ref: 1018d7a7091fd5e0433f501a3474cdc3fec322cc
dir: /appl/cmd/crypt.b/
implement Crypt; # encrypt/decrypt from stdin to stdout include "sys.m"; sys: Sys; stderr: ref Sys->FD; include "draw.m"; include "keyring.m"; keyring: Keyring; include "security.m"; ssl: SSL; include "bufio.m"; include "msgio.m"; msgio: Msgio; include "arg.m"; Crypt: module { init: fn(nil: ref Draw->Context, argv: list of string); }; Ehungup: con "i/o on hungup channel"; ALGSTR: con "alg "; DEFAULTALG: con "md5/ideacbc"; usage() { sys->fprint(stderr, "usage: crypt [-?] [-d] [-k secret] [-f secretfile] [-a alg[/alg]]\n"); sys->fprint(stderr, "available algorithms:\n"); showalgs(stderr); fail("bad usage"); } badmodule(m: string) { sys->fprint(stderr, "crypt: cannot load %s: %r\n", m); fail("bad module"); } headers: con 1; verbose := 0; init(nil: ref Draw->Context, argv: list of string) { sys = load Sys Sys->PATH; stderr = sys->fildes(2); ssl = load SSL SSL->PATH; if (ssl == nil) badmodule(SSL->PATH); keyring = load Keyring Keyring->PATH; if (keyring == nil) badmodule(SSL->PATH); msgio = load Msgio Msgio->PATH; msgio->init(); arg := load Arg Arg->PATH; if (arg == nil) badmodule(SSL->PATH); decrypt := 0; secret: array of byte; alg := DEFAULTALG; arg->init(argv); while ((opt := arg->opt()) != 0) { case opt { 'd' => decrypt = 1; 'k' => if ((s := arg->arg()) == nil) usage(); secret = array of byte s; 'f' => if ((f := arg->arg()) == nil) usage(); secret = readfile(f); 'a' => if ((alg = arg->arg()) == nil) usage(); '?' => showalgs(sys->fildes(1)); return; 'v' => verbose = 1; * => usage(); } } argv = arg->argv(); if (argv != nil) usage(); if(secret == nil) secret = array of byte readpassword(); sk := array[Keyring->SHA1dlen] of byte; keyring->sha1(secret, len secret, sk, nil); if (headers) { # deal with header - the header encodes the algorithm along with the data. if (decrypt) { msg := msgio->getmsg(sys->fildes(0)); if (msg != nil) alg = string msg; if (msg == nil || len alg < len ALGSTR || alg[0:len ALGSTR] != ALGSTR) error("couldn't get decrypt algorithm"); alg = alg[len ALGSTR:]; } else { msg := array of byte ("alg " + alg); e := msgio->sendmsg(sys->fildes(1), msg, len msg); if (e == -1) error("couldn't write algorithm string"); } } fd := docrypt(decrypt, alg, sk); if (decrypt) { # if decrypting, don't use stream, as we want to catch # decryption or checksum errors when they happen. buf := array[Sys->ATOMICIO] of byte; stdout := sys->fildes(1); while ((n := sys->read(fd, buf, len buf)) > 0) sys->write(stdout, buf, n); if (n == -1) { err := sys->sprint("%r"); if (err != Ehungup) error("decryption failed: " + err); } } else { stream(fd, sys->fildes(1), Sys->ATOMICIO); } } docrypt(decrypt: int, alg: string, sk: array of byte): ref Sys->FD { if (verbose) sys->fprint(stderr, "%scrypting with alg %s\n", (array[] of {"en", "de"})[decrypt!=0], alg); (err, fds, nil, nil) := cryptpipe(decrypt, alg, sk); if (err != nil) error(err); spawn stream(sys->fildes(0), fds[1], Sys->ATOMICIO); return fds[0]; } # set up an encrypt/decrypt session; if decrypt is non-zero, then # decrypt, else encrypt. alg is the algorithm to use; sk is the # used as the secret key. # returns tuple (err, fds, cfd, dir) # where err is non-nil on failure; # otherwise fds is an array of two fds; writing to fds[1] will make # crypted/decrypted data available to be read on fds[0]. # dir is the ssl directory in question. cryptpipe(decrypt: int, alg: string, sk: array of byte): (string, array of ref Sys->FD, ref Sys->FD, string) { pfd := array[2] of ref Sys->FD; if (sys->pipe(pfd) == -1) return ("pipe failed", nil, nil, nil); (err, c) := ssl->connect(pfd[1]); if (err != nil) return ("could not connect ssl: "+err, nil, nil, nil); pfd[1] = nil; err = ssl->secret(c, sk, sk); if (err != nil) return ("could not write secret: "+err, nil, nil, nil); if (alg != nil) if (sys->fprint(c.cfd, "alg %s", alg) == -1) return (sys->sprint("bad algorithm %s: %r", alg), nil, nil, nil); fds := array[2] of ref Sys->FD; if (decrypt) { fds[1] = pfd[0]; fds[0] = c.dfd; } else { fds[1] = c.dfd; fds[0] = pfd[0]; } return (nil, fds, c.cfd, c.dir); } algnames := array[] of {("crypt", "encalgs"), ("hash", "hashalgs")}; # find available algorithms and return as tuple of two lists: # (err, hashalgs, cryptalgs) algs(): (string, array of list of string) { (err, nil, nil, dir) := cryptpipe(0, nil, array[100] of byte); if (err != nil) return (err, nil); alglists := array[len algnames] of list of string; for (i := 0; i < len algnames; i++) { (nil, f) := algnames[i]; (nil, alglists[i]) = sys->tokenize(string readfile(dir + "/" + f), " "); } return (nil, alglists); } showalgs(fd: ref Sys->FD) { (err, alglists) := algs(); if (err != nil) error("cannot get algorithms: " + err); for (j := 0; j < len alglists; j++) { (name, nil) := algnames[j]; sys->fprint(fd, "%s:", name); for (l := alglists[j]; l != nil; l = tl l) sys->fprint(fd, " %s", hd l); sys->fprint(fd, "\n"); } } readpassword(): string { bufio := load Bufio Bufio->PATH; Iobuf: import bufio; stdin := bufio->open("/dev/cons", Sys->OREAD); cfd := sys->open("/dev/consctl", Sys->OWRITE); if (cfd == nil || sys->fprint(cfd, "rawon") <= 0) sys->fprint(stderr, "crypt: warning: cannot hide typed password\n"); sys->fprint(stderr, "password: "); s := ""; while ((c := stdin.getc()) >= 0 && c != '\n'){ case c { '\b' => if (len s > 0) s = s[0:len s - 1]; 8r25 => # ^U s = nil; * => s[len s] = c; } } sys->fprint(stderr, "\n"); return s; } stream(src, dst: ref Sys->FD, bufsize: int) { sys->stream(src, dst, bufsize); } readfile(f: string): array of byte { fd := sys->open(f, Sys->OREAD); if (fd == nil) error(sys->sprint("cannot read %s: %r", f)); buf := array[8192] of byte; # >8K key? get real! n := sys->read(fd, buf, len buf); if (n <= 0) return nil; return buf[0:n]; } error(s: string) { sys->fprint(stderr, "crypt: %s\n", s); fail("error"); } fail(e: string) { raise "fail: "+e; }