+
+get_out:
+ return -1;
+}
+
+/*
+ * If extracting, close any previous stream
+ */
+static bool close_previous_stream(r_ctx &rctx)
+{
+ bool rtn = true;
+
+ /*
+ * If extracting, it was from previous stream, so
+ * close the output file and validate the signature.
+ */
+ if (rctx.extract) {
+ if (rctx.size > 0 && !is_bopen(&rctx.bfd)) {
+ Jmsg0(rctx.jcr, M_ERROR, 0, _("Logic error: output file should be open\n"));
+ Pmsg2(000, "=== logic error size=%d bopen=%d\n", rctx.size,
+ is_bopen(&rctx.bfd));
+ }
+
+ if (rctx.prev_stream != STREAM_ENCRYPTED_SESSION_DATA) {
+ deallocate_cipher(rctx);
+ deallocate_fork_cipher(rctx);
+ }
+
+ if (rctx.jcr->plugin) {
+ plugin_set_attributes(rctx.jcr, rctx.attr, &rctx.bfd);
+ } else {
+ set_attributes(rctx.jcr, rctx.attr, &rctx.bfd);
+ }
+ rctx.extract = false;
+
+ /* Now perform the delayed restore of some specific data streams. */
+ rtn = pop_delayed_data_streams(rctx);
+
+ /* Verify the cryptographic signature, if any */
+ rctx.type = rctx.attr->type;
+ verify_signature(rctx);
+
+ /* Free Signature */
+ free_signature(rctx);
+ free_session(rctx);
+ rctx.jcr->ff->flags = 0;
+ Dmsg0(130, "Stop extracting.\n");
+ } else if (is_bopen(&rctx.bfd)) {
+ Jmsg0(rctx.jcr, M_ERROR, 0, _("Logic error: output file should not be open\n"));
+ Pmsg0(000, "=== logic error !open\n");
+ bclose(&rctx.bfd);
+ }
+
+ return rtn;
+}
+
+/*
+ * In the context of jcr, flush any remaining data from the cipher context,
+ * writing it to bfd.
+ * Return value is true on success, false on failure.
+ */
+bool flush_cipher(r_ctx &rctx, BFILE *bfd, uint64_t *addr, int flags, int32_t stream,
+ RESTORE_CIPHER_CTX *cipher_ctx)
+{
+ JCR *jcr = rctx.jcr;
+ uint32_t decrypted_len = 0;
+ char *wbuf; /* write buffer */
+ uint32_t wsize; /* write size */
+ char ec1[50]; /* Buffer printing huge values */
+ bool second_pass = false;
+
+again:
+ /* Write out the remaining block and free the cipher context */
+ cipher_ctx->buf = check_pool_memory_size(cipher_ctx->buf,
+ cipher_ctx->buf_len + cipher_ctx->block_size);
+
+ if (!crypto_cipher_finalize(cipher_ctx->cipher, (uint8_t *)&cipher_ctx->buf[cipher_ctx->buf_len],
+ &decrypted_len)) {
+ /* Writing out the final, buffered block failed. Shouldn't happen. */
+ Jmsg3(jcr, M_ERROR, 0, _("Decryption error. buf_len=%d decrypt_len=%d on file %s\n"),
+ cipher_ctx->buf_len, decrypted_len, jcr->last_fname);
+ }
+
+ Dmsg2(130, "Flush decrypt len=%d buf_len=%d\n", decrypted_len, cipher_ctx->buf_len);
+ /* If nothing new was decrypted, and our output buffer is empty, return */
+ if (decrypted_len == 0 && cipher_ctx->buf_len == 0) {
+ return true;
+ }
+
+ cipher_ctx->buf_len += decrypted_len;
+
+ unser_crypto_packet_len(cipher_ctx);
+ Dmsg1(500, "Crypto unser block size=%d\n", cipher_ctx->packet_len - CRYPTO_LEN_SIZE);
+ wsize = cipher_ctx->packet_len - CRYPTO_LEN_SIZE;
+ /* Decrypted, possibly decompressed output here. */
+ wbuf = &cipher_ctx->buf[CRYPTO_LEN_SIZE]; /* Skip the block length header */
+ cipher_ctx->buf_len -= cipher_ctx->packet_len;
+ Dmsg2(130, "Encryption writing full block, %u bytes, remaining %u bytes in buffer\n", wsize, cipher_ctx->buf_len);
+
+ if ((flags & FO_SPARSE) || (flags & FO_OFFSETS)) {
+ if (!sparse_data(jcr, bfd, addr, &wbuf, &wsize, flags)) {
+ return false;
+ }
+ }
+
+ if (flags & FO_COMPRESS) {
+ if (!decompress_data(jcr, stream, &wbuf, &wsize)) {
+ return false;
+ }
+ }
+
+ Dmsg0(130, "Call store_data\n");
+ if (!store_data(rctx, wbuf, wsize, (flags & FO_WIN32DECOMP) != 0)) {
+ return false;
+ }
+ jcr->JobBytes += wsize;
+ Dmsg2(130, "Flush write %u bytes, JobBytes=%s\n", wsize, edit_uint64(jcr->JobBytes, ec1));
+
+ /* Move any remaining data to start of buffer. */
+ if (cipher_ctx->buf_len > 0) {
+ Dmsg1(130, "Moving %u buffered bytes to start of buffer\n", cipher_ctx->buf_len);
+ memmove(cipher_ctx->buf, &cipher_ctx->buf[cipher_ctx->packet_len],
+ cipher_ctx->buf_len);
+ }
+ /* The packet was successfully written, reset the length so that the next
+ * packet length may be re-read by unser_crypto_packet_len() */
+ cipher_ctx->packet_len = 0;
+
+ if (cipher_ctx->buf_len >0 && !second_pass) {
+ second_pass = true;
+ goto again;
+ }
+
+ /* Stop decryption */
+ cipher_ctx->buf_len = 0;
+ cipher_ctx->packet_len = 0;
+
+ return true;
+}
+
+static void deallocate_cipher(r_ctx &rctx)
+{
+ /* Flush and deallocate previous stream's cipher context */
+ if (rctx.cipher_ctx.cipher) {
+ flush_cipher(rctx, &rctx.bfd, &rctx.fileAddr, rctx.flags, rctx.comp_stream, &rctx.cipher_ctx);
+ crypto_cipher_free(rctx.cipher_ctx.cipher);
+ rctx.cipher_ctx.cipher = NULL;
+ }
+}
+
+static void deallocate_fork_cipher(r_ctx &rctx)
+{
+
+ /* Flush and deallocate previous stream's fork cipher context */
+ if (rctx.fork_cipher_ctx.cipher) {
+ flush_cipher(rctx, &rctx.forkbfd, &rctx.fork_addr, rctx.fork_flags, rctx.comp_stream, &rctx.fork_cipher_ctx);
+ crypto_cipher_free(rctx.fork_cipher_ctx.cipher);
+ rctx.fork_cipher_ctx.cipher = NULL;
+ }
+}
+
+static void free_signature(r_ctx &rctx)
+{
+ if (rctx.sig) {
+ crypto_sign_free(rctx.sig);
+ rctx.sig = NULL;
+ }
+}
+
+static void free_session(r_ctx &rctx)
+{
+ if (rctx.cs) {
+ crypto_session_free(rctx.cs);
+ rctx.cs = NULL;
+ }
+}
+
+/*
+ * Verify the signature for the last restored file
+ * Return value is either true (signature correct)
+ * or false (signature could not be verified).
+ * TODO landonf: Implement without using find_one_file and
+ * without re-reading the file.
+ */
+static bool verify_signature(r_ctx &rctx)
+{
+ JCR *jcr = rctx.jcr;
+ X509_KEYPAIR *keypair;
+ DIGEST *digest = NULL;
+ crypto_error_t err;
+ uint64_t saved_bytes;
+ crypto_digest_t signing_algorithm = have_sha2 ?
+ CRYPTO_DIGEST_SHA256 : CRYPTO_DIGEST_SHA1;
+ crypto_digest_t algorithm;
+ SIGNATURE *sig = rctx.sig;
+
+
+ if (!jcr->crypto.pki_sign) {
+ /* no signature OK */
+ return true;
+ }
+ if (!sig) {
+ if (rctx.type == FT_REGE || rctx.type == FT_REG || rctx.type == FT_RAW) {
+ Jmsg1(jcr, M_ERROR, 0, _("Missing cryptographic signature for %s\n"),
+ jcr->last_fname);
+ goto get_out;
+ }
+ return true;
+ }
+
+ /* Iterate through the trusted signers */
+ foreach_alist(keypair, jcr->crypto.pki_signers) {
+ err = crypto_sign_get_digest(sig, jcr->crypto.pki_keypair, algorithm, &digest);
+ switch (err) {
+ case CRYPTO_ERROR_NONE:
+ Dmsg0(50, "== Got digest\n");
+ /*
+ * We computed jcr->crypto.digest using signing_algorithm while writing
+ * the file. If it is not the same as the algorithm used for
+ * this file, punt by releasing the computed algorithm and
+ * computing by re-reading the file.
+ */
+ if (algorithm != signing_algorithm) {
+ if (jcr->crypto.digest) {
+ crypto_digest_free(jcr->crypto.digest);
+ jcr->crypto.digest = NULL;
+ }
+ }
+ if (jcr->crypto.digest) {
+ /* Use digest computed while writing the file to verify
+ * the signature */
+ if ((err = crypto_sign_verify(sig, keypair, jcr->crypto.digest)) != CRYPTO_ERROR_NONE) {
+ Dmsg1(50, "Bad signature on %s\n", jcr->last_fname);
+ Jmsg2(jcr, M_ERROR, 0, _("Signature validation failed for file %s: ERR=%s\n"),
+ jcr->last_fname, crypto_strerror(err));
+ goto get_out;
+ }
+ } else {
+ /* Signature found, digest allocated. Old method,
+ * re-read the file and compute the digest */
+ jcr->crypto.digest = digest;
+
+ /* Checksum the entire file
+ * Make sure we don't modify JobBytes by saving and
+ * restoring it */
+ saved_bytes = jcr->JobBytes;
+ if (find_one_file(jcr, jcr->ff, do_file_digest, jcr->last_fname, (dev_t)-1, 1) != 0) {
+ Jmsg(jcr, M_ERROR, 0, _("Digest one file failed for file: %s\n"),
+ jcr->last_fname);
+ jcr->JobBytes = saved_bytes;
+ goto get_out;
+ }
+ jcr->JobBytes = saved_bytes;
+
+ /* Verify the signature */
+ if ((err = crypto_sign_verify(sig, keypair, digest)) != CRYPTO_ERROR_NONE) {
+ Dmsg1(50, "Bad signature on %s\n", jcr->last_fname);
+ Jmsg2(jcr, M_ERROR, 0, _("Signature validation failed for file %s: ERR=%s\n"),
+ jcr->last_fname, crypto_strerror(err));
+ goto get_out;
+ }
+ jcr->crypto.digest = NULL;
+ }
+
+ /* Valid signature */
+ Dmsg1(50, "Signature good on %s\n", jcr->last_fname);
+ crypto_digest_free(digest);
+ return true;
+
+ case CRYPTO_ERROR_NOSIGNER:
+ /* Signature not found, try again */
+ if (digest) {
+ crypto_digest_free(digest);
+ digest = NULL;
+ }
+ continue;
+ default:
+ /* Something strange happened (that shouldn't happen!)... */
+ Qmsg2(jcr, M_ERROR, 0, _("Signature validation failed for %s: %s\n"), jcr->last_fname, crypto_strerror(err));
+ goto get_out;
+ }
+ }
+
+ /* No signer */
+ Dmsg1(50, "Could not find a valid public key for signature on %s\n", jcr->last_fname);
+
+get_out:
+ if (digest) {
+ crypto_digest_free(digest);
+ }
+ return false;