aboutsummaryrefslogtreecommitdiffstats
path: root/g10/keyserver.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2015-02-18gpg: Print better diagnostics for keyserver operations.Werner Koch1-8/+55
* g10/armor.c (parse_key_failed_line): New. (check_input): Watch out for gpgkeys_ error lines. * g10/filter.h (armor_filter_context_t): Add field key_failed_code. * g10/import.c (import): Add arg r_gpgkeys_err. (import_keys_internal): Ditto. (import_keys_stream): Ditto. * g10/keyserver.c (keyserver_errstr): New. (keyserver_spawn): Detect "KEY " lines while sending. Get gpgkeys_err while receiving keys. (keyserver_work): Add kludge for better error messages. -- GnuPG-bug-id: 1832 Note that these changes can be backported to 1.4 but they don't make sense for 2.1 due to the removal of the keyserver helpers. The error reporting could be improved even more but given that this is an old GnuPG branch it is not justified to put too much effort into it. Signed-off-by: Werner Koch <[email protected]>
2014-08-06gpg: Fix regression due to the keyserver import filter.Werner Koch1-30/+46
* g10/keyserver.c (keyserver_retrieval_filter): Change args. Rewrite to take subpakets in account. * g10/import.c (import_one, import_secret_one): Pass keyblock to filter. -- GnuPG-bug-id: 1680
2014-06-25gpg: Make screening of keyserver result work with multi-key commands.Werner Koch1-23/+45
* g10/keyserver.c (ks_retrieval_filter_arg_s): new. (keyserver_retrieval_filter): Use new struct and check all descriptions. (keyserver_spawn): Pass filter arg suing the new struct. -- This is a fix for commit 5e933008. The old code did only work for a single key. It failed as soon as several keys are specified ("gpg --refresh-keys" or "gpg --recv-key A B C").
2014-06-24gpg: Screen keyserver responses.Stefan Tomanek1-12/+65
* g10/main.h (import_filter_t): New. * g10/import.c (import): Add filter callbacks to param list. (import_one): Ditto. (import_secret_one): Ditto. (import_keys_internal): Ditto. (import_keys_stream): Ditto. * g10/keyserver.c (keyserver_retrieval_filter): New. (keyserver_spawn): Pass filter to import_keys_stream() -- These changes introduces import functions that apply a constraining filter to imported keys. These filters can verify the fingerprints of the keys returned before importing them into the keyring, ensuring that the keys fetched from the keyserver are in fact those selected by the user beforehand. Signed-off-by: Stefan Tomanek <[email protected]> Re-indention and minor changes by wk. Resolved conflicts: g10/import.c g10/keyserver.c g10/main.h
2013-10-11gpg: Fix --version output and explicitly disable ECC.Werner Koch1-1/+1
* g10/misc.c (openpgp_pk_algo_name): New. Replace all calls in g10/ to gcry_pk_algo_name by a call to this function. (map_pk_openpgp_to_gcry): Map algo PUBKEY_ALGO_ELGAMAL_E to GCRY_PK_ELG. (openpgp_pk_test_algo): Use PUBKEY_ALGO_ELGAMAL_E instead of GCRY_PK_ELG_E. Return an error for ECC algos. (openpgp_pk_test_algo2): Return an error for ECC algos. * g10/gpg.c (build_list): Avoid printing ECC two times. * include/cipher.h: Do not use GCRY_PK_* macros for PUBKEY_ALGO_*. -- Due to recent changes to adjust for use with Libgcrypt 1.6, "gpg --version" printed two question marks. This patches fixes that and also make sure that gpg does advertise any ECC features. The patch in build_list is not really needed. Signed-off-by: Werner Koch <[email protected]>
2013-10-04gpg: Protect against rogue keyservers sending secret keys.Werner Koch1-5/+10
* g10/options.h (IMPORT_NO_SECKEY): New. * g10/keyserver.c (keyserver_spawn, keyserver_import_cert): Set new flag. * g10/import.c (import_secret_one): Deny import if flag is set. -- By modifying a keyserver or a DNS record to send a secret key, an attacker could trick a user into signing using a different key and user id. The trust model should protect against such rogue keys but we better make sure that secret keys are never received from remote sources. Suggested-by: Stefan Tomanek Signed-off-by: Werner Koch <[email protected]>
2012-11-29The keyserver search menu should honor --keyid-formatDavid Shaw1-5/+11
* keyserver.c (print_keyrec): Honor --keyid-format when getting back full fingerprints from the keyserver (the comment in the code was correct, the code was not).
2012-11-27Fix printing of ECC algo names in hkp keyserver listings.Werner Koch1-20/+21
* g10/misc.c (map_pk_openpgp_to_gcry): New. * g10/keyserver.c (print_keyrec): Map OpenPGP algorithm ids. -- Although we don't have support for ECC, we want to print a proper algorithm name in keyserver listings. This will only work while using a ECC enabled Libgcrypt. Problem reported by Kristian Fiskerstrand.
2009-07-23Try a DNS-SD lookup to find a domain-specific LDAP server beforeDavid Shaw1-13/+50
resorting to keys.{domain}.
2009-06-17Add readcert command.Werner Koch1-0/+3
fix reading large certificates.
2009-05-11* keyserver.c (keyserver_typemap): gpgkeys_hkp handles hkps as well.David Shaw1-2/+4
From 1.4.
2008-12-09Flush keyserver search output.Werner Koch1-0/+2
Add trustdb chnages from 1.4. Check algo usage for batch key generation.
2008-09-04* keyserver.c (keyserver_import_cert): Allow keyserver URLs inDavid Shaw1-7/+1
addition to full URLs in CERT records.
2008-04-08Enhanced --auto-key-locate.Werner Koch1-9/+20
2008-04-07Minor cleanups.Werner Koch1-1/+9
Implemented key helper kdns
2008-03-25Changed the way i18n files are located under Windows. The setting of theWerner Koch1-2/+2
Registry key is not anymore required. Helpfiles are not properly located.
2007-07-04Changed to GPLv3.Werner Koch1-4/+2
Removed intl/.
2007-06-14A whole bunch of changes to allow building for Windows.Werner Koch1-2/+2
See the ChangeLogs for details.
2007-03-14From STABLE-BRANCH-1-4David Shaw1-2/+9
* keyserver.c: Windows Vista doesn't grok X_OK and so fails access() tests. Previous versions interpreted X_OK as F_OK anyway, so we'll just use F_OK directly.
2006-12-06Fixes for CVE-2006-6235Werner Koch1-6/+7
2006-10-06* keyserver.c (keyserver_spawn): Write the 16-digit keyid ratherDavid Shaw1-2/+6
than whatever key selector the user used on the command line.
2006-10-02Fix for bug 537Werner Koch1-20/+20
2006-09-14Take advantage of newer gpg-error features.Werner Koch1-1/+1
2006-08-16With --enable-gpg the keyservers are now build and a first test using gpg2Werner Koch1-0/+4
shows no prblems. Needs more testing of course.
2006-05-23g10/ does build again.Werner Koch1-3/+6
2006-04-28Merged recent changes from 1.4Werner Koch1-35/+29
2006-04-27(keyserver_import_cert): Show warning if there is a CERT fingerprint,David Shaw1-0/+6
but no --keyserver set.
2006-04-27* keyserver.c (path_makes_direct): New. (keyserver_spawn): Used hereDavid Shaw1-32/+22
to add "_uri" to certain gpgkeys_xxx helpers when the meaning is different if a path is provided (i.e. ldap).
2006-04-22* keyserver.c: Fix build problem with platforms that stick libcurl inDavid Shaw1-3/+0
a place not in the regular include search path.
2006-04-21Still merging 1.4.3 code backWerner Koch1-1/+1
2006-04-19Continued with merging.Werner Koch1-2/+2
Still does not build.
2006-04-19Merged with gpg 1.4.3 code. Werner Koch1-274/+1028
The gpg part does not yet build.
2006-03-17* keyserver.c (keyserver_import_cert): Handle the IPGP CERT type forDavid Shaw1-12/+25
both the fingerprint alone, and fingerprint+URL cases. * getkey.c (get_pubkey_byname): Minor cleanup.
2006-03-16* cert.c (get_cert): Handle the fixed IPGP type with fingerprint.David Shaw1-1/+1
2006-03-14* keyserver-internal.h, keyserver.c (keyserver_import_pka): Use theDavid Shaw1-3/+9
same API as the other auto-key-locate fetchers. * getkey.c (get_pubkey_byname): Use the fingerprint of the key that we actually fetched. This helps prevent problems where the key that we fetched doesn't have the same name that we used to fetch it. In the case of CERT and PKA, this is an actual security requirement as the URL might point to a key put in by an attacker. By forcing the use of the fingerprint, we won't use the attacker's key here.
2006-03-14* keyserver-internal.h, keyserver.c (keyserver_spawn, keyserver_work,David Shaw1-19/+26
keyserver_import_cert, keyserver_import_name, keyserver_import_ldap): Pass fingerprint info through.
2006-03-14* main.h, import.c (import_one): Optionally return the fingerprint ofDavid Shaw1-2/+3
the key being imported. (import_keys_internal, import_keys_stream, import): Change all callers.
2006-02-24* keydb.h, getkey.c (release_akl), gpg.c (main): AddDavid Shaw1-2/+38
--no-auto-key-locate. * options.h, gpg.c (main): Keep track of each keyserver registered so we can match on them later. * keyserver-internal.h, keyserver.c (cmp_keyserver_spec, keyserver_match), gpgv.c: New. Find a keyserver that matches ours and return its spec. * getkey.c (get_pubkey_byname): Use it here to get the per-keyserver options from an earlier keyserver.
2006-02-24* keyserver.c (parse_keyserver_options): Only change max_cert if it isDavid Shaw1-1/+1
used.
2006-02-23* options.c, gpg.c (main), keyserver.c (keyserver_spawn): No specialDavid Shaw1-16/+7
treatment of include-revoked, include-subkeys, and try-dns-srv. These are keyserver features, and GPG shouldn't get involved here.
2006-02-23* keyserver.c (parse_keyserver_uri, add_canonical_option): Always appendDavid Shaw1-3/+3
options to the list, as ordering may be significant to the user.
2006-02-23* options.h, keyserver.c (add_canonical_option): New.David Shaw1-19/+43
(parse_keyserver_options): Moved from here. (parse_keyserver_uri): Use it here so each keyserver can have some private options in addition to the main keyserver-options (e.g. per-keyserver auth).
2006-02-22* options.h, keyserver-internal.h, keyserver.c (keyserver_import_name),David Shaw1-2/+2
getkey.c (free_akl, parse_auto_key_locate, get_pubkey_byname): The obvious next step: allow arbitrary keyservers in the auto-key-locate list.
2006-02-22* options.h, keyserver.c (parse_keyserver_options): RemoveDavid Shaw1-6/+4
auto-cert-retrieve as it is no longer meaningful. Add max-cert-size to allow users to pick a max key size retrieved via CERT.
2006-02-22* options.h, gpg.c (main), mainproc.c (check_sig_and_print), keyserver.cDavid Shaw1-4/+10
(keyserver_opts): Rename auto-pka-retrieve to honor-pka-record to be consistent with honor-keyserver-url.
2006-02-21* getkey.c (get_pubkey_byname): Fix minor security problem with PKA whenDavid Shaw1-3/+2
importing at -r time. The URL in the PKA record may point to a key put in by an attacker. Fix is to use the fingerprint from the PKA record as the recipient. This ensures that the PKA record is followed. * keyserver-internal.h, keyserver.c (keyserver_import_pka): Return the fingerprint we requested.
2006-02-21* gpgv.c: Stub keyserver_import_ldap.David Shaw1-0/+35
* keyserver-internal.h, keyserver.c (keyserver_import_ldap): Import using the PGP Universal trick of asking ldap://keys.(maildomain) for the key.
2006-02-21* keyserver.c (parse_keyserver_uri): Include the scheme in the uriDavid Shaw1-2/+7
even when we've assumed "hkp" when there was no scheme.
2006-01-24* keyserver.c (parse_keyserver_uri): If there is a path present, set theDavid Shaw1-0/+3
direct_uri flag so the right keyserver helper is run.
2006-01-22* keyserver.c (keyserver_spawn): Include the EXEEXT so we can findDavid Shaw1-2/+4
keyserver helpers on systems that use extensions. * misc.c (path_access) [HAVE_DRIVE_LETTERS]: Do the right thing with drive letter systems.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-22 12:05:38 +0000