trunk/Src/wptKeyCache.cpp

/* wptKeyCache.cpp- Caching for the pub- and the secring
 *      Copyright (C) 2001-2006, 2009 Timo Schulz
 *
 * This file is part of WinPT.
 *
 * WinPT is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * WinPT is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 */

#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <windows.h>
#include <stdio.h>
#include <string.h>
#include <ctype.h>
#include <assert.h>
#include <gpgme.h>

#include "wptKeyCache.h"
#include "openpgp.h"
#include "wptNLS.h"
#include "wptErrors.h"
#include "wptW32API.h"
#include "wptGPG.h"
#include "wptTypes.h"
#include "wptCommonCtl.h"
#include "wptContext.h"
#include "wptKeyEdit.h"
#include "wptUTF8.h"


gpgme_error_t parse_keyserver_url (char **r_keyserver, unsigned short *r_port);

/* Attribute list which holds the image data. */
struct attr_list_s {
    struct attr_list_s *next;
    char *fpr;                   /* fingerprint of the key */
    unsigned char *d;            /* actual JPEG data. */
    unsigned long octets;        /* length of the data. */
    unsigned int flags;          /* status of the attribute. */
};
typedef struct attr_list_s *attr_list_t;


static unsigned char*
safe_uchar_alloc (size_t n)
{
    unsigned char *p = new unsigned char[n];
    if (!p)
        BUG (0);
    return p;
}


/* Free attribute list @ctx. */
static void
free_attr_list (attr_list_t ctx)
{
    attr_list_t n;

    while (ctx) {
        n = ctx->next;
        free_if_alloc (ctx->fpr);
        free_if_alloc (ctx->d);
        free_if_alloc (ctx);
        ctx = n;
    }
}
        
/* Parse the attribute list in @fp and store it into @ctx.
   Return value: number of parsed items. */
int
parse_attr_list (FILE *fp, const BYTE *data, DWORD datlen, attr_list_t *ctx)
{
    attr_list_t c, t;
    char buf[512], *p, *buffer;
    int pos, n=0;
    
    *ctx = NULL;
    while (fgets (buf, 511, fp)) {
        if (strstr (buf, "\r\n"))
            buf[strlen (buf)-2]=0;
        if (strstr (buf, "\n"))
            buf[strlen (buf)-1]=0;
        if (strlen (buf) < 2 || !strstr (buf, "ATTRIBUTE"))
            continue;
        buffer = buf+9+10;
        pos = 0;
        c = new attr_list_s;
        if (!c)
            BUG (0);
        memset (c, 0, sizeof *c);

        p = strtok (buffer, " ");
        while (p != NULL) {
            switch (pos) {
            case 0: 
                c->fpr = m_strdup (p);
                break;
                
            case 1:
                c->octets = strtoul (p, NULL, 10);
                break;
                
            case 7:
                c->flags = strtoul (p, NULL, 10);
                break;
                
            default: 
                break;
            }
            pos++;
            p = strtok (NULL, " ");
        }
        if (!*ctx)
            *ctx = c;
        else {
            for (t = *ctx; t->next; t=t->next)
                ;
            t->next = c;
        }
        c->d = safe_uchar_alloc (c->octets);
        memcpy (c->d, data, c->octets);
        data += c->octets;
        datlen -= c->octets;
        n++;
    }
    /*assert (datlen == 0); */
    return n;
}


static int 
parse_attr_data (const char *keyid, attr_list_t *list)
{
    gpgme_error_t err;
    FILE *tmp;    
    BYTE *data;
    char *status, tmpnam[MAX_PATH+1];
    DWORD ndata = 0;

    err = gpg_get_photoid_data (keyid, &status, &data, &ndata);
    if (err)
        return err;

    get_temp_name (tmpnam, MAX_PATH, NULL);
    tmp = fopen (tmpnam, "w+b");
    if (ndata > 0 && tmp != NULL) {
        fwrite (status, 1, strlen (status), tmp);
        fflush (tmp);
        rewind (tmp);
        ndata = parse_attr_list (tmp, data, ndata, list);
    }
    else
        *list = NULL;
    if (tmp != NULL) {
        fclose (tmp);
        DeleteFile (tmpnam);
    }

    safe_free (status);
    safe_free (data);
    return ndata;
}


/* Parse the secret keyring and retrieve some additional information
   for each key which was found. */
static void
parse_secring (gpg_keycache_t cache, const char *kid, const char *secring)
{    
    PACKET *pkt;
    PKT_secret_key *sk;
    gpg_iobuf_t inp;
    gpgme_error_t err;
    gpgme_key_t key;
    struct keycache_s *c=NULL;
    char keyid[16+1]; 

    inp = gpg_iobuf_open (secring);
    if (!inp)
        return;

    gpg_iobuf_ioctl (inp, 3, 1, NULL);
    pkt = (PACKET*)calloc (1, sizeof *pkt);
    if (!pkt)
        BUG (0);
    gpg_init_packet (pkt);
    while (gpg_parse_packet (inp, pkt) != -1) {
        if (pkt->pkttype == PKT_SECRET_KEY) {
            sk = pkt->pkt.secret_key;
            /* XXX: key IDs of card public keys are wrong! */
            _snprintf (keyid, sizeof (keyid)-1, "%08lX",
                       gpg_keyid_from_sk (sk, NULL));
            if (kid && strcmp (kid, keyid) != 0)
                goto next;
            err = gpg_keycache_find_key2 (cache, keyid, 0, &key, &c);
            if (err)
                goto next;
            c->gloflags.is_protected = sk->is_protected;
            c->gloflags.divert_to_card = sk->protect.s2k.mode==1002? 1 : 0;
            if (c->pubpart != NULL) {
                c->pubpart->gloflags.is_protected = sk->is_protected;
                c->pubpart->gloflags.divert_to_card = sk->protect.s2k.mode==1002? 1 : 0;
            }
        }
next:
        gpg_free_packet (pkt);
        gpg_init_packet (pkt);
    }
    safe_free (pkt);
    gpg_iobuf_close (inp);
}


/* Update the photo image of a single key with the fingerprint
   @fpr. The @dat struct contains the new item data. */
static gpgme_error_t
keycache_update_photo (gpg_keycache_t ctx, const char *fpr, attr_list_t dat)
{
    struct keycache_s *fnd = NULL;
    gpgme_key_t key;
    
    gpg_keycache_find_key2 (ctx, fpr, 0, &key, &fnd);
    if (!fnd)
        return gpg_error (GPG_ERR_NOT_FOUND);
    free_if_alloc (fnd->attrib.d);
    fnd->attrib.flags = dat->flags;
    fnd->attrib.len = dat->octets;
    fnd->attrib.d = safe_uchar_alloc (dat->octets);
    memcpy (fnd->attrib.d, dat->d, dat->octets);
    return 0;
}


/* Update all photo images in the cache. */
static gpgme_error_t
keycache_update_photos (gpg_keycache_t ctx)
{
    attr_list_t list=NULL, n;
    DWORD ndata;

    ndata = parse_attr_data (NULL, &list);
    if (ndata < 1) {
        free_attr_list (list);
        return 0;
    }

    for (n=list; n; n=n->next)
        keycache_update_photo (ctx, n->fpr, n);
    free_attr_list (list);
    return 0;
}


void
keycache_decode_uid (struct keycache_s *ctx)
{
    gpgme_user_id_t u;
    struct native_uid_s *n, *t;

    for (u = ctx->key->uids; u; u = u->next) {
        n = new native_uid_s;
        if (!n)
            BUG (0);
        memset (n, 0, sizeof *n);
        if (is_8bit_string (u->uid)) {
            n->malloced = 1;
            n->uid = utf8_to_native (u->uid);
            if (u->name != NULL)
                n->name = utf8_to_native (u->name);
            if (u->email != NULL)
                n->email = m_strdup (u->email);
            if (u->comment != NULL)
                n->comment = utf8_to_native (u->comment);
        }
        else {
            n->malloced = 0;
            n->uid = u->uid;
            n->name = u->name;
            n->comment = u->comment;
            n->email = u->email;
        }
        n->signatures = u->signatures;
        n->validity = u->validity;
        n->revoked = u->revoked;
        if (!ctx->uids) 
            ctx->uids = n;
        else {
            for (t = ctx->uids; t->next; t=t->next)
                ;
            t->next = n;           
        }
    }
}


/* Store utf8 decoded user IDs in the code to avoid in-place decoding. */
static void
keycache_decode_uids (gpg_keycache_t ctx)
{
    struct keycache_s *c;

    for (c = ctx->item; c; c = c->next)
        keycache_decode_uid (c);
}


static void
free_native_uids (struct native_uid_s **r_n)
{
    struct native_uid_s *t;
    struct native_uid_s *n = *r_n;

    while (n != NULL) {
        t = n->next;
        if (n->malloced) {
            free_if_alloc (n->uid);
            free_if_alloc (n->name);
            free_if_alloc (n->comment);
            free_if_alloc (n->email);
        }
        free_if_alloc (n);
        n = t;
    }
    *r_n = NULL;
}


/* Merge the information from the keyrings into the key cache structure. */
static gpgme_error_t
keycache_prepare2 (gpg_keycache_t ctx, const char *kid,
                   const char *pubring, const char *secring)
{
    gpgme_error_t err = gpg_error (GPG_ERR_NO_ERROR);
    gpgme_key_t key = NULL;
    gpg_iobuf_t inp;
    PACKET *pkt;
    struct keycache_s *c;
    const BYTE *sym_prefs;
    char keyid[16+1];
    int key_seen = 0;
    size_t nsym =0;

    if (secring) {
        parse_secring (ctx, kid, secring);
        if (!pubring)
            return 0;
    }
    inp = gpg_iobuf_open (pubring);
    if (!inp)
        return gpg_error (GPG_ERR_KEYRING_OPEN);
    gpg_iobuf_ioctl (inp, 3, 1, NULL); /* disable cache */

    pkt = (PACKET*)calloc (1, sizeof * pkt);
    if (!pkt)
        BUG (0);
    gpg_init_packet (pkt);
    while (gpg_parse_packet (inp, pkt) != -1) {
        if (pkt->pkttype == PKT_PUBLIC_KEY) {
            strcpy (keyid, "");
            key_seen = 1;
        }
        if (pkt->pkttype == PKT_SIGNATURE && 
            pkt->pkt.signature->sig_class == 0x1F) {
            if (pkt->pkt.signature->numrevkeys == 0)
                goto next;
            _snprintf (keyid, sizeof (keyid) -1, "%08X", 
                        pkt->pkt.signature->keyid[1]);
            if (kid && strcmp (kid, keyid) != 0)
                goto next;
            err = gpg_keycache_find_key2 (ctx, keyid, 0, &key, &c);
            if (err)
                goto next;
            c->gloflags.has_desig_rev = 1;
        }
        if (pkt->pkttype == PKT_SIGNATURE && key_seen == 1 && c != NULL) {
            sym_prefs = gpg_parse_sig_subpkt (pkt->pkt.signature->hashed,
                                              SIGSUBPKT_PREF_SYM, &nsym);
            if (!sym_prefs)
                goto next;
            _snprintf (keyid, sizeof (keyid) - 1, "%08X",
                        pkt->pkt.signature->keyid[1]);
            if (kid && strcmp (kid, keyid) != 0)
                goto next;
            err = gpg_keycache_find_key2 (ctx, keyid, 0, &key, &c);
            if (err || !c)
                goto next;
            if (c->sym_prefs) // only use the prefs from the primary uid.
                goto next;
            else if (nsym > 0) {
                c->sym_prefs = safe_uchar_alloc (nsym+1);
                memset (c->sym_prefs, 0, nsym+1);
                memcpy (c->sym_prefs, sym_prefs, nsym);
            }
        }
next:
        gpg_free_packet (pkt);
        gpg_init_packet(pkt);
    }

    safe_free (pkt);
    gpg_iobuf_close (inp);
    return err;
}


gpgme_error_t
gpg_keycache_prepare (gpg_keycache_t ctx, const char *pubr, const char *secr)
{
    return keycache_prepare2 (ctx, NULL, pubr, secr);
}

gpgme_error_t
gpg_keycache_prepare_single (gpg_keycache_t ctx, const char *keyid,
                               const char *pubr, const char *secr)
{
    if (!strncmp (keyid, "0x", 2))
        keyid += 2;   
    return keycache_prepare2 (ctx, keyid, pubr, secr);
}


/* Create new keycache object and return it in @r_ctx.
   Return value: 0 on success. */
gpgme_error_t
gpg_keycache_new (gpg_keycache_t *r_ctx)
{
    gpg_keycache_t ctx;
    
    if (!r_ctx)
        return gpg_error (GPG_ERR_INV_ARG);
    ctx = new gpg_keycache_s;    
    if (!ctx)
        BUG (0);
    memset (ctx, 0, sizeof *ctx);
    ctx->secret = 0;
    ctx->pos = 0;
    *r_ctx = ctx;
    return 0;
}


void
gpg_keycache_item_release (struct keycache_s *c)
{
    if (c->key)
        gpgme_key_release (c->key);     
    c->key = NULL;      
    if (c->rev != NULL)    
        gpg_desig_rev_release (c->rev);
    c->rev = NULL;
    free_if_alloc (c->pref_keyserver);
    free_if_alloc (c->sym_prefs);
    free_if_alloc (c->attrib.d);
    free_if_alloc (c->card_type);
    free_native_uids (&c->uids);
    free_if_alloc (c);
}


/* Release keycache object @ctx. */
void
gpg_keycache_release (gpg_keycache_t ctx)
{
    struct keycache_s *c, *c2;
    
    if (!ctx)
        return;

    for (c = ctx->item; c; c = c2) {
        c2 = c->next;
        gpg_keycache_item_release (c);
    }
    free_if_alloc (ctx);
}


/* Set (progress) callback for the given keycache object.
   @ctx the keycache
   @cb  the callback function
   @cb_value1 opaque value which is passed to the callback.
   @cb_value2 see @cb_value1. */
void
gpg_keycache_set_cb (gpg_keycache_t ctx,
                     void (*cb)(void *, const char *, int, int, int),
                     void * cb_value1, int cb_value2)
{
    if (!ctx)
        return;
    ctx->cb = cb;
    ctx->cb_value = cb_value1;
    ctx->cb_value2 = cb_value2;
}


/* Add @key to the cache @ctx. @opaque return the key cache context as a void*.
   Return value: 0 on success. */
gpgme_error_t
gpg_keycache_add_key (gpg_keycache_t ctx, gpgme_key_t key, void **opaque)
{
    struct keycache_s *c, *n1;
    
    if (!ctx)
        return gpg_error (GPG_ERR_INV_ARG);
    
    c = new keycache_s;
    if (!c)
        BUG (0);
    memset (c, 0, sizeof *c);
    c->gloflags.is_protected = 1; /*default: assume protection. */
    c->key = key;
    if (!ctx->item)
        ctx->item = c;
    else {
        for (n1 = ctx->item; n1 && n1->next; n1 = n1->next)
            ;
        n1->next = c;
    }
    if (opaque)
        *opaque = c;
    return 0;
}


#define has_keyid_len(pattern) (\
    strlen (pattern) == 8  || strlen (pattern) == 10 || \
    strlen (pattern) == 16 || strlen (pattern) == 18)


gpgme_error_t
gpg_keycache_find_key2 (gpg_keycache_t ctx, const char *pattern, int flags,
                        gpgme_key_t *r_key, struct keycache_s **r_item)
{
    struct keycache_s *c;
    gpgme_subkey_t s;
    gpgme_user_id_t u;
    gpgme_key_t key;
    const char *kid;
    
    if (!ctx || !r_key)
        return gpg_error (GPG_ERR_INV_ARG);
    
    if (strstr (pattern, "0x"))
        pattern += 2;

    /* Sometimes a subkey has no valid fpr. As a kludge we convert v4 
       fingerprints into the 64-bit keyid. */
    if (strlen (pattern) == 40 && isxdigit (*pattern))
        pattern += 32;

    /* XXX: this code is very slow, revamp it and use hash tables whenever
            it is possible. */
    for (c = ctx->item; c; c = c->next) {
        key = c->key;
        assert (key->_refs >= 1);
        for (s = key->subkeys; s; s = s->next) {
            for (u = key->uids; u; u = u->next) {
                if (u->name && stristr (u->name, pattern)) {
                    if (r_item)
                        *r_item = c;
                    *r_key = flags? c->pubpart->key : c->key;
                    return 0;
                }
            }
            if (has_keyid_len (pattern))
                kid = s->keyid;
            else
                kid = s->fpr;
            if (kid && stristr (kid, pattern)) {
                if (r_item)
                    *r_item = c;
                *r_key = flags? c->pubpart->key : c->key;
                return 0;
            }
        }
    }
    *r_key = NULL;
    return gpg_error (GPG_ERR_INTERNAL);
}


gpgme_error_t
gpg_keycache_find_key (gpg_keycache_t ctx, const char *pattern,
                       int flags, gpgme_key_t *r_key)
{
    return gpg_keycache_find_key2 (ctx, pattern, flags, r_key, NULL);
}


/* Reload a photo image of a single key with the keyid @keyid.
   Return value: 0 on success. */
static gpgme_error_t
keycache_reload_photo (gpg_keycache_t ctx, const char *keyid)
{
    attr_list_t list;

    if (parse_attr_data (keyid, &list) < 1) {
        free_attr_list (list);
        return 0;
    }
    keycache_update_photo (ctx, list->fpr, list);
    free_attr_list (list);
    return 0;
}


/* Return the next key which was updated. Before it is
   returned the update flag is cleared.
   @r_status is 1 for a new key and 2 for an updated key.
   Return value: 0 on success. */
gpgme_error_t
gpg_keycache_next_updated_key (gpg_keycache_t ctx, 
                               struct keycache_s **r_obj,
                               int *r_status)
{
    struct keycache_s *c;

    for (c = ctx->item; c; c = c->next) {
        if (c->flags != 0) {
            *r_status = c->flags;
            *r_obj = c;
            c->flags = 0; /* reset update flag. */
            return 0;
        }
    }
    return gpg_error (GPG_ERR_NOT_FOUND);
}


/* Helper to retrieve a GPG key. */
static gpgme_error_t
get_gpg_key (const char *keyid, int is_sec, gpgme_key_t *r_key)
{
    gpgme_ctx_t ctx;
    gpgme_error_t err;

    err = gpgme_new (&ctx);
    if (err)
        return err;
    gpgme_set_keylist_mode  (ctx, GPGME_KEYLIST_MODE_SIGS);
    err = gpgme_get_key (ctx, keyid, r_key, is_sec);
    gpgme_release (ctx);
    return err;
}


/* Fetch a key directly from gpg but without adding
   it to the key cache. Caller must free @r_ctx. */
gpgme_error_t
gpg_keycache_fetch_key (const char *keyid, int is_sec, 
                        gpgme_key_t *r_key, struct keycache_s **r_c)
{
    gpgme_error_t err;
    gpgme_key_t key;
    struct keycache_s *c;

    *r_key = NULL;
    *r_c = NULL;
    err = get_gpg_key (keyid, is_sec, &key);
    if (err)
        return err;

    c = new keycache_s;
    if (!c)
        BUG (0);
    memset (c, 0, sizeof *c);
    c->gloflags.is_protected = 1; /*default: assume protection. */
    c->key = key;    
    keycache_decode_uid (c);
    *r_key = key;
    *r_c = c;
    return 0;
}


/* Update the key with the keyid @key in the key cache.
   If the key does not exist, it is added otherwise all
   parts are first freed and then replaced with the updated data. */
gpgme_error_t
gpg_keycache_update_key (gpg_keycache_t ctx, int is_sec, 
                         void *opaque, const char *keyid)
{    
    gpgme_key_t key=NULL, fndkey=NULL;
    gpgme_error_t err;
    struct keycache_s *c = NULL, *c_new=NULL;
    gpg_keycache_t pub = (gpg_keycache_t)opaque;

    err = get_gpg_key (keyid, is_sec, &key);
    if (err)
        return err;
    err = gpg_keycache_find_key2 (ctx, keyid, 0, &fndkey, &c);
    if (!err && c != NULL) {
        log_debug ("keycache update: keyid=%s %p\r\n", keyid, pub);
        gpgme_key_release (fndkey);
        c->key = key;
        c->flags = KC_FLAG_UPD;
        if (is_sec && pub != NULL && 
            !gpg_keycache_find_key (pub, keyid, 0, &fndkey)) {
            log_debug ("keycache update: set public part %p\r\n", fndkey);
            c->pubpart->key = fndkey;
        }
        /* XXX: this is also called for keys without a photo-id. */
        keycache_reload_photo (ctx, keyid);
    }
    else {
        log_debug ("keycache add: sync public part\r\n");
        if (is_sec)
            gpg_keycache_find_key2 (pub, keyid, 0, &fndkey, &c_new);
        gpg_keycache_add_key (ctx, key, (void **)&c);
        if (c != NULL && is_sec) {
            log_debug ("keycache add: keyid=%s %p %p\r\n", keyid, c, fndkey);
            c->pubpart = c_new;
            if (c_new != NULL) {
                c->pubpart->key = fndkey;
                c->gloflags.is_protected = c_new->gloflags.is_protected;
                c->gloflags.divert_to_card = c_new->gloflags.divert_to_card;
            }
        }
        if (c != NULL)
            c->flags = KC_FLAG_ADD;
    }

    /* refresh utf8 user ID list. */
    if (c != NULL && c->key) {
        free_native_uids (&c->uids);
        keycache_decode_uid (c);
    }

    return 0;
}


/* Delete a key from the cache @ctx with the pattern @pattern.
   Return value: 0 on success. */
gpgme_error_t
gpg_keycache_delete_key (gpg_keycache_t ctx, const char *pattern)
{
    struct keycache_s *itm = NULL, *c;
    gpgme_key_t key;
    gpgme_error_t rc;

    if (!ctx)
        return gpg_error (GPG_ERR_INV_ARG);
    rc = gpg_keycache_find_key2 (ctx, pattern, 0, &key, &itm);
    if (rc)
        return rc;
    
    c = ctx->item;
    if (!c) /* empty */
        return 0;
    else if (c->next == NULL) {
        if (itm->key)
            gpgme_key_release (itm->key);
        itm->key = NULL;
        free_if_alloc (itm);
        /* the cache has no other items, so we set the context to NULL
           to indicate that the entire cache is empty. */
        ctx->item = NULL;
    }
    else {
        for (; c != NULL; c = c->next) {
            if (c->next == itm)
                break;
        }
        assert (c != NULL); /* XXX: sometimes access violation. */
        c->next = c->next->next;
        if (itm->key)
            gpgme_key_release (itm->key);
        itm->key = NULL;
        free_if_alloc (itm);
    }
    return 0;
}


/* Initialize the given cache @ctx. If @pattern is NULL, the entire keyring
   will be added to the cache. @secret is 1 if the source is the secret keyring.
   Return value: 0 on success. */
gpgme_error_t
gpg_keycache_init (gpg_keycache_t ctx, const char *pattern, int secret)
{
    gpgme_error_t err;
    gpgme_ctx_t c;
    gpgme_key_t key;
    int count = 0;
    
    if (!ctx)
        return gpg_error (GPG_ERR_INV_ARG);
    
    err = gpgme_new (&c);
    if (err)
        return err;

    /* XXX: GPGME_KEYLIST_MODE_SIG_NOTATIONS causes an internal error! */
    gpgme_set_keylist_mode  (c, GPGME_KEYLIST_MODE_SIGS);
    err = gpgme_op_keylist_start (c, pattern, secret);
    while(!err) {
        err = gpgme_op_keylist_next (c, &key);
        if (!err)
            err = gpg_keycache_add_key (ctx, key, NULL);
        if (ctx->cb)
            ctx->cb (ctx->cb_value, _("Load GPG Keyrings..."), 0, 
                     count++, ctx->cb_value2);
    }
    if (gpgme_err_code (err) == GPG_ERR_EOF)
        err = gpg_error (GPG_ERR_NO_ERROR);
    keycache_update_photos (ctx);
    keycache_decode_uids (ctx);
    gpgme_op_keylist_end (c);
    gpgme_release (c);
    return err;
}


/* Return 1 if we can assume that the actual private key is
   stored on a smart card. This is not bullet proof, but the
   card provides 3 keys (RSA) and each key for a different purpose. */
static int
key_divert_to_card (gpgme_key_t key)
{
    gpgme_subkey_t k;
    int n=0;
    int can_auth = 0, can_encr = 0;

    for (k = key->subkeys; k; k = k->next) {
        n++;
        if (k->pubkey_algo != GPGME_PK_RSA || k->length != 1024) {
            return 0;
            break;
        }
        if (k->can_authenticate)
            can_auth++;
        if (k->can_encrypt)
            can_encr++;
    }
    if (n >= 3 && can_auth >= 1 && can_encr >= 1)
        return 1;
    return 0;
}


static unsigned char*
copy_uid_prefs (const unsigned char *prefs)
{
    unsigned char *p;
    size_t pos=0;

    while (prefs[pos] != 0)
        pos++;
    p = safe_uchar_alloc (pos+1);
    memset (p, 0, pos+1);
    memcpy (p, prefs, pos);
    return p;
}


/* Sync the secret and the public key cache information. */
gpgme_error_t
gpg_keycache_sync (gpg_keycache_t pub, gpg_keycache_t sec)
{
    struct keycache_s *c, *c_sec;
    gpgme_key_t key;

    if (!pub || !sec)
        return gpg_error (GPG_ERR_INV_ARG);
    
    for (c=sec->item; c; c=c->next) {
        if (!gpg_keycache_find_key2 (pub, c->key->subkeys->keyid, 0, 
                                     &key, &c_sec)) {
            c_sec->gloflags.is_protected = c->gloflags.is_protected;
            c_sec->gloflags.divert_to_card = c->gloflags.divert_to_card;
            if (!c->gloflags.divert_to_card)
                c->gloflags.divert_to_card = key_divert_to_card (key);
            if (c_sec->sym_prefs)
                c->sym_prefs = copy_uid_prefs (c_sec->sym_prefs);
            c->pubpart = c_sec;
            c->pubpart->key = key;
        }
    }
    return 0;
}


/* Rewind the given cache @ctx to the begin. */
void
gpg_keycache_rewind (gpg_keycache_t ctx)
{
    if (ctx)
        ctx->pos = 0;
}


/* Return the number of elements in the cache @ctx. */
int
gpg_keycache_get_size (gpg_keycache_t ctx)
{
    struct keycache_s *c;
    int count = 0;
    
    if (!ctx)
        return 0;
    for (c = ctx->item; c; c = c->next)
        count++;
    return count;
}


static gpgme_error_t
keycache_next_key (gpg_keycache_t ctx, int flags, 
                   struct keycache_s **c, gpgme_key_t *r_key)
{       
    if (!ctx || !r_key)
        return gpg_error (GPG_ERR_INV_ARG);

    if (!ctx->pos)
        ctx->tmp = ctx->item;
    
    if (!ctx->tmp || !ctx->tmp->key) {
        ctx->pos = 0;
        *r_key = NULL;
        return gpg_error (GPG_ERR_EOF);
    }
    if (ctx->tmp->flags != 0)
        ctx->tmp->flags = 0; /* reset the 'updated' status. */

    /* it might be possible there is no public key. */
    if (flags && ctx->tmp->pubpart == NULL)
        flags = 0;
    *r_key = flags? ctx->tmp->pubpart->key : ctx->tmp->key;
    *c = ctx->tmp;
    ctx->tmp = ctx->tmp->next;
    ctx->pos++;

    return 0;
}


/* Return the next key from the cache @ctx. The key will be returned 
   in @r_key. @flags can contain additional flags.
   Return value: 0 on success. */
gpgme_error_t
gpg_keycache_next_key (gpg_keycache_t ctx, int flags, gpgme_key_t *r_key)
{
    struct keycache_s *c=NULL;
    gpgme_error_t err;

    err = keycache_next_key (ctx, flags, &c, r_key);
    return err;
}


gpgme_error_t
gpg_keycache_next_key2 (gpg_keycache_t ctx, int flags, 
                        struct keycache_s **c, gpgme_key_t *r_key)
{
    return keycache_next_key (ctx, flags, c, r_key);
}


/* Search for a key with the pattern @pattern and mark
   this key as the default signing key if found.
   Return value: 0 on success. */
gpgme_error_t 
gpg_keycache_set_default_key (gpg_keycache_t ctx,
                              const char *pattern)
{
    gpgme_error_t err;
    gpgme_key_t key;
    struct keycache_s *itm;

    err = gpg_keycache_find_key2 (ctx, pattern, 0, &key, &itm);
    if (err)
        return err;

    if (itm)
        itm->default_key = 1;
    return 0;
}

/* Return the default key from the cache. If no was
   marked before, NULL is returned in @r_key.
   Return value: 0 on success. */
gpgme_error_t
gpg_keycache_get_default_key (gpg_keycache_t ctx,
                              gpgme_key_t *r_key)
{
    struct keycache_s *itm;

    *r_key = NULL;
    for (itm = ctx->item; itm; itm = itm->next) {
        if (itm->default_key) {
            *r_key = itm->key;
            break;
        }
    }
    if (!*r_key)
        return gpgme_error (GPG_ERR_NOT_FOUND);
    return 0;
}


static gpgme_error_t
decode_subpacket (const char *subpkt_data, int *type,
                  char **out, WORD *outlen)
{
    char tmp[128], *val;
    char *enc = NULL;      
    size_t pos = 0;

    /* example: spk:24:1:21:http%3A//subkeys.pgp.de */
    *outlen = 0;
    *out = NULL;
    
    if (strncmp (subpkt_data, "spk:", 4))
        return gpg_error (GPG_ERR_NO_DATA);

    /* XXX: do not use static buffer sizes. */
    strncpy (tmp, subpkt_data, DIM (tmp)-4);
    val = strtok (tmp, ":");
    while (val != NULL) {
        switch (pos++) {
        case 0:
            break;

        case 1: 
            if (type)
                *type = atoi (val);
            break;

        case 2:
            break;

        case 3:
            *outlen = atoi (val);
            break;

        case 4:
            enc = m_strdup (val);
            break;
        }
        val = strtok (NULL, ":");
    }
    if (!enc)
        return gpg_error (GPG_ERR_NO_DATA);
    unhexify_buffer (enc, out);
    free_if_alloc (enc);
    return 0;
}


/* If the attribute given in @attr is not set in the
   key cache object, try to update it. */
gpgme_error_t
gpg_keycache_update_attr (struct keycache_s *item,
                          int attr, int force)
{
    gpgme_error_t err = gpg_error (GPG_ERR_NO_ERROR);
    char *val = NULL;
    WORD n = 0;    

    switch (attr) {
    case KC_ATTR_PREFSYM:
        if (!force && item->sym_prefs)
            break;
        free_if_alloc (item->sym_prefs);
        err = gpg_find_key_subpacket (item->key->subkeys->keyid+8, attr, &val);
        if (!err && val != NULL)
            err = decode_subpacket (val, NULL, (char**)&item->sym_prefs, &n);
        break;

    case KC_ATTR_PREFKSERV:
        if (!force && item->pref_keyserver)
            break;
        free_if_alloc (item->pref_keyserver);
        err = gpg_find_key_subpacket (item->key->subkeys->keyid+8, attr, &val);
        if (!err && val != NULL)
            err = decode_subpacket (val, NULL, &item->pref_keyserver, &n);
        if (!err && item->pref_keyserver)
            err = parse_keyserver_url (&item->pref_keyserver, 
                                       &item->pref_keyserver_port);
        break;
    }
    safe_free (val);
    return err;
}