aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* speedo: Add a w32-release target.Werner Koch2015-10-081-1/+20
| | | | | | | | | | | | | | | | | | | | -- This simplifies building a release to: git tag -s gnupg-2.n.m ./autogen.sh --force cd ~/b/gnupg ~/s/gnupg/configure --enable-maintainer-mode make distcheck tar xJf gnupg-2.n.m.tar.bz2 make -f gnupg-2.n.m/build-aux/speedo.mk w32-release gpg -sbvu KEYID gnupg-2.n.m.tar.bz2 gpg -sbvu KEYID gnupg-w32-2.n.m-20151008.tar.xz gpg -sbvu KEYID gnupg-w32-2.n.m-20151008.exe scp gnupg-2.n.m.tar.bz2 $TARGET scp gnupg-w32-2.n.m-20151008.tar.xz $TARGET scp gnupg-w32-2.n.m-20151008.exe $TARGET
* common: Allow building of mkdir_p.c for Windows.Werner Koch2015-10-083-65/+95
| | | | | | | | | | | | * common/mkdir_p.c: Change license and comment debug statements. (amkdir_p, mkdir_p): Fail on malloc error and use default_errsource to build an error code. Change return value to gpg_error_t. (amkdir_p): Use gnupg_mkdir. * common/membuf.c: Include util.h first to avoid redefined macro warnings. Signed-off-by: Werner Koch <[email protected]>
* gpg: Add option --print-dane-records.Werner Koch2015-10-087-23/+141
| | | | | | | | | | | | | | | * g10/options.h (opt): Add field "print_dane_records". * g10/gpg.c (oPrintDANERecords): new. (opts): Add --print-dane-records. (main): Set that option. * g10/export.c (do_export): Remove EXPORT_DANE_FORMAT handling. (do_export_stream): Add EXPORT_DANE_FORMAT handling. * g10/keylist.c (list_keyblock_pka): Implement DANE record printing. * g10/gpgv.c (export_pubkey_buffer): New stub. * g10/test-stubs.c (export_pubkey_buffer): New stub. Signed-off-by: Werner Koch <[email protected]>
* Fix two unused/possible-uninitialized var warnings.Werner Koch2015-10-082-2/+1
| | | | --
* gpg: Pass CTRL parameter to all key listing functions.Werner Koch2015-10-084-34/+39
| | | | | | | | | | | | | | | | | | | | | * g10/keylist.c (public_key_list): Add arg CTRL. (secret_key_list): Ditto. (list_all, list_one): Ditto. (locate_one): Ditto. (list_keyblock_pka): Ditto. (list_keyblock): Ditto. (list_keyblock_direct): Ditto. * g10/keygen.c (proc_parameter_file): Add arg CTRL. (read_parameter_file): Ditto. (quick_generate_keypair): Ditto. (do_generate_keypair): Ditto. (generate_keypair): Pass arg CTRL. * g10/gpg.c (main): Pass arg CTRL to quick_generate_keypair. -- This will help use to implement the --server mode. Signed-off-by: Werner Koch <[email protected]>
* gpg: Remove unfinished experimental code to export as S-expressions.Werner Koch2015-10-072-175/+10
| | | | | | | | | | | | | * g10/options.h (EXPORT_SEXP_FORMAT): Remove. (EXPORT_DANE_FORMAT): New. * g10/export.c (parse_export_options): Remove "export-sexp-format". (export_seckeys): Adjust for removed option. (export_secsubkeys): Ditto. (do_export): Prepare for DANE format. (build_sexp, build_sexp_seckey): Remove. (do_export_stream): Remove use of removed functions. Signed-off-by: Werner Koch <[email protected]>
* gpg: Add new --auto-key-locate mechanism "dane".Werner Koch2015-10-066-15/+36
| | | | | | | | | | | | | | | * g10/call-dirmngr.c (gpg_dirmngr_dns_cert): Allow fetching via DANE. * g10/keyserver.c (keyserver_import_cert): Add arg "dane_mode". * g10/options.h (AKL_DANE): New. * g10/getkey.c (get_pubkey_byname): Implement AKL_DANE. (parse_auto_key_locate): Ditto. -- To test this use gpg --auto-key-locate clear,dane,local --locate-key -v [email protected] Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Addlow fetching keys using OpenPGP DANEWerner Koch2015-10-061-17/+54
| | | | | | | | | | | | | | * dirmngr/server.c (cmd_dns_cert): Add option --dane. -- This implements draft-ietf-dane-openpgpkey-05.txt To test this use $ gpg-connect-agent --dirmngr > /hex > dns_cert --dane [email protected] Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Improve DNS code to retrieve arbitrary records.Werner Koch2015-10-062-4/+55
| | | | | | | | | | | | | * dirmngr/dns-cert.c (get_dns_cert): Add hack to retrieve arbitrary resource records. * dirmngr/dns-cert.h (DNS_CERTTYPE_RRBASE): New. (DNS_CERTTYPE_RR61): New. -- This has been tested with ADNS on Unix and with the standard resolver. Because ADNS works it should also work on Windows. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Change DNS code to make additions easier.Werner Koch2015-10-061-64/+66
| | | | | * dirmngr/dns-cert.c (get_dns_cert) [!USE_ADNS]: Change loop to allow adding more resource types.
* dirmngr: Make commands RELOADDIRMNGR and KILLDIRMNGR work properly.Werner Koch2015-10-061-8/+7
| | | | | | | * dirmngr/server.c (cmd_killdirmngr): Set assuan close flag. (cmd_reloaddirmngr): Use check_owner_permission. Signed-off-by: Werner Koch <[email protected]>
* po: Typo fix in German translation.Werner Koch2015-10-061-2/+2
| | | | --
* dirmngr: Do tilde expansion for --hkp-cacert.Werner Koch2015-10-063-3/+16
| | | | | | | | | * dirmngr/dirmngr.c (parse_rereadable_options): Do tilde expansion and check for cert file existance in option --hkp-cacert. -- GnuPG-bug-id: 2120 Signed-off-by: Werner Koch <[email protected]>
* gpg: Fail decryption for AES etc message w/o MDC.Werner Koch2015-10-061-0/+16
| | | | | | | | | | | | | | | | * g10/mainproc.c (proc_encrypted): Fail for modern messages w/o MDC. -- This change turns the missing MDC warning into an error if the message has been encrypted using a cipher with a non-64 bit block length cipher and it is not Twofish. We can assume that such messages are created by code which should have been able to create MDC packets. AES was introduced with 1.0.3 on 2000-09-18 shortly after MDC (1.0.2 on 2000-07-12). We need to exclude Twofish because that might have been used before MDC. Signed-off-by: Werner Koch <[email protected]>
* agent: Fix verification of signature for smartcard.NIIBE Yutaka2015-10-061-1/+10
| | | | | | | | | * agent/pksign.c (agent_pksign_do): Use public key smartcard. -- Since gcry_pk_verify can't handle shadowed private key, public key SEXP should be prepared for smartcard.
* agent: Fix non-allocation for pinentry_loopback.NIIBE Yutaka2015-10-051-4/+2
| | | | | * agent/call-pinentry.c (agent_get_passphrase): Don't allocate, it will be allocated by pinentry_loopback.
* gpg: Install a dirmngr.conf file.Werner Koch2015-10-054-46/+87
| | | | | | | | | | | | | | | | | * g10/dirmngr-conf.skel: New. * g10/Makefile.am (EXTRA_DIST): Add file. (install-data-local, uninstall-local): Install that file. * g10/openfile.c (copy_options_file): Add arg "name", return a value, simplify with xstrconcat, and factor warning message out to: (try_make_homedir): here. Also install dirmngr.conf. * g10/options.skel: Remove --keyserver entry. -- The option --keyserver in gpg has been deprecated in favor of --keyserver in dirmngr.conf. Thus we need to install a skeleton file for dirmngr to set a default keyserver. Signed-off-by: Werner Koch <[email protected]>
* gpg: Deprecate the --keyserver option.Werner Koch2015-10-056-31/+82
| | | | | | | | | | | | | | | | | | | | | | | * g10/keyserver.c (keyserver_refresh): Change return type to gpg_error_t. Use gpg_dirmngr_ks_list to print the name of the keyserver to use. (keyserver_search): Do not print the "no keyserver" error message. The same error is anyway returned from dirmngr. * g10/call-dirmngr.c (ks_status_parm_s): Add field "keyword". (ks_status_cb): Handle other status keywords. (gpg_dirmngr_ks_list): New. * tools/gpgconf-comp.c (gc_options_gpg): Deprecate "keyserver". (gc_options_dirmngr): Add "Keyserver" group and "keyserver". -- Along with the corresponding dirmngr change this option allows to configure the keyserver only in dirmngr.conf. Existing configurations will continue to work. However, GUIs using gpgconf now the keyserver option under the dirmngr (aka Key Acquirer) tab unless they are in export mode in which the keyserver option is also show for gpg. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Add option --keyserver.Werner Koch2015-10-054-25/+124
| | | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (oKeyServer): New. (opts): Add "keyserver". (parse_rereadable_options): Parse that options (main): Add option to the gpgconf list. * dirmngr/dirmngr.h (opt): Add field "keyserver". * dirmngr/server.c (ensure_keyserver): New. (make_keyserver_item): New. Factored out from (cmd_keyserver): here. Call ensure_keyserver. (cmd_ks_search): Call ensure_keyserver. (cmd_ks_get): Ditto. (cmd_ks_fetch): Ditto. (cmd_ks_put): Ditto. -- This option specifies the keyserver to be used if the client does not set another keyserver. We want to fade out the use of --keyserver in gpg.conf in favor of specifying it here. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Make clear that --use-tor is not yet ready for use.Werner Koch2015-10-053-1/+15
| | | | | | * dirmngr/dirmngr.c (main): Print a warning if --use-tor has been given. * tools/gpgconf-comp.c (gc_options_dirmngr): Make --use-tor invisible.
* po: Update the German translation.Werner Koch2015-10-051-7/+26
| | | | --
* gpgconf: Change displayed name of Dirmngr to "Key Acquirer".Werner Koch2015-10-051-1/+1
| | | | | | | | | | | | * tools/gpgconf-comp.c (gc_component): Change printed name. -- All network access is handled by Dirmngr so at least in the GUI option dialog we should acknowledge that by changing the name to an issuer to understand term. This is an update of 819bba75aaed11ecef2e274add173718358212b9 suggested by Neal Walfield. The former term "Network Manager" conflicts with the well known GNOME network manager tool.
* tests: Two new OpenPGP test keys from E2E.Werner Koch2015-10-054-1/+81
| | | | --
* scd: Use Assuan macro instead of a number constant.Werner Koch2015-10-021-3/+4
| | | | --
* dirmngr: Fix use-after-free due to a realloc shrinking.Werner Koch2015-10-021-2/+2
| | | | | | | | | | | * dirmngr/ks-engine-hkp.c (map_host): Do not use original pointer after realloc. -- vex01 reported and debugged the problem. GnuPG-bug-id: 2107 Signed-off-by: Werner Koch <[email protected]>
* agent: Fix alignment problem with the second passphrase struct.Werner Koch2015-10-022-5/+23
| | | | | | | | | | | | | | | | | | | | * agent/genkey.c (agent_ask_new_passphrase): Use a separate malloc for PI2. Check return value of the malloc function. * agent/command-ssh.c (ssh_identity_register): Use a separate malloc for PI2. Wipe PI2. -- For whatever stupid reasons I once allocated only one memory area and split that into PI and PI2. This is actually a common pattern with malloc but here we used a made up object size and do not take the extra alignment required into account. One of these not yet hit by a (sig)bus PC/VAX hacker bugs. Instead of trying to fix the alignment, it is better to use a second calloc for the second struct. GnuPG-bug-id: 2112 Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix a practical hang after use of --faked-system-time.Werner Koch2015-10-012-8/+17
| | | | | | | * g10/sign.c (update_keysig_packet): Bail out if we would need to long for a new timestamp. Signed-off-by: Werner Koch <[email protected]>
* gpg: Print more info with "check selfsig".Werner Koch2015-10-011-0/+17
| | | | | * g10/keyedit.c (print_and_check_one_sig): Print more Some sigsub packets.
* gpg: Add debug helper to --edit-keys's check sub-command.Werner Koch2015-10-012-16/+37
| | | | | | | | | | | | | * g10/keyedit.c (print_and_check_one_sig): Add arg "extended" and print an asterisk for the chosen selfsig. (check_all_keysigs): Add arg "only_selfsig" (keyedit_menu) <cmdCHECK>: Add optional arg "selfsig". -- Using "check selfsig" prints only the self-signatures and indicates the chosen selfsig with an asterisk. Signed-off-by: Werner Koch <[email protected]>
* common: Fix strsplit.NIIBE Yutaka2015-09-301-1/+1
| | | | * common/stringhelp.c (strsplit): Fix arguments order.
* common: Add mkdir_p.Neal H. Walfield2015-09-303-1/+205
| | | | | | | | | * common/mkdir_p.c: New file. * common/mkdir_p.h: New file. * common/Makefile.am (common_sources): Add mkdir_p.c and mkdir_p.h. -- Signed-off-by: Neal H. Walfield <[email protected]>.
* common: Remove unused files.Neal H. Walfield2015-09-302-153/+0
| | | | | | | | * common/xmalloc.c: Remove file. * common/xmalloc.h: Remove file. -- Signed-off-by: Neal H. Walfield <[email protected]>.
* common: Include <gpg-error.h>.Neal H. Walfield2015-09-301-0/+1
| | | | | | | | | | * common/logging.h: Include <gpg-error.h>. -- Signed-off-by: Neal H. Walfield <[email protected]>. logging.h uses estream_t and as such should directly include <gpg-error.h>.
* g10: Remove unused struct cmp_help_context_s.Neal H. Walfield2015-09-291-6/+0
| | | | | | | * g10/sig-check.c (struct cmp_help_context_s) Remove unused struct. -- Signed-off-by: Neal H. Walfield <[email protected]>.
* g10: Avoid an unnecessary copy.Neal H. Walfield2015-09-291-4/+20
| | | | | | | | | * g10/sig-check.c (signature_check2): Avoid copying PK to RET_PK. Instead, directly use the provided storage. If none is provided allocate some. -- Signed-off-by: Neal H. Walfield <[email protected]>.
* ssh: Fix fingerprint computation for EdDSA key.NIIBE Yutaka2015-09-292-0/+21
| | | | | | | | | * common/ssh-utils.c (get_fingerprint): Handle the prefix of 0x40. * common/t-ssh-utils.c (sample_keys): Add a new key. -- Also adding Ed25519 test key.
* agent: RSA signature verification by gpg-agent.NIIBE Yutaka2015-09-292-33/+39
| | | | | | | | | | | | * g10/sign.c (do_sign): Let verify signature by gpg-agent. * agent/pksign.c (agent_pksign_do): Call gcry_pk_verify for RSA. -- RSA signature verification should be done to prevent attacks against RSA CRT implementations and not to return invalid signature to adversary. Newer libgcrypt does so. For older libgcrypt and smartcards, gpg-agent does signature verification.
* common: Provide two new error code replacements.Werner Koch2015-09-281-0/+4
| | | | | | * common/util.h (GPG_ERR_FALSE, GPG_ERR_TRUE): Rew replcements. Signed-off-by: Werner Koch <[email protected]>
* doc,w32: Fix compiler warnings.Werner Koch2015-09-281-2/+8
| | | | --
* common: Change calling convention for gnupg_spawn_process.Werner Koch2015-09-284-56/+124
| | | | | | | | | | | | | | | | | | | | * common/exechelp.h (GNUPG_SPAWN_NONBLOCK): New. (GNUPG_SPAWN_RUN_ASFW, GNUPG_SPAWN_DETACHED): Macro to replace the numbers. * common/exechelp.h (gnupg_spawn_process): Change function to not take an optional stream for stdin but to return one. * common/exechelp-posix.c (gnupg_spawn_process): Implement change. (create_pipe_and_estream): Add args outbound and nonblock. * common/exechelp-w32.c (gnupg_spawn_process): Implement change. -- In 2.1 this function is only used at one place and the stdin parameter is not used. Thus this change is trivial for the callers but along with estream's new es_poll it is overall simpler to use. Note that the Windows version has not been tested. Signed-off-by: Werner Koch <[email protected]>
* scd: Handle error correctly.NIIBE Yutaka2015-09-281-5/+5
| | | | | * scd/apdu.c (apdu_connect): Initialize variables and check an error of apdu_get_status_internal.
* ssh: Add 256, 384 and 521 bit test keys for the fingerprint.Werner Koch2015-09-221-0/+62
| | | | | | * common/t-ssh-utils.c (sample_keys): Add 3 new keys. Signed-off-by: Werner Koch <[email protected]>
* ssh: Fix fingerprint computation for 384 bit ECDSA keys.Werner Koch2015-09-221-1/+1
| | | | | | | | | | | * common/ssh-utils.c (get_fingerprint): Fix hashed string. -- That was an obvious c+p bug which should have been caught by a test case. GnuPG-bug-id: 2075 Debian-bug-id: 795636
* agent: Fix importing ECC key.NIIBE Yutaka2015-09-191-99/+11
| | | | | | | | | * agent/cvt-openpgp.c (convert_from_openpgp_main): Only encrypted parameters are stored as opaque. (apply_protection): ARRAY members are all normal, non-opaque MPI. (extract_private_key): Get public key as normal, non-opaque MPI. Remove support of ECC key with '(flags param)'. Remove support of "ecdsa" and "ecdh" keys of our experiment.
* scd: Fix KEYTOCARD handling for ECC key.NIIBE Yutaka2015-09-191-7/+11
| | | | | * scd/app-openpgp.c (ecc_writekey): Only public key can be native format.
* common: Add new function strlist_length.Neal H. Walfield2015-09-182-0/+11
| | | | | | | * common/strlist.c (strlist_length): New function. -- Signed-off-by: Neal H. Walfield <[email protected]>.
* gpgconf: Change displayed name of Dirmngr to "Network Manager".Werner Koch2015-09-181-1/+1
| | | | | | | | | | | * tools/gpgconf-comp.c (gc_component): Change printed name. -- All network access is handled by Dirmngr so at least in the GUI option dialog we should acknowledge that by changing the name to an issuer to understand term. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Add option --use-tor as a stub.Werner Koch2015-09-1810-7/+97
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.h (opt): Add field "use_tor". * dirmngr/dirmngr.c (oUseTor): New. (opts): Add --use-tor. (parse_rereadable_options): Set option. (main): Tell gpgconf about that option. * dirmngr/crlfetch.c (crl_fetch): Pass TOR flag to the http module and return an error if LDAP is used in TOR mode. (ca_cert_fetch): Return an error in TOR mode. (start_cert_fetch): Ditto. * dirmngr/ks-engine-finger.c (ks_finger_fetch): Pass TOR flag to the http module. * dirmngr/ks-engine-hkp.c (send_request): Ditto. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ks-engine-ldap.c (ks_ldap_get): Return an error in TOR mode. (ks_ldap_search): Ditto. (ks_ldap_put): Ditto. * dirmngr/ocsp.c (do_ocsp_request): Ditto. Also pass TOR flag to the http module. * dirmngr/server.c (option_handler): Add "honor-keyserver-url-used". (cmd_dns_cert): Return an error in TOR mode. (cmd_getinfo): Add subcommand "tor" * tools/gpgconf-comp.c (gc_options_dirmngr): Add TOR group. -- More work is required to actually make --use-tor useful. For now it returns an error for almost all network access but as soon as we have added the TOR feature to the http module some parts will start to work. Signed-off-by: Werner Koch <[email protected]>
* gpg: Report a conflict between honor-keyserver-url and TOR.Werner Koch2015-09-181-0/+16
| | | | | | | | | | | | | | | | | * g10/call-dirmngr.c (create_context): Send option and print a verbose error. -- It is in general a bad idea to use honor-keyserver-url but if Dirmngr is running in TOR mode we should not allow this option at all. We let Dirmngr know about the use of this option and let Dirmngr tell use whether TOR mode is active so that we can print a hint to disable that keyserver option. A future extension in gpgconf may disable that option directly but a user may still override that and thus we better check. Signed-off-by: Werner Koch <[email protected]>
* http: Add flag to force use of TOR (part 1)Werner Koch2015-09-183-1/+22
| | | | | | | | * common/http.h (HTTP_FLAG_FORCE_TOR): New. * common/http.c (http_raw_connect, send_request): Detect flag and return an error for now. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-13 13:47:07 +0000