New decryption flag GPGME_DECRYPT_SESSION_HASH.

* src/gpgme.h.in (_gpgme_op_decrypt_result): Add field session_hash.
(gpgme_decrypt_flags_t): Add flag GPGME_DECRYPT_SESSION_HASH.
(gpgme_status_code_t): Add flags GPGME_STATUS_SESSION_HASH.
* src/status-table.c (status_table): Add "SESSION_HASH".
* src/decrypt.c (release_op_data): Free new field.
(_gpgme_decrypt_status_handler): Handle new status code.
* src/engine-gpg.c (gpg_decrypt): Implement
  GPGME_DECRYPT_SESSION_HASH.

* tests/run-decrypt.c (print_result): Print session_hash.
(main): Add option --show-session-hash.

6 files changed, 50 insertions, 3 deletions

diff --git a/doc/gpgme.texi b/doc/gpgme.texi
index 5acefe24..7334d62a 100644
--- a/doc/gpgme.texi
+++ b/doc/gpgme.texi
@@ -5875,6 +5875,15 @@ used to information on the keyids of the recipients of some encrypted
 data.  Note that most other result items have no or no useful
 information in this case.
 
+@item GPGME_DECRYPT_SESSION_HASH
+@since{2.1.0}
+
+If supported by gpg (>= 2.5.19) pass the option
+@option{--show-session-hash} to gpg so that the decryption result
+field @code{session_key} will receive the hash of the session key.  If
+@code{GPGME_DECRYPT_LIST} is also set the gpg option
+@option{--show-only-session-key} is used instead.
+
 @end table
 
 The function returns the error codes as described for
@@ -5882,7 +5891,7 @@ The function returns the error codes as described for
 @end deftypefun
 
 @deftypefun gpgme_error_t gpgme_op_decrypt_ext_start ( @
-            @w{gpgme_ctx_t @var{ctx}}, @
+            @w{gpgme_ctx_tng @var{ctx}}, @
             @w{gpgme_decrypt_flags_t @var{flags}}, @
             @w{gpgme_data_t @var{cipher}}, @
             @w{gpgme_data_t @var{plain}})
@@ -5994,6 +6003,15 @@ A string with the symmetric encryption algorithm and mode using the
 format "<algo>.<mode>".  Note that the deprecated non-MDC encryption mode of
 OpenPGP is given as "PGPCFB".
 
+@item char *session_hash
+@since{2.1.0}
+
+A textual representation (nul-terminated string) of the SHA-256 hash
+of the session key used in symmetric encryption of the message.  It
+will receive the value @code{NULL} if the feature is not supported by
+the backend or the @code{GPGME_DECRYPT_SESSION_HASH} bit was not set
+in flags argument of the decryption function.
+
 @end table
 @end deftp
 
diff --git a/src/decrypt.c b/src/decrypt.c
index c6030eef..2fea1e0d 100644
--- a/src/decrypt.c
+++ b/src/decrypt.c
@@ -89,6 +89,7 @@ release_op_data (void *hook)
   free (opd->result.unsupported_algorithm);
   free (opd->result.file_name);
   free (opd->result.session_key);
+  free (opd->result.session_hash);
   free (opd->result.symkey_algo);
 
   while (recipient)
@@ -480,6 +481,12 @@ _gpgme_decrypt_status_handler (void *priv, gpgme_status_code_t code,
       opd->result.session_key = strdup(args);
       break;
 
+    case GPGME_STATUS_SESSION_HASH:
+      if (opd->result.session_hash)
+        free (opd->result.session_hash);
+      opd->result.session_hash = strdup (args);
+      break;
+
     case GPGME_STATUS_NO_SECKEY:
       {
 	gpgme_recipient_t rec = opd->result.recipients;
diff --git a/src/engine-gpg.c b/src/engine-gpg.c
index b43740bd..8c4e38bf 100644
--- a/src/engine-gpg.c
+++ b/src/engine-gpg.c
@@ -1974,9 +1974,17 @@ gpg_decrypt (void *engine,
         err = add_arg (gpg, "--unwrap");
     }
 
-  if (!err && (flags & GPGME_DECRYPT_LISTONLY))
+  if (!err && (flags & GPGME_DECRYPT_LISTONLY)
+           && !(flags & GPGME_DECRYPT_SESSION_HASH))
     err = add_arg (gpg, "--list-only");
 
+  if (!err && (flags & GPGME_DECRYPT_SESSION_HASH)
+           && have_gpg_version (gpg, "2.5.19"))
+    err = add_arg (gpg,
+                   (flags & GPGME_DECRYPT_LISTONLY)? "--show-only-session-hash"
+                   /* */                           : "--show-session-hash");
+
+
   if (!err && export_session_key)
     err = add_gpg_arg (gpg, "--show-session-key");
 
diff --git a/src/gpgme.h.in b/src/gpgme.h.in
index 063948f2..c8748eb7 100644
--- a/src/gpgme.h.in
+++ b/src/gpgme.h.in
@@ -1526,6 +1526,10 @@ struct _gpgme_op_decrypt_result
   /* A string with the symmetric encryption algorithm and mode using
    * the format "<algo>.<mode>".  */
   char *symkey_algo;
+
+  /* A string with the hash of the session key or NULL if the hash was
+   * not emitted by the backend.  */
+  char *session_hash;
 };
 typedef struct _gpgme_op_decrypt_result *gpgme_decrypt_result_t;
 
@@ -1540,6 +1544,7 @@ typedef enum
     GPGME_DECRYPT_VERIFY = 1,
     GPGME_DECRYPT_ARCHIVE = 2,
     GPGME_DECRYPT_LISTONLY = 16,
+    GPGME_DECRYPT_SESSION_HASH = 32,
     GPGME_DECRYPT_UNWRAP = 128
   }
 gpgme_decrypt_flags_t;
@@ -2727,7 +2732,8 @@ typedef enum
     GPGME_STATUS_DECRYPTION_COMPLIANCE_MODE = 99,
     GPGME_STATUS_VERIFICATION_COMPLIANCE_MODE = 100,
     GPGME_STATUS_CANCELED_BY_USER = 101,
-    GPGME_STATUS_ENCRYPTION_COMPLIANCE_MODE = 102
+    GPGME_STATUS_ENCRYPTION_COMPLIANCE_MODE = 102,
+    GPGME_STATUS_SESSION_HASH = 103
   }
 gpgme_status_code_t;
 
diff --git a/src/status-table.c b/src/status-table.c
index 6b2e3396..1b94e101 100644
--- a/src/status-table.c
+++ b/src/status-table.c
@@ -118,6 +118,7 @@ static struct status_table_s status_table[] =
   { "RSA_OR_IDEA", GPGME_STATUS_RSA_OR_IDEA },
   { "SC_OP_FAILURE", GPGME_STATUS_SC_OP_FAILURE },
   { "SC_OP_SUCCESS", GPGME_STATUS_SC_OP_SUCCESS },
+  { "SESSION_HASH", GPGME_STATUS_SESSION_HASH },
   { "SESSION_KEY", GPGME_STATUS_SESSION_KEY },
   { "SHM_GET", GPGME_STATUS_SHM_GET },
   { "SHM_GET_BOOL", GPGME_STATUS_SHM_GET_BOOL },
diff --git a/tests/run-decrypt.c b/tests/run-decrypt.c
index cbde49dc..aa02a3de 100644
--- a/tests/run-decrypt.c
+++ b/tests/run-decrypt.c
@@ -62,6 +62,7 @@ print_result (gpgme_decrypt_result_t result)
   printf ("MIME flag ..........: %s\n", result->is_mime? "yes":"no");
   printf ("Unsupported algo ...: %s\n", nonnull(result->unsupported_algorithm));
   printf ("Session key ........: %s\n", nonnull (result->session_key));
+  printf ("Session hash .......: %s\n", nonnull (result->session_hash));
   printf ("Symmetric algorithm : %s\n", result->symkey_algo);
 
   for (recp = result->recipients; recp && recp->next; recp = recp->next)
@@ -84,6 +85,7 @@ show_usage (int ex)
          "  --status         print status lines from the backend\n"
          "  --openpgp        use the OpenPGP protocol (default)\n"
          "  --cms            use the CMS protocol\n"
+         "  --show-session-hash             show the session key hash\n"
          "  --export-session-key            show the session key\n"
          "  --override-session-key STRING   use STRING as session key\n"
          "  --request-origin STRING         use STRING as request origin\n"
@@ -164,6 +166,11 @@ main (int argc, char **argv)
           protocol = GPGME_PROTOCOL_CMS;
           argc--; argv++;
         }
+      else if (!strcmp (*argv, "--show-session-hash"))
+        {
+          flags |= GPGME_DECRYPT_SESSION_HASH;
+          argc--; argv++;
+        }
       else if (!strcmp (*argv, "--export-session-key"))
         {
           export_session_key = 1;