aboutsummaryrefslogtreecommitdiffstats
path: root/agent (follow)
Commit message (Collapse)AuthorAgeFilesLines
* ssh: Support ECDSA keys.Werner Koch2012-12-123-106/+356
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (SPEC_FLAG_IS_ECDSA): New. (struct ssh_key_type_spec): Add fields CURVE_NAME and HASH_ALGO. (ssh_key_types): Add types ecdsa-sha2-nistp{256,384,521}. (ssh_signature_encoder_t): Add arg spec and adjust all callers. (ssh_signature_encoder_ecdsa): New. (sexp_key_construct, sexp_key_extract, ssh_receive_key) (ssh_convert_key_to_blob): Support ecdsa. (ssh_identifier_from_curve_name): New. (ssh_send_key_public): Retrieve and pass the curve_name. (key_secret_to_public): Ditto. (data_sign): Add arg SPEC and change callers to pass it. (ssh_handler_sign_request): Get the hash algo from SPEC. * common/ssh-utils.c (get_fingerprint): Support ecdsa. * agent/protect.c (protect_info): Add flag ECC_HACK. (agent_protect): Allow the use of the "curve" parameter. * agent/t-protect.c (test_agent_protect): Add a test case for ecdsa. * agent/command-ssh.c (ssh_key_grip): Print a better error code. -- The 3 standard curves are now supported in gpg-agent's ssh-agent protocol implementation. I tested this with all 3 curves and keys generated by OpenSSH 5.9p1. Using existing non-ssh generated keys will likely fail for now. To fix this, the code should first undergo some more cleanup; then the fixes are pretty straightforward. And yes, the data structures are way too complicated.
* ssh: Rewrite a function for better maintainabilityWerner Koch2012-12-111-40/+41
| | | | | | | | * agent/command-ssh.c (ssh_signature_encoder_dsa): Rewrite. -- Using es_fopenmem instead of a preallocated buffer is safer and easier to read.
* ssh: Improve key lookup for many keys.Werner Koch2012-12-101-154/+166
| | | | | | | | | | | | | | | | | | | * agent/command-ssh.c: Remove dirent.h. (control_file_s): Add struct item. (rewind_control_file): New. (search_control_file): Factor code out to ... (read_control_file_item): New. (ssh_handler_request_identities): Change to iterate over entries in sshcontrol. -- Formerly we scanned the private key directory for matches of entries in sshcontrol. This patch changes it to scan the sshcontrol file and thus considers only keys configured there. The rationale for this is that it is common to have only a few ssh keys but many private keys. Even if that assumption does not hold true, the scanning of the sshcontrol file is faster than reading the directory and only then scanning the ssh control for each directory entry.
* ssh: Cleanup sshcontrol file access code.Werner Koch2012-12-101-61/+104
| | | | | | | | * agent/command-ssh.c (SSH_CONTROL_FILE_NAME): New macro to replace the direct use of the string. (struct control_file_s, control_file_t): New. (open_control_file, close_control_file): New. Use them instead of using fopen/fclose directly.
* agent: Add envvar "gnupg_SSH_AUTH_SOCK_by"Werner Koch2012-12-101-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/gpg-agent.c (main): Pass new envar gnupg_SSH_AUTH_SOCK_by to an invoked process. -- This environment variable is useful for debugging if --use-standard-socket is used (which is the default since 2.1). Commonly you should have this in your init script (e.g. ~/.bashrc): unset GPG_AGENT_INFO unset SSH_AGENT_PID SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh" export SSH_AUTH_SOCK The problem is that gpg-agent won't be able to override the SSH_AUTH_SOCK envvar if gpg-agent has been invoked as gpg-agent --enable-ssh-support --daemon /bin/bash To fix this you should instead use this code in the init script: unset GPG_AGENT_INFO unset SSH_AGENT_PID if [ ${gnupg_SSH_AUTH_SOCK_by:-0} -ne $$ ]; then export SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh" fi This will work in all cases and thus allows to start gpg-agent for testing purposes with a different homedir and use this gpg-agent as an ssh-agent. Example: GNUPGHOME=$(pwd) gpg-agent --enable-ssh-support --daemon /bin/bash gnupg_SSH_AUTH_SOCK_by is set to the PID of the exec-ed process and thus will work safely if called recursively.
* Do not use a broken ttyname.Werner Koch2012-11-201-2/+2
| | | | | | | | | | | | * configure.ac (HAVE_BROKEN_TTYNAME): New ac_define set for Android systems. * common/util.h (gnupg_ttyname): New macro. Change all callers of ttyname to use this macro instead. (ttyname) [W32]: Rename to _gnupg_ttyname and use also if HAVE_BROKEN_TTYNAME is defined. * common/simple-pwquery.c (agent_send_all_options): Keep on using ttyname unless HAVE_BROKEN_TTYNAME is set. This is because this file may be used standalone.
* agent: Use wipememory instead of memset in one place.Werner Koch2012-11-061-1/+1
| | | | | * agent/command.c (clear_outbuf): Use wipememory. Suggested by Ben Kibbey.
* Allow decryption with card keys > 3072 bitsWerner Koch2012-11-061-10/+15
| | | | | | | | | | | | | | | | * scd/command.c (MAXLEN_SETDATA): New. (cmd_setdata): Add option --append. * agent/call-scd.c (agent_card_pkdecrypt): Use new option for long data. * scd/app-openpgp.c (struct app_local_s): Add field manufacturer. (app_select_openpgp): Store manufacturer. (do_decipher): Print a note for broken cards. -- Please note that I was not able to run a full test because I only have broken cards (S/N < 346) available.
* agent: Fix wrong use of gcry_sexp_build_arrayNIIBE Yutaka2012-11-021-4/+4
| | | | | | | | | | | | | | | | | | | | * findkey.c (agent_public_key_from_file): Fix use of gcry_sexp_build_array. -- A test case leading to a segv in Libgcrypt is gpg-connect-agent \ "READKEY 9277C5875C8AFFCB727661C18BE4E0A0DEED9260" /bye The keygrip was created by "monkeysphere s", which has a comment. gcry_sexp_build_array expects pointers to the arguments which is quite surprising. Probably ARG_NEXT was accidentally implemented wrongly. Anyway, we can't do anything about it and thus need to fix the check the users of this function. Some-comments-by: Werner Koch <[email protected]>
* Fix typos spotted during translationsDavid Prévot2012-08-241-1/+1
| | | | | | | | | | | | | | | * agent/genkey.c: s/to to/to/ * sm/*.c: s/failed to allocated/failed to allocate/ * sm/certlist.c, ./dirmngr/validate.c: s/should have not/should not have/ * g10/seskey.c: missing closing parenthesis * dirmngr/crlcache.c: s/may has/may have/ Consistency fix: * g10/gpg.c, kbx/kbxutil.c, sm/gpgsm.c: uppercase after Syntax * dirmngr/dirmngr_ldap: no period in Syntax * dirmngr/dirmngr-client.c: infinitive for option description: s/certificates are expected/expect certificates/
* Actually show translators comments in PO filesDavid Prévot2012-08-241-1/+1
| | | | --
* Change all quotes in strings and comments to the new GNU standard.Werner Koch2012-06-0511-71/+71
| | | | | | | | | | | | | | | | | | | The asymmetric quotes used by GNU in the past (`...') don't render nicely on modern systems. We now use two \x27 characters ('...'). The proper solution would be to use the correct Unicode symmetric quotes here. However this has the disadvantage that the system requires Unicode support. We don't want that today. If Unicode is available a generated po file can be used to output proper quotes. A simple sed script like the one used for en@quote is sufficient to change them. The changes have been done by applying sed -i "s/\`\([^'\`]*\)'/'\1'/g" to most files and fixing obvious problems by hand. The msgid strings in the po files were fixed with a similar command.
* agent: Fix deadlock in trustlist due to the switch to npth.Werner Koch2012-04-301-44/+78
| | | | | | | | | | | | | | | | * agent/trustlist.c (clear_trusttable): New. (agent_reload_trustlist): Use new function. (read_trustfiles): Require to be called with lock held. (agent_istrusted): Factor all code out to ... (istrusted_internal): new. Add ALREADY_LOCKED arg. Make sure the table islocked. Do not print TRUSTLISTFLAG stati if called internally. (agent_marktrusted): Replace calls to agent_reload_trustlist by explicit code. -- In contrast to pth, npth does not use recursive mutexes by default. However, the code in trustlist.c assumed recursive locks and thus we had to rework it.
* Print warning for arguments not considered an option.Werner Koch2012-03-271-0/+10
| | | | | | | | | | | | | | | | | | GnuPG requires that options are given before other arguments. This can sometimes be confusing. We now print a warning if we found an argument looking alike a long option without being preceded by the stop option. This is bug#1343. * common/argparse.h (ARGPARSE_FLAG_STOP_SEEN): New. * common/argparse.c (arg_parse): Set new flag. * g10/gpg.c (main): Print the warning. * agent/gpg-agent.c (main): Ditto. * dirmngr/dirmngr.c (main): Ditto. * g13/g13.c (main): Ditto. * scd/scdaemon.c (main): Ditto. * sm/gpgsm.c (main): Ditto. * tools/gpg-connect-agent.c (main): Ditto. * tools/gpgconf.c (main): Ditto.
* agent: Add pin length field to the shadowed private key format.Werner Koch2012-02-075-5/+41
| | | | | | | | This is not yet fully implemented. It will eventually allow to support pinpad equipped readers which do not support variable length pin lengths. * agent/protect.c (parse_shadow_info): Add optional arg R_PINLEN and parse pinlen info. Change all callers to pass NULL for it.
* Use new status printing functions.Werner Koch2012-02-071-12/+4
| | | | | | * agent/command.c (cmd_geteventcounter): Get rid of static buffers. * scd/command.c (cmd_serialno, cmd_learn): Simplify by using print_assuan_status.
* agent: New function agent_print_status.Werner Koch2012-02-072-0/+19
| | | | | | * common/asshelp2.c (vprint_assuan_status): New. (print_assuan_status): Re-implement using above func. * agent/command.c (agent_print_status): New.
* agent: Simplify printing of INQUIRE_MAXLEN.Werner Koch2012-02-061-12/+5
| | | | | | * agent/command.c: Include asshelp.h. (cmd_pkdecrypt, cmd_genkey, cmd_preset_passphrase) (pinentry_loopback): Use print_assuan_status for INQUIRE_MAXLEN.
* common: Add a global variable to for the default error source.Werner Koch2012-02-063-0/+4
| | | | | | | | | | | | | | For the shared code parts it is cumbersome to pass an error sourse variable to each function. Its value is always a constant for a given binary and thus a global variable makes things a lot easier than the former macro stuff. * common/init.c (default_errsource): New global var. (init_common_subsystems): Rename to _init_common_subsystems. Set DEFAULT_ERRSOURCE. * common/init.h: Assert value of GPG_ERR_SOURCE_DEFAULT. (init_common_subsystems): New macro. * common/util.h (default_errsource): Add declaration. * kbx/keybox-defs.h: Add some GPG_ERR_SOURCE_DEFAULT trickery.
* Also let GENKEY and PKDECRYPT send the INQUIRE_MAXLEN status message.Ben Kibbey2012-02-031-3/+11
| | | | | | * agent/command.c (cmd_pkdecrypt): Send the INQUIRE_MAXLEN status message before doing the inquire. (cmd_genkey): Ditto.
* Inform the client of the preset passphrase length.Ben Kibbey2012-02-021-1/+7
| | | | | * agent/command.c (cmd_preset_passphrase): Send the INQUIRE_MAXLEN status message before inquiring the passphrase.
* Return GPG_ERR_CARD_NOT_PRESENT when pinentry-mode=loopback.Ben Kibbey2012-01-261-0/+4
| | | | | | | | | Since there isn't a way to prompt the user to insert the smartcard when pinentry-mode=loopback, return GPG_ERR_CARD_NOT_PRESENT instead of GPG_ERR_NO_PIN_ENTRY. * agent/divert-scd.c (ask_for_card): Return GPG_ERR_CARD_NOT_PRESENT when pinentry-mode=loopback.
* Also check for GPG_ERR_ASS_CANCELED during an inquire.Ben Kibbey2012-01-261-2/+4
| | | | | | | | | | Fix pinentry-mode=loopback when cancelling an inquire from scdaemon. This is similar to commit 4f21f8d but for both protocol command cancellation and pinentry cancellation. * agent/call-scd.c (agent_card_pkdecrypt): Check for GPG_ERR_ASS_CANCELED. (agent_card_pksign): Ditto.
* Fix strerror vs. gpg_strerror usage.Werner Koch2012-01-251-1/+1
| | | | | This bug was introduced by the migration to npth. * agent/gpg-agent.c (handle_connections): Use strerror.
* Re-indent overlong lines.Werner Koch2012-01-251-4/+8
| | | | --
* Add missing variable.Werner Koch2012-01-251-2/+5
| | | | * agent/gpg-agent.c (handle_connections) [!W32]: Add missing variable.
* Port LDAP wrapper to NPTH.Marcus Brinkmann2012-01-251-1/+3
| | | | | * agent/gpg-agent.c (handle_connections): Handle error. * dirmngr/dirmngr_ldap.c, dirmngr/ldap-wrapper-ce.c: Port to NPTH.
* Port Windows code to NPTH.Marcus Brinkmann2012-01-251-12/+18
| | | | | | | | | | * agent/gpg-agent.c (get_agent_ssh_socket_name): Use INVALID_HANDLE_VALUE instead of 0. (handle_signal) [!HAVE_W32_SYSTEM]: Don't define. (handle_connections): Port Windows code to NPTH. * dirmngr/dirmngr.c (handle_connections): Port Windows code to NPTH. * g13/g13.c (handle_connections): Port Windows code to NPTH. * scd/scdaemon.c (handle_connections): Port Windows code to NPTH.
* Port to npth.Marcus Brinkmann2012-01-257-318/+217
| | | | | | | | | | | | | | | | | | | | | * configure.ac: Don't check for PTH but for NPTH. (AH_BOTTOM): Remove PTH_SYSCALL_SOFT. (have_pth): Rename to ... (have_npth): ... this. (USE_GNU_NPTH): Rename to ... (USE_GNU_PTH): ... this. * m4/npth.m4: New file. * agent/Makefile.am, agent/cache.c, agent/call-pinentry.c, agent/call-scd.c, agent/findkey.c, agent/gpg-agent.c, agent/trustlist.c, common/Makefile.am, common/estream.c, common/exechelp-posix.c, common/exechelp-w32.c, common/exechelp-w32ce.c, common/http.c, common/init.c, common/sysutils.c, dirmngr/Makefile.am, dirmngr/crlfetch.c, dirmngr/dirmngr.c, dirmngr/dirmngr_ldap.c, dirmngr/ldap-wrapper-ce.c, dirmngr/ldap-wrapper.c, dirmngr/ldap.c, g13/Makefile.am, g13/call-gpg.c, g13/g13.c, g13/runner.c, scd/Makefile.am, scd/apdu.c, scd/app.c, scd/ccid-driver.c, scd/command.c, scd/scdaemon.c, tools/Makefile.am: Port to npth.
* Add the INQUIRE_MAXLEN status message.Ben Kibbey2012-01-181-0/+6
| | | | | | | | This status message is used to inform the client of the maximum length of an inquired passphrase and is used in pinentry-mode=loopback. * agent/command.c (pinentry_loopback): Send the INQUIRE_MAXLEN status message before doing the inquire.
* gpg-agent: fix lc-messages handling not to change Xauthority settingJim Meyering2012-01-161-0/+1
| | | | | | * agent/gpg-agent.c (main): Supply omitted "break" statement for lc-messages option. Otherwise, control would fall through to the following oXauthority case and use the same value there.
* Fix indentation.Werner Koch2012-01-151-1/+2
|
* Fix scdaemon pinentry inquire cancelation.Ben Kibbey2012-01-141-16/+29
| | | | | | | | | | Similar to commit 29af488 but also fixes PKDECRYPT and PKSIGN. * agent/call-scd.c (agent_card_pkdecrypt): Check for GPG_ERR_CANCELED when returning from the PKDECRYPT operation of scdaemon and cancel the inquire. (agent_card_pksign): Ditto. (cancel_inquire): New.
* Terminate csh commands with a semicolon.Werner Koch2012-01-031-2/+2
| | | | | | | Fixes bug#1386. * agent/gpg-agent.c (main): Terminate csh style output with a semicolon. * scd/scdaemon.c: Ditto.
* Only set gcrypt thread callback for older version of gcrypt.Marcus Brinkmann2012-01-021-0/+9
| | | | | | | | * agent/gpg-agent.c, dirmngr/dirmngr.c, g13/g13.c, scd/scdaemon.c (USE_GCRY_THREAD_CBS): New macro, defined if GCRY_THREAD_OPTION_VERSION is 0. (fixed_gcry_pth_init) [!USE_GCRY_THREAD_CBS]: Don't define. (main) [!USE_GCRY_THREAD_CBS]: Do not install thread callbacks.
* Require Libassuan 2.0.3Werner Koch2011-12-202-13/+0
| | | | | | | | | * configure.ac: Require Libassuan 2.0.3. * agent/call-scd.c (ASSUAN_CONVEY_COMMENTS): Remove macro replacement. * agent/command.c (cmd_killagent) [ASSUAN_FORCE_CLOSE]: Remove dependency. (cmd_killagent) [ASSUAN_FORCE_CLOSE]: Ditto. * scd/command.c (cmd_killscd) [ASSUAN_FORCE_CLOSE]: Ditto.
* Don't kill pinentry by SIGKILL but let it quit by SIGINT.NIIBE Yutaka2011-12-161-2/+1
| | | | | * agent/call-pinentry.c (agent_popup_message_stop): To pinentry, send SIGINT (was: SIGKILL).
* agent: Pass comment lines from scd verbatim thru gpg-agent.Werner Koch2011-12-141-10/+23
| | | | | | * agent/call-scd.c (pass_status_thru): Pass comment lines verbatim. * tools/gpg-connect-agent.c (help_cmd_p): New. (main): Treat an "SCD HELP" the same as "HELP".
* Fix last change.Werner Koch2011-12-051-1/+0
| | | | * agent/command.c (start_command_handler): Remove use of removed var.
* Amend the agent code with more comments.Werner Koch2011-12-053-46/+161
| | | | * agent/command.c (server_local_s): Remove unused field MESSAGE_FD.
* Generate the ChangeLog from commit logs.Werner Koch2011-12-012-2/+14
| | | | | | | | | | | | | * scripts/gitlog-to-changelog: New script. Taken from gnulib. * scripts/git-log-fix: New file. * scripts/git-log-footer: New file. * doc/HACKING: Describe the ChangeLog policy * ChangeLog: New file. * Makefile.am (EXTRA_DIST): Add new files. (gen-ChangeLog): New. (dist-hook): Run gen-ChangeLog. Rename all ChangeLog files to ChangeLog-2011.
* Improve ssh card key diagnostic message.Werner Koch2011-11-282-2/+10
| | | | | | | * command-ssh.c (card_key_available): Change wording of no key diagnostic. (ssh_handler_request_identities): Do not call card_key_available if the scdaemon is disabled.
* Allow no protection in pinentry-mode=loopback.Ben Kibbey2011-09-132-2/+12
| | | | | When the inquired passphrase has a 0 length then treat it as no protection.
* Fixed invalid free.Ben Kibbey2011-09-131-3/+1
|
* Handle pinentry-mode=loopback.Ben Kibbey2011-09-125-2/+83
| | | | | | When this mode is set an inquire will be sent to the client to retrieve the passphrase. This adds a new inquire keyword "NEW_PASSPHRASE" that the GENKEY and PASSWD commands use when generating a new key.
* Fixed set but unused variable bugsWerner Koch2011-08-104-6/+11
|
* Update option s2k-count to match the documentation.Ben Kibbey2011-08-102-3/+8
| | | | The option would previously return an error if its value was < 65536.
* Made the KILLAGENT and KILLSCD commands working again.Werner Koch2011-08-101-0/+5
| | | | | This requires that GnuPG is build with a newer version of Libassuan (2.0.3).
* Make the inquire cancel fix a little bit more robust.Werner Koch2011-07-272-1/+18
|
* Fixed gpg-agent SCD inquire command cancellation.Ben Kibbey2011-07-272-0/+18
| | | | | Need to send the CANCEL command back to scdaemon otherwise the next SCD command will fail.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-12 18:14:32 +0000