aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * scd: Support PASSWD --clear for OpenPGP card.NIIBE Yutaka2019-01-231-1/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (do_change_pin): Implement handling APP_CHANGE_FLAG_CLEAR. -- It is specified in the specification version 3.1 or later. Some version 2 cards (including Gnuk) support this feature. Any version 1 card has no support for this feature. For CHVNO = 1, it clears for both of 81 and 82; That is, user's key usages for signing and others (decryption and auth). For CHVNO = 3, it clears for 83, admin key. For CHVNO = 2, it clears 82; That is, user's key usages others (decryption and auth). Signed-off-by: NIIBE Yutaka <[email protected]>
| * gpg: Stop early when trying to create a primary Elgamal key.Werner Koch2019-01-221-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | * g10/misc.c (openpgp_pk_test_algo2): Add extra check. -- The problem is that --key-gen --batch with a parameter file didn't detect that Elgamal is not capable of signing and so an error was only triggered at the time the self-signature was created. See the code comment for details. GnuPG-bug-id: 4329 Signed-off-by: Werner Koch <[email protected]>
| * card-tool: Add skeleton for new toolWerner Koch2019-01-224-6/+936
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * tools/gpg-card-tool.c: New. * tools/gpg-card-tool-w32info.rc: New. * tools/Makefile.am: Add new tool. -- To support more cards than the OpenPGP card it is useful to have a separate tool. It will have have the "gpg --card-edit" style interactive interface as well as direct command line options for all commands. In a first step the OpenPGP card will be supported, to allow its use as an alternative to the gpg command, and the forthcoming PIV card support. The tool can be though as a direct interface to scdaemon. Signed-off-by: Werner Koch <[email protected]>
| * common: Add generic status print function.Werner Koch2019-01-223-0/+63
| | | | | | | | | | | | | | | | | | | | | | | | | | * common/status.c (gnupg_set_status_fd): New. (gnupg_status_printf): New. * po/Makevars (XGETTEXT_OPTIONS): Add gnupg-status_printf. -- Some of the extra tools take a --status-fd option to print certain status messages. A generic printf style print function thus makes sense. Signed-off-by: Werner Koch <[email protected]>
| * scd: Support CHV-STATUS and CHECKPIN for PIV.Werner Koch2019-01-211-25/+212
| | | | | | | | | | | | | | | | | | | | | | | | * scd/app-piv.c (parse_pin_keyref): New. (get_chv_status): New. (do_getattr): Add name CHV-STATUS. (verify_pin): Add arg keyref to support other PINs. (do_change_pin): New. Right now limited to --clear. (do_check_pin): New. (app_select_piv): Register new commands. Signed-off-by: Werner Koch <[email protected]>
| * scd: Add option --clear to PASSWD.Werner Koch2019-01-217-6/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/command.c (cmd_passwd): Add option --clear. (send_status_printf): New. * scd/app-common.h (APP_CHANGE_FLAG_CLEAR): New. * scd/app-nks.c (do_change_pin): Return an error if that option is used. * scd/app-openpgp.c (do_change_pin): Ditto. -- Card application may support this option to clear the PIN verification status of a specific PIN. Signed-off-by: Werner Koch <[email protected]>
| * scd: Add very basic support for PIV cards.Werner Koch2019-01-204-1/+1301
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-piv.c: New. * scd/Makefile.am (card_apps): Add app-piv.c * scd/app.c (app_new_register): Try to get a Yubikey serial number. Detect the PIV application. (get_supported_applications): Add "piv". -- Right now this allows the use of the authentication key (9A) for SSH authentication. More support will follow soon. Tested with Yubikey-5.
| * scd: One new and one improved 7816 function.Werner Koch2019-01-206-27/+90
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/apdu.c (apdu_send_direct): New arg R_SW. * scd/command.c (cmd_apdu): Ditto. * scd/iso7816.c (iso7816_apdu_direct): New arg R_SW. (iso7816_general_authenticate): New. * scd/app-nks.c (get_chv_status, get_nks_version): Pass NULL for new arg. -- iso7816_general_authenticate will be used for the PIV card support. The new arg to iso7816_apdu_direct and apdu_send_direct allows to get the raw status word back without the need to handle an output buffer. Signed-off-by: Werner Koch <[email protected]>
| * ssh: Simplify the curve name lookup.Werner Koch2019-01-171-84/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (struct ssh_key_type_spec): Add field alt_curve_name. (ssh_key_types): Add some alternate curve names. (ssh_identifier_from_curve_name): Lookup also bey alternative names and return the canonical name. (ssh_key_to_blob): Simplify the ECDSA case by using gcry_pk_get_curve instead of the explicit mapping. (ssh_receive_key): Likewise. Use ssh_identifier_from_curve_name to validate the curve name. Remove the reverse mapping because since GnuPG-2.2 Libgcrypt 1.7 is required. (ssh_handler_request_identities): Log an error message. -- This change will make it easier to support other curves, in particular those from tokens. Libgcrypt has a large list of alias names which we now use to to make the mapping more flexible. Signed-off-by: Werner Koch <[email protected]>
| * gpg: Report STATUS_NO_SECKEY when it is examined.NIIBE Yutaka2019-01-163-15/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/packet.h (struct pubkey_enc_list): Add result. * g10/mainproc.c (proc_pubkey_enc): Initialize ->result. (proc_encrypted): Report STATUS_NO_SECKEY status. * g10/pubkey-enc.c (get_session_key): Set ->result. -- This change is for GPGME compatibility. Before this change, gpgme/tests/json/t-json failed with t-decrypt-verify. Signed-off-by: NIIBE Yutaka <[email protected]>
| * doc: Mark keyserver-options timeout and http-proxy as obsolete.Werner Koch2019-01-081-25/+5
| | | | | | | | --
| * scd: Fix for USB INTERRUPT transfer.NIIBE Yutaka2019-01-071-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | * scd/ccid-driver.c (intr_cb): When LIBUSB_TRANSFER_NO_DEVICE, just handle this event as failure. -- It used to try another interrupt transfer request to make sure if it fails again. GnuPG-bug-id: 4308 Signed-off-by: NIIBE Yutaka <[email protected]>
| * scd: Add two variants to the set of ISO7816 functions.Werner Koch2019-01-032-0/+86
| | | | | | | | | | | | | | * scd/iso7816.c (iso7816_select_application_ext): New. (iso7816_get_data_odd): New. Signed-off-by: Werner Koch <[email protected]>
| * scd: Support "READKEY --advanced" for all cards.Werner Koch2019-01-031-6/+29
| | | | | | | | | | | | | | | | | | | | | | * scd/command.c (cmd_readkey): Reformat for advanced mode. -- The --advanced option used to work only if the driver supported that but not if we extracted the public key from an x.509 certificate. This patch fixes that. Signed-off-by: Werner Koch <[email protected]>
| * doc: Typo fix in code commentWerner Koch2019-01-021-4/+4
| | | | | | | | --
| * wks: Do not use compression for the encrypted data.Werner Koch2018-12-182-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * tools/gpg-wks-client.c (encrypt_response): Add arg -z0. * tools/gpg-wks-server.c (encrypt_stream): Ditto. -- If for example a server was built without the development packages of the compression libraries installed, the server will not be able to decrypt a request. In theory this can't happen due to the preference system but it is just to easy to create the server's key using a different version of gpg and then use gpg-wks-server built differently. For the short messages we exchange compression is not really required and thus we better do without to make the system more robust. Signed-off-by: Werner Koch <[email protected]>
| * scd: Fix description string.NIIBE Yutaka2018-12-181-2/+2
| | | | | | | | | | | | * scd/app-openpgp.c (data_objects): Capitalize the word for usage. Signed-off-by: NIIBE Yutaka <[email protected]>
| * Silence a few compiler warnings new with gcc 8.Werner Koch2018-12-172-7/+14
| | | | | | | | | | | | | | | | * dirmngr/dns.c: Include gpgrt.h. Silence -Warray-bounds also gcc. * tools/gpg-pair-tool.c (command_respond): Init two vars to silence gcc. Signed-off-by: Werner Koch <[email protected]>
| * card: Suppress error message by agent_scd_cardlist.NIIBE Yutaka2018-12-121-1/+1
| | | | | | | | | | | | | | * g10/call-agent.c (agent_scd_cardlist): Add FLAG_FOR_CARD_SUPPRESS_ERRORS. Signed-off-by: NIIBE Yutaka <[email protected]>
| * agent: Make the S2K calibration time runtime configurabe.Werner Koch2018-12-114-9/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/protect.c (s2k_calibration_time): New file global var. (calibrate_s2k_count): Use it here. (get_calibrated_s2k_count): Replace function static var by ... (s2k_calibrated_count): new file global var. (set_s2k_calibration_time): New function. * agent/gpg-agent.c (oS2KCalibration): New const. (opts): New option --s2k-calibration. (parse_rereadable_options): Parse that option. -- Note that using an unrelistic high value (like 60000) takes quite some time for calibration. GnuPG-bug-id: 3399 Signed-off-by: Werner Koch <[email protected]>
| * dirmngr: Retry another server from the pool on 502, 503, 504.Werner Koch2018-12-111-7/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/ks-engine-hkp.c (handle_send_request_error): Add arg http_status and handle it. (ks_hkp_search): Get http_status froms end_request and pass on to handle_send_request_error. (ks_hkp_get): Ditto. (ks_hkp_put): Ditto. -- GnuPG-bug-id: 4175 Signed-off-by: Werner Koch <[email protected]>
| * dirmngr: New function http_status2string.Werner Koch2018-12-112-0/+26
| | | | | | | | | | | | | | | | | | * dirmngr/http.c (http_status2string): New. -- Right now only the standard 5xx codes. Signed-off-by: Werner Koch <[email protected]>
| * gpg: In search-keys return "Not found" instead of "No Data".Werner Koch2018-12-111-1/+3
| | | | | | | | | | | | | | | | * g10/keyserver.c (keyserver_search): Check for NO_DATA. -- GnuPG-bug-id: 3830 Signed-off-by: Werner Koch <[email protected]>
| * tools: Use POSIX compatible arguments for findTomi Leppänen2018-12-111-1/+1
| | | | | | | | * tools/addgnupghome (filelist): Remove bashism.
| * g10: Fix print_pubkey_info new line output.NIIBE Yutaka2018-12-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/keylist.c (print_pubkey_info): Reverse the condition. -- This mistakes were introduced when replacing by estream. It resulted 'gpg --card-status' from a process with no controlling terminal fails. Fixes-commit: fb2ba98963beea249474f5d6d7345cf9b4b7f570 Signed-off-by: NIIBE Yutaka <[email protected]>
| * wks: Fix filter expression syntax flaw.Werner Koch2018-12-041-4/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | * tools/wks-util.c (wks_get_key, wks_filter_uid): The filter expression needs a space before the value. (install_key_from_spec_file): Replace es_getline by es_read_line and remove debug output. -- A value of starting with '<' was considered an invalid operator due to our tokenization method. Signed-off-by: Werner Koch <[email protected]>
| * gpg: Prepare revocation keys for use with v5 keys.Werner Koch2018-12-0410-40/+66
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/packet.h (struct revocation_key): Add field 'fprlen'. * g10/parse-packet.c (parse_revkeys): Set fprlen and allow for v5 keys. Also fix reading of unitialized data at place where MAX_FINGERPRINT_LEN is used. * g10/revoke.c (gen_desig_revoke): Allow for v5 keys and use fprlen. Do an explicit compare to avoid reading unitialized data. * g10/sig-check.c (check_revocation_keys): Use the fprlen. * g10/getkey.c (merge_selfsigs_main): Do an explicit copy to avoid reading unitialized data. * g10/import.c (revocation_present): Use fprlen. * g10/keyedit.c (show_key_with_all_names): Use fprlen. (menu_addrevoker): Use fprlen. Allow for v5 keys. * g10/keygen.c (keygen_add_revkey): Use fprlen. (parse_revocation_key): Allow for v5 keys. * g10/keyid.c (keyid_from_fingerprint): Allow for v5 keys. Print a better error message in case of bogus fingerprints. * g10/keylist.c (print_revokers): Use fprlen. -- The reading of uninitialized data is harmless but we better fix it to make valgrind happy. More serious was that we always passed MAX_FINGERPRINT_LEN but we will need to support 20 and 32 octet fingerprints and MAX_FINGERPRINT_LEN would be too large for a v4. Signed-off-by: Werner Koch <[email protected]>
| * wks: Allow reading of --install-key arguments from stdin.Werner Koch2018-12-044-10/+81
| | | | | | | | | | | | | | | | | | * tools/wks-util.c (install_key_from_spec_file): New. (wks_cmd_install_key): Call it. * tools/gpg-wks-client.c (main): Allow --install-key w/o arguments. * tools/gpg-wks-server.c (main): Ditto. Signed-off-by: Werner Koch <[email protected]>
| * gpg: New list-option "show-only-fpr-mbox".Werner Koch2018-12-044-1/+65
| | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (parse_list_options): Add option "show-only-fpr-mbox". * g10/options.h (LIST_SHOW_ONLY_FPR_MBOX): New. * g10/keylist.c (list_keyblock_simple): New. (list_keyblock): Call it. (list_all): Do not print the keyring name in LIST_SHOW_ONLY_FPR_MBOX mode. Signed-off-by: Werner Koch <[email protected]>
| * wks: Create sub-directoriesWerner Koch2018-12-041-5/+25
| | | | | | | | | | | | | | * tools/wks-util.c (wks_compute_hu_fname): Stat and create directory if needed. Signed-off-by: Werner Koch <[email protected]>
| * wks: Add new commands --install-key and --remove-key to the client.Werner Koch2018-12-042-0/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * tools/gpg-wks-client.c (aInstallKey, aRemoveKey, oDirectory): New. (opts): Add "--install-key", "--remove-key" and "-C". (parse_arguments): Parse them. (main): Check that the given directory exists. Implement the new commands. -- These commands maybe useful to prepare a WKD directory on a non-Unix box using the standard wks client. Signed-off-by: Werner Koch <[email protected]>
| * wks: Move a few server functions to wks-util.Werner Koch2018-12-043-309/+317
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * tools/gpg-wks-server.c (write_to_file): Move to ... * tools/wks-util.c: here. * tools/gpg-wks-server.c (compute_hu_fname): Move to ... * tools/wks-util.c (wks_compute_hu_fname): here. * tools/gpg-wks-server.c (fname_from_userid): Move to ... * tools/wks-util.c (wks_fname_from_userid): here. * tools/gpg-wks-server.c (command_install_key): Move to ... * tools/wks-util.c (wks_cmd_install_key): here and change caller. * tools/gpg-wks-server.c (command_remove_key): Move to ... * tools/wks-util.c (wks_cmd_remove_key): here and change callers. Signed-off-by: Werner Koch <[email protected]>
| * build: Remove --with-*-prefix from configure_opts.NIIBE Yutaka2018-12-041-10/+0
| | | | | | | | | | | | | | | | | | | | | | * autogen.rc (configure_opts): Remove --with-*-prefix. -- It seems that we haven't done cross-build for amd64 for a while, we now use nPth instead of Pth. Signed-off-by: NIIBE Yutaka <[email protected]>
| * g10/mainproc: disable hash contexts when --skip-verify is usedJussi Kivilinna2018-12-011-3/+8
| | | | | | | | | | | | | | | | * g10/mainproc.c (proc_plaintext): Do not enable hash contexts when opt.skip_verify is set. -- Signed-off-by: Jussi Kivilinna <[email protected]>
| * common/iobuf: fix memory wiping in iobuf_copyJussi Kivilinna2018-12-011-1/+6
| | | | | | | | | | | | | | | | * common/iobuf.c (iobuf_copy): Wipe used area of buffer instead of first sizeof(char*) bytes. -- Signed-off-by: Jussi Kivilinna <[email protected]>
| * common/mischelp: use platform memory zeroing function for wipememoryJussi Kivilinna2018-12-013-19/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/mischelp.h (wipememory): Replace macro with function prototype. (wipememory2): Remove. * common/mischelp.c (wipememory): New. * configure.ac (AC_CHECK_FUNCS): Check for 'explicit_bzero'. -- In new wipememory function, memory is cleared through platform provided secure memory zeroing function, SecureZeroMemory or explicit_bzero. If none of these is available, memset is called through volatile function pointer to so that compiler won't optimize away the call. Signed-off-by: Jussi Kivilinna <[email protected]>
| * scd: Add strerror to new error message.Werner Koch2018-11-301-1/+1
| | | | | | | | | | | | * agent/call-scd.c (wait_child_thread): Add %s. Signed-off-by: Werner Koch <[email protected]>
| * gpg: Improve error message about failed keygrip computation.Werner Koch2018-11-301-1/+6
| | | | | | | | | | | | * g10/keyid.c (keygrip_from_pk): Print the fingerprint on failure. Signed-off-by: Werner Koch <[email protected]>
| * scd: Serialize opening device by select_application.NIIBE Yutaka2018-11-281-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app.c (app_new_register): Don't lock APP_LIST_LOCK here. (select_application): Lock with APP_LIST_LOCK earlier. -- What we want to do here is to serialize the call of select_application. In the old code, it was possible that a call of select_application was blocked internally, and then another call of select_application entered. We can have a dedicated lock for call of select_application, but it is easier to re-use APP_LIST_LOCK. Signed-off-by: NIIBE Yutaka <[email protected]>
| * agent: Better serialization for scdaemon access.NIIBE Yutaka2018-11-271-19/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | * agent/call-scd.c (unlock_scd): Move lock before accessing IN_USE. (wait_child_thread): Add log_info for Windows, and fixed log_error message. -- The old code is still valid with cooperate threads, but this is better. Signed-off-by: NIIBE Yutaka <[email protected]>
| * w32: Fix linkage of gpg-pair-toolAndre Heinecke2018-11-261-1/+1
| | | | | | | | | | | | | | * tools/Makefile.am (gpg_pair_tool_LDADD): Add W32SOCKLIBS. -- This is required because parts of libcommon depend on ws2_32.
| * agent: Have a thread to wait for the child process of scdaemon.NIIBE Yutaka2018-11-263-89/+97
| | | | | | | | | | | | | | | | * agent/call-scd.c (wait_child_thread): New. (start_scd): Create a thread for wait_child_thread. (agent_scd_check_aliveness): Remove. Signed-off-by: NIIBE Yutaka <[email protected]>
| * agent: Defer calling assuan_release when it's still in use.NIIBE Yutaka2018-11-261-22/+40
| | | | | | | | | | | | | | | | | | | | * agent/call-scd.c (struct scd_local_s): Remove LOCK, introduce IN_USE and INVALID flags. (unlock_scd): Call assuan_release when CTX is invalid. (start_scd): Set IN_USE. (agent_scd_check_aliveness): Don't call assuan_release when it's in use. Signed-off-by: NIIBE Yutaka <[email protected]>
| * agent: Clean up SCDaemon management.NIIBE Yutaka2018-11-261-8/+1
| | | | | | | | | | | | | | | | * agent/call-scd.c (struct scd_local_s): Remove ctrl_backlink. (start_scd): Don't assign to the field. (agent_scd_check_aliveness): Fix typo in comment. Signed-off-by: NIIBE Yutaka <[email protected]>
| * dirmngr: Avoid possible CSRF attacks via http redirects.Werner Koch2018-11-227-95/+435
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/http.h (parsed_uri_s): Add fields off_host and off_path. (http_redir_info_t): New. * dirmngr/http.c (do_parse_uri): Set new fields. (same_host_p): New. (http_prepare_redirect): New. * dirmngr/t-http-basic.c: New test. * dirmngr/ks-engine-hkp.c (send_request): Use http_prepare_redirect instead of the open code. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. -- With this change a http query will not follow a redirect unless the Location header gives the same host. If the host is different only the host and port is taken from the Location header and the original path and query parts are kept. Signed-off-by: Werner Koch <[email protected]>
| * doc: Clarify use of clear and nodefault in the AKL.Werner Koch2018-11-212-2/+4
| | | | | | | | --
| * gpg: Start using OCB mode by default with Libgcrypt 1.9.Werner Koch2018-11-161-1/+3
| | | | | | | | | | | | | | | | * g10/main.h (GCRYPT_VERSION_NUMBER): Fix type in condition. -- GnuPG-bug-id: 4259 Signed-off-by: Werner Koch <[email protected]>
| * doc: Add NEWS item from recent 2.2 releases.Werner Koch2018-11-161-9/+71
| | | | | | | | --
| * card: Display UIF setting.NIIBE Yutaka2018-11-153-1/+24
| | | | | | | | | | | | | | | | * g10/call-agent.h (agent_card_info_s): Add UIF fields. * g10/call-agent.c (learn_status_cb): Put UIF DOs info. * g10/card-util.c (current_card_status): Output for UIF. Signed-off-by: NIIBE Yutaka <[email protected]>
| * scd: Make "learn" report about KDF data object.NIIBE Yutaka2018-11-152-3/+12
| | | | | | | | | | | | | | * scd/app-openpgp.c (do_learn_status): Report KDF attr. * g10/card-util.c (current_card_status): Output KDF for with_colons. Signed-off-by: NIIBE Yutaka <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-19 09:00:27 +0000