|
|
|
|
@ -1,138 +1,68 @@
|
|
|
|
|
diff --git a/libqpdf/QPDF.cc b/libqpdf/QPDF.cc
|
|
|
|
|
index 3eeea86..2a6923c 100644
|
|
|
|
|
--- a/libqpdf/QPDF.cc
|
|
|
|
|
+++ b/libqpdf/QPDF.cc
|
|
|
|
|
@@ -11,6 +11,10 @@
|
|
|
|
|
#include <string.h>
|
|
|
|
|
#include <memory.h>
|
|
|
|
|
diff -up qpdf-11.7.0/libqpdf/QPDF.cc.relax qpdf-11.7.0/libqpdf/QPDF.cc
|
|
|
|
|
--- qpdf-11.7.0/libqpdf/QPDF.cc.relax 2023-12-24 13:36:07.000000000 +0100
|
|
|
|
|
+++ qpdf-11.7.0/libqpdf/QPDF.cc 2024-01-08 15:17:27.020951639 +0100
|
|
|
|
|
@@ -13,6 +13,10 @@
|
|
|
|
|
#include <sstream>
|
|
|
|
|
#include <vector>
|
|
|
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+# include <gnutls/crypto.h>
|
|
|
|
|
+#endif
|
|
|
|
|
+
|
|
|
|
|
#include <qpdf/QTC.hh>
|
|
|
|
|
#include <qpdf/QUtil.hh>
|
|
|
|
|
#include <qpdf/Pipeline.hh>
|
|
|
|
|
@@ -262,7 +266,13 @@ QPDF::processFile(char const* filename, char const* password)
|
|
|
|
|
#include <qpdf/BufferInputSource.hh>
|
|
|
|
|
#include <qpdf/FileInputSource.hh>
|
|
|
|
|
#include <qpdf/OffsetInputSource.hh>
|
|
|
|
|
@@ -250,14 +254,26 @@ void
|
|
|
|
|
QPDF::processFile(char const* filename, char const* password)
|
|
|
|
|
{
|
|
|
|
|
FileInputSource* fi = new FileInputSource();
|
|
|
|
|
fi->setFilename(filename);
|
|
|
|
|
auto* fi = new FileInputSource(filename);
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
|
|
|
+#endif
|
|
|
|
|
processInputSource(fi, password);
|
|
|
|
|
processInputSource(std::shared_ptr<InputSource>(fi), password);
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
|
|
|
+#endif
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
@@ -271,7 +281,13 @@ QPDF::processFile(char const* description, FILE* filep,
|
|
|
|
|
QPDF::processFile(char const* description, FILE* filep, bool close_file, char const* password)
|
|
|
|
|
{
|
|
|
|
|
FileInputSource* fi = new FileInputSource();
|
|
|
|
|
fi->setFile(description, filep, close_file);
|
|
|
|
|
auto* fi = new FileInputSource(description, filep, close_file);
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
|
|
|
+#endif
|
|
|
|
|
processInputSource(fi, password);
|
|
|
|
|
processInputSource(std::shared_ptr<InputSource>(fi), password);
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
|
|
|
+#endif
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
diff --git a/libqpdf/QPDFWriter.cc b/libqpdf/QPDFWriter.cc
|
|
|
|
|
index 689fef7..57df1eb 100644
|
|
|
|
|
--- a/libqpdf/QPDFWriter.cc
|
|
|
|
|
+++ b/libqpdf/QPDFWriter.cc
|
|
|
|
|
@@ -24,6 +24,10 @@
|
|
|
|
|
#include <algorithm>
|
|
|
|
|
#include <stdlib.h>
|
|
|
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+#include <gnutls/crypto.h>
|
|
|
|
|
+#endif
|
|
|
|
|
+
|
|
|
|
|
QPDFWriter::Members::Members(QPDF& pdf) :
|
|
|
|
|
pdf(pdf),
|
|
|
|
|
filename("unspecified"),
|
|
|
|
|
@@ -321,6 +325,13 @@ void
|
|
|
|
|
QPDFWriter::setDeterministicID(bool val)
|
|
|
|
|
{
|
|
|
|
|
this->m->deterministic_id = val;
|
|
|
|
|
+
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ if (val)
|
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
|
|
|
+ else
|
|
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
|
|
|
+#endif
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
@@ -342,6 +353,13 @@ void
|
|
|
|
|
QPDFWriter::setPreserveEncryption(bool val)
|
|
|
|
|
{
|
|
|
|
|
this->m->preserve_encryption = val;
|
|
|
|
|
+
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ if (val)
|
|
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
|
|
|
+ else
|
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
|
|
|
+#endif
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
@@ -2301,12 +2319,23 @@ QPDFWriter::generateID()
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ unsigned oldmode = gnutls_fips140_mode_enabled();
|
|
|
|
|
+
|
|
|
|
|
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
|
|
+#endif
|
|
|
|
|
+
|
|
|
|
|
MD5 m;
|
|
|
|
|
m.encodeString(seed.c_str());
|
|
|
|
|
MD5::Digest digest;
|
|
|
|
|
m.digest(digest);
|
|
|
|
|
result = std::string(reinterpret_cast<char*>(digest),
|
|
|
|
|
sizeof(MD5::Digest));
|
|
|
|
|
+
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
|
|
+#endif
|
|
|
|
|
+
|
|
|
|
|
}
|
|
|
|
|
diff -up qpdf-11.7.0/libqpdf/QPDF_encryption.cc.relax qpdf-11.7.0/libqpdf/QPDF_encryption.cc
|
|
|
|
|
--- qpdf-11.7.0/libqpdf/QPDF_encryption.cc.relax 2023-12-24 13:36:07.000000000 +0100
|
|
|
|
|
+++ qpdf-11.7.0/libqpdf/QPDF_encryption.cc 2024-01-08 15:19:52.303117277 +0100
|
|
|
|
|
@@ -3,6 +3,8 @@
|
|
|
|
|
|
|
|
|
|
// If /ID already exists, follow the spec: use the original first
|
|
|
|
|
diff --git a/libqpdf/QPDF_encryption.cc b/libqpdf/QPDF_encryption.cc
|
|
|
|
|
index 2ff48df..ce6fb31 100644
|
|
|
|
|
--- a/libqpdf/QPDF_encryption.cc
|
|
|
|
|
+++ b/libqpdf/QPDF_encryption.cc
|
|
|
|
|
@@ -1,6 +1,8 @@
|
|
|
|
|
// This file implements methods from the QPDF class that involve
|
|
|
|
|
// encryption.
|
|
|
|
|
#include <qpdf/assert_debug.h>
|
|
|
|
|
|
|
|
|
|
+#include <qpdf/qpdf-config.h>
|
|
|
|
|
+
|
|
|
|
|
#include <qpdf/QPDF.hh>
|
|
|
|
|
|
|
|
|
|
#include <qpdf/QPDFExc.hh>
|
|
|
|
|
@@ -18,6 +20,10 @@
|
|
|
|
|
#include <assert.h>
|
|
|
|
|
#include <string.h>
|
|
|
|
|
@@ -19,6 +21,10 @@
|
|
|
|
|
#include <algorithm>
|
|
|
|
|
#include <cstring>
|
|
|
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+# include <gnutls/crypto.h>
|
|
|
|
|
+#endif
|
|
|
|
|
+
|
|
|
|
|
static unsigned char const padding_string[] = {
|
|
|
|
|
0x28, 0xbf, 0x4e, 0x5e, 0x4e, 0x75, 0x8a, 0x41,
|
|
|
|
|
0x64, 0x00, 0x4e, 0x56, 0xff, 0xfa, 0x01, 0x08,
|
|
|
|
|
@@ -380,10 +386,21 @@ QPDF::compute_data_key(std::string const& encryption_key,
|
|
|
|
|
0x28, 0xbf, 0x4e, 0x5e, 0x4e, 0x75, 0x8a, 0x41, 0x64, 0x00, 0x4e, 0x56, 0xff, 0xfa, 0x01, 0x08,
|
|
|
|
|
0x2e, 0x2e, 0x00, 0xb6, 0xd0, 0x68, 0x3e, 0x80, 0x2f, 0x0c, 0xa9, 0xfe, 0x64, 0x53, 0x69, 0x7a};
|
|
|
|
|
@@ -349,10 +355,21 @@ QPDF::compute_data_key(
|
|
|
|
|
result += "sAlT";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@ -151,12 +81,12 @@ index 2ff48df..ce6fb31 100644
|
|
|
|
|
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
|
|
+#endif
|
|
|
|
|
+
|
|
|
|
|
return std::string(reinterpret_cast<char*>(digest),
|
|
|
|
|
std::min(result.length(), toS(16)));
|
|
|
|
|
return {reinterpret_cast<char*>(digest), std::min(result.length(), toS(16))};
|
|
|
|
|
}
|
|
|
|
|
@@ -1150,6 +1167,12 @@ QPDF::getKeyForObject(
|
|
|
|
|
|
|
|
|
|
@@ -976,6 +993,12 @@ QPDF::getKeyForObject(
|
|
|
|
|
void
|
|
|
|
|
QPDF::decryptString(std::string& str, int objid, int generation)
|
|
|
|
|
QPDF::decryptString(std::string& str, QPDFObjGen const& og)
|
|
|
|
|
{
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ unsigned oldmode = gnutls_fips140_mode_enabled();
|
|
|
|
|
@ -164,12 +94,12 @@ index 2ff48df..ce6fb31 100644
|
|
|
|
|
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
|
|
+#endif
|
|
|
|
|
+
|
|
|
|
|
if (objid == 0)
|
|
|
|
|
{
|
|
|
|
|
if (!og.isIndirect()) {
|
|
|
|
|
return;
|
|
|
|
|
@@ -1230,6 +1253,10 @@ QPDF::decryptString(std::string& str, int objid, int generation)
|
|
|
|
|
QUtil::int_to_string(objid) + " " +
|
|
|
|
|
QUtil::int_to_string(generation) + ": " + e.what());
|
|
|
|
|
}
|
|
|
|
|
@@ -1036,6 +1059,10 @@ QPDF::decryptString(std::string& str, QP
|
|
|
|
|
} catch (std::runtime_error& e) {
|
|
|
|
|
throw damagedPDF("error decrypting string for object " + og.unparse() + ": " + e.what());
|
|
|
|
|
}
|
|
|
|
|
+
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
@ -177,10 +107,10 @@ index 2ff48df..ce6fb31 100644
|
|
|
|
|
+#endif
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
@@ -1240,6 +1267,12 @@ QPDF::decryptStream(PointerHolder<EncryptionParameters> encp,
|
|
|
|
|
// Prepend a decryption pipeline to 'pipeline'. The decryption pipeline (returned as
|
|
|
|
|
@@ -1051,6 +1078,12 @@ QPDF::decryptStream(
|
|
|
|
|
QPDFObjectHandle& stream_dict,
|
|
|
|
|
std::vector<PointerHolder<Pipeline> >& heap)
|
|
|
|
|
std::unique_ptr<Pipeline>& decrypt_pipeline)
|
|
|
|
|
{
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ unsigned oldmode = gnutls_fips140_mode_enabled();
|
|
|
|
|
@ -189,12 +119,12 @@ index 2ff48df..ce6fb31 100644
|
|
|
|
|
+#endif
|
|
|
|
|
+
|
|
|
|
|
std::string type;
|
|
|
|
|
if (stream_dict.getKey("/Type").isName())
|
|
|
|
|
{
|
|
|
|
|
@@ -1361,6 +1394,10 @@ QPDF::decryptStream(PointerHolder<EncryptionParameters> encp,
|
|
|
|
|
if (stream_dict.getKey("/Type").isName()) {
|
|
|
|
|
type = stream_dict.getKey("/Type").getName();
|
|
|
|
|
@@ -1151,6 +1184,10 @@ QPDF::decryptStream(
|
|
|
|
|
toI(key.length()));
|
|
|
|
|
}
|
|
|
|
|
heap.push_back(pipeline);
|
|
|
|
|
pipeline = decrypt_pipeline.get();
|
|
|
|
|
+
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
|
|
@ -202,3 +132,67 @@ index 2ff48df..ce6fb31 100644
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
diff -up qpdf-11.7.0/libqpdf/QPDFWriter.cc.relax qpdf-11.7.0/libqpdf/QPDFWriter.cc
|
|
|
|
|
--- qpdf-11.7.0/libqpdf/QPDFWriter.cc.relax 2023-12-24 13:36:07.000000000 +0100
|
|
|
|
|
+++ qpdf-11.7.0/libqpdf/QPDFWriter.cc 2024-01-08 15:17:27.022951614 +0100
|
|
|
|
|
@@ -26,6 +26,10 @@
|
|
|
|
|
#include <cstdlib>
|
|
|
|
|
#include <stdexcept>
|
|
|
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+#include <gnutls/crypto.h>
|
|
|
|
|
+#endif
|
|
|
|
|
+
|
|
|
|
|
QPDFWriter::ProgressReporter::~ProgressReporter() // NOLINT (modernize-use-equals-default)
|
|
|
|
|
{
|
|
|
|
|
// Must be explicit and not inline -- see QPDF_DLL_CLASS in README-maintainer
|
|
|
|
|
@@ -287,6 +291,13 @@ void
|
|
|
|
|
QPDFWriter::setDeterministicID(bool val)
|
|
|
|
|
{
|
|
|
|
|
m->deterministic_id = val;
|
|
|
|
|
+
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ if (val)
|
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
|
|
|
+ else
|
|
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
|
|
|
+#endif
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
@@ -307,6 +318,13 @@ void
|
|
|
|
|
QPDFWriter::setPreserveEncryption(bool val)
|
|
|
|
|
{
|
|
|
|
|
m->preserve_encryption = val;
|
|
|
|
|
+
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ if (val)
|
|
|
|
|
+ GNUTLS_FIPS140_SET_STRICT_MODE();
|
|
|
|
|
+ else
|
|
|
|
|
+ GNUTLS_FIPS140_SET_LAX_MODE();
|
|
|
|
|
+#endif
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
@@ -1890,11 +1908,21 @@ QPDFWriter::generateID()
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ unsigned oldmode = gnutls_fips140_mode_enabled();
|
|
|
|
|
+
|
|
|
|
|
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
|
|
+#endif
|
|
|
|
|
+
|
|
|
|
|
MD5 m;
|
|
|
|
|
m.encodeString(seed.c_str());
|
|
|
|
|
MD5::Digest digest;
|
|
|
|
|
m.digest(digest);
|
|
|
|
|
result = std::string(reinterpret_cast<char*>(digest), sizeof(MD5::Digest));
|
|
|
|
|
+
|
|
|
|
|
+#ifdef USE_CRYPTO_GNUTLS
|
|
|
|
|
+ gnutls_fips140_set_mode(static_cast<gnutls_fips_mode_t>(oldmode), GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
|
|
|
+#endif
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// If /ID already exists, follow the spec: use the original first word and generate a new second
|
|
|
|
|
|
