From eb05922cd1d3b60cfbc2c92c0fecf65677f40a1b Mon Sep 17 00:00:00 2001 From: csoler Date: Fri, 17 Jun 2016 22:21:06 -0400 Subject: [PATCH] added a tooltip and read color for unsecure GXS identities. These are still supported for a few weeks at most. So get rid of them --- libretroshare/src/gxs/gxssecurity.cc | 30 ++++++++++++---- libretroshare/src/gxs/gxssecurity.h | 1 + libretroshare/src/retroshare/rsidentity.h | 1 + libretroshare/src/services/p3idservice.cc | 4 +++ retroshare-gui/src/gui/Identity/IdDialog.cpp | 38 +++++++++++++------- 5 files changed, 56 insertions(+), 18 deletions(-) diff --git a/libretroshare/src/gxs/gxssecurity.cc b/libretroshare/src/gxs/gxssecurity.cc index bb5607432..a1de27d89 100644 --- a/libretroshare/src/gxs/gxssecurity.cc +++ b/libretroshare/src/gxs/gxssecurity.cc @@ -122,6 +122,14 @@ static void setRSAPrivateKeyData(RsTlvPrivateRSAKey& key, RSA *rsa_priv) free(data) ; } +bool GxsSecurity::checkFingerprint(const RsTlvPublicRSAKey& key) +{ + RSA *rsa_pub = ::extractPublicKey(key) ; + bool res = (key.keyId == getRsaKeyFingerprint(rsa_pub)) ; + RSA_free(rsa_pub) ; + return res ; +} + bool GxsSecurity::checkPrivateKey(const RsTlvPrivateRSAKey& key) { #ifdef GXS_SECURITY_DEBUG @@ -152,22 +160,29 @@ bool GxsSecurity::checkPrivateKey(const RsTlvPrivateRSAKey& key) if(recomputed_key_id != key.keyId) { - std::cerr << "(WW) GxsSecurity::checkPrivateKey(): key " << key.keyId << " has wrong fingerprint " << recomputed_key_id << std::endl; - if(key.keyId == getRsaKeyFingerprint_old_insecure_method(rsa_pub)) { - std::cerr << "(WW) fingerprint was derived using old---insecure---format. It can be faked easily. You should get rid of it!" << std::endl; +#ifdef GXS_SECURITY_DEBUG + std::cerr << "(WW) fingerprint of key " << key.keyId << " was derived using old---insecure---format. It can be faked easily. You should get rid of this key!" << std::endl; +#endif RSA_free(rsa_pub) ; + + // The policy is to *accept* these private keys, but the public key that corresponds will be rejected anyway, as it can easily be faked. return true ; } - - RSA_free(rsa_pub) ; - return false ; + else + { + std::cerr << "(WW) GxsSecurity::checkPrivateKey(): key " << key.keyId << " has wrong fingerprint " << recomputed_key_id << std::endl; + + RSA_free(rsa_pub) ; + return false ; + } } RSA_free(rsa_pub) ; return true ; } + bool GxsSecurity::checkPublicKey(const RsTlvPublicRSAKey &key) { #ifdef GXS_SECURITY_DEBUG @@ -209,6 +224,9 @@ bool GxsSecurity::checkPublicKey(const RsTlvPublicRSAKey &key) std::cerr << "(WW) fingerprint was derived using old---insecure---format. It can be faked easily." << std::endl; #endif RSA_free(rsa_pub) ; + + // The policy is to accept these public keys, but warn the owner, since they might be fake keys. They will be soon rejected here, by replacing + // the return value by false. return true ; } else diff --git a/libretroshare/src/gxs/gxssecurity.h b/libretroshare/src/gxs/gxssecurity.h index 126c496d1..b19f81302 100644 --- a/libretroshare/src/gxs/gxssecurity.h +++ b/libretroshare/src/gxs/gxssecurity.h @@ -125,6 +125,7 @@ class GxsSecurity static bool checkPublicKey(const RsTlvPublicRSAKey &key); static bool checkPrivateKey(const RsTlvPrivateRSAKey &key); + static bool checkFingerprint(const RsTlvPublicRSAKey& key); // helper function to only check the fingerprint /*! * Adds possibly missing public keys when private keys are present. diff --git a/libretroshare/src/retroshare/rsidentity.h b/libretroshare/src/retroshare/rsidentity.h index 7965da100..e57d43162 100644 --- a/libretroshare/src/retroshare/rsidentity.h +++ b/libretroshare/src/retroshare/rsidentity.h @@ -69,6 +69,7 @@ static const uint32_t RS_IDENTITY_FLAGS_IS_A_CONTACT = 0x0001; static const uint32_t RS_IDENTITY_FLAGS_PGP_LINKED = 0x0002; static const uint32_t RS_IDENTITY_FLAGS_PGP_KNOWN = 0x0004; static const uint32_t RS_IDENTITY_FLAGS_IS_OWN_ID = 0x0008; +static const uint32_t RS_IDENTITY_FLAGS_IS_DEPRECATED= 0x0010; // used to denote keys with deprecated fingerprint format. class GxsReputation { diff --git a/libretroshare/src/services/p3idservice.cc b/libretroshare/src/services/p3idservice.cc index 22fb8da49..d436f07af 100644 --- a/libretroshare/src/services/p3idservice.cc +++ b/libretroshare/src/services/p3idservice.cc @@ -1701,9 +1701,13 @@ void RsGxsIdCache::init(const RsGxsIdGroupItem *item, const RsTlvPublicRSAKey& i { if(!priv_key.checkKey()) std::cerr << "(EE) Private key missing for own identity " << pub_key.keyId << std::endl; + } if(!pub_key.checkKey()) std::cerr << "(EE) Public key missing for identity " << pub_key.keyId << std::endl; + + if(!GxsSecurity::checkFingerprint(pub_key)) + details.mFlags |= RS_IDENTITY_FLAGS_IS_DEPRECATED; /* rest must be retrived from ServiceString */ updateServiceString(item->meta.mServiceString); diff --git a/retroshare-gui/src/gui/Identity/IdDialog.cpp b/retroshare-gui/src/gui/Identity/IdDialog.cpp index 28103738e..120435be1 100644 --- a/retroshare-gui/src/gui/Identity/IdDialog.cpp +++ b/retroshare-gui/src/gui/Identity/IdDialog.cpp @@ -1373,19 +1373,33 @@ bool IdDialog::fillIdListItem(const RsGxsIdGroup& data, QTreeWidgetItem *&item, item->setTextAlignment(RSID_COL_VOTES, Qt::AlignRight); item->setData(RSID_COL_VOTES,Qt::DisplayRole, QString::number(info.mOverallReputationScore - 1.0f,'f',3)); - if(isOwnId) - { - QFont font = item->font(RSID_COL_NICKNAME) ; - font.setBold(true) ; - item->setFont(RSID_COL_NICKNAME,font) ; - item->setFont(RSID_COL_IDTYPE,font) ; - item->setFont(RSID_COL_KEYID,font) ; + if(isOwnId) + { + RsIdentityDetails idd ; + rsIdentity->getIdDetails(RsGxsId(data.mMeta.mGroupId),idd) ; - QString tooltip = tr("This identity is owned by you"); - item->setToolTip(RSID_COL_NICKNAME, tooltip) ; - item->setToolTip(RSID_COL_KEYID, tooltip) ; - item->setToolTip(RSID_COL_IDTYPE, tooltip) ; - } + QFont font = item->font(RSID_COL_NICKNAME) ; + + font.setBold(true) ; + item->setFont(RSID_COL_NICKNAME,font) ; + item->setFont(RSID_COL_IDTYPE,font) ; + item->setFont(RSID_COL_KEYID,font) ; + + QString tooltip = tr("This identity is owned by you"); + + if(idd.mFlags & RS_IDENTITY_FLAGS_IS_DEPRECATED) + { + item->setForeground(RSID_COL_NICKNAME,QBrush(Qt::red)); + item->setForeground(RSID_COL_KEYID,QBrush(Qt::red)); + item->setForeground(RSID_COL_IDTYPE,QBrush(Qt::red)); + + tooltip += tr("\nThis identity has a unsecure fingerprint (It's probably quite old).\nYou should get rid of it now and use a new one.\nThese identities will soon be not supported anymore.") ; + } + + item->setToolTip(RSID_COL_NICKNAME, tooltip) ; + item->setToolTip(RSID_COL_KEYID, tooltip) ; + item->setToolTip(RSID_COL_IDTYPE, tooltip) ; + } QPixmap pixmap ;