| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (sexp_key_construct): Use es_free to release
memory allocated by es_fclose_snatch.
(data_sign): Likewise.
--
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_send_available_keys): Clear the error when
skipping.
--
Of course we need to clear the error so that in case the last key in
the array was skipped, that error is not returned by the function.
Updates-commit: 2469dc5aae671247100339493ad7919919a02db9
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (start_command_handler_ssh): Firther protect the
SOCKET cast.
--
Note that Cygwin is not supported, YMMV.
GnuPG-bug-id: 7667
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_send_available_keys): Adjust key counter
for skipped keys.
--
Fixes-commit: 8b8a8b246c443d5631a88ec59b88edf00aa0ff51
which introduced a regression due to an extra variable for counting
the keys.
The bug showed up for example if a card with a Brainpool Auth key was
also used. Unfortunately OpenSSH still does not allow for Brainpool
keys.
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_send_available_keys): Close file and
directory on error paths.
--
GnuPG-bug-id: 7201
Signed-off-by: Jakub Jelen <[email protected]>
|
|\
| |
| |
| |
| |
| |
| |
| | |
--
Fixed conflicts:
NEWS
configure.ac
doc/gpg.texi
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* agent/agent.h (struct ephemeral_private_key_s): New.
(struct server_control_s): Add ephemeral_mode and ephemeral_keys.
(GENKEY_FLAG_NO_PROTECTION, GENKEY_FLAG_PRESET): New.
* agent/genkey.c (clear_ephemeral_keys): New.
(store_key): Add arg ctrl and implement ephemeral_mode. Change all
callers.
(agent_genkey): Replace args no_protection and preset by a generic new
flags arg.
* agent/findkey.c (wipe_and_fclose): New.
(agent_write_private_key): Add arg ctrl and implement ephemeral_mode.
Change all callers.
(agent_update_private_key): Ditto
(read_key_file): Ditto.
(agent_key_available): Ditto.
* agent/command-ssh.c (card_key_available): Do not update display s/n
in ephemeral mode. This is however enver triggred.
* agent/gpg-agent.c (agent_deinit_default_ctrl): Cleanup ephemeral
keys.
* agent/command.c (cmd_genkey): Use the new flags instead of separate
vars.
(cmd_readkey): Create a shadow key only in non-ephemeral_mode.
(cmd_getinfo): Add sub-command "ephemeral".
(option_handler): Add option "ephemeral".
--
The idea here that a session can be switched in an ephemeral mode
which does not store or read keys from disk but keeps them local to
the session.
GnuPG-bug-id: 6944
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* agent/findkey.c (agent_write_private_key): Add arg dispserialno and
update the token.
(agent_write_shadow_key): Add arg dispserialno and adjust all callers.
--
GnuPG-bug-id: 6135
Note that this has been forward ported from 2.2
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* configure.ac (HAVE_SOCKET): Detect SOCKET type.
* agent/command-ssh.c [HAVE_SOCKET] (start_command_handler_ssh): Use
SOCKET to cast.
--
GnuPG-bug-id: 6508
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|/
|
|
|
|
|
|
|
|
|
| |
* agent/findkey.c (agent_write_private_key): Add arg dispserialno and
update the token.
(agent_write_shadow_key): Add arg dispserialno and adjust all callers.
--
GnuPG-bug-id: 6135
Note that this has been forward ported from 2.2
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_send_available_keys): Redefine the order of
keys.
--
GnuPG-bug-id: 6212
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/agent.h (opt): Remove enable_extended_key_format.
* agent/gpg-agent.c (enum cmd_and_opt_values): Turn
oDisableExtendedKeyFormat and oEnableExtendedKeyFormat into dummy
options.
* agent/protect.c (do_encryption): Remove arg use_ocb and
corresponding code.
(agent_protect): Ditto. Change all callers.
* agent/findkey.c (agent_write_private_key): Simplify due to the
removal of disable-extended-key-format.
(write_extended_private_key): Fold into agent_write_private_key.
--
This change is related to
GnuPG-bug-id: 6386
but should have no visible effect except for the removal of
option --disable-extended-key-format.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/findkey.c (public_key_from_file): Add arg r_sshorder.
(agent_ssh_key_from_file): Ditto.
* agent/command-ssh.c (struct key_collection_item_s): New.
(struct key_collection_s): New.
(search_control_file): Add art r_lnr.
(add_to_key_array): New.
(free_key_array): New.
(compare_key_collection_items): New.
(ssh_send_available_keys): Rewrite to return the keys in the user
given order.
--
GnuPG-bug-id: 6212
We now first return the keys from active cards, followed by keys
listed in sshcontrol, finally from those with the "Use-for-ssh" key
attribute. Keys from active cards are returned sorted by their S/N.
Keys from sshcontrol are returned in the order they are given in that
file. Use-for-ssh keys are ordered by the value assigned to that key
attribute. The values for the latter are clamped at 99999.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (card_key_available): Replace blanks.
--
For managing the authorized_key file of ssh it is convenient if the
comment does not have any spaces. Thus we now return
cardno:FFFE_50FF3D01
instead of
cardno:FFFE 50FF3D01
Note that gpg --export-ssh-key uses the keyid as comment because it
does not known the S/N of the card. Gpg-agent however does not know
about OpenPGP and uses the s/n.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/agent.h (start_command_handler_ssh_stream): New.
* agent/command-ssh.c (start_command_handler_ssh_stream): New.
* agent/gpg-agent.c (oWin32OpenSSHSupport): New.
(W32_DEFAILT_AGENT_PIPE_NAME): New.
(main): Add oWin32OpenSSHSupport support.
(win32_openssh_thread): New.
(handle_connections): Spawn win32_openssh_thread.
* configure.ac (NEED_GPGRT_VERSION): Require libgpg-error 1.46.
--
GnuPG-bug-id: 3883
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c: Fix comments.
* agent/findkey.c (public_key_from_file): Remove "OPENPGP.3" check.
--
GnuPG-bug-id: 5996
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/agent.h (agent_raw_key_from_file): Add R_KEYMETA argument.
(agent_update_private_key): New.
* agent/command-ssh.c (data_sign): Follow the change of the function
agent_raw_key_from_file.
* agent/command.c (do_one_keyinfo): Likewise.
(cmd_keyattr): New.
(register_commands): Add an entry of cmd_keyattr.
* agent/findkey.c (agent_update_private_key): New.
(agent_raw_key_from_file): Add R_KEYMETA argument.
--
GnuPG-bug-id: 5988
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_send_available_keys): Do not bump
key_counter for ignored keys. Also use opt.debug instead of
opt.verbose and fix a memory leak.
--
The error shown by "ssh-add -l" before this fix was:
error fetching identities: incomplete messag
Fixes-commit: 193fcc2f7a8cca5240ce50499c54f99235a87e1c
GnuPG-bug-id: 5996
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/agent.h (agent_ssh_key_from_file): New.
* agent/command-ssh.c (get_ssh_keyinfo_on_cards): New.
(ssh_send_available_keys): Loop on the GNUPG_PRIVATE_KEYS_DIR.
Support keys by agent_ssh_key_from_file.
(ssh_handler_request_identities): Move card key handling to
ssh_send_available_keys.
* agent/findkey.c (public_key_from_file): New. Adding handling
for SSH.
(agent_public_key_from_file): Use public_key_from_file.
(agent_ssh_key_from_file): New.
--
GnuPG-bug-id: 5996
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_handler_request_identities): Don't release
KEY_PUBLIC too early.
--
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_send_available_keys): New.
(ssh_handler_request_identities): Use ssh_send_available_keys.
--
GnuPG-bug-id: 5985
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (SSH_OPT_CONSTRAIN_MAXSIGN): New.
(SSH_OPT_CONSTRAIN_EXTENSION): New.
(ssh_handler_add_identity): Ignore them.
(ssh_handler_extension): Take success for session-bind.
--
OpenSSH 8.9 does not gracefully allow communication with older agent
implementations. Until this new OpenSSH feature has been settled we
return a faked response.
Code has not yet been tested.
GnuPG-bug-id: 5931
|
|
|
|
|
|
|
|
| |
--
* agent/command-ssh.c (add_control_entry): Ignore failure of the MD5
digest
Signed-off-by: Jakub Jelen <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (start_command_handler_ssh): Use es_sysopen.
--
With new (not-yet-released) libgpg-error, gpg-agent should be able to
handle connection from Cygwin version of OpenSSH.
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (get_client_info): Use type gnupg_fd_t for
socket, until call of socket API.
(start_command_handler_ssh): Don't convert here.
--
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (sexp_key_construct): Do not put an empty string
into an S-expression.
(stream_read_string): Do not not try to a read a zero length block.
--
Actually we could handles this different by not putting a comment tag
into the s-expression, however this requires more code and at other
places we already return "(none)" instead of an empty comment.
The second fix is more or less a cosmetic thing to get better error
messages in case the underlying read system call returns an error.
GnuPG-bug-id: 5794
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_handler_request_identities): Remove double
check of ERR.
* g10/getkey.c (get_pubkey_byname): Remove double use of break.
* g10/pkglue.c (pk_encrypt): Handle possible NULL-ptr access due to
failed malloc.
Signed-off-by: Werner Koch <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_handler_request_identities): Skip unknown
curves.
--
For example when using my standard ed25519 token and testing cards
with only Brainpool support, the ssh-agent failed due to the unknown
curves seen on the card. This patches fixes this by ignoring keys
with unknown curves.
Signed-off-by: Werner Koch <[email protected]>
|
|
|
|
|
|
|
|
|
| |
* g10/gpg.c (oNoAutoTrustNewKey): New.
(opts): Add --no-auto-trust-new-key.
(main): Set it.
* g10/options.h (opt): Add flags.no_auto_trust_new_key.
Signed-off-by: Werner Koch <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* common/session-env.c (session_env_list_stdenvnames): Extend to allow
return all names as one string.
* agent/command-ssh.c (SSH_REQUEST_EXTENSION): New.
(SSH_RESPONSE_EXTENSION_FAILURE): New.
(request_specs): Add handler for the extension command.
(ssh_handler_extension): New.
--
The extension mechanism is specified in
https://tools.ietf.org/html/draft-miller-ssh-agent-04
Signed-off-by: Werner Koch <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
| |
--
We need to use es_fopen on Windows to cope with non-ascii file names.
This is quite a large but fortunately straightforward change. At a
very few places we keep using stdio (for example due to the use of
popen).
GnuPG-bug-id: 5098
Signed-off-by: Werner Koch <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/command.c (cmd_genkey): Add option --timestamp.
(cmd_import_key): Ditto.
* agent/genkey.c (store_key): Add arg timestamp and change callers.
(agent_genkey): Ditto.
* agent/findkey.c (write_extended_private_key): Add args timestamp and
new key to write a Created line.
(agent_write_private_key): Add arg timestamp.
(agent_write_shadow_key): Ditto.
agent/protect-tool.c (agent_write_private_key): Ditto as dummy arg.
Signed-off-by: Werner Koch <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/command.c (cmd_sethash): Add option --pss and allow for
--hash=null.
* agent/agent.h (struct server_control_s): Add digest.is_pss and
zero where needed.
* agent/pksign.c (agent_pksign_do): Allow for PSS with cards.
* scd/command.c (cmd_pksign): Add for --hash=none.
--
This is not a full implementaion of PSS but allows scdaemon card
drivers to detect already PSS formatted data.
Signed-off-by: Werner Koch <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/call-scd.c: Factor re-usable code out to ...
* agent/call-daemon.c: new. Store infos in an array to allow for
other backend daemons.
* agent/Makefile.am (gpg_agent_SOURCES): Add new file.
* agent/agent.h: Include assuan.h.
(enum daemon_type): New.
(opt): Replace scdaemon_program by daemon_program array. Replace
scd_local by a array d_local. Change users accordingly.
--
The model I'm using for a TPM daemon is the current scdaemon. That
includes start and stop handlers plus liveness checks and an assuan
socket generator. To avoid massive code duplication (and save me a
lot of effort), I've elected to strip this code out of call-scd.c into
a generic framework which can then be reused as is by the TPM handling
daemon.
Signed-off-by: James Bottomley <[email protected]>
Co-authored-by: Werner Koch <[email protected]>
Modified original patch for 2.2 heavily to fit the new framework used
in master (gnupg 2.3)
Signed-off-by: Werner Koch <[email protected]>
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_key_to_blob): Prepare for non-prefixed
point representation of EdDSA.
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_receive_key): Curve is "Ed25519".
Use sexp_key_construct always.
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/agent.h (struct server_control_s): Add field digest.data.
* agent/gpg-agent.c (agent_deinit_default_ctrl): Free that field.
* agent/command.c (reset_notify): Ditto.
(start_command_handler): ditto.
(cmd_sethash): Add new option --inquire.
* agent/call-scd.c (agent_card_pksign): For now return an error if
inquire mode was used.
* agent/command-ssh.c (ssh_handler_sign_request): Make sure
digest.data is cleared.
* agent/divert-scd.c (divert_pksign): Implement inquire mode.
* agent/pksign.c (agent_pksign_do): Ditto.
--
This is required to support EdDSA according to RFC8410.
GnuPG-bug-id: 4888
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
No functional changes, just fixing minor spelling issues.
---
Most of these were identified from the command line by running:
codespell \
--ignore-words-list fpr,stati,keyserver,keyservers,asign,cas,iff,ifset \
--skip '*.po,ChangeLog*,help.*.txt,*.jpg,*.eps,*.pdf,*.png,*.gpg,*.asc' \
doc g13 g10 kbx agent artwork scd tests tools am common dirmngr sm \
NEWS README README.maint TODO
Signed-off-by: Daniel Kahn Gillmor <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/call-scd.c (agent_card_serialno): Allow NULL for R_SERIAL.
(struct readkey_status_parm_s): New.
(readkey_status_cb): New.
(agent_card_readkey): Add optional arg R_KEYREF and change all
callers.
* agent/findkey.c (key_parms_from_sexp): Allow also a "public-key".
* agent/divert-scd.c (ask_for_card): Allow for SHADOW_INFO being NULL.
* agent/pksign.c (agent_pksign_do): Fallback to sign with an on-card
if there is no stub key yet. Create the stub key. Also fixed a
misnaming between s_pkey and s_skey.
--
This change allows to create OpenPGP keys directly from a card without
first making sure that a stub key exists. It is also the less
surprising behaviour.
Signed-off-by: Werner Koch <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (card_key_available): Supply KEYINFO argument.
Call agent_card_readkey by KEYGRIP of KEYINFO.
Don't use $AUTHKEYID, but IDSTR of KEYINFO.
(ssh_handler_request_identities): Follow the change of
card_key_available.
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/agent.h (agent_card_cardlist): Remove.
(agent_card_keyinfo): Add CAP argument.
* agent/call-scd.c (card_cardlist_cb): Remove.
(agent_card_cardlist): Remove.
(agent_card_keyinfo): Support CAP constraint.
* agent/command-ssh.c (card_key_list): Remove.
(ssh_handler_request_identities): Use SCD KEYINFO command.
* agent/command.c (cmd_keyinfo): Follow the API change.
* agent/divert-scd.c (ask_for_card): Likewise.
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_key_to_protected_buffer): Update
the length by the second call of gcry_sexp_sprint.
--
GnuPG-bug-id: 4502
Signed-off-by: NIIBE Yutaka <[email protected]>
|
|
|
|
| |
--
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/findkey.c (write_extended_private_key): Add args serialno and
keyref. Write a Token line if that does not yet exist.
(agent_write_private_key): Add args serialno and keyref and change all
callers.
(agent_write_shadow_key): Skip leading spaces.
* agent/keyformat.txt: Improve extended key format docs.
--
Noet that the extended key forma is the defaqult in 2.3. This patch
is a first step to better handle tokens which carray the same key.
Signed-off-by: Werner Koch <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (struct ssh_key_type_spec): Add field
alt_curve_name.
(ssh_key_types): Add some alternate curve names.
(ssh_identifier_from_curve_name): Lookup also bey alternative names
and return the canonical name.
(ssh_key_to_blob): Simplify the ECDSA case by using gcry_pk_get_curve
instead of the explicit mapping.
(ssh_receive_key): Likewise. Use ssh_identifier_from_curve_name to
validate the curve name. Remove the reverse mapping because since
GnuPG-2.2 Libgcrypt 1.7 is required.
(ssh_handler_request_identities): Log an error message.
--
This change will make it easier to support other curves, in particular
those from tokens. Libgcrypt has a large list of alias names which we
now use to to make the mapping more flexible.
Signed-off-by: Werner Koch <[email protected]>
|
|
|
|
| |
Signed-off-by: Daniel Kahn Gillmor <[email protected]>
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (ssh_handler_add_identity): Handle other errors
than EOF.
--
GnuPG-bug-id: 4221
Signed-off-by: Werner Koch <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* agent/command-ssh.c (get_client_info): Turn client_uid into an int.
Fix setting of it in case of a failed getsocketopt.
* agent/command.c (start_command_handler): Fix setting of the pid and
uid for Windows.
--
Fixes-commit: 28aa6890588cc108639951bb4bef03ac17743046
which obviously was only added to master.
Signed-off-by: Werner Koch <[email protected]>
|
|\
| |
| |
| |
| |
| |
| |
| |
| | |
--
Fixed conflicts:
NEWS - keep master
configure.ac - merge
g10/card-util.c - mostly 2.2
g10/sig-check.c - 2.2
|
| |
| |
| |
| |
| |
| |
| |
| | |
* agent/command-ssh.c (ssh_handler_sign_request): Simplify detection
of flags.
--
Signed-off-by: Werner Koch <[email protected]>
|