/* import.c - import a key into our key storage.

 * Copyright (C) 1998-2007, 2010-2011 Free Software Foundation, Inc.

 * Copyright (C) 2014, 2016, 2017, 2019  Werner Koch

 *

 * This file is part of GnuPG.

 *

 * GnuPG is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 3 of the License, or

 * (at your option) any later version.

 *

 * GnuPG is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, see <https://www.gnu.org/licenses/>.

 */

#include <config.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <errno.h>

#include "gpg.h"

#include "options.h"

#include "packet.h"

#include "../common/status.h"

#include "keydb.h"

#include "../common/util.h"

#include "trustdb.h"

#include "main.h"

#include "../common/i18n.h"

#include "../common/ttyio.h"

#include "../common/recsel.h"

#include "keyserver-internal.h"

#include "call-agent.h"

#include "../common/membuf.h"

#include "../common/init.h"

#include "../common/mbox-util.h"

#include "key-check.h"

#include "key-clean.h"

struct import_stats_s

{

  ulong count;

  ulong no_user_id;

  ulong imported;

  ulong n_uids;

  ulong n_sigs;

  ulong n_subk;

  ulong unchanged;

  ulong n_revoc;

  ulong secret_read;

  ulong secret_imported;

  ulong secret_dups;

  ulong skipped_new_keys;

  ulong not_imported;

  ulong n_sigs_cleaned;

  ulong n_uids_cleaned;

  ulong v3keys;   /* Number of V3 keys seen.  */

};

/* Node flag to indicate that a user ID or a subkey has a

 * valid self-signature.  */

#define NODE_GOOD_SELFSIG  1

/* Node flag to indicate that a user ID or subkey has

 * an invalid self-signature.  */

#define NODE_BAD_SELFSIG   2

/* Node flag to indicate that the node shall be deleted.  */

#define NODE_DELETION_MARK 4

/* A node flag used to temporary mark a node. */

#define NODE_FLAG_A  8

/* A flag used by transfer_secret_keys. */

#define NODE_TRANSFER_SECKEY 16

/* An object and a global instance to store selectors created from

 * --import-filter keep-uid=EXPR.

 * --import-filter drop-sig=EXPR.

 *

 * FIXME: We should put this into the CTRL object but that requires a

 * lot more changes right now.  For now we use save and restore

 * function to temporary change them.

 */

/* Definition of the import filters.  */

struct import_filter_s

{

  recsel_expr_t keep_uid;

  recsel_expr_t drop_sig;

};

/* The current instance.  */

struct import_filter_s import_filter;

static int import (ctrl_t ctrl,

                   IOBUF inp, const char* fname, struct import_stats_s *stats,

       unsigned char **fpr, size_t *fpr_len, unsigned int options,

       import_screener_t screener, void *screener_arg,

                   int origin, const char *url);

static int read_block (IOBUF a, unsigned int options,

                       PACKET **pending_pkt, kbnode_t *ret_root, int *r_v3keys);

static void revocation_present (ctrl_t ctrl, kbnode_t keyblock);

static gpg_error_t import_one (ctrl_t ctrl,

                       kbnode_t keyblock,

                       struct import_stats_s *stats,

                       unsigned char **fpr, size_t *fpr_len,

                       unsigned int options, int from_sk, int silent,

                       import_screener_t screener, void *screener_arg,

                       int origin, const char *url, int *r_valid);

static gpg_error_t import_matching_seckeys (

                       ctrl_t ctrl, kbnode_t seckeys,

                       const byte *mainfpr, size_t mainfprlen,

                       struct import_stats_s *stats, int batch);

static gpg_error_t import_secret_one (ctrl_t ctrl, kbnode_t keyblock,

                              struct import_stats_s *stats, int batch,

                              unsigned int options, int for_migration,

                              import_screener_t screener, void *screener_arg,

                              kbnode_t *r_secattic);

static int import_revoke_cert (ctrl_t ctrl, kbnode_t node, unsigned int options,

                               struct import_stats_s *stats);

static int chk_self_sigs (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid,

                          int *non_self);

static int delete_inv_parts (ctrl_t ctrl, kbnode_t keyblock,

                             u32 *keyid, unsigned int options,

                             kbnode_t *r_otherrevsigs);

static int any_uid_left (kbnode_t keyblock);

static void remove_all_non_self_sigs (kbnode_t *keyblock, u32 *keyid);

static int merge_blocks (ctrl_t ctrl, unsigned int options,

                         kbnode_t keyblock_orig,

       kbnode_t keyblock, u32 *keyid,

                         u32 curtime, int origin, const char *url,

       int *n_uids, int *n_sigs, int *n_subk );

static gpg_error_t append_new_uid (unsigned int options,

                                   kbnode_t keyblock, kbnode_t node,

                                   u32 curtime, int origin, const char *url,

                                   int *n_sigs);

static int append_key (kbnode_t keyblock, kbnode_t node, int *n_sigs);

static int merge_sigs (kbnode_t dst, kbnode_t src, int *n_sigs);

static int merge_keysigs (kbnode_t dst, kbnode_t src, int *n_sigs);

static void

release_import_filter (import_filter_t filt)

{

  recsel_release (filt->keep_uid);

  filt->keep_uid = NULL;

  recsel_release (filt->drop_sig);

  filt->drop_sig = NULL;

}

static void

cleanup_import_globals (void)

{

  release_import_filter (&import_filter);

}

int

parse_import_options(char *str,unsigned int *options,int noisy)

{

  struct parse_options import_opts[]=

    {

      {"import-local-sigs",IMPORT_LOCAL_SIGS,NULL,

       N_("import signatures that are marked as local-only")},

      {"repair-pks-subkey-bug",IMPORT_REPAIR_PKS_SUBKEY_BUG,NULL,

       N_("repair damage from the pks keyserver during import")},

      {"keep-ownertrust", IMPORT_KEEP_OWNERTTRUST, NULL,

       N_("do not clear the ownertrust values during import")},

      {"fast-import",IMPORT_FAST,NULL,

       N_("do not update the trustdb after import")},

      {"bulk-import",IMPORT_BULK, NULL,

       N_("enable bulk import mode")},

      {"import-show",IMPORT_SHOW,NULL,

       N_("show key during import")},

      {"show-only", (IMPORT_SHOW | IMPORT_DRY_RUN), NULL,

       N_("show key but do not actually import") },

      {"merge-only",IMPORT_MERGE_ONLY,NULL,

       N_("only accept updates to existing keys")},

      {"import-clean",IMPORT_CLEAN,NULL,

       N_("remove unusable parts from key after import")},

      {"import-minimal",IMPORT_MINIMAL|IMPORT_CLEAN,NULL,

       N_("remove as much as possible from key after import")},

      {"self-sigs-only", IMPORT_SELF_SIGS_ONLY, NULL,

       N_("ignore key-signatures which are not self-signatures")},

      {"import-export", IMPORT_EXPORT, NULL,

       N_("run import filters and export key immediately")},

      {"restore", IMPORT_RESTORE, NULL,

       N_("assume the GnuPG key backup format")},

      {"import-restore", IMPORT_RESTORE, NULL, NULL},

      {"repair-keys", IMPORT_REPAIR_KEYS, NULL,

       N_("repair keys on import")},

      {"force-update", IMPORT_FORCE_UPDATE, NULL,

       N_("update even unchanged keys")},

      /* New options.  Right now, without description string.  */

      {"ignore-attributes", IMPORT_IGNORE_ATTRIBUTES, NULL, NULL},

      {"only-pubkeys", IMPORT_ONLY_PUBKEYS, NULL,

       N_("do not import secret keys")},

      /* Hidden options which are enabled by default and are provided

       * in case of problems with the respective implementation.  */

      {"collapse-uids", IMPORT_COLLAPSE_UIDS, NULL, NULL},

      {"collapse-subkeys", IMPORT_COLLAPSE_SUBKEYS, NULL, NULL},

      /* Aliases for backward compatibility */

      {"allow-local-sigs",IMPORT_LOCAL_SIGS,NULL,NULL},

      {"repair-hkp-subkey-bug",IMPORT_REPAIR_PKS_SUBKEY_BUG,NULL,NULL},

      /* dummy */

      {"import-unusable-sigs",0,NULL,NULL},

      {"import-clean-sigs",0,NULL,NULL},

      {"import-clean-uids",0,NULL,NULL},

      {"convert-sk-to-pk",0, NULL,NULL}, /* Not anymore needed due to

                                            the new design.  */

      {NULL,0,NULL,NULL}

    };

  int rc;

  int saved_self_sigs_only, saved_import_clean;

  /* We need to set flags indicating whether the user has set certain

   * options or if they came from the default.  */

  saved_self_sigs_only = (*options & IMPORT_SELF_SIGS_ONLY);

  saved_self_sigs_only &= ~IMPORT_SELF_SIGS_ONLY;

  saved_import_clean   = (*options & IMPORT_CLEAN);

  saved_import_clean   &= ~IMPORT_CLEAN;

  rc = parse_options (str, options, import_opts, noisy);

  if (rc && (*options & IMPORT_SELF_SIGS_ONLY))

    opt.flags.expl_import_self_sigs_only = 1;

  else

    *options |= saved_self_sigs_only;

  if (rc && (*options & IMPORT_CLEAN))

    opt.flags.expl_import_clean = 1;

  else

    *options |= saved_import_clean;

  if (rc && (*options & IMPORT_RESTORE))

    {

      /* Alter other options we want or don't want for restore.  */

      *options |= (IMPORT_LOCAL_SIGS | IMPORT_KEEP_OWNERTTRUST);

      *options &= ~(IMPORT_MINIMAL | IMPORT_CLEAN

                    | IMPORT_REPAIR_PKS_SUBKEY_BUG

                    | IMPORT_MERGE_ONLY);

    }

  return rc;

}

/* Parse and set an import filter from string.  STRING has the format

 * "NAME=EXPR" with NAME being the name of the filter.  Spaces before

 * and after NAME are not allowed.  If this function is all called

 * several times all expressions for the same NAME are concatenated.

 * Supported filter names are:

 *

 *  - keep-uid :: If the expression evaluates to true for a certain

 *                user ID packet, that packet and all it dependencies

 *                will be imported.  The expression may use these

 *                variables:

 *

 *                - uid  :: The entire user ID.

 *                - mbox :: The mail box part of the user ID.

 *                - primary :: Evaluate to true for the primary user ID.

 */

gpg_error_t

parse_and_set_import_filter (const char *string)

{

  gpg_error_t err;

  /* Auto register the cleanup function.  */

  register_mem_cleanup_func (cleanup_import_globals);

  if (!strncmp (string, "keep-uid=", 9))

    err = recsel_parse_expr (&import_filter.keep_uid, string+9);

  else if (!strncmp (string, "drop-sig=", 9))

    err = recsel_parse_expr (&import_filter.drop_sig, string+9);

  else

    err = gpg_error (GPG_ERR_INV_NAME);

  return err;

}

/* Save the current import filters, return them, and clear the current

 * filters.  Returns NULL on error and sets ERRNO.  */

import_filter_t

save_and_clear_import_filter (void)

{

  import_filter_t filt;

  filt = xtrycalloc (1, sizeof *filt);

  if (!filt)

    return NULL;

  *filt = import_filter;

  memset (&import_filter, 0, sizeof import_filter);

  return filt;

}

/* Release the current import filters and restore them from NEWFILT.

 * Ownership of NEWFILT is moved to this function.  */

void

restore_import_filter (import_filter_t filt)

{

  if (filt)

    {

      release_import_filter (&import_filter);

      import_filter = *filt;

      xfree (filt);

    }

}

import_stats_t

import_new_stats_handle (void)

{

  return xmalloc_clear ( sizeof (struct import_stats_s) );

}

void

import_release_stats_handle (import_stats_t p)

{

  xfree (p);

}

/* Read a key from a file.  Only the first key in the file is

 * considered and stored at R_KEYBLOCK.  FNAME is the name of the

 * file.

 */

gpg_error_t

read_key_from_file_or_buffer (ctrl_t ctrl, const char *fname,

                              const void *buffer, size_t buflen,

                              kbnode_t *r_keyblock)

{

  gpg_error_t err;

  iobuf_t inp;

  PACKET *pending_pkt = NULL;

  kbnode_t keyblock = NULL;

  u32 keyid[2];

  int v3keys;   /* Dummy */

  int non_self; /* Dummy */

  (void)ctrl;

  *r_keyblock = NULL;

  log_assert (!!fname ^ !!buffer);

  if (fname)

    {

      inp = iobuf_open (fname);

      if (!inp)

        err = gpg_error_from_syserror ();

      else if (is_secured_file (iobuf_get_fd (inp)))

        {

          iobuf_close (inp);

          inp = NULL;

          err = gpg_error (GPG_ERR_EPERM);

        }

      else

        err = 0;

      if (err)

        {

          log_error (_("can't open '%s': %s\n"),

                     iobuf_is_pipe_filename (fname)? "[stdin]": fname,

                     gpg_strerror (err));

          if (gpg_err_code (err) == GPG_ERR_ENOENT)

            err = gpg_error (GPG_ERR_NO_PUBKEY);

          goto leave;

        }

      /* Push the armor filter.  */

      {

        armor_filter_context_t *afx;

        afx = new_armor_context ();

        afx->only_keyblocks = 1;

        push_armor_filter (afx, inp);

        release_armor_context (afx);

      }

    }

  else  /* Read from buffer (No armor expected).  */

    {

      inp = iobuf_temp_with_content (buffer, buflen);

    }

  /* Read the first non-v3 keyblock.  */

  while (!(err = read_block (inp, 0, &pending_pkt, &keyblock, &v3keys)))

    {

      if (keyblock->pkt->pkttype == PKT_PUBLIC_KEY)

        break;

      log_info (_("skipping block of type %d\n"), keyblock->pkt->pkttype);

      release_kbnode (keyblock);

      keyblock = NULL;

    }

  if (err)

    {

      if (gpg_err_code (err) != GPG_ERR_INV_KEYRING)

        log_error (_("error reading '%s': %s\n"),

                   fname? (iobuf_is_pipe_filename (fname)? "[stdin]": fname)

                   /* */ : "[buffer]",

                   gpg_strerror (err));

      goto leave;

    }

  keyid_from_pk (keyblock->pkt->pkt.public_key, keyid);

  if (!find_next_kbnode (keyblock, PKT_USER_ID))

    {

      err = gpg_error (GPG_ERR_NO_USER_ID);

      goto leave;

    }

  /* We do the collapsing unconditionally although it is expected that

   * clean keys are provided here.  */

  collapse_uids (&keyblock);

  collapse_subkeys (&keyblock);

  clear_kbnode_flags (keyblock);

  if (chk_self_sigs (ctrl, keyblock, keyid, &non_self))

    {

      err = gpg_error (GPG_ERR_INV_KEYRING);

      goto leave;

    }

  if (!delete_inv_parts (ctrl, keyblock, keyid, 0, NULL) )

    {

      err = gpg_error (GPG_ERR_NO_USER_ID);

      goto leave;

    }

  *r_keyblock = keyblock;

  keyblock = NULL;

 leave:

  if (inp)

    {

      iobuf_close (inp);

      /* Must invalidate that ugly cache to actually close the file. */

      if (fname)

        iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);

    }

  release_kbnode (keyblock);

  /* FIXME: Do we need to free PENDING_PKT ? */

  return err;

}

/* Import an already checked public key which was included in a

 * signature and the signature verified out using this key.  */

gpg_error_t

import_included_key_block (ctrl_t ctrl, kbnode_t keyblock)

{

  gpg_error_t err;

  struct import_stats_s *stats;

  import_filter_t save_filt;

  int save_armor = opt.armor;

  opt.armor = 0;

  stats = import_new_stats_handle ();

  save_filt = save_and_clear_import_filter ();

  if (!save_filt)

    {

      err = gpg_error_from_syserror ();

      goto leave;

    }

  /* FIXME: Should we introduce a dedicated KEYORG ? */

  err = import_one (ctrl, keyblock,

                    stats, NULL, 0, 0, 0, 0,

                    NULL, NULL, KEYORG_UNKNOWN, NULL, NULL);

 leave:

  restore_import_filter (save_filt);

  import_release_stats_handle (stats);

  opt.armor = save_armor;

  return err;

}

/*

 * Import the public keys from the given filename. Input may be armored.

 * This function rejects all keys which are not validly self signed on at

 * least one userid. Only user ids which are self signed will be imported.

 * Other signatures are not checked.

 *

 * Actually this function does a merge. It works like this:

 *

 *  - get the keyblock

 *  - check self-signatures and remove all userids and their signatures

 *    without/invalid self-signatures.

 *  - reject the keyblock, if we have no valid userid.

 *  - See whether we have this key already in one of our pubrings.

 *    If not, simply add it to the default keyring.

 *  - Compare the key and the self-signatures of the new and the one in

 *    our keyring.  If they are different something weird is going on;

 *    ask what to do.

 *  - See whether we have only non-self-signature on one user id; if not

 *    ask the user what to do.

 *  - compare the signatures: If we already have this signature, check

 *    that they compare okay; if not, issue a warning and ask the user.

 *    (consider looking at the timestamp and use the newest?)

 *  - Simply add the signature.  Can't verify here because we may not have

 *    the signature's public key yet; verification is done when putting it

 *    into the trustdb, which is done automagically as soon as this pubkey

 *    is used.

 *  - Proceed with next signature.

 *

 *  Key revocation certificates have special handling.

 */

static gpg_error_t

import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames,

          import_stats_t stats_handle,

                      unsigned char **fpr, size_t *fpr_len,

          unsigned int options,

                      import_screener_t screener, void *screener_arg,

                      int origin, const char *url)

{

  int i;

  gpg_error_t err = 0;

  struct import_stats_s *stats = stats_handle;

  if (!stats)

    stats = import_new_stats_handle ();

  if (inp)

    {

      err = import (ctrl, inp, "[stream]", stats, fpr, fpr_len, options,

                    screener, screener_arg, origin, url);

    }

  else

    {

      if (!fnames && !nnames)

        nnames = 1;  /* Ohh what a ugly hack to jump into the loop */

      for (i=0; i < nnames; i++)

        {

          const char *fname = fnames? fnames[i] : NULL;

          IOBUF inp2 = iobuf_open(fname);

          if (!fname)

            fname = "[stdin]";

          if (inp2 && is_secured_file (iobuf_get_fd (inp2)))

            {

              iobuf_close (inp2);

              inp2 = NULL;

              gpg_err_set_errno (EPERM);

            }

          if (!inp2)

            log_error (_("can't open '%s': %s\n"), fname, strerror (errno));

          else

            {

              err = import (ctrl, inp2, fname, stats, fpr, fpr_len, options,

                           screener, screener_arg, origin, url);

              iobuf_close (inp2);

              /* Must invalidate that ugly cache to actually close it. */

              iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);

              if (err)

                log_error ("import from '%s' failed: %s\n",

                           fname, gpg_strerror (err) );

            }

          if (!fname)

            break;

  }

    }

  if (!stats_handle)

    {

      if ((options & (IMPORT_SHOW | IMPORT_DRY_RUN))

          != (IMPORT_SHOW | IMPORT_DRY_RUN))

        import_print_stats (stats);

      import_release_stats_handle (stats);

    }

  /* If no fast import and the trustdb is dirty (i.e. we added a key

     or userID that had something other than a selfsig, a signature

     that was other than a selfsig, or any revocation), then

     update/check the trustdb if the user specified by setting

     interactive or by not setting no-auto-check-trustdb */

  if (!(options & IMPORT_FAST))

    check_or_update_trustdb (ctrl);

  return err;

}

void

import_keys (ctrl_t ctrl, char **fnames, int nnames,

       import_stats_t stats_handle, unsigned int options,

             int origin, const char *url)

{

  import_keys_internal (ctrl, NULL, fnames, nnames, stats_handle,

                        NULL, NULL, options, NULL, NULL, origin, url);

}

gpg_error_t

import_keys_es_stream (ctrl_t ctrl, estream_t fp,

                       import_stats_t stats_handle,

                       unsigned char **fpr, size_t *fpr_len,

                       unsigned int options,

                       import_screener_t screener, void *screener_arg,

                       int origin, const char *url)

{

  gpg_error_t err;

  iobuf_t inp;

  inp = iobuf_esopen (fp, "rb", 1, 0);

  if (!inp)

    {

      err = gpg_error_from_syserror ();

      log_error ("iobuf_esopen failed: %s\n", gpg_strerror (err));

      return err;

    }

  err = import_keys_internal (ctrl, inp, NULL, 0, stats_handle,

                             fpr, fpr_len, options,

                             screener, screener_arg, origin, url);

  iobuf_close (inp);

  return err;

}

static int

import (ctrl_t ctrl, IOBUF inp, const char* fname,struct import_stats_s *stats,

  unsigned char **fpr,size_t *fpr_len, unsigned int options,

  import_screener_t screener, void *screener_arg,

        int origin, const char *url)

{

  PACKET *pending_pkt = NULL;

  kbnode_t keyblock = NULL;  /* Need to initialize because gcc can't

                                grasp the return semantics of

                                read_block. */

  kbnode_t secattic = NULL;  /* Kludge for PGP desktop percularity */

  int rc = 0;

  int v3keys;

  getkey_disable_caches ();

  if (!opt.no_armor) /* Armored reading is not disabled.  */

    {

      armor_filter_context_t *afx;

      afx = new_armor_context ();

      afx->only_keyblocks = 1;

      push_armor_filter (afx, inp);

      release_armor_context (afx);

    }

  while (!(rc = read_block (inp, options, &pending_pkt, &keyblock, &v3keys)))

    {

      stats->v3keys += v3keys;

      if (keyblock->pkt->pkttype == PKT_PUBLIC_KEY)

        {

          rc = import_one (ctrl, keyblock,

                           stats, fpr, fpr_len, options, 0, 0,

                           screener, screener_arg, origin, url, NULL);

          if (secattic)

            {

              byte tmpfpr[MAX_FINGERPRINT_LEN];

              size_t tmpfprlen;

              if (!rc && !(opt.dry_run || (options & IMPORT_DRY_RUN)))

                {

                  /* Kudge for PGP desktop - see below.  */

                  fingerprint_from_pk (keyblock->pkt->pkt.public_key,

                                       tmpfpr, &tmpfprlen);

                  rc = import_matching_seckeys (ctrl, secattic,

                                                tmpfpr, tmpfprlen,

                                                stats, opt.batch);

                }

              release_kbnode (secattic);

              secattic = NULL;

            }

        }

      else if (keyblock->pkt->pkttype == PKT_SECRET_KEY)

        {

          release_kbnode (secattic);

          secattic = NULL;

          rc = import_secret_one (ctrl, keyblock, stats,

                                  opt.batch, options, 0,

                                  screener, screener_arg, &secattic);

          keyblock = NULL;  /* Ownership was transferred.  */

          if (secattic)

            {

              if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY)

                rc = 0; /* Try import after the next pubkey.  */

              /* The attic is a workaround for the peculiar PGP

               * Desktop method of exporting a secret key: The

               * exported file is the concatenation of two armored

               * keyblocks; first the private one and then the public

               * one.  The strange thing is that the secret one has no

               * binding signatures at all and thus we have not

               * imported it.  The attic stores that secret keys and

               * we try to import it once after the very next public

               * keyblock.  */

            }

        }

      else if (keyblock->pkt->pkttype == PKT_SIGNATURE

               && IS_KEY_REV (keyblock->pkt->pkt.signature) )

        {

          release_kbnode (secattic);

          secattic = NULL;

          rc = import_revoke_cert (ctrl, keyblock, options, stats);

        }

      else

        {

          release_kbnode (secattic);

          secattic = NULL;

          log_info (_("skipping block of type %d\n"), keyblock->pkt->pkttype);

  }

      release_kbnode (keyblock);

      /* fixme: we should increment the not imported counter but

         this does only make sense if we keep on going despite of

         errors.  For now we do this only if the imported key is too

         large. */

      if (gpg_err_code (rc) == GPG_ERR_TOO_LARGE

            && gpg_err_source (rc) == GPG_ERR_SOURCE_KEYBOX)

        {

          stats->not_imported++;

        }

      else if (rc)

        break;

      if (!(++stats->count % 100) && !opt.quiet)

        log_info (_("%lu keys processed so far\n"), stats->count );

      if (origin == KEYORG_WKD && stats->count >= 5)

        {

          /* We limit the number of keys _received_ from the WKD to 5.

           * In fact there should be only one key but some sites want

           * to store a few expired keys there also.  gpg's key

           * selection will later figure out which key to use.  Note

           * that for WKD we always return the fingerprint of the

           * first imported key.  */

          log_info ("import from WKD stopped after %d keys\n", 5);

          break;

        }

    }

  stats->v3keys += v3keys;

  if (rc == -1)

    rc = 0;

  else if (rc && gpg_err_code (rc) != GPG_ERR_INV_KEYRING)

    log_error (_("error reading '%s': %s\n"), fname, gpg_strerror (rc));

  release_kbnode (secattic);

  /* When read_block loop was stopped by error, we have PENDING_PKT left.  */

  if (pending_pkt)

    {

      free_packet (pending_pkt, NULL);

      xfree (pending_pkt);

    }

  return rc;

}

/* Helper to migrate secring.gpg to GnuPG 2.1.  */

gpg_error_t

import_old_secring (ctrl_t ctrl, const char *fname)

{

  gpg_error_t err;

  iobuf_t inp;

  PACKET *pending_pkt = NULL;

  kbnode_t keyblock = NULL;  /* Need to initialize because gcc can't

                                grasp the return semantics of

                                read_block. */

  struct import_stats_s *stats;

  int v3keys;

  inp = iobuf_open (fname);

  if (inp && is_secured_file (iobuf_get_fd (inp)))

    {

      iobuf_close (inp);

      inp = NULL;

      gpg_err_set_errno (EPERM);

    }

  if (!inp)

    {

      err = gpg_error_from_syserror ();

      log_error (_("can't open '%s': %s\n"), fname, gpg_strerror (err));

      return err;

    }

  getkey_disable_caches();

  stats = import_new_stats_handle ();

  while (!(err = read_block (inp, 0, &pending_pkt, &keyblock, &v3keys)))

    {

      if (keyblock->pkt->pkttype == PKT_SECRET_KEY)

        {

          err = import_secret_one (ctrl, keyblock, stats, 1, 0, 1,

                                   NULL, NULL, NULL);

          keyblock = NULL; /* Ownership was transferred.  */

        }

      release_kbnode (keyblock);

      if (err)

        break;

    }

  import_release_stats_handle (stats);

  if (err == -1)

    err = 0;

  else if (err && gpg_err_code (err) != GPG_ERR_INV_KEYRING)

    log_error (_("error reading '%s': %s\n"), fname, gpg_strerror (err));

  else if (err)

    log_error ("import from '%s' failed: %s\n", fname, gpg_strerror (err));

  iobuf_close (inp);

  iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);

  return err;

}

void

import_print_stats (import_stats_t stats)

{

  if (!opt.quiet)

    {

      log_info(_("Total number processed: %lu\n"),

               stats->count + stats->v3keys);

      if (stats->v3keys)

        log_info(_("    skipped PGP-2 keys: %lu\n"), stats->v3keys);

      if (stats->skipped_new_keys )

        log_info(_("      skipped new keys: %lu\n"),

                 stats->skipped_new_keys );

      if (stats->no_user_id )

        log_info(_("          w/o user IDs: %lu\n"), stats->no_user_id );

      if (stats->imported)

        {

          log_info(_("              imported: %lu"), stats->imported );

          log_printf ("\n");

        }

      if (stats->unchanged )

        log_info(_("             unchanged: %lu\n"), stats->unchanged );

      if (stats->n_uids )

        log_info(_("          new user IDs: %lu\n"), stats->n_uids );

      if (stats->n_subk )

        log_info(_("           new subkeys: %lu\n"), stats->n_subk );

      if (stats->n_sigs )

        log_info(_("        new signatures: %lu\n"), stats->n_sigs );

      if (stats->n_revoc )

        log_info(_("   new key revocations: %lu\n"), stats->n_revoc );

      if (stats->secret_read )

        log_info(_("      secret keys read: %lu\n"), stats->secret_read );

      if (stats->secret_imported )

        log_info(_("  secret keys imported: %lu\n"), stats->secret_imported );

      if (stats->secret_dups )

        log_info(_(" secret keys unchanged: %lu\n"), stats->secret_dups );

      if (stats->not_imported )

        log_info(_("          not imported: %lu\n"), stats->not_imported );

      if (stats->n_sigs_cleaned)

        log_info(_("    signatures cleaned: %lu\n"),stats->n_sigs_cleaned);

      if (stats->n_uids_cleaned)

        log_info(_("      user IDs cleaned: %lu\n"),stats->n_uids_cleaned);

    }

  if (is_status_enabled ())

    {

      char buf[15*20];

      snprintf (buf, sizeof buf,

                "%lu %lu %lu 0 %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu",

    stats->count + stats->v3keys,

    stats->no_user_id,

    stats->imported,

    stats->unchanged,

    stats->n_uids,

    stats->n_subk,