aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Release 2.2.37gnupg-2.2.37Werner Koch2022-08-241-1/+3
|
* gpgsm: New option --compatibility-flags.Werner Koch2022-08-197-9/+164
| | | | | | | | | | | | | | | | | * sm/gpgsm.c (oCompatibilityFlags): New option. (compatibility_flags): new. (main): Parse and print them in verbose mode. * sm/gpgsm.h (opt): Add field compat_glags.: (COMPAT_ALLOW_KA_TO_ENCR): New. * sm/keylist.c (print_capabilities): Take care of the new flag. * sm/certlist.c (cert_usage_p): Ditto. * common/miscellaneous.c (parse_compatibility_flags): New. * common/util.h (struct compatibility_flags_s): New. -- Backported-from-master: f0b373cec93bb01f02b9c0a3ab1f3e242b381c3f Backported-from-master: ce63eaa4f8f3f41aafcaddd8d658dacd522334a8
* gpgconf: Make --auto-key-import and --include-key-block visible again.Werner Koch2022-08-172-0/+7
| | | | | | | | * tools/gpgconf-comp.c: Add options. -- Fixes-commit: 7a3a1ef3707194e1086c452d005319c519905d3e GnuPG-bug-id: 6138
* agent: Fix bug introduced earlier today.Werner Koch2022-08-161-1/+1
| | | | | | | * agent/findkey.c (agent_write_private_key): Fix condition. -- Fixes-commit: 755920d4335730fbf25e24342dc9c8a8a772dac3
* doc: Prepare NEWSWerner Koch2022-08-161-0/+43
| | | | --
* gpg: Fix "generate" command in --card-edit.Werner Koch2022-08-162-1/+10
| | | | | | | | | | | | | | | | | | * g10/card-util.c (get_info_for_key_operation): Get the APPTYPE before testing for it. * g10/card-util.c (current_card_status): Always try to update the shadow keys. * g10/call-agent.c (agent_scd_getattr): Handle $AUTHKEYID. -- The first part fixed a regression introduced today. GnuPG-bug-id: 5100 The second part is usually not required because our ssh-agent code anyway looks for the OpenPGP.3 key. However, this helps to put the Display S/N into the shadow key so that we get a better prompt to insert the card.
* gpg: Update shadow-keys with --card-status also for non-openpgp cards.Werner Koch2022-08-164-2/+32
| | | | | | | * agent/command.c (cmd_readkey): Also allow for $AUTHKEYID in card mode. * g10/call-agent.c (agent_update_shadow_keys): new. * g10/card-util.c (current_card_status): Call it.
* agent: Let READKEY update the display-s/n of the Token entry.Werner Koch2022-08-165-64/+174
| | | | | | | | | | | | | * agent/findkey.c (agent_write_private_key): Factor file name generation out to ... (fname_from_keygrip): new. (write_extended_private_key): Add and implement new arg MAYBE_UPDATE. (agent_write_shadow_key): Ditto. * agent/command.c (cmd_readkey): Update the shadow-key in card mode. -- GnuPG-bug-id 6135
* gpg: Fix --card-status to handle lowercase APPTYPEsWerner Koch2022-08-161-6/+6
| | | | * g10/card-util.c (current_card_status): Use ascii_strcasecmp.
* gpg: Fix detecting OpenPGP card by serialno.NIIBE Yutaka2022-08-161-4/+5
| | | | | | | | | | | | * g10/card-util.c (get_info_for_key_operation): Use ->apptype to determine card's APP. (current_card_status): Even if its SERIALNO is not like OpenPGP card, it's OpenPGP card when app says so. -- GnuPG-bug-id: 5100 Signed-off-by: NIIBE Yutaka <[email protected]> Backported-from-master: 157f1de64e437cecd75335e9f4077ba9835e3da0
* common: In private key mode write "Key:" always last in name-value.Werner Koch2022-08-161-13/+40
| | | | | | | | | | | | | * common/name-value.c (nvc_write): Take care of Key. Factor some code out to ... (write_one_entry): new. -- The key item is in general not manual editable thus we put it at the end of a file. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit c9fa28bfad297b17e76341ffb40383ce92da5d44)
* agent: Create and use Token entries to track the display s/n.Werner Koch2022-08-1510-36/+272
| | | | | | | | | | | | | | | | | | | | | | | | * agent/divert-scd.c (linefeed_to_percent0A): New. (ask_for_card): Add arg grip. Read Token and Label items and use them. (divert_pksign, divert_pkdecrypt): Pass down grip. * agent/findkey.c (write_extended_private_key): Add args serialno, keyref, and dispserialno. Writen Token item. (agent_write_private_key): Add args serialno, keyref, and dispserialno. (read_key_file): Add arg r_keymeta. (agent_keymeta_from_file): New. (agent_write_shadow_key): Remove leading spaces from serialno and keyid. * agent/protect-tool.c (agent_write_private_key): Ditto. * agent/learncard.c (agent_handle_learn): Get DISPSERIALNO and pass to agent_write_shadow_key. * agent/command-ssh.c (card_key_available): Ditto. -- GnuPG-bug-id: 6135 This patch backports some changes from master but also adds the Display-S/N tracking.
* common: New function nve_set.Werner Koch2022-08-152-15/+90
| | | | | | | | | | | | * common/name-value.c (nve_set): New. (nvc_set): Use nve_set. (nvc_delete_named): New. (nvc_get_string): New. (nvc_get_boolean): New. -- This function is required to allow updating a specific line. The other new functions are backported from master
* gpg: Fix wrong error message for keytocard.Werner Koch2022-08-041-3/+1
| | | | | | | * g10/call-agent.c (agent_keytocard): Emit SC_OP_FAILURE. -- GnuPG-bug-id: 6122
* common: Silence warnings from AllowSetForegroundWindow.Werner Koch2022-08-032-2/+12
| | | | | * common/sysutils.c (gnupg_allow_set_foregound_window): Print warning only with debug flag set.
* dirmngr: Fix failed malloc error message.Werner Koch2022-08-031-2/+5
| | | | * dirmngr/ocsp.c (check_signature): Fix error printing of xtrymalloc.
* gpgconf: Add config file for Windows Registry dumps.Werner Koch2022-08-033-1/+85
| | | | | | | * tools/gpgconf.c (show_registry_entries_from_file): New. (show_configs): Call it. * doc/examples/gpgconf.rnames: New. * doc/Makefile.am (examples): Add it.
* gpg: Make symmetric + pubkey encryption de-vs compliant.Werner Koch2022-08-021-5/+46
| | | | | | | | | | | | | | | | | | | | | | | * g10/mainproc.c (proc_encrypted): Make symmetric + pubkey encryption de-vs compliant. * g10/mainproc.c (struct symlist_item): New. (struct mainproc_context): Add field symenc_list. (release_list): Free that list. (proc_symkey_enc): Record infos from symmetric session packet. (proc_encrypted): Check symkey packet algos -- The original check was too strong because it is in fact compliant to encrypt with a symmetric key and and public key. Thus decryption should issue a compliance status. In addition we now check that the cipher algorithms used to symmetrically encrypt the session key are all compliant. This is similar to our check for all public key encrypted session key packets. GnuPG-bug-id: 6119 Fixes-commit: b03fab09e188f7bb10237d4f20455e4026737e4e
* gpgconf: Improve registry dumping.Werner Koch2022-08-024-15/+44
| | | | | | | | | * common/w32-reg.c (read_w32_registry_string): Map REG_DWORD to a string. (read_w32_reg_string): Add arg r_hklm_fallback and change all callers. (show_configs): Indicate whether the HKLM fallback was used. * tools/gpgconf.c (show_other_registry_entries): Fix the Outlook Addin Registry key. Indicate whether the HKLM fallback was used.
* gpg: For de-vs use SHA-256 instead of SHA-1 as implicit preference.Werner Koch2022-07-281-2/+10
| | | | | | | | * g10/pkclist.c (select_algo_from_prefs): Change implicit hash algorithm. -- GnuPG-bug-id: 6043
* agent: New option --no-user-trustlist and --sys-trustlist-name.Werner Koch2022-07-274-17/+77
| | | | | | | | | | | | | | | | | | | | | | | | | | * agent/gpg-agent.c (oNoUserTrustlist,oSysTrustlistName): New. (opts): Add new option names. (parse_rereadable_options): Parse options. (finalize_rereadable_options): Reset allow-mark-trusted for the new option. * agent/agent.h (opt): Add fields no_user_trustlist and sys_trustlist_name. * agent/trustlist.c (make_sys_trustlist_name): New. (read_one_trustfile): Use here. (read_trustfiles): Use here. Implement --no-user-trustlist. Also repalce "allow_include" by "systrust" and adjust callers. -- With the global options we can now avoid that a user changes the Root-CA trust by editing the trustlist.txt. However, to implement this we need a new option so that we don't need to rely on some magic like --no-allow-mark-trusted has been put into a force section. The second option makes system administration easier as it allows to keep the trustlist in a non-distributed file. GnuPG-bug-id: 5990 Backported-from-master: 1530d04725d475bf29328eab40b42f72ff8aa06b
* gpg: Look up user ID to revoke by UID hashIngo Klöcker2022-07-272-31/+93
| | | | | | | | | | | | | | | * g10/keyedit.c (find_userid_by_namehash, find_userid): New. (keyedit_quick_revuid): Use find_userid() instead of iterating over the nodes of the keyblock. * tests/openpgp/quick-key-manipulation.scm: Add test for revoking a user ID specified by its hash. -- This makes it possible to specify the user ID to revoke as UID hash when calling --quick-revoke-uid. GnuPG-bug-id: 5936 (cherry picked from commit 35b17550706c8b7479ae96654feb97c05263cfc9)
* wkd: Bind the address to the nonce.Werner Koch2022-07-271-6/+67
| | | | | | | | | | | | * tools/gpg-wks-server.c (make_pending_fname): New. (store_key_as_pending, check_and_publish): Use here. (process_new_key): Pass addrspec to store_key_as_pending. (expire_one_domain): Expire also the new files. -- Along with the pass traversal bug this enhancement was Suggested-by: Philipp Breuch <[email protected]> GnuPG-bug-id: 6098
* dirmngr: Ask keyservers to provide the key fingerprintsIngo Klöcker2022-07-261-1/+1
| | | | | | | | | | | | | * dirmngr/ks-engine-hkp.c (ks_hkp_search): Add "fingerprint=on" to request URL. -- Some keyservers, e.g. keyserver.ubuntu.com (Hockeypuck), do not provide the key fingerprints by default. Therefore, we ask for the fingerprints explicitly. GnuPG-bug-id: 5741 (cherry picked from commit c7fa4c7f8bf375e3739ef8361f38b6b31113b8bf)
* gpg: Request keygrip of key to add via command interfaceIngo Klöcker2022-07-252-2/+11
| | | | | | | | | | | | * g10/keygen.c (ask_algo): Request keygrip via cpr_get. * doc/help.txt (gpg.keygen.keygrip): New help text. -- This change makes it possible to add an existing (sub)key to another key via the status/command interface. GnuPG-bug-id: 5771 (cherry picked from commit 19b1a28621c614b81f596e363b1ce49dd9fae115)
* wkd: Fix path traversal attack on gpg-wks-server.Werner Koch2022-07-252-0/+25
| | | | | | | | * tools/gpg-wks-server.c (check_and_publish): Check for invalid characters in sender controlled data. * tools/wks-util.c (wks_fname_from_userid): Ditto. (wks_compute_hu_fname): Ditto. (ensure_policy_file): Ditto.
* scd:openpgp: Fix workaround for Yubikey heuristics.NIIBE Yutaka2022-07-131-8/+21
| | | | | | | | | | | | | * scd/app-openpgp.c (parse_algorithm_attribute): Handle the case of firmware 5.4, too. -- Cherry-picked master commit of: f34b9147eb3070bce80d53febaa564164cd6c977 GnuPG-bug-id: 6070 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Fail when no good algorithm attribute.NIIBE Yutaka2022-07-131-18/+29
| | | | | | | | | | | | | | | | | * scd/app-openpgp.c (parse_algorithm_attribute): Return the error. (change_keyattr): Follow the change. (app_select_openpgp): Handle the error of parse_algorithm_attribute. -- Backport master commit of: 53eddf9b9ea01210f71b851b5cb92a5f1cdb6f7d This change allows following invocation of app_select_openpgp, which may work well (if the problem is device side for initial connection). GnuPG-bug-id: 5963 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Don't inhibit SSH authentication for larger data if it can.NIIBE Yutaka2022-07-121-0/+5
| | | | | | | | | | | | * scd/app-openpgp.c (do_auth): Use command chaining if available. -- Cherry-picked from master branch of: e8fb8e2b3e66d5ea8a3dc90afdc14611abf2c3da GnuPG-bug-id: 5935 Signed-off-by: NIIBE Yutaka <[email protected]>
* Post release updatesWerner Koch2022-07-062-1/+5
| | | | --
* Release 2.3.36gnupg-2.2.36Werner Koch2022-07-061-1/+25
|
* gpgconf: New short options -V and -XWerner Koch2022-06-291-5/+40
| | | | | | | | * tools/gpgconf.c: Assign short options -X and -V (show_version_gnupg): Print the vsd version if available. -- These changes are helpful for phone support.
* agent: Flush before calling ftruncate.NIIBE Yutaka2022-06-231-0/+2
| | | | | | | | | | | | | * agent/findkey.c (write_extended_private_key): Make sure it is flushed out. -- Cherry-picked from master commit of: 99d2931887e5ba0db9007024b3420b110603d5be GnuPG-bug-id: 6035 Signed-off-by: NIIBE Yutaka <[email protected]>
* sm: Update pkcs#12 module from masterWerner Koch2022-06-213-361/+761
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * sm/minip12.c: Update from master. * sm/import.c (parse_p12): Pass NULL for curve. -- Over the last years we had a couple of changes not backported to 2.2. However, to support DFN p12 files and probably other p12 files we need to update the minip12.c module. Instead of picking commits we take the module verbatim, which is relatively easy because it was originally designed to be a standalone module. Summary of commits taken from master: sm: Improve pkcs#12 debug output. sm: Rework the PKCS#12 parser to support DFN issued keys. sm: Fix parsing encrypted data. sm: Do not print certain issuer not found diags in quiet mode. sm: Silence some output on --quiet sm: Replace all assert calls by log_assert. doc: Typo fixes in code comments sm: Add support to export ECC private keys. Detailed log messages for those commits: commit 52f9e13c0cb3b42c469e2d00352ab36948ca1e55 sm: Improve pkcs#12 debug output. * sm/minip12.c (parse_shrouded_key_bag): Fix offset diagnostic. (parse_cert_bag): Ditto. (parse_bag_data): Remove debug output. Pass startoffset. Fix offset diagnostic. commit a4e04375e84ecb7ea0d02e153cb27988fca4c2d0 sm: Rework the PKCS#12 parser to support DFN issued keys. * sm/minip12.c (struct p12_parse_ctx_s): New. Use this instead of passing several parameters to most functions. (parse_pag_data): Factor things out to ... parse_shrouded_key_bag): new. (parse_cert_bag): New. (parse_bag_data): New. (p12_parse): Setup the parse context. To support newer pkcs#12 files like those issued by the DFN we need to support another ordering of data elements. This rework reflects the P12 data structure a bit better than our old ad-hoc hacks. Tests could only be done with the certificate parts and not the encrypted private keys. GnuPG-bug-id: 6037 commit 6c50834c0905b55ee2da18728194dd4c93c377bf sm: Fix parsing encrypted data. * sm/minip12.c (cram_octet_string): Finish when N==0. (parse_bag_encrypted_data): Support constructed data with multiple octet strings. GnuPG-bug-id: 5793 commit a170f0e73f38e474b6d4463433fe344eca865fa5 sm: Do not print certain issuer not found diags in quiet mode. * sm/certchain.c (find_up_dirmngr): Print one diagnostic only in verbose mode. Do not print issuer not found diags in quiet mode. * sm/minip12.c (parse_bag_data): Add missing verbose condition. GnuPG-bug-id: 4757 commit 615d2e4fb15859320ea0ebec1bb457c692c57f0a sm: Silence some output on --quiet * sm/encrypt.c (gpgsm_encrypt): Take care of --quiet. * sm/gpgsm.c: Include minip12.h. (set_debug): Call p12_set_verbosity. * sm/import.c (parse_p12): Dump keygrip only in debug mode. * sm/minip12.c (opt_verbose, p12_set_verbosity): New. (parse_bag_encrypted_data): Print info messages only in verbose mode. GnuPG-bug-id: 4757 commit 9ee975d588ee99550917e3d459dd6f79057f5c30 gpgsm: Replace all assert calls by log_assert. commit 9bc9d0818b0e636a9dbc0dd24edf53eae95dd8e7 doc: Typo fixes in code comments commit 5da6925a334c68d736804d8f19a684a678409d99 sm: Add support to export ECC private keys. * sm/minip12.c [TEST]: Remove test code. Include util.h, tlv.h. and openpgpdefs.h. Remove the class and tag constants and replace them by those from tlv.h. (builder_add_oid, builder_add_mpi): New. (build_key_sequence): Rename to ... (build_rsa_key_sequence): this. (build_ecc_key_sequence): New. (p12_build): Call RSA or ECC builder. (p12_raw_build): Ditto. * sm/export.c (gpgsm_p12_export): Use correct armor header for ECC. (sexp_to_kparms): Support ECC. GnuPG-bug-id: 4921
* common: Add an easy to use DER builder.Werner Koch2022-06-204-12/+417
| | | | | | | | | | | | | | | | | | * common/tlv-builder.c: New. * common/tlv.c: Remove stuff only used by GnuPG 1. (put_tlv_to_membuf, get_tlv_length): Move to ... * common/tlv-builder.c: here. * common/tlv.h (tlv_builder_t): New. -- Such code should actually go into libksba and we will eventually do that. However, for now it is easier to keep it here. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 5ea878274ef51c819368f021c69c518b9aef6f82) - Add coverity meta comment from commit a95ddffdcd58383cce93677be5e7e11c5c229a98
* g10: Fix garbled status messages in NOTATION_DATAWerner Koch2022-06-141-9/+4
| | | | | | | | | | | | * g10/cpr.c (write_status_text_and_buffer): Fix off-by-one -- Depending on the escaping and line wrapping the computed remaining buffer length could be wrong. Fixed by always using a break to terminate the escape detection loop. Might have happened for all status lines which may wrap. GnuPG-bug-id: T6027
* agent,scd: Make sure to set CONFIDENTIAL flag in Assuan.NIIBE Yutaka2022-06-093-3/+17
| | | | | | | | | | | | | | | * agent/call-scd.c (inq_needpin): Call assuan_begin_confidential and assuan_end_confidential, and wipe the memory after use. * agent/command.c (cmd_preset_passphrase): Likewise. * scd/command.c (pin_cb): Likewise. -- Backport the change of master commit of: 052f58422dca1044aba7acb4cf57416e7a8cb01f GnuPG-bug-id: 5977 Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr,w32: Silence compiler warnings for the LDAP API.Werner Koch2022-06-033-2/+26
| | | | --
* w32: Avoid warning about not including winsock2.h after windows.hWerner Koch2022-06-031-0/+3
| | | | * common/dynload.h: Include winsock2.h first.
* w32: Allow Unicode filenames for iobuf_cancel.Werner Koch2022-06-033-35/+24
| | | | | | | | | * common/iobuf.c (iobuf_cancel): Use gnupg_remove * common/mischelp.c (same_file_p): Allow for Unicode names. -- Note that the second patch is used to handle Unicode filenames which are symbolic links.
* scd:p15: Fix accidental commit of debug codeWerner Koch2022-06-011-6/+3
| | | | | | | * scd/app-p15.c (do_sign): Revert MSE setting. -- Fixes-commit: 91acbdc93c8a6ae06b483a27c8bb7c33a978108d
* scd: Shorten cardio debug output for all zeroes.Werner Koch2022-06-011-4/+33
| | | | | | | | * scd/apdu.c (all_zero_p): New. (send_le): Use it. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 9b6f574928546e6905a92c3e74d72478f1585c66)
* scd: Fix use of SCardListReaders for PC/SC.NIIBE Yutaka2022-05-171-1/+1
| | | | | | | | | | | | | * scd/apdu.c (open_pcsc_reader): Initialize NREADER. -- Backport master commit of: 1b1684cf6192d9edb90a54ebe4a0e66b3d59a44b Reported-by: Ludovic Rousseau GnuPG-bug-id: 5979 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Add workaround for ECC attribute on Yubikey.NIIBE Yutaka2022-05-101-1/+2
| | | | | | | | | | | | | * scd/app-openpgp.c (parse_algorithm_attribute): Skip possibly bogus octet in a key attribute. -- Apply master commit of: 054d14887ef8fa1cbadef4ed2ea28213f25f5d25 GnuPG-bug-id: 5963 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:p15: Improve the displayed S/N for Technology Nexus cards.Werner Koch2022-05-061-6/+42
| | | | | | | | | * scd/app-p15.c (any_control_or_space_mem): New. (get_dispserialno): Add new code. -- This works with my test cards and now reflects what's printed on the front matter of the card.
* scd:p15: Fix the the sanity check of the displayed S/N.Werner Koch2022-05-061-2/+6
| | | | | | | | | * scd/app-p15.c (any_control_or_space): Fix loop. -- This check is only done to avoid printing wrongly encoded S/N for human consumption. e
* scd:p15: Fix reading certificates without length info.Werner Koch2022-05-051-6/+23
| | | | | | * scd/app-p15.c (readcert_by_cdf): Do not use extended mode if the CDF object has no length info. Add debug output when reading a cert. (read_p15_info): No more need to disable extended mode for GeNUA cards.
* scd: New debug flags "card".Werner Koch2022-05-052-1/+4
| | | | | | | | | | * scd/scdaemon.c (debug_flags): Add "card". * scd/scdaemon.h (DBG_CARD_VALUE, DBG_CARD): New. -- Some information from parsing the card are often very helpful. However, the card_io triggered APDU dumps are in most cases too heavy. Thus this new debug flag.
* gpg: Minor robustness fix.Werner Koch2022-05-051-6/+9
| | | | | | | | * g10/parse-packet.c (mpi_read_detect_0_removal): Protect agains failed gcry_mpi_scan. -- Fixes-commit: 3fcef7371480cce392d690897d42955f1b19c12a
* tests: Add a test for Ed25519 keys for non-protected secret.NIIBE Yutaka2022-05-021-0/+69
| | | | | | | | | | | | * tests/openpgp/issue5120.scm: New. -- Applied the master commit of: 602c37ac0678d690a5b68d6c1749b8daa3d5f328 GnuPG-bug-id: 5120, 5953 Signed-off-by: NIIBE Yutaka <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-17 14:25:17 +0000