_key; / PKT_SECRET_[SUB]KEY */
	PKT_comment comment; / PKT_COMMENT */
	PKT_user_id user_id; / PKT_USER_ID */
	PKT_compressed compressed; / PKT_COMPRESSED */
	PKT_encrypted encrypted; / PKT_ENCRYPTED[_MDC] */
	PKT_mdc mdc; / PKT_MDC */
	PKT_ring_trust ring_trust; / PKT_RING_TRUST */
	PKT_plaintext plaintext; / PKT_PLAINTEXT */
	PKT_gpg_control gpg_control; / PKT_GPG_CONTROL */
	} pkt;
	};

	#define init_packet(a) do { (a)->pkttype = 0; \
	(a)->pkt.generic = NULL; \
	} while(0)


	/* A notation. See RFC 4880, Section 5.2.3.16. */
	struct notation
	{
	/* The notation's name. */
	char *name;
	/* If the notation is human readable, then the value is stored here
	as a NUL-terminated string. If it is not human readable a human
	readable approximation of the binary value _may_ be stored
	here. */
	char *value;
	/* Sometimes we want to %-expand the value. In these cases, we save
	that transformed value here. */
	char *altvalue;
	/* If the notation is not human readable, then the value is stored
	here. */
	unsigned char *bdat;
	/* The amount of data stored in BDAT.

	Note: if this is 0 and BDAT is NULL, this does not necessarily
	mean that the value is human readable. It could be that we have
	a 0-length value. To determine whether the notation is human
	readable, always check if VALUE is not NULL. This works, because
	if a human-readable value has a length of 0, we will still
	allocate space for the NUL byte. */
	size_t blen;
	struct
	{
	/* The notation is critical. */
	unsigned int critical:1;
	/* The notation is human readable. */
	unsigned int human:1;
	/* The notation should be deleted. */
	unsigned int ignore:1;
	} flags;

	/* A field to facilitate creating a list of notations. */
	struct notation *next;
	};
	typedef struct notation *notation_t;

	/-- mainproc.c --/
	void reset_literals_seen(void);
	int proc_packets (ctrl_t ctrl, void *ctx, iobuf_t a );
	int proc_signature_packets (ctrl_t ctrl, void *ctx, iobuf_t a,
	strlist_t signedfiles, const char *sigfile );
	int proc_signature_packets_by_fd (ctrl_t ctrl,
	void *anchor, IOBUF a, int signed_data_fd );
	int proc_encryption_packets (ctrl_t ctrl, void *ctx, iobuf_t a);
	int list_packets( iobuf_t a );

	/-- parse-packet.c --/

	/* Sets the packet list mode to MODE (i.e., whether we are dumping a
	packet or not). Returns the current mode. This allows for
	temporarily suspending dumping by doing the following:

	int saved_mode = set_packet_list_mode (0);
	...
	set_packet_list_mode (saved_mode);
	*/
	int set_packet_list_mode( int mode );

	#if DEBUG_PARSE_PACKET
	/* There are debug functions and should not be used directly. */
	int dbg_search_packet( iobuf_t inp, PACKET pkt, off_t retpos, int with_uid,
	const char* file, int lineno );
	int dbg_parse_packet( iobuf_t inp, PACKET *ret_pkt,
	const char* file, int lineno );
	int dbg_copy_all_packets( iobuf_t inp, iobuf_t out,
	const char* file, int lineno );
	int dbg_copy_some_packets( iobuf_t inp, iobuf_t out, off_t stopoff,
	const char* file, int lineno );
	int dbg_skip_some_packets( iobuf_t inp, unsigned n,
	const char* file, int lineno );
	#define search_packet( a,b,c,d ) \
	dbg_search_packet( (a), (b), (c), (d), __FILE__, __LINE__ )
	#define parse_packet( a, b ) \
	dbg_parse_packet( (a), (b), __FILE__, __LINE__ )
	#define copy_all_packets( a,b ) \
	dbg_copy_all_packets((a),(b), __FILE__, __LINE__ )
	#define copy_some_packets( a,b,c ) \
	dbg_copy_some_packets((a),(b),(c), __FILE__, __LINE__ )
	#define skip_some_packets( a,b ) \
	dbg_skip_some_packets((a),(b), __FILE__, __LINE__ )
	#else
	/* Return the next valid OpenPGP packet in *PKT. (This function will
	skip any packets whose type is 0.)

	Returns 0 on success, -1 if EOF is reached, and an error code
	otherwise. In the case of an error, the packet in *PKT may be
	partially constructed. As such, even if there is an error, it is
	necessary to free *PKT to avoid a resource leak. To detect what
	has been allocated, clear PKT before calling this function. /
	int parse_packet( iobuf_t inp, PACKET *pkt);

	/* Return the first OpenPGP packet in *PKT that contains a key (either
	a public subkey, a public key, a secret subkey or a secret key) or,
	if WITH_UID is set, a user id.

	Saves the position in the pipeline of the start of the returned
	packet (according to iobuf_tell) in RETPOS, if it is not NULL.

	The return semantics are the same as parse_packet. */
	int search_packet( iobuf_t inp, PACKET pkt, off_t retpos, int with_uid );

	/* Copy all packets (except invalid packets, i.e., those with a type
	of 0) from INP to OUT until either an error occurs or EOF is
	reached.

	Returns -1 when end of file is reached or an error code, if an
	error occurred. (Note: this function never returns 0, because it
	effectively keeps going until it gets an EOF.) */
	int copy_all_packets( iobuf_t inp, iobuf_t out );

	/* Like copy_all_packets, but stops at the first packet that starts at
	or after STOPOFF (as indicated by iobuf_tell).

	Example: if STOPOFF is 100, the first packet in INP goes from 0 to
	110 and the next packet starts at offset 111, then the packet
	starting at offset 0 will be completely processed (even though it
	extends beyond STOPOFF) and the packet starting at offset 111 will
	not be processed at all. */
	int copy_some_packets( iobuf_t inp, iobuf_t out, off_t stopoff );

	/* Skips the next N packets from INP.

	If parsing a packet returns an error code, then the function stops
	immediately and returns the error code. Note: in the case of an
	error, this function does not indicate how many packets were
	successfully processed. */
	int skip_some_packets( iobuf_t inp, unsigned n );
	#endif

	/* Parse a signature packet and store it in *SIG.

	The signature packet is read from INP. The OpenPGP header (the tag
	and the packet's length) have already been read; the next byte read
	from INP should be the first byte of the packet's contents. The
	packet's type (as extract from the tag) must be passed as PKTTYPE
	and the packet's length must be passed as PKTLEN. This is used as
	the upper bound on the amount of data read from INP. If the packet
	is shorter than PKTLEN, the data at the end will be silently
	skipped. If an error occurs, an error code will be returned. -1
	means the EOF was encountered. 0 means parsing was successful. */
	int parse_signature( iobuf_t inp, int pkttype, unsigned long pktlen,
	PKT_signature *sig );

	/* Given a subpacket area (typically either PKT_signature.hashed or
	PKT_signature.unhashed), either:

	- test whether there are any subpackets with the critical bit set
	that we don't understand,

	- list the subpackets, or,

	- find a subpacket with a specific type.

	REQTYPE indicates the type of operation.

	If REQTYPE is SIGSUBPKT_TEST_CRITICAL, then this function checks
	whether there are any subpackets that have the critical bit and
	which GnuPG cannot handle. If GnuPG understands all subpackets
	whose critical bit is set, then this function returns simply
	returns SUBPKTS. If there is a subpacket whose critical bit is set
	and which GnuPG does not understand, then this function returns
	NULL and, if START is not NULL, sets *START to the 1-based index of
	the subpacket that violates the constraint.

	If REQTYPE is SIGSUBPKT_LIST_HASHED or SIGSUBPKT_LIST_UNHASHED, the
	packets are dumped. Note: if REQTYPE is SIGSUBPKT_LIST_HASHED,
	this function does not check whether the hash is correct; this is
	merely an indication of the section that the subpackets came from.

	If REQTYPE is anything else, then this function interprets the
	values as a subpacket type and looks for the first subpacket with
	that type. If such a packet is found, *CRITICAL (if not NULL) is
	set if the critical bit was set, *RET_N is set to the offset of the
	subpacket's content within the SUBPKTS buffer, *START is set to the
	1-based index of the subpacket within the buffer, and returns
	&SUBPKTS[*RET_N].

	*START is the number of initial subpackets to not consider. Thus,
	if START is 2, then the first 2 subpackets are ignored. /
	const byte enum_sig_subpkt ( const subpktarea_t subpkts,
	sigsubpkttype_t reqtype,
	size_t ret_n, int start, int *critical );

	/* Shorthand for:

	enum_sig_subpkt (buffer, reqtype, ret_n, NULL, NULL); */
	const byte parse_sig_subpkt ( const subpktarea_t buffer,
	sigsubpkttype_t reqtype,
	size_t *ret_n );

	/* This calls parse_sig_subpkt first on the hashed signature area in
	SIG and then, if that returns NULL, calls parse_sig_subpkt on the
	unhashed subpacket area in SIG. */
	const byte parse_sig_subpkt2 ( PKT_signature sig,
	sigsubpkttype_t reqtype);

	/* Returns whether the N byte large buffer BUFFER is sufficient to
	hold a subpacket of type TYPE. Note: the buffer refers to the
	contents of the subpacket (not the header) and it must already be
	initialized: for some subpackets, it checks some internal
	constraints.

	Returns 0 if the size is acceptable. Returns -2 if the buffer is
	definitely too short. To check for an error, check whether the
	return value is less than 0. */
	int parse_one_sig_subpkt( const byte *buffer, size_t n, int type );

	/* Looks for revocation key subpackets (see RFC 4880 5.2.3.15) in the
	hashed area of the signature packet. Any that are found are added
	to SIG->REVKEY and SIG->NUMREVKEYS is updated appropriately. */
	void parse_revkeys(PKT_signature *sig);

	/* Extract the attributes from the buffer at UID->ATTRIB_DATA and
	update UID->ATTRIBS and UID->NUMATTRIBS accordingly. */
	int parse_attribute_subpkts(PKT_user_id *uid);

	/* Set the UID->NAME field according to the attributes. MAX_NAMELEN
	must be at least 71. */
	void make_attribute_uidname(PKT_user_id *uid, size_t max_namelen);

	/* Allocate and initialize a new GPG control packet. DATA is the data
	to save in the packet. */
	PACKET *create_gpg_control ( ctrlpkttype_t type,
	const byte *data,
	size_t datalen );

	/-- build-packet.c --/
	int build_packet( iobuf_t inp, PACKET *pkt );
	gpg_error_t gpg_mpi_write (iobuf_t out, gcry_mpi_t a);
	gpg_error_t gpg_mpi_write_nohdr (iobuf_t out, gcry_mpi_t a);
	u32 calc_packet_length( PACKET *pkt );
	void build_sig_subpkt( PKT_signature *sig, sigsubpkttype_t type,
	const byte *buffer, size_t buflen );
	void build_sig_subpkt_from_sig (PKT_signature sig, PKT_public_key pksk);
	int delete_sig_subpkt(subpktarea_t *buffer, sigsubpkttype_t type );
	void build_attribute_subpkt(PKT_user_id *uid,byte type,
	const void *buf,u32 buflen,
	const void *header,u32 headerlen);
	struct notation string_to_notation(const char string,int is_utf8);
	struct notation blob_to_notation(const char name,
	const char *data, size_t len);
	struct notation sig_to_notation(PKT_signature sig);
	void free_notation(struct notation *notation);

	/-- free-packet.c --/
	void free_symkey_enc( PKT_symkey_enc *enc );
	void free_pubkey_enc( PKT_pubkey_enc *enc );
	void free_seckey_enc( PKT_signature *enc );
	void release_public_key_parts( PKT_public_key *pk );
	void free_public_key( PKT_public_key *key );
	void free_attributes(PKT_user_id *uid);
	void free_user_id( PKT_user_id *uid );
	void free_comment( PKT_comment *rem );
	void free_packet( PACKET *pkt );
	prefitem_t copy_prefs (const prefitem_t prefs);
	PKT_public_key copy_public_key( PKT_public_key d, PKT_public_key *s );
	PKT_signature copy_signature( PKT_signature d, PKT_signature *s );
	PKT_user_id scopy_user_id (PKT_user_id sd );
	int cmp_public_keys( PKT_public_key a, PKT_public_key b );
	int cmp_signatures( PKT_signature a, PKT_signature b );
	int cmp_user_ids( PKT_user_id a, PKT_user_id b );


	/-- sig-check.c --/
	/* Check a signature. This is shorthand for check_signature2 with
	the unnamed arguments passed as NULL. */
	int check_signature (PKT_signature *sig, gcry_md_hd_t digest);

	/* Check a signature. Looks up the public key from the key db. (If
	- RET_PK is not NULL, it is returned in *RET_PK.) DIGEST contains a
	- valid hash context that already includes the signed data. This
	- function adds the relevant meta-data to the hash before finalizing
	- it and verifying the signature. */
	-int check_signature2 (PKT_signature *sig, gcry_md_hd_t digest,
	- u32 r_expiredate, int r_expired, int *r_revoked,
	- PKT_public_key *ret_pk);
	+ * R_PK is not NULL, it is stored at RET_PK.) DIGEST contains a
	+ * valid hash context that already includes the signed data. This
	+ * function adds the relevant meta-data to the hash before finalizing
	+ * it and verifying the signature. */
	+gpg_error_t check_signature2 (PKT_signature *sig, gcry_md_hd_t digest,
	+ u32 r_expiredate, int r_expired, int *r_revoked,
	+ PKT_public_key **r_pk);


	/-- pubkey-enc.c --/
	gpg_error_t get_session_key (ctrl_t ctrl, PKT_pubkey_enc k, DEK dek);
	gpg_error_t get_override_session_key (DEK dek, const char string);

	/-- compress.c --/
	int handle_compressed (ctrl_t ctrl, void ctx, PKT_compressed cd,
	int (callback)(iobuf_t, void ), void *passthru );

	/-- encr-data.c --/
	int decrypt_data (ctrl_t ctrl, void ctx, PKT_encrypted ed, DEK *dek );

	/-- plaintext.c --/
	gpg_error_t get_output_file (const byte *embedded_name, int embedded_namelen,
	iobuf_t data, char *fnamep, estream_t fpp);
	int handle_plaintext( PKT_plaintext pt, md_filter_context_t mfx,
	int nooutput, int clearsig );
	int ask_for_detached_datafile( gcry_md_hd_t md, gcry_md_hd_t md2,
	const char *inname, int textmode );

	/-- sign.c --/
	int make_keysig_packet( PKT_signature *ret_sig, PKT_public_key pk,
	PKT_user_id uid, PKT_public_key subpk,
	PKT_public_key *pksk, int sigclass, int digest_algo,
	u32 timestamp, u32 duration,
	int (mksubpkt)(PKT_signature , void *),
	void *opaque,
	const char *cache_nonce);
	gpg_error_t update_keysig_packet (PKT_signature **ret_sig,
	PKT_signature *orig_sig,
	PKT_public_key *pk,
	PKT_user_id *uid,
	PKT_public_key *subpk,
	PKT_public_key *pksk,
	int (mksubpkt)(PKT_signature , void *),
	void *opaque );

	/-- keygen.c --/
	PKT_user_id generate_user_id (kbnode_t keyblock, const char uidstr);

	#endif /G10_PACKET_H/
	diff --git a/g10/sig-check.c b/g10/sig-check.c
	index 334add785..4d39e0925 100644
	--- a/g10/sig-check.c
	+++ b/g10/sig-check.c
	@@ -1,1104 +1,1108 @@
	/* sig-check.c - Check a signature
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003,
	* 2004, 2006 Free Software Foundation, Inc.
	* Copyright (C) 2015, 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <http://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#include "gpg.h"
	#include "util.h"
	#include "packet.h"
	#include "keydb.h"
	#include "main.h"
	#include "status.h"
	#include "i18n.h"
	#include "options.h"
	#include "pkglue.h"

	static int check_signature_end (PKT_public_key pk, PKT_signature sig,
	gcry_md_hd_t digest,
	int r_expired, int r_revoked,
	PKT_public_key *ret_pk);

	static int check_signature_end_simple (PKT_public_key pk, PKT_signature sig,
	gcry_md_hd_t digest);

	/* Check a signature. This is shorthand for check_signature2 with
	the unnamed arguments passed as NULL. */
	int
	check_signature (PKT_signature *sig, gcry_md_hd_t digest)
	{
	return check_signature2 (sig, digest, NULL, NULL, NULL, NULL);
	}


	/* Check a signature.
	*
	* Looks up the public key that created the signature (SIG->KEYID)
	* from the key db. Makes sure that the signature is valid (it was
	* not created prior to the key, the public key was created in the
	* past, and the signature does not include any unsupported critical
	* features), finishes computing the hash of the signature data, and
	* checks that the signature verifies the digest. If the key that
	* generated the signature is a subkey, this function also verifies
	* that there is a valid backsig from the subkey to the primary key.
	* Finally, if status fd is enabled and the signature class is 0x00 or
	* 0x01, then a STATUS_SIG_ID is emitted on the status fd.
	*
	* SIG is the signature to check.
	*
	* DIGEST contains a valid hash context that already includes the
	* signed data. This function adds the relevant meta-data from the
	* signature packet to compute the final hash. (See Section 5.2 of
	* RFC 4880: "The concatenation of the data being signed and the
	* signature data from the version number through the hashed subpacket
	* data (inclusive) is hashed.")
	*
	* If R_EXPIREDATE is not NULL, R_EXPIREDATE is set to the key's
	* expiry.
	*
	* If R_EXPIRED is not NULL, *R_EXPIRED is set to 1 if PK has expired
	* (0 otherwise). Note: PK being expired does not cause this function
	* to fail.
	*
	* If R_REVOKED is not NULL, *R_REVOKED is set to 1 if PK has been
	* revoked (0 otherwise). Note: PK being revoked does not cause this
	* function to fail.
	*
	- * If PK is not NULL, the public key is saved in *PK on success.
	+ * If R_PK is not NULL, the public key is stored at that address if it
	+ * was found; other wise NULL is stored.
	*
	* Returns 0 on success. An error code otherwise. */
	-int
	+gpg_error_t
	check_signature2 (PKT_signature sig, gcry_md_hd_t digest, u32 r_expiredate,
	- int r_expired, int r_revoked, PKT_public_key *pk )
	+ int r_expired, int r_revoked, PKT_public_key **r_pk)
	{
	int rc=0;
	- int pk_internal;
	+ PKT_public_key *pk;

	- if (pk)
	- pk_internal = 0;
	- else
	- {
	- pk_internal = 1;
	- pk = xmalloc_clear( sizeof *pk );
	- }
	+ if (r_expiredate)
	+ *r_expiredate = 0;
	+ if (r_expired)
	+ *r_expired = 0;
	+ if (r_revoked)
	+ *r_revoked = 0;
	+ if (r_pk)
	+ *r_pk = NULL;
	+
	+ pk = xtrycalloc (1, sizeof *pk);
	+ if (!pk)
	+ return gpg_error_from_syserror ();

	if ( (rc=openpgp_md_test_algo(sig->digest_algo)) )
	; /* We don't have this digest. */
	else if ((rc=openpgp_pk_test_algo(sig->pubkey_algo)))
	; /* We don't have this pubkey algo. */
	else if (!gcry_md_is_enabled (digest,sig->digest_algo))
	{
	/* Sanity check that the md has a context for the hash that the
	sig is expecting. This can happen if a onepass sig header does
	not match the actual sig, and also if the clearsign "Hash:"
	header is missing or does not match the actual sig. */

	log_info(_("WARNING: signature digest conflict in message\n"));
	- rc = GPG_ERR_GENERAL;
	+ rc = gpg_error (GPG_ERR_GENERAL);
	}
	else if( get_pubkey( pk, sig->keyid ) )
	- rc = GPG_ERR_NO_PUBKEY;
	+ rc = gpg_error (GPG_ERR_NO_PUBKEY);
	else if(!pk->flags.valid)
	{
	/* You cannot have a good sig from an invalid key. */
	- rc = GPG_ERR_BAD_PUBKEY;
	+ rc = gpg_error (GPG_ERR_BAD_PUBKEY);
	}
	else
	{
	if(r_expiredate)
	*r_expiredate = pk->expiredate;

	rc = check_signature_end (pk, sig, digest, r_expired, r_revoked, NULL);

	/* Check the backsig. This is a 0x19 signature from the
	subkey on the primary key. The idea here is that it should
	not be possible for someone to "steal" subkeys and claim
	them as their own. The attacker couldn't actually use the
	subkey, but they could try and claim ownership of any
	signatures issued by it. */
	- if(rc==0 && !pk->flags.primary && pk->flags.backsig < 2)
	+ if (!rc && !pk->flags.primary && pk->flags.backsig < 2)
	{
	if (!pk->flags.backsig)
	{
	log_info(_("WARNING: signing subkey %s is not"
	" cross-certified\n"),keystr_from_pk(pk));
	log_info(_("please see %s for more information\n"),
	"https://gnupg.org/faq/subkey-cross-certify.html");
	/* --require-cross-certification makes this warning an
	error. TODO: change the default to require this
	after more keys have backsigs. */
	if(opt.flags.require_cross_cert)
	- rc = GPG_ERR_GENERAL;
	+ rc = gpg_error (GPG_ERR_GENERAL);
	}
	else if(pk->flags.backsig == 1)
	{
	log_info(_("WARNING: signing subkey %s has an invalid"
	" cross-certification\n"),keystr_from_pk(pk));
	- rc = GPG_ERR_GENERAL;
	+ rc = gpg_error (GPG_ERR_GENERAL);
	}
	}
	}

	- if (pk_internal \|\| rc)
	- {
	- release_public_key_parts (pk);
	- if (pk_internal)
	- xfree (pk);
	- else
	- /* Be very sure that the caller doesn't try to use PK. /
	- memset (pk, 0, sizeof (*pk));
	- }
	-
	if( !rc && sig->sig_class < 2 && is_status_enabled() ) {
	/* This signature id works best with DLP algorithms because
	* they use a random parameter for every signature. Instead of
	* this sig-id we could have also used the hash of the document
	* and the timestamp, but the drawback of this is, that it is
	* not possible to sign more than one identical document within
	* one second. Some remote batch processing applications might
	* like this feature here.
	*
	* Note that before 2.0.10, we used RIPE-MD160 for the hash
	* and accidentally didn't include the timestamp and algorithm
	* information in the hash. Given that this feature is not
	* commonly used and that a replay attacks detection should
	* not solely be based on this feature (because it does not
	* work with RSA), we take the freedom and switch to SHA-1
	* with 2.0.10 to take advantage of hardware supported SHA-1
	* implementations. We also include the missing information
	* in the hash. Note also the SIG_ID as computed by gpg 1.x
	* and gpg 2.x didn't matched either because 2.x used to print
	* MPIs not in PGP format. */
	u32 a = sig->timestamp;
	int nsig = pubkey_get_nsig( sig->pubkey_algo );
	unsigned char p, buffer;
	size_t n, nbytes;
	int i;
	char hashbuf[20];

	nbytes = 6;
	for (i=0; i < nsig; i++ )
	{
	if (gcry_mpi_print (GCRYMPI_FMT_USG, NULL, 0, &n, sig->data[i]))
	BUG();
	nbytes += n;
	}

	/* Make buffer large enough to be later used as output buffer. */
	if (nbytes < 100)
	nbytes = 100;
	nbytes += 10; /* Safety margin. */

	/* Fill and hash buffer. */
	buffer = p = xmalloc (nbytes);
	*p++ = sig->pubkey_algo;
	*p++ = sig->digest_algo;
	*p++ = (a >> 24) & 0xff;
	*p++ = (a >> 16) & 0xff;
	*p++ = (a >> 8) & 0xff;
	*p++ = a & 0xff;
	nbytes -= 6;
	for (i=0; i < nsig; i++ )
	{
	if (gcry_mpi_print (GCRYMPI_FMT_PGP, p, nbytes, &n, sig->data[i]))
	BUG();
	p += n;
	nbytes -= n;
	}
	gcry_md_hash_buffer (GCRY_MD_SHA1, hashbuf, buffer, p-buffer);

	p = make_radix64_string (hashbuf, 20);
	sprintf (buffer, "%s %s %lu",
	p, strtimestamp (sig->timestamp), (ulong)sig->timestamp);
	xfree (p);
	write_status_text (STATUS_SIG_ID, buffer);
	xfree (buffer);
	}

	+ if (r_pk)
	+ *r_pk = pk;
	+ else
	+ {
	+ release_public_key_parts (pk);
	+ xfree (pk);
	+ }
	+
	return rc;
	}


	/* The signature SIG was generated with the public key PK. Check
	* whether the signature is valid in the following sense:
	*
	* - Make sure the public key was created before the signature was
	* generated.
	*
	* - Make sure the public key was created in the past
	*
	* - Check whether PK has expired (set *R_EXPIRED to 1 if so and 0
	* otherwise)
	*
	* - Check whether PK has been revoked (set *R_REVOKED to 1 if so
	* and 0 otherwise).
	*
	* If either of the first two tests fail, returns an error code.
	* Otherwise returns 0. (Thus, this function doesn't fail if the
	* public key is expired or revoked.) */
	static int
	check_signature_metadata_validity (PKT_public_key pk, PKT_signature sig,
	int r_expired, int r_revoked)
	{
	u32 cur_time;

	if(r_expired)
	*r_expired = 0;
	if(r_revoked)
	*r_revoked = 0;

	if( pk->timestamp > sig->timestamp )
	{
	ulong d = pk->timestamp - sig->timestamp;
	if ( d < 86400 )
	{
	log_info
	(ngettext
	("public key %s is %lu second newer than the signature\n",
	"public key %s is %lu seconds newer than the signature\n",
	d), keystr_from_pk (pk), d);
	}
	else
	{
	d /= 86400;
	log_info
	(ngettext
	("public key %s is %lu day newer than the signature\n",
	"public key %s is %lu days newer than the signature\n",
	d), keystr_from_pk (pk), d);
	}
	if (!opt.ignore_time_conflict)
	return GPG_ERR_TIME_CONFLICT; /* pubkey newer than signature. */
	}

	cur_time = make_timestamp();
	if( pk->timestamp > cur_time )
	{
	ulong d = pk->timestamp - cur_time;
	if (d < 86400)
	{
	log_info (ngettext("key %s was created %lu second"
	" in the future (time warp or clock problem)\n",
	"key %s was created %lu seconds"
	" in the future (time warp or clock problem)\n",
	d), keystr_from_pk (pk), d);
	}
	else
	{
	d /= 86400;
	log_info (ngettext("key %s was created %lu day"
	" in the future (time warp or clock problem)\n",
	"key %s was created %lu days"
	" in the future (time warp or clock problem)\n",
	d), keystr_from_pk (pk), d);
	}
	if (!opt.ignore_time_conflict)
	return GPG_ERR_TIME_CONFLICT;
	}

	/* Check whether the key has expired. We check the has_expired
	flag which is set after a full evaluation of the key (getkey.c)
	as well as a simple compare to the current time in case the
	merge has for whatever reasons not been done. */
	if( pk->has_expired \|\| (pk->expiredate && pk->expiredate < cur_time)) {
	char buf[11];
	if (opt.verbose)
	log_info(_("Note: signature key %s expired %s\n"),
	keystr_from_pk(pk), asctimestamp( pk->expiredate ) );
	sprintf(buf,"%lu",(ulong)pk->expiredate);
	write_status_text(STATUS_KEYEXPIRED,buf);
	if(r_expired)
	*r_expired = 1;
	}

	if (pk->flags.revoked)
	{
	if (opt.verbose)
	log_info (_("Note: signature key %s has been revoked\n"),
	keystr_from_pk(pk));
	if (r_revoked)
	*r_revoked=1;
	}

	return 0;
	}


	/* Finish generating a signature and check it. Concretely: make sure
	* that the signature is valid (it was not created prior to the key,
	* the public key was created in the past, and the signature does not
	* include any unsupported critical features), finish computing the
	* digest by adding the relevant data from the signature packet, and
	* check that the signature verifies the digest.
	*
	* DIGEST contains a hash context, which has already hashed the signed
	* data. This function adds the relevant meta-data from the signature
	* packet to compute the final hash. (See Section 5.2 of RFC 4880:
	* "The concatenation of the data being signed and the signature data
	* from the version number through the hashed subpacket data
	* (inclusive) is hashed.")
	*
	* SIG is the signature to check.
	*
	* PK is the public key used to generate the signature.
	*
	* If R_EXPIRED is not NULL, *R_EXPIRED is set to 1 if PK has expired
	* (0 otherwise). Note: PK being expired does not cause this function
	* to fail.
	*
	* If R_REVOKED is not NULL, *R_REVOKED is set to 1 if PK has been
	* revoked (0 otherwise). Note: PK being revoked does not cause this
	* function to fail.
	*
	* If RET_PK is not NULL, PK is copied into RET_PK on success.
	*
	* Returns 0 on success. An error code other. */
	static int
	check_signature_end (PKT_public_key pk, PKT_signature sig,
	gcry_md_hd_t digest,
	int r_expired, int r_revoked, PKT_public_key *ret_pk)
	{
	int rc = 0;

	if ((rc = check_signature_metadata_validity (pk, sig,
	r_expired, r_revoked)))
	return rc;

	if ((rc = check_signature_end_simple (pk, sig, digest)))
	return rc;

	if(!rc && ret_pk)
	copy_public_key(ret_pk,pk);

	return rc;
	}

	/* This function is similar to check_signature_end, but it only checks
	whether the signature was generated by PK. It does not check
	expiration, revocation, etc. */
	static int
	check_signature_end_simple (PKT_public_key pk, PKT_signature sig,
	gcry_md_hd_t digest)
	{
	gcry_mpi_t result = NULL;
	int rc = 0;
	const struct weakhash *weak;

	if (!opt.flags.allow_weak_digest_algos)
	for (weak = opt.weak_digests; weak; weak = weak->next)
	if (sig->digest_algo == weak->algo)
	{
	print_digest_rejected_note(sig->digest_algo);
	return GPG_ERR_DIGEST_ALGO;
	}

	/* Make sure the digest algo is enabled (in case of a detached
	signature). */
	gcry_md_enable (digest, sig->digest_algo);

	/* Complete the digest. */
	if( sig->version >= 4 )
	gcry_md_putc( digest, sig->version );
	gcry_md_putc( digest, sig->sig_class );
	if( sig->version < 4 ) {
	u32 a = sig->timestamp;
	gcry_md_putc( digest, (a >> 24) & 0xff );
	gcry_md_putc( digest, (a >> 16) & 0xff );
	gcry_md_putc( digest, (a >> 8) & 0xff );
	gcry_md_putc( digest, a & 0xff );
	}
	else {
	byte buf[6];
	size_t n;
	gcry_md_putc( digest, sig->pubkey_algo );
	gcry_md_putc( digest, sig->digest_algo );
	if( sig->hashed ) {
	n = sig->hashed->len;
	gcry_md_putc (digest, (n >> 8) );
	gcry_md_putc (digest, n );
	gcry_md_write (digest, sig->hashed->data, n);
	n += 6;
	}
	else {
	/* Two octets for the (empty) length of the hashed
	section. */
	gcry_md_putc (digest, 0);
	gcry_md_putc (digest, 0);
	n = 6;
	}
	/* add some magic per Section 5.2.4 of RFC 4880. */
	buf[0] = sig->version;
	buf[1] = 0xff;
	buf[2] = n >> 24;
	buf[3] = n >> 16;
	buf[4] = n >> 8;
	buf[5] = n;
	gcry_md_write( digest, buf, 6 );
	}
	gcry_md_final( digest );

	/* Convert the digest to an MPI. */
	result = encode_md_value (pk, digest, sig->digest_algo );
	if (!result)
	return GPG_ERR_GENERAL;

	/* Verify the signature. */
	rc = pk_verify( pk->pubkey_algo, result, sig->data, pk->pkey );
	gcry_mpi_release (result);

	if( !rc && sig->flags.unknown_critical )
	{
	log_info(_("assuming bad signature from key %s"
	" due to an unknown critical bit\n"),keystr_from_pk(pk));
	rc = GPG_ERR_BAD_SIGNATURE;
	}

	return rc;
	}


	/* Add a uid node to a hash context. See section 5.2.4, paragraph 4
	of RFC 4880. */
	static void
	hash_uid_packet (PKT_user_id uid, gcry_md_hd_t md, PKT_signature sig )
	{
	if( uid->attrib_data ) {
	if( sig->version >=4 ) {
	byte buf[5];
	buf[0] = 0xd1; /* packet of type 17 */
	buf[1] = uid->attrib_len >> 24; /* always use 4 length bytes */
	buf[2] = uid->attrib_len >> 16;
	buf[3] = uid->attrib_len >> 8;
	buf[4] = uid->attrib_len;
	gcry_md_write( md, buf, 5 );
	}
	gcry_md_write( md, uid->attrib_data, uid->attrib_len );
	}
	else {
	if( sig->version >=4 ) {
	byte buf[5];
	buf[0] = 0xb4; /* indicates a userid packet */
	buf[1] = uid->len >> 24; /* always use 4 length bytes */
	buf[2] = uid->len >> 16;
	buf[3] = uid->len >> 8;
	buf[4] = uid->len;
	gcry_md_write( md, buf, 5 );
	}
	gcry_md_write( md, uid->name, uid->len );
	}
	}

	static void
	cache_sig_result ( PKT_signature *sig, int result )
	{
	if ( !result ) {
	sig->flags.checked = 1;
	sig->flags.valid = 1;
	}
	else if ( gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE ) {
	sig->flags.checked = 1;
	sig->flags.valid = 0;
	}
	else {
	sig->flags.checked = 0;
	sig->flags.valid = 0;
	}
	}


	/* SIG is a key revocation signature. Check if this signature was
	* generated by any of the public key PK's designated revokers.
	*
	* PK is the public key that SIG allegedly revokes.
	*
	* SIG is the revocation signature to check.
	*
	* This function avoids infinite recursion, which can happen if two
	* keys are designed revokers for each other and they revoke each
	* other. This is done by observing that if a key A is revoked by key
	* B we still consider the revocation to be valid even if B is
	* revoked. Thus, we don't need to determine whether B is revoked to
	* determine whether A has been revoked by B, we just need to check
	* the signature.
	*
	* Returns 0 if sig is valid (i.e. pk is revoked), non-0 if not
	* revoked. We are careful to make sure that GPG_ERR_NO_PUBKEY is
	* only returned when a revocation signature is from a valid
	* revocation key designated in a revkey subpacket, but the revocation
	* key itself isn't present.
	*
	* XXX: This code will need to be modified if gpg ever becomes
	* multi-threaded. Note that this guarantees that a designated
	* revocation sig will never be considered valid unless it is actually
	* valid, as well as being issued by a revocation key in a valid
	* direct signature. Note also that this is written so that a revoked
	* revoker can still issue revocations: i.e. If A revokes B, but A is
	* revoked, B is still revoked. I'm not completely convinced this is
	* the proper behavior, but it matches how PGP does it. -dms */
	int
	check_revocation_keys (PKT_public_key pk, PKT_signature sig)
	{
	static int busy=0;
	int i;
	int rc = GPG_ERR_GENERAL;

	log_assert (IS_KEY_REV(sig));
	log_assert ((sig->keyid[0]!=pk->keyid[0]) \|\| (sig->keyid[0]!=pk->keyid[1]));

	/* Avoid infinite recursion. Consider the following:
	*
	* - We want to check if A is revoked.
	*
	* - C is a designated revoker for B and has revoked B.
	*
	* - B is a designated revoker for A and has revoked A.
	*
	* When checking if A is revoked (in merge_selfsigs_main), we
	* observe that A has a designed revoker. As such, we call this
	* function. This function sees that there is a valid revocation
	* signature, which is signed by B. It then calls check_signature()
	* to verify that the signature is good. To check the sig, we need
	* to lookup B. Looking up B means calling merge_selfsigs_main,
	* which checks whether B is revoked, which calls this function to
	* see if B was revoked by some key.
	*
	* In this case, the added level of indirection doesn't hurt. It
	* just means a bit more work. However, if C == A, then we'd end up
	* in a loop. But, it doesn't make sense to look up C anyways: even
	* if B is revoked, we conservatively consider a valid revocation
	* signed by B to revoke A. Since this is the only place where this
	* type of recursion can occur, we simply cause this function to
	* fail if it is entered recursively. */
	if (busy)
	{
	/* Return an error (i.e. not revoked), but mark the pk as
	uncacheable as we don't really know its revocation status
	until it is checked directly. */
	pk->flags.dont_cache = 1;
	return rc;
	}

	busy=1;

	/* es_printf("looking at %08lX with a sig from %08lX\n",(ulong)pk->keyid[1],
	(ulong)sig->keyid[1]); */

	/* is the issuer of the sig one of our revokers? */
	if( !pk->revkey && pk->numrevkeys )
	BUG();
	else
	for(i=0;i<pk->numrevkeys;i++)
	{
	/* The revoker's keyid. */
	u32 keyid[2];

	keyid_from_fingerprint(pk->revkey[i].fpr,MAX_FINGERPRINT_LEN,keyid);

	if(keyid[0]==sig->keyid[0] && keyid[1]==sig->keyid[1])
	/* The signature was generated by a designated revoker.
	Verify the signature. */
	{
	gcry_md_hd_t md;

	if (gcry_md_open (&md, sig->digest_algo, 0))
	BUG ();
	hash_public_key(md,pk);
	/* Note: check_signature only checks that the signature
	is good. It does not fail if the key is revoked. */
	rc=check_signature(sig,md);
	cache_sig_result(sig,rc);
	gcry_md_close (md);
	break;
	}
	}

	busy=0;

	return rc;
	}

	/* Check that the backsig BACKSIG from the subkey SUB_PK to its
	primary key MAIN_PK is valid.

	Backsigs (0x19) have the same format as binding sigs (0x18), but
	this function is simpler than check_key_signature in a few ways.
	For example, there is no support for expiring backsigs since it is
	questionable what such a thing actually means. Note also that the
	sig cache check here, unlike other sig caches in GnuPG, is not
	persistent. */
	int
	check_backsig (PKT_public_key main_pk,PKT_public_key sub_pk,
	PKT_signature *backsig)
	{
	gcry_md_hd_t md;
	int rc;

	/* Always check whether the algorithm is available. Although
	gcry_md_open would throw an error, some libgcrypt versions will
	print a debug message in that case too. */
	if ((rc=openpgp_md_test_algo (backsig->digest_algo)))
	return rc;

	if(!opt.no_sig_cache && backsig->flags.checked)
	return backsig->flags.valid? 0 : gpg_error (GPG_ERR_BAD_SIGNATURE);

	rc = gcry_md_open (&md, backsig->digest_algo,0);
	if (!rc)
	{
	hash_public_key(md,main_pk);
	hash_public_key(md,sub_pk);
	rc = check_signature_end (sub_pk, backsig, md, NULL, NULL, NULL);
	cache_sig_result(backsig,rc);
	gcry_md_close(md);
	}

	return rc;
	}


	/* Check that a signature over a key is valid. This is a
	* specialization of check_key_signature2 with the unnamed parameters
	* passed as NULL. See the documentation for that function for more
	* details. */
	int
	check_key_signature (KBNODE root, KBNODE node, int *is_selfsig)
	{
	return check_key_signature2 (root, node, NULL, NULL, is_selfsig, NULL, NULL);
	}


	/* Returns whether SIGNER generated the signature SIG over the packet
	PACKET, which is a key, subkey or uid, and comes from the key block
	KB. (KB is PACKET's corresponding keyblock; we don't assume that
	SIG has been added to the keyblock.)

	If SIGNER is set, then checks whether SIGNER generated the
	signature. Otherwise, uses SIG->KEYID to find the alleged signer.
	This parameter can be used to effectively override the alleged
	signer that is stored in SIG.

	KB may be NULL if SIGNER is set.

	Unlike check_key_signature, this function ignores any cached
	results! That is, it does not consider SIG->FLAGS.CHECKED and
	SIG->FLAGS.VALID nor does it set them.

	This doesn't check the signature's semantic mean. Concretely, it
	doesn't check whether a non-self signed revocation signature was
	created by a designated revoker. In fact, it doesn't return an
	error for a binding generated by a completely different key!

	Returns 0 if the signature is valid. Returns GPG_ERR_SIG_CLASS if
	this signature can't be over PACKET. Returns GPG_ERR_NOT_FOUND if
	the key that generated the signature (according to SIG) could not
	be found. Returns GPG_ERR_BAD_SIGNATURE if the signature is bad.
	Other errors codes may be returned if something else goes wrong.

	IF IS_SELFSIG is not NULL, sets *IS_SELFSIG to 1 if this is a
	self-signature (by the key's primary key) or 0 if not.

	If RET_PK is not NULL, returns a copy of the public key that
	generated the signature (i.e., the signer) on success. This must
	be released by the caller using release_public_key_parts (). */
	gpg_error_t
	check_signature_over_key_or_uid (PKT_public_key *signer,
	PKT_signature sig, KBNODE kb, PACKET packet,
	int is_selfsig, PKT_public_key ret_pk)
	{
	int rc;
	PKT_public_key *pripk = kb->pkt->pkt.public_key;
	gcry_md_hd_t md;
	int signer_alloced = 0;

	rc = openpgp_pk_test_algo (sig->pubkey_algo);
	if (rc)
	return rc;
	rc = openpgp_md_test_algo (sig->digest_algo);
	if (rc)
	return rc;

	/* A signature's class indicates the type of packet that it
	signs. */
	if (/* Primary key binding (made by a subkey). */
	sig->sig_class == 0x19
	/* Direct key signature. */
	\|\| sig->sig_class == 0x1f
	/* Primary key revocation. */
	\|\| sig->sig_class == 0x20)
	{
	if (packet->pkttype != PKT_PUBLIC_KEY)
	/* Key revocations can only be over primary keys. */
	return gpg_error (GPG_ERR_SIG_CLASS);
	}
	else if (/* Subkey binding. */
	sig->sig_class == 0x18
	/* Subkey revocation. */
	\|\| sig->sig_class == 0x28)
	{
	if (packet->pkttype != PKT_PUBLIC_SUBKEY)
	return gpg_error (GPG_ERR_SIG_CLASS);
	}
	else if (/* Certification. */
	sig->sig_class == 0x10
	\|\| sig->sig_class == 0x11
	\|\| sig->sig_class == 0x12
	\|\| sig->sig_class == 0x13
	/* Certification revocation. */
	\|\| sig->sig_class == 0x30)
	{
	if (packet->pkttype != PKT_USER_ID)
	return gpg_error (GPG_ERR_SIG_CLASS);
	}
	else
	return gpg_error (GPG_ERR_SIG_CLASS);

	/* PACKET is the right type for SIG. */

	if (signer)
	{
	if (is_selfsig)
	{
	if (signer->keyid[0] == pripk->keyid[0]
	&& signer->keyid[1] == pripk->keyid[1])
	*is_selfsig = 1;
	else
	*is_selfsig = 0;
	}
	}
	else
	{
	/* Get the signer. If possible, avoid a look up. */
	if (sig->keyid[0] == pripk->keyid[0]
	&& sig->keyid[1] == pripk->keyid[1])
	/* Issued by the primary key. */
	{
	signer = pripk;
	if (is_selfsig)
	*is_selfsig = 1;
	}
	else
	{
	kbnode_t ctx = NULL;
	kbnode_t n;

	/* See if one of the subkeys was the signer (although this
	is extremely unlikely). */
	while ((n = walk_kbnode (kb, &ctx, 0)))
	{
	PKT_public_key *subk;

	if (n->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	continue;

	subk = n->pkt->pkt.public_key;
	if (sig->keyid[0] == subk->keyid[0]
	&& sig->keyid[1] == subk->keyid[1])
	/* Issued by a subkey. */
	{
	signer = subk;
	break;
	}
	}

	if (! signer)
	/* Signer by some other key. */
	{
	if (is_selfsig)
	*is_selfsig = 0;
	if (ret_pk)
	{
	signer = ret_pk;
	memset (signer, 0, sizeof (*signer));
	signer_alloced = 1;
	}
	else
	{
	signer = xmalloc_clear (sizeof (*signer));
	signer_alloced = 2;
	}

	rc = get_pubkey (signer, sig->keyid);
	if (rc)
	{
	xfree (signer);
	signer = NULL;
	signer_alloced = 0;
	goto out;
	}
	}
	}
	}

	/* We checked above that we supported this algo, so an error here is
	a bug. */
	if (gcry_md_open (&md, sig->digest_algo, 0))
	BUG ();

	/* Hash the relevant data. */

	if (/* Direct key signature. */
	sig->sig_class == 0x1f
	/* Primary key revocation. */
	\|\| sig->sig_class == 0x20)
	{
	log_assert (packet->pkttype == PKT_PUBLIC_KEY);
	hash_public_key (md, packet->pkt.public_key);
	rc = check_signature_end_simple (signer, sig, md);
	}
	else if (/* Primary key binding (made by a subkey). */
	sig->sig_class == 0x19)
	{
	log_assert (packet->pkttype == PKT_PUBLIC_KEY);
	hash_public_key (md, packet->pkt.public_key);
	hash_public_key (md, signer);
	rc = check_signature_end_simple (signer, sig, md);
	}
	else if (/* Subkey binding. */
	sig->sig_class == 0x18
	/* Subkey revocation. */
	\|\| sig->sig_class == 0x28)
	{
	log_assert (packet->pkttype == PKT_PUBLIC_SUBKEY);
	hash_public_key (md, pripk);
	hash_public_key (md, packet->pkt.public_key);
	rc = check_signature_end_simple (signer, sig, md);
	}
	else if (/* Certification. */
	sig->sig_class == 0x10
	\|\| sig->sig_class == 0x11
	\|\| sig->sig_class == 0x12
	\|\| sig->sig_class == 0x13
	/* Certification revocation. */
	\|\| sig->sig_class == 0x30)
	{
	log_assert (packet->pkttype == PKT_USER_ID);
	hash_public_key (md, pripk);
	hash_uid_packet (packet->pkt.user_id, md, sig);
	rc = check_signature_end_simple (signer, sig, md);
	}
	else
	/* We should never get here. (The first if above should have
	already caught this error.) */
	BUG ();

	gcry_md_close (md);

	out:
	if (! rc && ret_pk && (signer_alloced == -1 \|\| ret_pk != signer))
	copy_public_key (ret_pk, signer);
	if (signer_alloced == 1)
	/* We looked up SIGNER; it is not a pointer into KB. */
	{
	release_public_key_parts (signer);
	if (signer_alloced == 2)
	/* We also allocated the memory. */
	xfree (signer);
	}

	return rc;
	}

	/* Check that a signature over a key (e.g., a key revocation, key
	* binding, user id certification, etc.) is valid. If the function
	* detects a self-signature, it uses the public key from the specified
	* key block and does not bother looking up the key specified in the
	* signature packet.
	*
	* ROOT is a keyblock.
	*
	* NODE references a signature packet that appears in the keyblock
	* that should be verified.
	*
	* If CHECK_PK is set, the specified key is sometimes preferred for
	* verifying signatures. See the implementation for details.
	*
	* If RET_PK is not NULL, the public key that successfully verified
	* the signature is copied into *RET_PK.
	*
	* If IS_SELFSIG is not NULL, *IS_SELFSIG is set to 1 if NODE is a
	* self-signature.
	*
	* If R_EXPIREDATE is not NULL, *R_EXPIREDATE is set to the expiry
	* date.
	*
	* If R_EXPIRED is not NULL, *R_EXPIRED is set to 1 if PK has been
	* expired (0 otherwise). Note: PK being revoked does not cause this
	* function to fail.
	*
	*
	* If OPT.NO_SIG_CACHE is not set, this function will first check if
	* the result of a previous verification is already cached in the
	* signature packet's data structure.
	*
	* TODO: add r_revoked here as well. It has the same problems as
	* r_expiredate and r_expired and the cache. */
	int
	check_key_signature2 (kbnode_t root, kbnode_t node, PKT_public_key *check_pk,
	PKT_public_key ret_pk, int is_selfsig,
	u32 r_expiredate, int r_expired )
	{
	PKT_public_key *pk;
	PKT_signature *sig;
	int algo;
	int rc;

	if (is_selfsig)
	*is_selfsig = 0;
	if (r_expiredate)
	*r_expiredate = 0;
	if (r_expired)
	*r_expired = 0;
	log_assert (node->pkt->pkttype == PKT_SIGNATURE);
	log_assert (root->pkt->pkttype == PKT_PUBLIC_KEY);

	pk = root->pkt->pkt.public_key;
	sig = node->pkt->pkt.signature;
	algo = sig->digest_algo;

	/* Check whether we have cached the result of a previous signature
	check. Note that we may no longer have the pubkey or hash
	needed to verify a sig, but can still use the cached value. A
	cache refresh detects and clears these cases. */
	if ( !opt.no_sig_cache )
	{
	if (sig->flags.checked) /* Cached status available. */
	{
	if (is_selfsig)
	{
	u32 keyid[2];

	keyid_from_pk (pk, keyid);
	if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1])
	*is_selfsig = 1;
	}
	/* BUG: This is wrong for non-self-sigs... needs to be the
	actual pk. */
	rc = check_signature_metadata_validity (pk, sig, r_expired, NULL);
	if (rc)
	return rc;
	return sig->flags.valid? 0 : gpg_error (GPG_ERR_BAD_SIGNATURE);
	}
	}

	rc = openpgp_pk_test_algo(sig->pubkey_algo);
	if (rc)
	return rc;
	rc = openpgp_md_test_algo(algo);
	if (rc)
	return rc;

	if (sig->sig_class == 0x20) /* key revocation */
	{
	u32 keyid[2];
	keyid_from_pk( pk, keyid );

	/* Is it a designated revoker? */
	if (keyid[0] != sig->keyid[0] \|\| keyid[1] != sig->keyid[1])
	rc = check_revocation_keys (pk, sig);
	else
	{
	rc = check_signature_metadata_validity (pk, sig,
	r_expired, NULL);
	if (! rc)
	rc = check_signature_over_key_or_uid (pk, sig, root, root->pkt,
	is_selfsig, ret_pk);
	}
	}
	else if (sig->sig_class == 0x28 /* subkey revocation */
	\|\| sig->sig_class == 0x18) /* key binding */
	{
	kbnode_t snode = find_prev_kbnode (root, node, PKT_PUBLIC_SUBKEY);

	if (snode)
	{
	rc = check_signature_metadata_validity (pk, sig,
	r_expired, NULL);
	if (! rc)
	/* 0x28 must be a self-sig, but 0x18 needn't be. */
	rc = check_signature_over_key_or_uid (sig->sig_class == 0x18
	? NULL : pk,
	sig, root, snode->pkt,
	is_selfsig, ret_pk);
	}
	else
	{
	if (opt.verbose)
	{
	if (sig->sig_class == 0x28)
	log_info (_("key %s: no subkey for subkey"
	" revocation signature\n"), keystr_from_pk(pk));
	else if (sig->sig_class == 0x18)
	log_info(_("key %s: no subkey for subkey"
	" binding signature\n"), keystr_from_pk(pk));
	}
	rc = GPG_ERR_SIG_CLASS;
	}
	}
	else if (sig->sig_class == 0x1f) /* direct key signature */
	{
	rc = check_signature_metadata_validity (pk, sig,
	r_expired, NULL);
	if (! rc)
	rc = check_signature_over_key_or_uid (pk, sig, root, root->pkt,
	is_selfsig, ret_pk);
	}
	else if (/* Certification. */
	sig->sig_class == 0x10
	\|\| sig->sig_class == 0x11
	\|\| sig->sig_class == 0x12
	\|\| sig->sig_class == 0x13
	/* Certification revocation. */
	\|\| sig->sig_class == 0x30)
	{
	kbnode_t unode = find_prev_kbnode (root, node, PKT_USER_ID);

	if (unode)
	{
	rc = check_signature_metadata_validity (pk, sig, r_expired, NULL);
	if (! rc)
	/* If this is a self-sig, ignore check_pk. */
	rc = check_signature_over_key_or_uid
	(keyid_cmp (pk_keyid (pk), sig->keyid) == 0 ? pk : check_pk,
	sig, root, unode->pkt, NULL, ret_pk);
	}
	else
	{
	if (!opt.quiet)
	log_info ("key %s: no user ID for key signature packet"
	" of class %02x\n",keystr_from_pk(pk),sig->sig_class);
	rc = GPG_ERR_SIG_CLASS;
	}
	}
	else
	{
	log_info ("sig issued by %s with class %d (digest: %02x %02x)"
	" is not valid over a user id or a key id, ignoring.\n",
	keystr (sig->keyid), sig->sig_class,
	sig->digest_start[0], sig->digest_start[1]);
	rc = gpg_error (GPG_ERR_BAD_SIGNATURE);
	}

	cache_sig_result (sig, rc);

	return rc;
	}

File Metadata

Mime Type: text/x-diff
Expires: Thu, Feb 5, 9:44 PM (1 d, 13 h)
Storage Engine: local-disk
Storage Format: Raw Data
Storage Handle: 81/1a/40fffac83c08ed62a784dd7228bd

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions