aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* scd: Make the PIN cache robust against wrongdoing of gpg-agent.Werner Koch2020-01-132-4/+81
| | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): New field pincache. (cache_pin): Set it. (pin_from_cache): Consult it. * scd/app-piv.c (struct app_local_s): New field pincache. (cache_pin): Set it. (pin_from_cache): Consult it. -- Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Implement PIN cache.Werner Koch2020-01-135-29/+100
| | | | | | | | | | | | | | | | | | | | | | * scd/command.c (pincache_put): Add arg pinlen and change all callers to provide it. * scd/app-piv.c (cache_pin): New. (pin_from_cache): New. (ask_and_prepare_chv): Add args no_cache and r_unpaddedpinlen. Take PIN from the cache. Return the unpadded length. (verify_chv): Add arg ctrl. Cache the PIN. (do_change_chv): Clear PIN cache. -- The PIV pins are padded but we want to store the unpadded PIN. Thus the changes to the function. Code has has been tested by commenting the no_cache parameter because we the current test certificate was created for PIV.9C which requires a verification for each use. More testing is required. GnuPG-bug-id: 4791 Signed-off-by: Werner Koch <[email protected]>
* agent: Avoid multiple calls to scd for KEYINFO.Werner Koch2020-01-131-2/+45
| | | | | | | | | | | | | | | | | | | | * agent/command.c (struct server_local_s): Add last_card_keyinfo. (eventcounter): Add maybe_key_change. (cmd_genkey, cmd_scd, cmd_import_key, cmd_delete_key): Bump new counter. (cmd_keyinfo): Cache the keyinfo from the card. (start_command_handler): Release the cache. -- This cache speeds up processing of commands like "gpg -K" because scdaemon does not need to be asked for each key as long as nothing changed with the card. We should have a better notification service from scdaemon to make sure that we get only the relevant events. What we do right now is a bit course but sufficient. Signed-off-by: Werner Koch <[email protected]>
* agent: Replace free by xfree in recently added code.Werner Koch2020-01-131-3/+3
| | | | | | * agent/call-scd.c (agent_card_free_keyinfo): Use xfree. Signed-off-by: Werner Koch <[email protected]>
* gpg,sm: Avoid useless ASFW diagnostic in loopback mode.Werner Koch2020-01-134-0/+39
| | | | | | | | | | | * common/sysutils.c (inhibit_set_foregound_window): New var. (gnupg_inhibit_set_foregound_window): New func. (gnupg_allow_set_foregound_window): Use var. * g10/gpg.c (main): Inhibit in loopback mode. * sm/gpgsm.c (main): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
* scd: Fix memory leak in command READKEY.Werner Koch2020-01-132-3/+9
| | | | | | | * scd/command.c (cmd_readcert): Replace xstrdup by xtrystrdup. (cmd_readkey): Ditto. Fix memory leak. Signed-off-by: Werner Koch <[email protected]>
* scd: Make SERIALNO --all work correctly and use it.Werner Koch2020-01-135-57/+94
| | | | | | | | | | | | | | * scd/app.c (maybe_switch_app): Factor reselect code out to ... (run_reselect): new. (app_write_learn_status): Tweak diagnostics. (app_do_with_keygrip): Run reselect if a card has more than one switchable application. * agent/call-scd.c (agent_card_serialno): Ditto. * tools/card-call-scd.c (start_agent): Use option --all with SERIALNO. (scd_serialno): Ditto. Signed-off-by: Werner Koch <[email protected]>
* agent: handle SSH operation by KEYGRIP.NIIBE Yutaka2020-01-131-86/+15
| | | | | | | | | | * agent/command-ssh.c (card_key_available): Supply KEYINFO argument. Call agent_card_readkey by KEYGRIP of KEYINFO. Don't use $AUTHKEYID, but IDSTR of KEYINFO. (ssh_handler_request_identities): Follow the change of card_key_available. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Extend agent_card_getattr with KEYGRIP.NIIBE Yutaka2020-01-133-5/+11
| | | | | | | | | | * agent/agent.h (struct card_key_info_s): KEYGRIP null terminated. (agent_card_getattr): Add KEYGRIP argument. * agent/call-scd.c (agent_card_getattr): Handle KEYGRIP argument. (card_keyinfo_cb): Make KEYGRIP null terminated. * agent/command.c (cmd_readkey): Follow the change. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Implement direct access by KEYGRIP for GETATTR and READKEY.NIIBE Yutaka2020-01-102-50/+119
| | | | | | | | | * scd/app-openpgp.c (do_readkey): Handle KEYGRIP access. * scd/command.c (do_readkey): New. (cmd_readkey): Use do_readkey supporting KEYGRIP access. (cmd_getattr): Supporting KEYGRIP access. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:openpgp: Implement PIN cache.Werner Koch2020-01-091-104/+229
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (wipe_and_free, wipe_and_free_string): Use them everywere where we do a wipememory followed by a free. (pin2hash_if_kdf): Change interface. The input PIN is not anymore changed. Further there are no more assumptions about the length of the provided buffer. (cache_pin): Restructure. (chvno_to_keyref): New. (pin_from_cache): New. (verify_a_chv): Add arg CTRL. Adjust for changed pin2hash_if_kdf. Chache and retrieve the PIN here. (verify_chv2): Do not cache the PIN here. (build_enter_admin_pin_prompt): Add arg 'r_remaining'. (verify_chv3): Adjust for changed pin2hash_if_kdf. Implement the PIN cache. (do_change_pin): Clear the PIN cache. Do not change the PIN here. Lots of adjustments to cope with the chnaged pin2hash_if_kdf. (do_sign): Do not cache the PIN here. -- Note that some of the changes are required because we can't rely that the PIN is always cached in secure memory. Thus it is better to do an explicit wipe. Testing the PIN cache can currently only be done my modifying the code to do a verification for each operation. Only some basic testing has been done. Clearing the PIN cache is also not fully implemented. With the forthcoming changes to app-piv we should be enter able to test the PIN cache. Missing stuff: - The agent should be able to selectively clear the cache on a per slot base. - We should replace AESWRAP by OCB. Signed-off-by: Werner Koch <[email protected]>
* scd: Use a scdaemon internal key to protect the PIN cache IPC.Werner Koch2020-01-094-112/+148
| | | | | | | | | | | | | | | | | | | * agent/call-scd.c (handle_pincache_put): Do not decrypt. (handle_pincache_get): New. (inq_needpin): Call it. * scd/command.c (set_key_for_pincache): New. (pincache_put): Restructure and set key. (pincache_get): Ditto. -- This change does away with encrypting and decrypting the cached PIN in the agent. There is no need for this we can simply cache the cryptogram and let scdaemon decrypt after retrieving it from the agent. This way we do not need to share a key between gpg-agent and scdaemon and further the cached content is invalid after the scdaemon process has been replaced. Signed-off-by: Werner Koch <[email protected]>
* agent: SSH: SCD KEYINFO to list available keys.NIIBE Yutaka2020-01-095-116/+39
| | | | | | | | | | | | | | * agent/agent.h (agent_card_cardlist): Remove. (agent_card_keyinfo): Add CAP argument. * agent/call-scd.c (card_cardlist_cb): Remove. (agent_card_cardlist): Remove. (agent_card_keyinfo): Support CAP constraint. * agent/command-ssh.c (card_key_list): Remove. (ssh_handler_request_identities): Use SCD KEYINFO command. * agent/command.c (cmd_keyinfo): Follow the API change. * agent/divert-scd.c (ask_for_card): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: First changes to implement a PIN cache.Werner Koch2020-01-0711-85/+418
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/command.c (pincache_put): New. Uses a dummy key for now. (pincache_get): New. * scd/app.c (select_application): Flush the PIN cache. (scd_update_reader_status_file): Ditto. (maybe_switch_app): Call the new prep_reselect function. (app_write_learn_status): Ditto. * scd/app-openpgp.c (cache_pin): New helper to cache a PIN. (verify_chv2): Call it. (verify_chv3): Call it. (clear_chv_status): Call it. (do_change_pin): Call it. * scd/app-common.h (struct app_ctx_s): Add function 'prep_select'. * scd/app-openpgp.c (do_prep_reselect): New stub function. (app_select_openpgp): Set new stub function. * scd/app-piv.c (do_prep_reselect): New stub function. (app_select_piv): Set new stub function. * scd/app-common.h (struct app_ctx_s): Add parameter ctrl to setattr, sign, auth, decipher, and check_pin. Change all implementations and callers to pass such a parameter. -- This is work in progress. Signed-off-by: Werner Koch <[email protected]>
* agent: First changes to support a PIN cache for scdaemon.Werner Koch2020-01-074-29/+217
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/agent.h (CACHE_MODE_PIN): New. * agent/cache.c (housekeeping): Special handling of new new mode. (agent_flush_cache): Ditto. Add arg 'pincache_only' and change caller. (agent_put_cache): Support new mode. (agent_get_cache): Ditto. * agent/call-scd.c (wait_child_thread): Flush the entire PIN cache. (start_scd): Ditto. (agent_card_killscd): Ditto. (handle_pincache_put): New. Uses a dummy encryption key for now. (pincache_put_cb): New. (inq_needpin): Prepare for PINCACHE_GET inquiry. (learn_status_cb): Handle the PINENTRY_PUT status line. (get_serialno_cb): Ditto (agent_card_pksign): Ditto. (padding_info_cb): Ditto. (agent_card_readcert): Ditto. (agent_card_readkey): Ditto. (agent_card_writekey): Ditto. (card_getattr_cb): Ditto. (card_cardlist_cb): Ditto. (card_keyinfo_cb): Ditto. (pass_status_thru): Ditto. -- Take care: This is not finished. Signed-off-by: Werner Koch <[email protected]>
* kbx: Make sure the tables are joined in a select.Werner Koch2020-01-071-3/+3
| | | | | | | | * kbx/backend-sqlite.c (run_select_statement): Join the tables. -- For whatever reasons that part was missing or got lost before committing.
* scd: Minor fix for readibility.Werner Koch2020-01-033-3/+3
| | | | | | | | | | | | * scd/command.c (open_card_with_request): Use NULL instead of APPTYPE_NULL. -- Using the enum is wrong because a string is expected. However it did harm anything because the value of the enum is 0 and thus equivalent to NULL. Signed-off-by: Werner Koch <[email protected]>
* kbx: Initial support for an SQLite backendWerner Koch2020-01-029-87/+1424
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * kbx/backend-sqlite.c: New. * kbx/Makefile.am (keyboxd_SOURCES): Add it. (keyboxd_CFLAGS, keyboxd_LDADD): Add SQLite flags. * kbx/backend.h (enum database_types): Add DB_TYPE_SQLITE. (be_sqlite_local_t): New typedef. (struct db_request_part_s): Add field besqlite. * kbx/backend-support.c (strdbtype): Add string for DB_TYPE_SQLITE. (be_generic_release_backend): Support SQLite. (be_release_request): Ditto. (be_find_request_part): Ditto. (is_x509_blob): Rename to ... (be_is_x509_blob): this and make global. * kbx/frontend.c (kbxd_set_database): Detect ".db" suffix and use that for SQLite. (kbxd_search): Support SQLite (kbxd_store): Ditto. (kbxd_delete): Ditto. * kbx/frontend.h (kbxd_store_modes): Move to ... * kbx/keyboxd.h (enum kbxd_store_modes): here. * kbx/keyboxd.c (main): USe pubring.db for now. This is a temporary hack. * kbx/backend-kbx.c (be_kbx_delete): Remove unused var cert. -- Take care: This is not finished and in particular filling the database takes quite long. Signed-off-by: Werner Koch <[email protected]>
* Update wk's signing keyWerner Koch2020-01-011-0/+0
| | | | | | -- The expiration time of that smartcard based key has been prolonged by 2 years.
* gpg: Fix output of --with-secret if a pattern is given.Werner Koch2019-12-231-8/+25
| | | | | | | | | | | | | * g10/keylist.c (list_one): Probe for a secret key in --with-secret mode. -- In contrast to list_all(), list_one() did not tests for a secret key and took MARK_TRUSTED verbatim as an indication for "secret key available". GnuPG-bug: 4061 Signed-off-by: Werner Koch <[email protected]>
* doc: Typ fix in commentWerner Koch2019-12-231-1/+1
| | | | --
* kbx: Change keyboxd to work only with one database.Werner Koch2019-12-233-162/+112
| | | | | | | | | | | | | | | | | | * kbx/frontend.c (the_database): New var. (db_desc_t): Remove. (kbxd_add_resource): Renamed to ... (kbxd_set_database): this. Simplify. (kbxd_search): Change to use only one database. (kbxd_store): Ditto. (kbxd_delete): Ditto. -- The original implementation was way to complicated and would have only brought back the problems deciding which database to use for each key. The new scheme used one configured database and only that. That database needs to be set right at the start. Signed-off-by: Werner Koch <[email protected]>
* scd: Enhance KEYINFO command to limit listing with capability.NIIBE Yutaka2019-12-195-35/+79
| | | | | | | | | | | | | | | | | | * scd/app-common.h: Add CAPABILITY argument to the WITH_KEYGRIP. (app_do_with_keygrip): Likewise. * scd/app-openpgp.c (send_keyinfo_if_available): New. (do_with_keygrip): Support listing with CAPABILITY. * scd/app-piv.c (do_with_keygrip): Likewise. * scd/app.c (maybe_switch_app): Supply the argument. (app_do_with_keygrip): Add CAPABILITY argument. * scd/command.c (cmd_pksign, cmd_pkauth): Supply the argument. (cmd_pkdecrypt): Likewise. (cmd_keyinfo): Support listing with CAPABILITY. -- GnuPG-bug-id: 4784 Signed-off-by: NIIBE Yutaka <[email protected]>
* Include release information from 2.2.17 to 2.2.19Werner Koch2019-12-091-1/+121
| | | | --
* sm: Add special case for expired intermediate certificates.Werner Koch2019-12-062-17/+91
| | | | | | | | | | | | | | | | | | | | | | | | | * sm/gpgsm.h (struct server_control_s): Add field 'current_time'. * sm/certchain.c (find_up_search_by_keyid): Detect a corner case. Also simplify by using ref-ed cert objects in place of an anyfound var. -- See the code for a description of the problem. Tested using the certs from the bug report and various command lines gpgsm --faked-system-time=XXXX --disable-crl-checks \ -ea -v --debug x509 -r 0x95599828 with XXXX being 20190230T000000 -> target cert too young with XXXX being 20190330T000000 -> okay with XXXX being 20190830T000000 -> okay, using the long term cert with XXXX being 20220330T000000 -> target cert expired The --disabled-crl-checks option is required because in our a simple test setting dirmngr does not know about the faked time. GnuPG-bug-id: 4696 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Tell gpg about WKD looks resulting from a cache.Werner Koch2019-12-062-2/+8
| | | | | | | | | | | | | * dirmngr/server.c (proc_wkd_get): Print new NOTE status "wkd_cached_result". * g10/call-dirmngr.c (ks_status_cb): Detect this and print a not ein verbose mode. -- This little patch is helpful to see why a WKD change still does not work after it has been updated on the server. Signed-off-by: Werner Koch <[email protected]>
* gpg: Use AKL for angle bracketed mail address with -r.Werner Koch2019-12-041-6/+31
| | | | | | | | | | | | | | | | | | | | * g10/getkey.c (get_pubkey_byname): Extend is_mbox checking. (get_best_pubkey_byname): Ditto. -- With this patch it is now possible to use gpg -e -r '<[email protected]>' and auto key locate will find the key. Without that a plain mail address; i.e. gpg -e -r '[email protected]' was required. GnuPG-bug-id: 4726 Signed-off-by: Werner Koch <[email protected]>
* gpg: Change the way v5 fingerprints are printed.Werner Koch2019-11-283-16/+7
| | | | | | | | | | | | | * g10/gpg.h (MAX_FORMATTED_FINGERPRINT_LEN): Increase by one. * g10/keyid.c (format_hexfingerprint): Change v5 key formatting. -- The new format are groups of 5 letters to resemble the CW speed measurement rules. Many hams are used to such blocks from their CW lessons. Note that there is no double blank in the middle as with the v4 keys. Signed-off-by: Werner Koch <[email protected]>
* gpg: Implement insert, update, and delete via keyboxd.Werner Koch2019-11-281-7/+96
| | | | | | | | | | | | * g10/call-keyboxd.c (struct store_parm_s): New. (store_inq_cb): New. (keydb_update_keyblock): Implement the keyboxd part. (keydb_insert_keyblock): Ditto. (keydb_delete_keyblock): Ditto. (keydb_search_reset): Clear ubid flag. Also use the correct union member for building the search string. Signed-off-by: Werner Koch <[email protected]>
* kbx: Add new command DELETE.Werner Koch2019-11-285-0/+138
| | | | | | | | * kbx/kbxserver.c (cmd_delete): New. * kbx/frontend.c (kbxd_delete): New. * kbx/backend-kbx.c (be_kbx_delete): New. Signed-off-by: Werner Koch <[email protected]>
* kbx: Redefine the UBID which is now the primary fingerprint.Werner Koch2019-11-2818-180/+170
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/util.h (UBID_LEN): New. Use it at all places. * kbx/keybox-blob.c (create_blob_finish): Do not write the UBID item. * kbx/keybox-dump.c (print_ubib): Remove. (_keybox_dump_blob): Do not print the now removed ubid flag. * kbx/keybox-search-desc.h (struct keydb_search_desc): Use constants for the size of the ubid and grip. * kbx/keybox-search.c (blob_cmp_ubid): New. (has_ubid): Make it a simple wrapper around blob_cmp_ubid. (keybox_get_data): Add arg 'r_ubid'. * kbx/frontend.h (enum kbxd_store_modes): New. * kbx/kbxserver.c (cmd_store): Add new option --insert. * kbx/backend-cache.c (be_cache_initialize): New. (be_cache_add_resource): Call it here. * kbx/backend-kbx.c (be_kbx_seek): Remove args 'fpr' and 'fprlen'. (be_kbx_search): Get the UBID from keybox_get_data. * kbx/backend-support.c (be_fingerprint_from_blob): Replace by ... (be_ubid_from_blob): new. Change all callers. * kbx/frontend.c (kbxd_add_resource): Temporary disable the cache but use the new cache init function. (kbxd_store): Replace arg 'only_update' by 'mode'. Seek using the ubid. Take care of the mode. -- It turned out that using the hash of the entire blob was not helpful. Thus we redefine the Unique-Blob-ID (UBID) as the primary fingerprint of the blob. In case this is a v5 OpenPGP key a left truncated version of the SHA-256 hash is used; in all other cases the full SHA-1 hash. Using a SHA-256 hash does not make sense because v4 keys are and will for some time be the majority of keys and thus padding them with zeroes won't make any difference. Even if fingerprint collisions can eventually be created we will assume that the keys are bogus and that it does not make sense to store its twin also in our key storage. We can also easily extend the update code to detect a collision and reject the update. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Replace no-strict-overflow pragma by wrapv pragma.Werner Koch2019-11-271-3/+8
| | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (time_for_housekeeping_p): Build with --fwrapv. Replace protecting macro. -- I once replaced all JNLIB macros by GPGRT macros. However, I missed to get this right for the push pragma test and used GPGRT_GCC_HAVE_PUSH_PRAGMA instead of the correct GPGRT_HAVE_PRAGMA_GCC_PUSH Now after fixing this it turned out that no-strict-overflow is not anymore supported as oprimize pragma and thus I replaced that too according to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58454 . Tested with 32 bit Windows but the real test will be in 2038. Signed-off-by: Werner Koch <[email protected]>
* gpg: Move a keydb function to another file.Werner Koch2019-11-273-42/+46
| | | | | | | * g10/keydb.c (build_keyblock_image): Move to ... * g10/build-packet.c (build_keyblock_image): here. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Rework of the LDAP code, part 1.Werner Koch2019-11-266-40/+93
| | | | | | | | | | | | | | | | | | | | | | | * dirmngr/http.h (struct parsed_uri_s): Add flag is_ldap. * dirmngr/http.c (do_parse_uri): Set flag. Do not error out for a missing slashes in an http scheme if NO_SCHEME_CHECK is active. * dirmngr/t-http.c (main): Print new flag. * dirmngr/ks-engine-ldap.c (ks_ldap_help): Use flag instead of checking the scheme. * dirmngr/ldap-parse-uri.c (ldap_uri_p): Re-implement using http_parse_uri. * dirmngr/t-ldap-parse-uri.c (main): Add option --verbose. -- This patch merely remove the separate parser for checking for an LDAP scheme. It is better to let our generic URI parser handle this. Also fixes this bug || url[4] == 'i' || url[4] == 'i') to make the rarely used ldapi scheme case-insensitive. More changes to the LDAP code are planned. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Make building with a TLS library mandatoryWerner Koch2019-11-262-59/+37
| | | | | | | * configure.ac: Do not build dirmngr if no TLS is available. * dirmngr/http.c: Remove all uses of the USE_TLS macro. Signed-off-by: Werner Koch <[email protected]>
* doc: Fixed variable naming.Werner Koch2019-11-262-2/+2
| | | | | | | | * kbx/keybox.h: Fix naming of arguments. * scd/ccid-driver.c (print_error) [TEST]: Add missing break. Note that this is anyway an impossible case. Signed-off-by: Werner Koch <[email protected]>
* agent: Improve --debug-pinentry diagnosticsWerner Koch2019-11-251-19/+35
| | | | | | | | | | | | | | * agent/call-pinentry.c (atfork_cb): Factor code out to ... (atfork_core): new. -- We convey certain envvars directly via the environment to Pinentry and thus they don't show up in the Assuan logging. Because we better don't call a logging function in an atfork handle, this patch splits the code up and uses the same code to display what was done in at fork after the connection has been established. Signed-off-by: Werner Koch <[email protected]>
* doc,dirmngr: Clarify --standard-resolver.Werner Koch2019-11-231-1/+2
| | | | | | -- Signed-off-by: Werner Koch <[email protected]>
* wkd: Let --install-key write a template policy file.Werner Koch2019-11-231-0/+83
| | | | | | | | | * tools/wks-util.c (ensure_policy_file): New. (wks_cmd_install_key): Call it. -- GnuPG-bug-id: 4753 Signed-off-by: Werner Koch <[email protected]>
* po: Apply removal of dirmngr/ldap-wrapper-ce.c.NIIBE Yutaka2019-11-191-1/+0
| | | | | | * po/POTFILES.in: Update. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr,gpg: Better diagnostic in case of bad TLS certificates.Werner Koch2019-11-183-7/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | * doc/DETAILS: Specify new status code "NOTE". * dirmngr/ks-engine-http.c (ks_http_fetch): Print a NOTE status for a bad TLS certificate. * g10/call-dirmngr.c (ks_status_cb): Detect this status. -- For example a gpg -v --locate-external-keys [email protected] now yields gpg: Note: server uses an invalid certificate gpg: (further info: bad cert for 'posteo.net': \ Hostname does not match the certificate) gpg: error retrieving '[email protected]' via WKD: Wrong name gpg: error reading key: Wrong name (without -v the "further info" line is not shown). Note that even after years Posteo is not able to provide a valid certificate for their .net addresses. Anyway, this help to show the feature. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Forward http redirect warnings to gpg.Werner Koch2019-11-185-1/+24
| | | | | | | | | | | | | | | | * dirmngr/http.c: Include dirmngr-status.h (http_prepare_redirect): Emit WARNING status lines for redirection problems. * dirmngr/http.h: Include fwddecl.h. (struct http_redir_info_s): Add field ctrl. * dirmngr/ks-engine-hkp.c (send_request): Set it. * dirmngr/ks-engine-http.c (ks_http_fetch): Set it. * g10/call-dirmngr.c (ks_status_cb): Detect the two new warnings. -- This should make it easier to diagnose problems with bad WKD servers. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Fixed typo in recently added diagnostic.Werner Koch2019-11-182-2/+2
| | | | --
* scd,ccid: Fix detection of supported readers with pinpad.NIIBE Yutaka2019-11-151-3/+4
| | | | | | | * scd/ccid-driver.c (ccid_transceive_secure): When not supported, return CCID_DRIVER_ERR_NOT_SUPPORTED. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Use IPv4 or IPv6 interface only if available.Werner Koch2019-11-124-3/+119
| | | | | | | | | | | | | | | * dirmngr/dns-stuff.c (cached_inet_support): New variable. (dns_stuff_housekeeping): New. (check_inet_support): New. * dirmngr/http.c (connect_server): Use only detected interfaces. * dirmngr/dirmngr.c (housekeeping_thread): Flush the new cache. -- This currently works only for Windows but that is where users really ran into problems. The old workaround was to configure disable-ipv4 or disable-ipv6. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Tune down err on missing ldapservers fileAndre Heinecke2019-11-121-1/+1
| | | | | | | | | | | | * dirmngr/dirmngr.c (parse_ldapservers_file): Tune down error in case no such file exists. -- This is hardly an error because by default such a file does not exist. This caused trouble in support because people think "Oh the system prints an error". GnuPG-Bug-Id: T3539
* dirmngr: Remove cruft from dirmngr_ldapWerner Koch2019-11-116-708/+58
| | | | | | | | | | | | | | | | | | | * configure.ac (USE_LDAPWRAPPER): Remove ac_define and conditional. * dirmngr/Makefile.am: Remove USE_LDAPWRAPPER and considere true. * dirmngr/ldap-wrapper-ce.c: Remove. * dirmngr/ldap-wrapper.c: Remove USE_LDAPWRAPPER stuff. Minor chnages to debug output. * dirmngr/dirmngr_ldap.c: Remove USE_LDAPWRAPPER stuff. Remove my_ldap macros. (fetch_ldap) [W32]: Use ldap_sslinit. -- Note that the ldap_sslinit stuff for Windows has not been tested. This patch removes the whole wrapper-but-linked business because we do not need it anymore. WindowsCE for which we used it is pretty dead. Signed-off-by: Werner Koch <[email protected]>
* gpg: Forbid the creation of SHA-1 third-party key signatures.Werner Koch2019-11-111-7/+44
| | | | | | | | | | | * g10/sign.c (SIGNHINT_KEYSIG, SIGNHINT_SELFSIG): New. (do_sign): Add arg signhints and inhibit SHA-1 signatures. Change callers to pass 0. (complete_sig): Add arg signhints and pass on. (make_keysig_packet, update_keysig_packet): Set signhints. -- Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Rename an enum value for clarity.Werner Koch2019-11-111-3/+3
| | | | | | | | | | * dirmngr/ldapserver.h: Rename LDAPSERVER_OPT. -- Using _OPT is not good because it does not describe for what this configuration group is used. _SESSION immediately shows the purpose. Signed-off-by: Werner Koch <[email protected]>
* gpgsm: Allow sepcification of ldaps servers.Werner Koch2019-11-099-17/+145
| | | | | | | | | | | | | | | | | | | | | | | | | | | * sm/gpgsm.h (struct keyserver_spec): Add field use_ldaps. * sm/gpgsm.c (parse_keyserver_line): Parse flags. * sm/call-dirmngr.c (prepare_dirmngr): Send ldaps flag to the dirmngr. * dirmngr/dirmngr.h (struct ldap_server_s): Add field use_ldaps. * dirmngr/ldapserver.c (ldapserver_parse_one): Parse flags. * dirmngr/ldap.c (start_cert_fetch_ldap): Call wrapper with --tls. * dirmngr/dirmngr_ldap.c: New option --tls. (fetch_ldap): Make use of that option. -- There was no way to specify an LDAPS server in dirmngr_ldapserver.socnf or with gpgsm's --keyserver option. This patch fixes this. Eventually we should allow to replace host and port by a partial URI in the same way ldap_initialize does it. For backward compatibility we do not yet do that. Although the dirmngr code accepts an URL (eg. taken from a certificate), I can't see how the scheme was ever used. Thus the patch also detects an ldaps scheme and uses this. That part has not been tested, though. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-10 14:55:53 +0000