aboutsummaryrefslogtreecommitdiffstats
path: root/common/dns-cert.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2015-04-23gpg: Move all DNS access to Dirmngr.Werner Koch1-368/+0
* common/dns-cert.h: Move to ../dirmngr/. * common/dns-cert.c: Move to ../dirmngr/. Change args to return the key as a buffer. * common/t-dns-cert.c: Move to ../dirmngr/. * common/pka.c, common/pka.h, common/t-pka.c: Remove. * dirmngr/server.c (data_line_cookie_write): Factor code out to data_line_write and make it a wrapper for that. (data_line_write): New. (cmd_dns_cert): New. (register_commands): Register new command. * g10/Makefile.am (LDADD): Remove DNSLIBS. * g10/call-dirmngr.c (dns_cert_parm_s): New. (dns_cert_data_cb, dns_cert_status_cb): New. (gpg_dirmngr_dns_cert): New. (gpg_dirmngr_get_pka): New. * g10/gpgv.c (gpg_dirmngr_get_pka): New dummy function. * g10/keyserver.c (keyserver_import_cert): Replace get_dns_cert by gpg_dirmngr_dns_cert. (keyserver_import_pka): Replace get_pka_info by gpg_dirmngr_get_pka. * g10/mainproc.c: Include call-dirmngr.h. (pka_uri_from_sig): Add CTX arg. Replace get_pka_info by gpg_dirmngr_get_pka. -- With this patch gpg does not do any network access itself but uses dirmngr for that. Note that we need to keep linking to NETLIBS due to the logging code and because we need TCP for our socket emulation under Windows. Probably also required for Solaris etc. Signed-off-by: Werner Koch <[email protected]>
2015-02-25gpg: Switch to a hash and CERT record based PKA system.Werner Koch1-6/+9
* common/dns-cert.c (get_dns_cert): Make r_key optional. * common/pka.c: Rewrite for the new hash based lookup. * common/t-pka.c: New. * configure.ac: Remove option --disable-dns-pka. (USE_DNS_PKA): Remove ac_define. * g10/getkey.c (parse_auto_key_locate): Always include PKA. -- Note that although PKA is now always build, it will only work if support for looking up via DNS has not been disabled. The new PKA only works with the IPGP DNS certtype and shall be used only to retrieve the fingerprint and optional the key for the first time. Due to the security problems with DNSSEC the former assumption to validate the key using DNSSEC is not anymore justified. Instead an additional layer (e.g. Trust-On-First-Use) needs to be implemented to track change to the key. Having a solid way of getting a key matching a mail address is however a must have. More work needs to go into a redefinition of the --verify-options pka-lookups and pka-trust-increase. The auto-key-locate mechanism should also be able to continue key fetching with another methods once the fingerprint has been retrieved with PKA. Signed-off-by: Werner Koch <[email protected]>
2015-02-25common: Allow requesting a specific certtype with get_dns_cert()Werner Koch1-21/+15
* common/dns-cert.c (get_dns_cert): Add arg want_certtype. Change all callers. (CERTTYPE_): Move constants to ... * common/dns-cert.h: here as DNS_CERTTYPE_. Signed-off-by: Werner Koch <[email protected]>
2015-02-23common: Fix regression due to commit 2183683b.Werner Koch1-1/+0
* common/dns-cert.c (get_dns_cert): Remove cruft. -- GnuPG-bug-id: 1850 Signed-off-by: Werner Koch <[email protected]>
2015-02-11Use inline functions to convert buffer data to scalars.Werner Koch1-9/+11
* common/host2net.h (buf16_to_ulong, buf16_to_uint): New. (buf16_to_ushort, buf16_to_u16): New. (buf32_to_size_t, buf32_to_ulong, buf32_to_uint, buf32_to_u32): New. -- Commit 91b826a38880fd8a989318585eb502582636ddd8 was not enough to avoid all sign extension on shift problems. Hanno Böck found a case with an invalid read due to this problem. To fix that once and for all almost all uses of "<< 24" and "<< 8" are changed by this patch to use an inline function from host2net.h. Signed-off-by: Werner Koch <[email protected]>
2014-11-07build: Improve test for ADNSWerner Koch1-3/+0
* configure.ac <adns>: Use adns_free as probe function for libadns. (HAVE_ADNS_FREE): Remove bogus tests to set this and remove the macro. (ADNSLIBS): Do not ac_subst - it is only used within configure. -- adns_free is required on Windows anyway (for robustness reasons) and it has been around for so long now that we do not need a separate test. An upstream adns 1.5 has meanwhile been release but I doubt that this has the required Windows code - and it is not libtool based anyway.
2014-03-07w32: Include winsock2.h to silence warnings.Werner Koch1-0/+3
2014-02-10tests: Avoid segv if dns cert lookup is not configured.Werner Koch1-4/+4
* common/dns-cert.c (get_dns_cert) [!USE_DNS_CERT]: Reset return args.
2013-08-01common: Fix a build error when using adns.Werner Koch1-4/+5
* common/dns-cert.c (get_dns_cert) [USE_ADNS]: Fix synatx error. -- (fixes commit 31f548a18aed729c05ea367f2d8a8104480430d5) Signed-off-by: Werner Koch <[email protected]>
2012-04-20Change license for some files in common to LGPLv3+/GPLv2+.Werner Koch1-5/+15
Having the LGPL on the common GnuPG code helps to share code between GnuPG and related projects (like GPGME and Libassuan). This is good for interoperability and to reduces bugs. * common/asshelp.c, common/asshelp.h, common/asshelp2.c, common/b64dec.c * common/b64enc.c, common/convert.c, common/dns-cert.c * common/dns-cert.h common/exechelp-posix.c, common/exechelp-w32.c * common/exechelp-w32ce.c, common/exechelp.h, common/get-passphrase.c * common/get-passphrase.h, common/gettime.c, common/gpgrlhelp.c * common/helpfile.c, common/homedir.c, common/http.c, common/http.h * common/i18n.c, common/init.c, common/init.h, common/iobuf.c * common/iobuf.h, common/localename.c, common/membuf.c, common/membuf.h * common/miscellaneous.c, common/openpgp-oid.c, common/openpgpdefs.h * common/percent.c, common/pka.c, common/pka.h, common/session-env.c * common/session-env.h, common/sexp-parse.h, common/sexputil.c * common/signal.c, common/srv.c, common/srv.h, common/ssh-utils.c * common/ssh-utils.h, common/sysutils.c, common/sysutils.h * common/tlv.c, common/tlv.h, common/ttyio.c, common/ttyio.h * common/userids.c, common/userids.h, common/xasprintf.c: Change license to LGPLv3+/GPLv2+/
2012-02-07common: Replace macro based function calls by using DEFAULT_ERRSOURCE.Werner Koch1-18/+21
* common/dns-cert.h (get_dns_cert): Remove macro. * common/dns-cert.c (_get_dns_cert): Rename to get_dns_cert. Replace arg ERRSOURCE by global DEFAULT_ERRSOURCE. * common/http.h (http_parse_uri, http_raw_connect, http_open) (http_open_document, http_wait_response): Remove macros. * common/http.c (_http_parse_uri, _http_raw_connect, _http_open) (_http_open_document, _http_wait_response): Remove underscore from symbols. Replace args ERRSOURCE by global DEFAULT_ERRSOURCE. * common/ssh-utils.h (ssh_get_fingerprint) (ssh_get_fingerprint_string): Remove macros. * common/ssh-utils.h (_ssh_get_fingerprint) (_ssh_get_fingerprint_string): Remove underscore from symbols. Replace args ERRSOURCE by global DEFAULT_ERRSOURCE. * common/tlv.h (parse_ber_header, parse_sexp): Remove macros. * common/tlv.c: Include util.h. (_parse_ber_header, _parse_sexp): Remove underscore from symbols. Replace args ERRSOURCE by global DEFAULT_ERRSOURCE.
2011-11-30Rewrite dns-cert.c to not use the gpg-only iobuf stuff.Werner Koch1-72/+123
* common/dns-cert.c: Remove iobuf.h. (get_dns_cert): Rename to _get_dns_cert. Remove MAX_SIZE arg. Change iobuf arg to a estream-t. Rewrite function to make use of estream instead of iobuf. Require all parameters. Return an gpg_error_t error instead of the type. Add arg ERRSOURCE. * common/dns-cert.h (get_dns_cert): New macro to pass the error source to _gpg_dns_cert. * common/t-dns-cert.c (main): Adjust for changes in get_dns_cert. * g10/keyserver.c (keyserver_import_cert): Ditto. * doc/gpg.texi (GPG Configuration Options): Remove max-cert-size.
2011-11-30dns-cert.c: Use constants for better readability.Werner Koch1-8/+21
2011-11-30Re-indented dns-cert.cWerner Koch1-121/+122
2011-11-30Use separate test module for dns-cert.c.Werner Koch1-60/+2
* dns-cert.c (get_dns_cert): Factor test code out to ... * t-dns-cert.c: new file.
2011-02-04Nuked almost all trailing white space.post-nuke-of-trailing-wsWerner Koch1-5/+5
We better do this once and for all instead of cluttering all future commits with diffs of trailing white spaces. In the majority of cases blank or single lines are affected and thus this change won't disturb a git blame too much. For future commits the pre-commit scripts checks that this won't happen again.
2010-03-22More chnages to use estream. Add a way to replace the standardWerner Koch1-0/+7
descriptors.
2009-12-08Unification of the search descriptor usage.Werner Koch1-1/+1
2009-12-08Support CERT records via ADNSWerner Koch1-9/+107
2007-07-04Changed to GPLv3.Werner Koch1-4/+2
Removed intl/.
2006-06-16Added missing filesWerner Koch1-0/+246
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-09 11:39:53 +0000