|
|
@ -1,68 +1,138 @@ |
|
|
|
diff -up qpdf-11.7.0/libqpdf/QPDF.cc.relax qpdf-11.7.0/libqpdf/QPDF.cc |
|
|
|
diff --git a/libqpdf/QPDF.cc b/libqpdf/QPDF.cc |
|
|
|
--- qpdf-11.7.0/libqpdf/QPDF.cc.relax 2023-12-24 13:36:07.000000000 +0100 |
|
|
|
index 3eeea86..2a6923c 100644 |
|
|
|
+++ qpdf-11.7.0/libqpdf/QPDF.cc 2024-01-08 15:17:27.020951639 +0100 |
|
|
|
--- a/libqpdf/QPDF.cc |
|
|
|
@@ -13,6 +13,10 @@ |
|
|
|
+++ b/libqpdf/QPDF.cc |
|
|
|
#include <sstream> |
|
|
|
@@ -11,6 +11,10 @@ |
|
|
|
#include <vector> |
|
|
|
#include <string.h> |
|
|
|
|
|
|
|
#include <memory.h> |
|
|
|
|
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+# include <gnutls/crypto.h> |
|
|
|
+# include <gnutls/crypto.h> |
|
|
|
+#endif |
|
|
|
+#endif |
|
|
|
+ |
|
|
|
+ |
|
|
|
#include <qpdf/BufferInputSource.hh> |
|
|
|
#include <qpdf/QTC.hh> |
|
|
|
#include <qpdf/FileInputSource.hh> |
|
|
|
#include <qpdf/QUtil.hh> |
|
|
|
#include <qpdf/OffsetInputSource.hh> |
|
|
|
#include <qpdf/Pipeline.hh> |
|
|
|
@@ -250,14 +254,26 @@ void |
|
|
|
@@ -262,7 +266,13 @@ QPDF::processFile(char const* filename, char const* password) |
|
|
|
QPDF::processFile(char const* filename, char const* password) |
|
|
|
|
|
|
|
{ |
|
|
|
{ |
|
|
|
auto* fi = new FileInputSource(filename); |
|
|
|
FileInputSource* fi = new FileInputSource(); |
|
|
|
|
|
|
|
fi->setFilename(filename); |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE(); |
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE(); |
|
|
|
+#endif |
|
|
|
+#endif |
|
|
|
processInputSource(std::shared_ptr<InputSource>(fi), password); |
|
|
|
processInputSource(fi, password); |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE(); |
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE(); |
|
|
|
+#endif |
|
|
|
+#endif |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
void |
|
|
|
void |
|
|
|
QPDF::processFile(char const* description, FILE* filep, bool close_file, char const* password) |
|
|
|
@@ -271,7 +281,13 @@ QPDF::processFile(char const* description, FILE* filep, |
|
|
|
{ |
|
|
|
{ |
|
|
|
auto* fi = new FileInputSource(description, filep, close_file); |
|
|
|
FileInputSource* fi = new FileInputSource(); |
|
|
|
|
|
|
|
fi->setFile(description, filep, close_file); |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE(); |
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE(); |
|
|
|
+#endif |
|
|
|
+#endif |
|
|
|
processInputSource(std::shared_ptr<InputSource>(fi), password); |
|
|
|
processInputSource(fi, password); |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE(); |
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE(); |
|
|
|
+#endif |
|
|
|
+#endif |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
void |
|
|
|
void |
|
|
|
diff -up qpdf-11.7.0/libqpdf/QPDF_encryption.cc.relax qpdf-11.7.0/libqpdf/QPDF_encryption.cc |
|
|
|
diff --git a/libqpdf/QPDFWriter.cc b/libqpdf/QPDFWriter.cc |
|
|
|
--- qpdf-11.7.0/libqpdf/QPDF_encryption.cc.relax 2023-12-24 13:36:07.000000000 +0100 |
|
|
|
index 689fef7..57df1eb 100644 |
|
|
|
+++ qpdf-11.7.0/libqpdf/QPDF_encryption.cc 2024-01-08 15:19:52.303117277 +0100 |
|
|
|
--- a/libqpdf/QPDFWriter.cc |
|
|
|
@@ -3,6 +3,8 @@ |
|
|
|
+++ b/libqpdf/QPDFWriter.cc |
|
|
|
|
|
|
|
@@ -24,6 +24,10 @@ |
|
|
|
|
|
|
|
#include <algorithm> |
|
|
|
|
|
|
|
#include <stdlib.h> |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
|
|
|
|
+#include <gnutls/crypto.h> |
|
|
|
|
|
|
|
+#endif |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
QPDFWriter::Members::Members(QPDF& pdf) : |
|
|
|
|
|
|
|
pdf(pdf), |
|
|
|
|
|
|
|
filename("unspecified"), |
|
|
|
|
|
|
|
@@ -321,6 +325,13 @@ void |
|
|
|
|
|
|
|
QPDFWriter::setDeterministicID(bool val) |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
this->m->deterministic_id = val; |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
|
|
|
|
+ if (val) |
|
|
|
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE(); |
|
|
|
|
|
|
|
+ else |
|
|
|
|
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE(); |
|
|
|
|
|
|
|
+#endif |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
void |
|
|
|
|
|
|
|
@@ -342,6 +353,13 @@ void |
|
|
|
|
|
|
|
QPDFWriter::setPreserveEncryption(bool val) |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
this->m->preserve_encryption = val; |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
|
|
|
|
+ if (val) |
|
|
|
|
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE(); |
|
|
|
|
|
|
|
+ else |
|
|
|
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE(); |
|
|
|
|
|
|
|
+#endif |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
void |
|
|
|
|
|
|
|
@@ -2301,12 +2319,23 @@ QPDFWriter::generateID() |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
|
|
|
|
+ unsigned oldmode = gnutls_fips140_mode_enabled(); |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD); |
|
|
|
|
|
|
|
+#endif |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
MD5 m; |
|
|
|
|
|
|
|
m.encodeString(seed.c_str()); |
|
|
|
|
|
|
|
MD5::Digest digest; |
|
|
|
|
|
|
|
m.digest(digest); |
|
|
|
|
|
|
|
result = std::string(reinterpret_cast<char*>(digest), |
|
|
|
|
|
|
|
sizeof(MD5::Digest)); |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
|
|
|
|
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD); |
|
|
|
|
|
|
|
+#endif |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
#include <qpdf/assert_debug.h> |
|
|
|
// If /ID already exists, follow the spec: use the original first |
|
|
|
|
|
|
|
diff --git a/libqpdf/QPDF_encryption.cc b/libqpdf/QPDF_encryption.cc |
|
|
|
|
|
|
|
index 2ff48df..ce6fb31 100644 |
|
|
|
|
|
|
|
--- a/libqpdf/QPDF_encryption.cc |
|
|
|
|
|
|
|
+++ b/libqpdf/QPDF_encryption.cc |
|
|
|
|
|
|
|
@@ -1,6 +1,8 @@ |
|
|
|
|
|
|
|
// This file implements methods from the QPDF class that involve |
|
|
|
|
|
|
|
// encryption. |
|
|
|
|
|
|
|
|
|
|
|
+#include <qpdf/qpdf-config.h> |
|
|
|
+#include <qpdf/qpdf-config.h> |
|
|
|
+ |
|
|
|
+ |
|
|
|
#include <qpdf/QPDF.hh> |
|
|
|
#include <qpdf/QPDF.hh> |
|
|
|
|
|
|
|
|
|
|
|
#include <qpdf/QPDFExc.hh> |
|
|
|
#include <qpdf/QPDFExc.hh> |
|
|
|
@@ -19,6 +21,10 @@ |
|
|
|
@@ -18,6 +20,10 @@ |
|
|
|
#include <algorithm> |
|
|
|
#include <assert.h> |
|
|
|
#include <cstring> |
|
|
|
#include <string.h> |
|
|
|
|
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+# include <gnutls/crypto.h> |
|
|
|
+# include <gnutls/crypto.h> |
|
|
|
+#endif |
|
|
|
+#endif |
|
|
|
+ |
|
|
|
+ |
|
|
|
static unsigned char const padding_string[] = { |
|
|
|
static unsigned char const padding_string[] = { |
|
|
|
0x28, 0xbf, 0x4e, 0x5e, 0x4e, 0x75, 0x8a, 0x41, 0x64, 0x00, 0x4e, 0x56, 0xff, 0xfa, 0x01, 0x08, |
|
|
|
0x28, 0xbf, 0x4e, 0x5e, 0x4e, 0x75, 0x8a, 0x41, |
|
|
|
0x2e, 0x2e, 0x00, 0xb6, 0xd0, 0x68, 0x3e, 0x80, 0x2f, 0x0c, 0xa9, 0xfe, 0x64, 0x53, 0x69, 0x7a}; |
|
|
|
0x64, 0x00, 0x4e, 0x56, 0xff, 0xfa, 0x01, 0x08, |
|
|
|
@@ -349,10 +355,21 @@ QPDF::compute_data_key( |
|
|
|
@@ -380,10 +386,21 @@ QPDF::compute_data_key(std::string const& encryption_key, |
|
|
|
result += "sAlT"; |
|
|
|
result += "sAlT"; |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
@ -81,12 +151,12 @@ diff -up qpdf-11.7.0/libqpdf/QPDF_encryption.cc.relax qpdf-11.7.0/libqpdf/QPDF_e |
|
|
|
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD); |
|
|
|
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD); |
|
|
|
+#endif |
|
|
|
+#endif |
|
|
|
+ |
|
|
|
+ |
|
|
|
return {reinterpret_cast<char*>(digest), std::min(result.length(), toS(16))}; |
|
|
|
return std::string(reinterpret_cast<char*>(digest), |
|
|
|
|
|
|
|
std::min(result.length(), toS(16))); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
@@ -1150,6 +1167,12 @@ QPDF::getKeyForObject( |
|
|
|
@@ -976,6 +993,12 @@ QPDF::getKeyForObject( |
|
|
|
|
|
|
|
void |
|
|
|
void |
|
|
|
QPDF::decryptString(std::string& str, QPDFObjGen const& og) |
|
|
|
QPDF::decryptString(std::string& str, int objid, int generation) |
|
|
|
{ |
|
|
|
{ |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+ unsigned oldmode = gnutls_fips140_mode_enabled(); |
|
|
|
+ unsigned oldmode = gnutls_fips140_mode_enabled(); |
|
|
@ -94,12 +164,12 @@ diff -up qpdf-11.7.0/libqpdf/QPDF_encryption.cc.relax qpdf-11.7.0/libqpdf/QPDF_e |
|
|
|
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD); |
|
|
|
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD); |
|
|
|
+#endif |
|
|
|
+#endif |
|
|
|
+ |
|
|
|
+ |
|
|
|
if (!og.isIndirect()) { |
|
|
|
if (objid == 0) |
|
|
|
|
|
|
|
{ |
|
|
|
return; |
|
|
|
return; |
|
|
|
} |
|
|
|
@@ -1230,6 +1253,10 @@ QPDF::decryptString(std::string& str, int objid, int generation) |
|
|
|
@@ -1036,6 +1059,10 @@ QPDF::decryptString(std::string& str, QP |
|
|
|
QUtil::int_to_string(objid) + " " + |
|
|
|
} catch (std::runtime_error& e) { |
|
|
|
QUtil::int_to_string(generation) + ": " + e.what()); |
|
|
|
throw damagedPDF("error decrypting string for object " + og.unparse() + ": " + e.what()); |
|
|
|
|
|
|
|
} |
|
|
|
} |
|
|
|
+ |
|
|
|
+ |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
@ -107,10 +177,10 @@ diff -up qpdf-11.7.0/libqpdf/QPDF_encryption.cc.relax qpdf-11.7.0/libqpdf/QPDF_e |
|
|
|
+#endif |
|
|
|
+#endif |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
// Prepend a decryption pipeline to 'pipeline'. The decryption pipeline (returned as |
|
|
|
void |
|
|
|
@@ -1051,6 +1078,12 @@ QPDF::decryptStream( |
|
|
|
@@ -1240,6 +1267,12 @@ QPDF::decryptStream(PointerHolder<EncryptionParameters> encp, |
|
|
|
QPDFObjectHandle& stream_dict, |
|
|
|
QPDFObjectHandle& stream_dict, |
|
|
|
std::unique_ptr<Pipeline>& decrypt_pipeline) |
|
|
|
std::vector<PointerHolder<Pipeline> >& heap) |
|
|
|
{ |
|
|
|
{ |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+ unsigned oldmode = gnutls_fips140_mode_enabled(); |
|
|
|
+ unsigned oldmode = gnutls_fips140_mode_enabled(); |
|
|
@ -119,12 +189,12 @@ diff -up qpdf-11.7.0/libqpdf/QPDF_encryption.cc.relax qpdf-11.7.0/libqpdf/QPDF_e |
|
|
|
+#endif |
|
|
|
+#endif |
|
|
|
+ |
|
|
|
+ |
|
|
|
std::string type; |
|
|
|
std::string type; |
|
|
|
if (stream_dict.getKey("/Type").isName()) { |
|
|
|
if (stream_dict.getKey("/Type").isName()) |
|
|
|
type = stream_dict.getKey("/Type").getName(); |
|
|
|
{ |
|
|
|
@@ -1151,6 +1184,10 @@ QPDF::decryptStream( |
|
|
|
@@ -1361,6 +1394,10 @@ QPDF::decryptStream(PointerHolder<EncryptionParameters> encp, |
|
|
|
toI(key.length())); |
|
|
|
toI(key.length())); |
|
|
|
} |
|
|
|
} |
|
|
|
pipeline = decrypt_pipeline.get(); |
|
|
|
heap.push_back(pipeline); |
|
|
|
+ |
|
|
|
+ |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD); |
|
|
|
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD); |
|
|
@ -132,67 +202,3 @@ diff -up qpdf-11.7.0/libqpdf/QPDF_encryption.cc.relax qpdf-11.7.0/libqpdf/QPDF_e |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
void |
|
|
|
void |
|
|
|
diff -up qpdf-11.7.0/libqpdf/QPDFWriter.cc.relax qpdf-11.7.0/libqpdf/QPDFWriter.cc |
|
|
|
|
|
|
|
--- qpdf-11.7.0/libqpdf/QPDFWriter.cc.relax 2023-12-24 13:36:07.000000000 +0100 |
|
|
|
|
|
|
|
+++ qpdf-11.7.0/libqpdf/QPDFWriter.cc 2024-01-08 15:17:27.022951614 +0100 |
|
|
|
|
|
|
|
@@ -26,6 +26,10 @@ |
|
|
|
|
|
|
|
#include <cstdlib> |
|
|
|
|
|
|
|
#include <stdexcept> |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
|
|
|
|
+#include <gnutls/crypto.h> |
|
|
|
|
|
|
|
+#endif |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
QPDFWriter::ProgressReporter::~ProgressReporter() // NOLINT (modernize-use-equals-default) |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
// Must be explicit and not inline -- see QPDF_DLL_CLASS in README-maintainer |
|
|
|
|
|
|
|
@@ -287,6 +291,13 @@ void |
|
|
|
|
|
|
|
QPDFWriter::setDeterministicID(bool val) |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
m->deterministic_id = val; |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
|
|
|
|
+ if (val) |
|
|
|
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE(); |
|
|
|
|
|
|
|
+ else |
|
|
|
|
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE(); |
|
|
|
|
|
|
|
+#endif |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
void |
|
|
|
|
|
|
|
@@ -307,6 +318,13 @@ void |
|
|
|
|
|
|
|
QPDFWriter::setPreserveEncryption(bool val) |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
m->preserve_encryption = val; |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
|
|
|
|
+ if (val) |
|
|
|
|
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE(); |
|
|
|
|
|
|
|
+ else |
|
|
|
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE(); |
|
|
|
|
|
|
|
+#endif |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
void |
|
|
|
|
|
|
|
@@ -1890,11 +1908,21 @@ QPDFWriter::generateID() |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
|
|
|
|
+ unsigned oldmode = gnutls_fips140_mode_enabled(); |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD); |
|
|
|
|
|
|
|
+#endif |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
MD5 m; |
|
|
|
|
|
|
|
m.encodeString(seed.c_str()); |
|
|
|
|
|
|
|
MD5::Digest digest; |
|
|
|
|
|
|
|
m.digest(digest); |
|
|
|
|
|
|
|
result = std::string(reinterpret_cast<char*>(digest), sizeof(MD5::Digest)); |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS |
|
|
|
|
|
|
|
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD); |
|
|
|
|
|
|
|
+#endif |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// If /ID already exists, follow the spec: use the original first word and generate a new second |
|
|
|
|
|
|
|