|
|
05547d |
diff --git a/libqpdf/QPDF.cc b/libqpdf/QPDF.cc
|
|
|
05547d |
index 3eeea86..2a6923c 100644
|
|
|
05547d |
--- a/libqpdf/QPDF.cc
|
|
|
05547d |
+++ b/libqpdf/QPDF.cc
|
|
|
68374e |
@@ -11,6 +11,10 @@
|
|
|
68374e |
#include <string.h>
|
|
|
68374e |
#include <memory.h>
|
|
|
68374e |
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
68374e |
+# include <gnutls/crypto.h>
|
|
|
68374e |
+#endif
|
|
|
68374e |
+
|
|
|
68374e |
#include <qpdf/QTC.hh>
|
|
|
68374e |
#include <qpdf/QUtil.hh>
|
|
|
68374e |
#include <qpdf/Pipeline.hh>
|
|
|
05547d |
@@ -262,7 +266,13 @@ QPDF::processFile(char const* filename, char const* password)
|
|
|
68374e |
{
|
|
|
68374e |
FileInputSource* fi = new FileInputSource();
|
|
|
68374e |
fi->setFilename(filename);
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
68374e |
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
|
68374e |
+#endif
|
|
|
68374e |
processInputSource(fi, password);
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
68374e |
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
|
68374e |
+#endif
|
|
|
68374e |
}
|
|
|
68374e |
|
|
|
68374e |
void
|
|
|
05547d |
@@ -271,7 +281,13 @@ QPDF::processFile(char const* description, FILE* filep,
|
|
|
68374e |
{
|
|
|
68374e |
FileInputSource* fi = new FileInputSource();
|
|
|
68374e |
fi->setFile(description, filep, close_file);
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
68374e |
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
|
68374e |
+#endif
|
|
|
68374e |
processInputSource(fi, password);
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
68374e |
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
|
68374e |
+#endif
|
|
|
68374e |
}
|
|
|
68374e |
|
|
|
68374e |
void
|
|
|
05547d |
diff --git a/libqpdf/QPDFWriter.cc b/libqpdf/QPDFWriter.cc
|
|
|
05547d |
index 689fef7..57df1eb 100644
|
|
|
05547d |
--- a/libqpdf/QPDFWriter.cc
|
|
|
05547d |
+++ b/libqpdf/QPDFWriter.cc
|
|
|
05547d |
@@ -24,6 +24,10 @@
|
|
|
05547d |
#include <algorithm>
|
|
|
05547d |
#include <stdlib.h>
|
|
|
05547d |
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
05547d |
+#include <gnutls/crypto.h>
|
|
|
05547d |
+#endif
|
|
|
05547d |
+
|
|
|
05547d |
QPDFWriter::Members::Members(QPDF& pdf) :
|
|
|
05547d |
pdf(pdf),
|
|
|
05547d |
filename("unspecified"),
|
|
|
05547d |
@@ -321,6 +325,13 @@ void
|
|
|
05547d |
QPDFWriter::setDeterministicID(bool val)
|
|
|
05547d |
{
|
|
|
05547d |
this->m->deterministic_id = val;
|
|
|
05547d |
+
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
05547d |
+ if (val)
|
|
|
05547d |
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
|
05547d |
+ else
|
|
|
05547d |
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
|
05547d |
+#endif
|
|
|
05547d |
}
|
|
|
05547d |
|
|
|
05547d |
void
|
|
|
05547d |
@@ -342,6 +353,13 @@ void
|
|
|
05547d |
QPDFWriter::setPreserveEncryption(bool val)
|
|
|
05547d |
{
|
|
|
05547d |
this->m->preserve_encryption = val;
|
|
|
05547d |
+
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
05547d |
+ if (val)
|
|
|
05547d |
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
|
05547d |
+ else
|
|
|
05547d |
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
|
05547d |
+#endif
|
|
|
05547d |
}
|
|
|
05547d |
|
|
|
05547d |
void
|
|
|
05547d |
@@ -2301,12 +2319,23 @@ QPDFWriter::generateID()
|
|
|
05547d |
}
|
|
|
05547d |
}
|
|
|
05547d |
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
05547d |
+ unsigned oldmode = gnutls_fips140_mode_enabled();
|
|
|
05547d |
+
|
|
|
05547d |
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
05547d |
+#endif
|
|
|
05547d |
+
|
|
|
05547d |
MD5 m;
|
|
|
05547d |
m.encodeString(seed.c_str());
|
|
|
05547d |
MD5::Digest digest;
|
|
|
05547d |
m.digest(digest);
|
|
|
05547d |
result = std::string(reinterpret_cast<char*>(digest),
|
|
|
05547d |
sizeof(MD5::Digest));
|
|
|
05547d |
+
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
05547d |
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
05547d |
+#endif
|
|
|
05547d |
+
|
|
|
05547d |
}
|
|
|
05547d |
|
|
|
05547d |
// If /ID already exists, follow the spec: use the original first
|
|
|
05547d |
diff --git a/libqpdf/QPDF_encryption.cc b/libqpdf/QPDF_encryption.cc
|
|
|
05547d |
index 2ff48df..ce6fb31 100644
|
|
|
05547d |
--- a/libqpdf/QPDF_encryption.cc
|
|
|
05547d |
+++ b/libqpdf/QPDF_encryption.cc
|
|
|
68374e |
@@ -1,6 +1,8 @@
|
|
|
68374e |
// This file implements methods from the QPDF class that involve
|
|
|
68374e |
// encryption.
|
|
|
68374e |
|
|
|
68374e |
+#include <qpdf/qpdf-config.h>
|
|
|
68374e |
+
|
|
|
68374e |
#include <qpdf/QPDF.hh>
|
|
|
68374e |
|
|
|
68374e |
#include <qpdf/QPDFExc.hh>
|
|
|
68374e |
@@ -18,6 +20,10 @@
|
|
|
68374e |
#include <assert.h>
|
|
|
68374e |
#include <string.h>
|
|
|
68374e |
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
68374e |
+# include <gnutls/crypto.h>
|
|
|
68374e |
+#endif
|
|
|
68374e |
+
|
|
|
68374e |
static unsigned char const padding_string[] = {
|
|
|
68374e |
0x28, 0xbf, 0x4e, 0x5e, 0x4e, 0x75, 0x8a, 0x41,
|
|
|
68374e |
0x64, 0x00, 0x4e, 0x56, 0xff, 0xfa, 0x01, 0x08,
|
|
|
05547d |
@@ -380,10 +386,21 @@ QPDF::compute_data_key(std::string const& encryption_key,
|
|
|
05547d |
result += "sAlT";
|
|
|
05547d |
}
|
|
|
05547d |
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
05547d |
+ unsigned oldmode = gnutls_fips140_mode_enabled();
|
|
|
05547d |
+
|
|
|
05547d |
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
05547d |
+#endif
|
|
|
05547d |
+
|
|
|
05547d |
MD5 md5;
|
|
|
05547d |
md5.encodeDataIncrementally(result.c_str(), result.length());
|
|
|
05547d |
MD5::Digest digest;
|
|
|
05547d |
md5.digest(digest);
|
|
|
05547d |
+
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
05547d |
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
05547d |
+#endif
|
|
|
05547d |
+
|
|
|
05547d |
return std::string(reinterpret_cast<char*>(digest),
|
|
|
05547d |
std::min(result.length(), toS(16)));
|
|
|
05547d |
}
|
|
|
05547d |
@@ -1150,6 +1167,12 @@ QPDF::getKeyForObject(
|
|
|
68374e |
void
|
|
|
68374e |
QPDF::decryptString(std::string& str, int objid, int generation)
|
|
|
68374e |
{
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
68374e |
+ unsigned oldmode = gnutls_fips140_mode_enabled();
|
|
|
68374e |
+
|
|
|
68374e |
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
68374e |
+#endif
|
|
|
68374e |
+
|
|
|
68374e |
if (objid == 0)
|
|
|
68374e |
{
|
|
|
68374e |
return;
|
|
|
05547d |
@@ -1230,6 +1253,10 @@ QPDF::decryptString(std::string& str, int objid, int generation)
|
|
|
68374e |
QUtil::int_to_string(objid) + " " +
|
|
|
68374e |
QUtil::int_to_string(generation) + ": " + e.what());
|
|
|
68374e |
}
|
|
|
68374e |
+
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
68374e |
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
68374e |
+#endif
|
|
|
68374e |
}
|
|
|
68374e |
|
|
|
68374e |
void
|
|
|
05547d |
@@ -1240,6 +1267,12 @@ QPDF::decryptStream(PointerHolder<EncryptionParameters> encp,
|
|
|
68374e |
QPDFObjectHandle& stream_dict,
|
|
|
68374e |
std::vector<PointerHolder<Pipeline> >& heap)
|
|
|
68374e |
{
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
68374e |
+ unsigned oldmode = gnutls_fips140_mode_enabled();
|
|
|
68374e |
+
|
|
|
68374e |
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
68374e |
+#endif
|
|
|
68374e |
+
|
|
|
68374e |
std::string type;
|
|
|
68374e |
if (stream_dict.getKey("/Type").isName())
|
|
|
68374e |
{
|
|
|
05547d |
@@ -1361,6 +1394,10 @@ QPDF::decryptStream(PointerHolder<EncryptionParameters> encp,
|
|
|
68374e |
toI(key.length()));
|
|
|
68374e |
}
|
|
|
68374e |
heap.push_back(pipeline);
|
|
|
68374e |
+
|
|
|
05547d |
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
68374e |
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
68374e |
+#endif
|
|
|
68374e |
}
|
|
|
68374e |
|
|
|
68374e |
void
|