aboutsummaryrefslogtreecommitdiffstats
path: root/dirmngr (unfollow)
Commit message (Collapse)AuthorFilesLines
2016-08-18dirmngr: Remove all system daemon features.Werner Koch7-237/+14
* dirmngr/dirmngr.h (opts): Remove fields 'system_service' and 'system_daemon'. * common/homedir.c (dirmngr_sys_socket_name): Remove. (dirmngr_user_socket_name): Rename to ... (dirmngr_socket_name): this. Change call callers. * common/asshelp.c (start_new_dirmngr): Remove the system socket feature. * tools/gpgconf.c (list_dirs): Do not print "dirmngr-sys-socket". * sm/server.c (gpgsm_server): Adjust for removed system socket feature. * dirmngr/server.c (cmd_getinfo): Ditto. (cmd_killdirmngr): Remove check for system daemon. (cmd_reloaddirmngr): Ditto. * dirmngr/dirmngr.c (USE_W32_SERVICE): Remove macro. (aService): Remove. (opts): Remove --service. (w32_service_control): Remove. (real_main, call_real_main) [W32]: Remove wrapper. (main): Remove Windows system service feature. Remove system dameon feature. Use only the "~/.gnupg/dirmngr_ldapservers.conf" file. * dirmngr/certcache.c (load_certs_from_dir): Remove warning in the system dameon case. * dirmngr/crlcache.c (DBDIR_D): Always use "~/.gnupg/crls.d". * dirmngr/ocsp.c (validate_responder_cert): Do not call validate_cert_chain which was used only in system daemon mode. * dirmngr/validate.c (validate_cert_chain): Always use the code. -- We are now starting dirmngr as needed as a user daemon. The deprecated system daemon mode does not anymore make sense. In case a system wide daemon is required, it is better to setup a dedicated account to run dirmngr and tweak socket permissions accordingly. Signed-off-by: Werner Koch <[email protected]>
2016-08-12Call log_set_prefix() with human-readable labels.Daniel Kahn Gillmor2-3/+3
* agent/preset-passphrase.c, agent/protect-tool.c, dirmngr/dirmngr.c * dirmngr/t-http.c, g10/gpg.c, g10/gpgv.c, g13/g13-syshelp.c * g13/g13.c, kbx/kbxutil.c, scd/scdaemon.c, sm/gpgsm.c * tests/gpgscm/main.c, tools/gpg-check-pattern.c * tools/gpg-connect-agent.c, tools/gpgconf.c, tools/gpgtar.c * tools/symcryptrun.c: Invoke log_set_prefix() with human-readable labels. -- Some invocations of log_set_prefix() were done with raw numeric values instead of values that humans can understand. Use symbolic representations instead of numeric for better readability. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2016-08-11common: New function string_to_u64.Werner Koch1-11/+2
* common/stringhelp.c (string_to_u64): New. * dirmngr/http.c (longcounter_t): Remove. (struct cookie_s): Change content_length to uint64_t. (parse_response): Use string_to_u64. -- Meanwhile we allow some C99 features including stdint.h. Thus we can simplify things now. Signed-off-by: Werner Koch <[email protected]>
2016-08-09Cleanup initialization of libgcrypt.Ben Kibbey2-6/+2
* common/init.c (init_common_subsystems): Initialize libgcrypt. * dirmngr/Makefile.am (dirmngr_ldap): Link with libgcrypt. -- Most other modules already call gcry_check_version() after init_common_subsystems() so may as well move initialization of libgcrypt to here. Also fixes a warning in the system log from gpgconf --homedir. Signed-off-by: Ben Kibbey <[email protected]>
2016-08-03More cleanup of "allow to".Daniel Kahn Gillmor2-3/+3
* README, agent/command.c, agent/keyformat.txt, common/i18n.c, common/iobuf.c, common/keyserver.h, dirmngr/cdblib.c, dirmngr/ldap-wrapper.c, doc/DETAILS, doc/TRANSLATE, doc/announce-2.1.txt, doc/gpg.texi, doc/gpgsm.texi, doc/scdaemon.texi, doc/tools.texi, doc/whats-new-in-2.1.txt, g10/export.c, g10/getkey.c, g10/import.c, g10/keyedit.c, m4/ksba.m4, m4/libgcrypt.m4, m4/ntbtls.m4, po/ca.po, po/cs.po, po/da.po, po/de.po, po/el.po, po/eo.po, po/es.po, po/et.po, po/fi.po, po/fr.po, po/gl.po, po/hu.po, po/id.po, po/it.po, po/ja.po, po/nb.po, po/pl.po, po/pt.po, po/ro.po, po/ru.po, po/sk.po, po/sv.po, po/tr.po, po/uk.po, po/zh_CN.po, po/zh_TW.po, scd/app-p15.c, scd/ccid-driver.c, scd/command.c, sm/gpgsm.c, sm/sign.c, tools/gpgconf-comp.c, tools/gpgtar.h: replace "Allow to" with clearer text. In standard English, the normal construction is "${XXX} allows ${YYY} to" -- that is, the subject (${XXX}) of the sentence is allowing the object (${YYY}) to do something. When the object is missing, the phrasing sounds awkward, even if the object is implied by context. There's almost always a better construction that isn't as awkward. These changes should make the language a bit clearer. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2016-08-03dirmngr: Emit correct spelling of "superseded".Daniel Kahn Gillmor2-2/+2
* dirmngr/crlcache.c (list_one_crl_entry): Spell superseded correctly. * dirmngr/ocsp.c (ocsp_invalid): Likewise. This might break some tools which parse the existing output and expect misspellings, but i'm not sure there are many such tools, and we should use standardized orthography going forward. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2016-07-14dirmngr: fix handling of HTTP redirectionsDamien Goutte-Gattat1-1/+2
* dirmngr/ks-engine-http.c (ks_http_fetch): Reinitialize HTTP session when following a HTTP redirection. Signed-off-by: Damien Goutte-Gattat <[email protected]>
2016-07-14gpg: Fix regression since 2.1 in --search-key with a fingerprint.Werner Koch1-2/+6
* dirmngr/ks-engine-hkp.c (ks_hkp_search): Prefix fingerprint with 0x. -- pre-2.1 made sure that the 0x prefix was put before the fingerprint so that the search command works. Actually --recv-key should be used with a fingerprint but some users are using --search-key, probably to use the interactive mode. GnuPG-bug-id: 2412 Signed-off-by: Werner Koch <[email protected]>
2016-07-14build: Require latest released librariesWerner Koch1-7/+2
* agent/protect.c (OCB_MODE_SUPPORTED): Remove macro. (do_encryption): Always support OCB. (do_decryption): Ditto. (agent_unprotect): Ditto. * dirmngr/server.c (is_tor_running): Unconditionally build this. -- Although not technically required, it is easier to require them to avoid bug reports due to too old library versions. Signed-off-by: Werner Koch <[email protected]>
2016-07-12dirmngr: Fix typo.Daniel Kahn Gillmor1-1/+1
-- Signed-off-by: Justus Winter <[email protected]>
2016-07-01Fix trivial memory leaks in tests.Justus Winter1-0/+2
* dirmngr/t-ldap-parse-uri.c (check_ldap_escape_filter): Free result. * g10/t-stutter.c (main): Free file name. Signed-off-by: Justus Winter <[email protected]>
2016-06-28dirmngr: add option to retrieve extra WKS info.Werner Koch1-8/+22
* dirmngr/server.c (cmd_wkd_get): Add option --submission-address. Signed-off-by: Werner Koch <[email protected]>
2016-06-14ldap: Improve info output for v3 fallbackWerner Koch1-2/+3
* dirmngr/dirmngr_ldap.c (fetch_ldap): Do not use log_debug in an unprotected section. Replace log_debug by log_info in verbose mode. -- GnuPG-bug-id: 2376
2016-06-14dirmngr: Try ldap protocol V3 as fallbackAndre Heinecke1-0/+12
* dirmngr/dirmngr_ldap.c (fetch_ldap): Try V3 Protocol in case default Protocol gives error. -- Servers may have blocked V2 Protocol, in which case the bind will result in a Protocol Error. In that case we try again with v3 Protocol if the ldap libarary used to compile dirmngr supports V3. Signed-off-by: Andre Heinecke <[email protected]>
2016-06-14dirmngr: Print ldap error if bind failsAndre Heinecke1-1/+1
* dirmngr/dirmngr_ldap.c (fetch_ldap): Use ldap_err2string on bind return. -- ldap_simple_bind_s does not set errno. Signed-off-by: Andre Heinecke <[email protected]>
2016-06-14doc: Consistently use 'keyserver'.Werner Koch1-1/+1
-- GnuPG-bug-id: 2383 Signed-off-by: Werner Koch <[email protected]>
2016-06-08Explicitly restrict socket permissions.Werner Koch1-0/+4
* agent/gpg-agent.c (create_server_socket): Call chmod before listen. * scd/scdaemon.c (create_server_socket): Ditto. * dirmngr/dirmngr.c (main): Ditto. -- This is just in case of a improperly set umask. Note that a connect requires a write permissions.
2016-06-08Do not use no-libgcrypt dummy for toolsWerner Koch1-5/+4
* tools/Makefile.am (gpgconf_SOURCES): Remove no-libgcrypt.c. (gpgconf_LDADD): Add LIBGCRYPT_LIBS. (gpg_connect_agent_LDADD): Ditto. (gpgtar_LDADD): Ditto. * dirmngr/Makefile.am (dirmngr_client_LDADD): Ditto. (t_common_ldadd): Ditto. Remove no-libgcrypt.o. -- We need this change so that a future code in common/ can use Libgcrypt functions; in particular hashing. Signed-off-by: Werner Koch <[email protected]>
2016-06-07common: Remove homedir arg from start_new_{dirmngr,gpg_agent}.Werner Koch1-1/+0
* common/asshelp.c (start_new_gpg_agent): Remove arg 'homedir' in favor of gnupg_homedir (). Change all callers. (start_new_dirmngr): Ditto. * common/get-passphrase.c (gnupg_prepare_get_passphrase): Remove arg 'homedir'. Signed-off-by: Werner Koch <[email protected]>
2016-06-07Replace use of opt.homedir by accessor functions.Werner Koch3-31/+20
* common/homedir.c (the_gnupg_homedir): New var. (gnupg_set_homedir): New. (gnupg_homedir): New. * g10/options.h (struct opt): Remove 'homedir' and replace all users by the new accessor functions. * g13/g13-common.h (struct opt): Ditto. * scd/scdaemon.h (struct opt): Ditto. * sm/gpgsm.h (struct opt): Ditto. * dirmngr/dirmngr.h (struct opt): Ditto. * agent/preset-passphrase.c (opt_homedir): Ditto. * agent/protect-tool.c (opt_homedir): Ditto. -- This will make detection of a non-default homedir easier. Signed-off-by: Werner Koch <[email protected]>
2016-05-27common: Extend gnupg_create_inbound_pipe et al.Werner Koch1-2/+2
* common/exechelp-posix.c (gnupg_create_inbound_pipe): Add args 'r_fp' and 'nonblock'. (gnupg_create_outbound_pipe): Ditto. * common/exechelp-w32.c (gnupg_create_inbound_pipe): Add non yet functional args 'r_fp' and 'nonblock'. (gnupg_create_outbound_pipe): Ditto. * common/exechelp-w32ce.c (gnupg_create_inbound_pipe): Ditto. (gnupg_create_outbound_pipe): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
2016-05-18dirmngr: Adjust the WKD lookup to specs version -01.Werner Koch1-2/+0
* dirmngr/server.c (cmd_wkd_get): Remove second occurrence of the domain part. -- This change updates gnupg to comply with draft-koch-openpgp-webkey-service-01
2016-04-27dirmngr: Add experimental command WKD_GET.Werner Koch1-4/+74
* dirmngr/server.c (cmd_wkd_get): New. (register_commands): Add command WKD_GET. Signed-off-by: Werner Koch <[email protected]>
2016-04-27dirmngr: Use system provided root CAs with KS_FETCH.Werner Koch1-1/+3
* dirmngr/ks-engine-http.c (ks_http_fetch): Use HTTP_FLAG_TRUST_SYS. Signed-off-by: Werner Koch <[email protected]>
2016-04-26http: Allow to request system defined CAs for TLS.Werner Koch5-14/+41
* dirmngr/http.h (HTTP_FLAG_TRUST_DEF, HTTP_FLAG_TRUST_SYS): New. * dirmngr/http.c (http_session_new): Add arg "flags". * dirmngr/ks-engine-hkp.c (send_request): Use new flag HTTP_FLAG_TRUST_DEF for the new arg of http_session_new. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (main): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
2016-04-15dirmngr: Fix https never reported in general helpAndre Heinecke1-1/+7
* dirmngr/ks-engine-http.c (ks_hkp_help): Also print https when supported and no uri provided. -- Wrong reporting was pointed out by K_F, again.
2016-04-15dirmngr: Fix https incorrectly reported in helpAndre Heinecke1-0/+2
* dirmngr/ks-engine-http.c (ks_hkp_help): Only print https if tls is supported. -- Wrong reporting was pointed out by K_F. Check is the same as in ks-engine-hkp.c
2016-04-05dirmngr: Autodetect PEM format in dirmngr-client.Justus Winter1-13/+30
* dirmngr/dirmngr-client.c (init_asctobin): New function. (main): Move the initialization code to the new function. (read_pem_certificate): Initialize base64 table. (read_certificate): Try to decode certificates given in files as PEM first. GnuPG-bug-id: 1844 Signed-off-by: Justus Winter <[email protected]>
2016-03-03dirmngr: Add more missing CFLAGS.Justus Winter1-2/+2
* dirmngr/Makefile.am (t_ldap_parse_uri_CFLAGS): Add 'GCRYPT_CFLAGS'. (t_dns_stuff_CFLAGS): Likewise. GnuPG-bug-id: 2235 Signed-off-by: Justus Winter <[email protected]>
2016-03-02common: Consolidate Assuan server argument handling.Justus Winter1-72/+1
* common/Makefile.am (common_sources): Add new files. * common/server-help.c: New file. * common/server-help.h: Likewise. * agent/command.c: Drop argument handling primitives in favor of using the consolidated ones. * dirmngr/server.c: Likewise. * g10/server.c: Likewise. * g13/server.c: Likewise. * scd/command.c: Likewise. * sm/server.c: Likewise. Signed-off-by: Justus Winter <[email protected]>
2016-03-01dirmngr: Add missing CFLAGS.Justus Winter1-2/+4
* dirmngr/Makefile.am (t_ldap_parse_uri_CFLAGS): Add 'GPG_ERROR_CFLAGS'. (t_dns_stuff_CFLAGS): Likewise. Signed-off-by: Justus Winter <[email protected]>
2016-02-15dirmngr: fix for memory alignment.NIIBE Yutaka1-6/+14
* dirmngr/dns-stuff.c (get_dns_cert): Cast through void *. (getsrv, get_dns_cname): Make sure it's aligned for HEADER. -- Signed-off-by: NIIBE Yutaka <[email protected]>
2016-01-27dirmngr: Build fix for FreeBSD (EAI macros)Werner Koch1-0/+4
* dirmngr/dns-stuff.c (map_eai_to_gpg_error): Map EAI_NODATA and EAI_ADDRFAMILY only if defined. -- Reported-by: Christoph Moench-Tegeder <[email protected]> Signed-off-by: Werner Koch <[email protected]>
2016-01-22dirmngr: Indicate that serial numbers are hexadecimal.Werner Koch3-9/+16
* dirmngr/misc.c (hexify_data): Add arg with_prefix. Adjust all callers. * dirmngr/crlcache.c (cache_isvalid): Print "0x" in front of the S/N. -- GnuPG-bug-id: 1147 Signed-off-by: Werner Koch <[email protected]>
2016-01-22dirmngr: Provide the keyserver pool name even if there is no CNAME.Werner Koch1-2/+2
* dirmngr/ks-engine-hkp.c (map_host): Fix setting of r_poolname. -- map_host is intended to return the name of the pool as an additional information. However this broke some time ago and a pool name was only retrained if the pool name was retrieved from a DNS CNAME. Signed-off-by: Werner Koch <[email protected]>
2016-01-22dirmngr: Use sks-keyservers CA by default for the hkps pool.Daniel Kahn Gillmor6-5/+36
* dirmngr/Makefile.am (dist_pkgdata_DATA): Add sks-keyservers.netCA.pem. * dirmngr/http.c (http_session_new): Add optional arg intended_hostname and set a default cert. * dirmngr/ks-engine-hkp.c (send_request): Pass httphost to http_session_new. -- Ship the certificate for the sks-keyservers hkps pool. If the user has specified that they want to use hkps://hkps.pool.sks-keyservers.net, and they have not specified any hkp-cacert explicitly, then initialize the trust path with this specific trust anchor. Co-authored-by: [email protected] Signed-off-by: Werner Koch <[email protected]>
2016-01-06dirmngr: Silence one regression test.Werner Koch1-2/+4
* dirmngr/t-dns-stuff.c (main): Do not print info during standard "make check". Signed-off-by: Werner Koch <[email protected]>
2015-12-22gpg: Suppress a warning.Neal H. Walfield1-0/+2
* dirmngr/dns-stuff.c (enable_dns_tormode): Reference new_circuit to avoid a warning when ADNS is not available. -- Signed-off-by: Neal H. Walfield <[email protected]>
2015-12-07dirmngr: Initialize http status code.Justus Winter1-1/+1
* dirmngr/ks-action.c (ks_action_search): Initialize 'http_status' as it is unused if LDAP is used to search for keys. -- This amends 6ac57a48. Signed-off-by: Justus Winter <[email protected]>
2015-12-04dirmngr: Stricter handling of http error codes.Justus Winter3-13/+21
* dirmngr/ks-action.c (ks_action_search): Only retry if the keyserver responded with a '404 Not Found'. * dirmngr/ks-engine-hkp.c (send_request): Return http status code. (ks_hkp_search): Likewise. (ks_hkp_{get,put}): Adapt call to 'send_request'. * dirmngr/ks-engine.h (ks_hkp_search): Update prototype. Signed-off-by: Justus Winter <[email protected]>
2015-12-04dirmngr: Really search all keyservers for patterns.Justus Winter1-1/+14
* dirmngr/ks-action.c (ks_action_search): Search all configured keyservers for the given patterns. Signed-off-by: Justus Winter <[email protected]> GnuPG-bug-id: 1038
2015-12-04dirmngr: Handle http status '501 Not Implemented'.Justus Winter1-0/+4
* dirmngr/ks-engine-hkp.c (send_request): Handle status 501 and return GPG_ERR_NOT_IMPLEMENTED. Signed-off-by: Justus Winter <[email protected]> GnuPG-bug-id: 1221
2015-12-04dirmngr: Add command to print the resolver version.Werner Koch1-0/+12
* dirmngr/server.c (cmd_getinfo): Add sub-command "dnsinfo".
2015-12-02build: Require at least Libassuan 2.4.1.Werner Koch2-17/+0
* configure.ac (NEED_LIBASSUAN_VERSION): Set to 2.4.1. * agent/gpg-agent.c (create_server_socket): Remove check for libassuan >= 2.3.0 and >= 2.1.4. (main): Remove check for libassuan >= 2.1.4. * scd/scdaemon.c (create_server_socket): Remove check for libassuan >= 2.1.4. * dirmngr/dirmngr.c (set_tor_mode): Remove check for libassuan >= 2.3.0. * dirmngr/http.c (http_raw_connect, send_request): Remove checks for libassuan >= 2.3.0. Signed-off-by: Werner Koch <[email protected]>
2015-12-02dirmngr: Switch to an onion address if Tor is running.Werner Koch3-31/+122
* dirmngr/dirmngr.h (opt): Turn field 'keyserver' into an strlist. * dirmngr/dirmngr.c (parse_rereadable_options): Allow multiple --keyserver options. * dirmngr/server.c (server_local_s): Add field 'tor_state'. (release_uri_item_list): New. (release_ctrl_keyservers): Use it. (start_command_handler): Release list of keyservers. (is_tor_running): New. (cmd_getinfo): Re-implement "tor" subcommand using new fucntion. (ensure_keyserver): Rewrite. * g10/dirmngr-conf.skel: Add two keyserver options. -- This feature is independent of --use-tor and automagically uses Tor if available. The dirmngr.conf file needs to specify two keyservers to make this work. For new installations this is done using the skeleton file. This feature requires the Libassuan 2.4.2 to work. This patch also fixes a memory leak of opt.keyserver en passant. Signed-off-by: Werner Koch <[email protected]>
2015-12-02http: Enhance parser to detect .onion addresses.Werner Koch3-33/+45
* dirmngr/http.h (parsed_uri_s): Add flag 'onion'. * dirmngr/http.c (do_parse_uri): Set that flag. * dirmngr/t-http.c (main): Print flags. Signed-off-by: Werner Koch <[email protected]>
2015-12-01dirmngr: Improve error handling.Justus Winter1-3/+2
* dirmngr/dns-stuff.c (getsrv): Avoid looking at 'header' before checking for errors, but silently ignore errors when looking up SRV records. -- This is a follow-up to 946faaff. Signed-off-by: Justus Winter <[email protected]>
2015-11-27Silence compiler warnings related to not using assuan_fd_t.Werner Koch1-2/+2
* common/call-gpg.c (start_gpg): Use assuan_fd_t. Note that the declaration was already fixed by a previous change. * dirmngr/server.c (cmd_getinfo): Use assuan_fd_t. -- Note that this matters only for Windows and it does not harm as long as we can only build for 32 bit Windows withsizeof(int)==sizeof(void*). Signed-off-by: Werner Koch <[email protected]>
2015-11-27Avoid incompatible pointer assignment warnings on Windows.Werner Koch2-10/+11
* common/logging.c (fun_writer): Use gpgrt_ssize_t instead of ssize_t. * dirmngr/server.c (data_line_cookie_write): Ditto. * sm/certdump.c (format_name_writer): Ditto. * sm/server.c (data_line_cookie_write): Ditto. * dirmngr/http.c (cookie_read, cookie_write): Ditto. -- See the release notes of libgpg-error 1.15 for background info on gpgrt_ssize_t. Signed-off-by: Werner Koch <[email protected]>
2015-11-27dirmngr: Avoid casting away a const from an char**.Werner Koch1-13/+38
* dirmngr/ldap.c (start_cert_fetch_ldap): Do not use pointers from global variables. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-18 12:58:10 +0000