aboutsummaryrefslogtreecommitdiffstats
path: root/g10/tofu.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2017-01-02g10: Use bitfield for flags of user ids.Justus Winter1-4/+4
* g10/packet.h (is_{primary,revoked,expired}): Move to the flags bitfield. * g10/call-dirmngr.c: Update all uses using the following semantic patch. * g10/export.c: Likewise. * g10/getkey.c: Likewise. * g10/import.c: Likewise. * g10/kbnode.c: Likewise. * g10/keyedit.c: Likewise. * g10/keylist.c: Likewise. * g10/keyserver.c: Likewise. * g10/mainproc.c: Likewise. * g10/pkclist.c: Likewise. * g10/pubkey-enc.c: Likewise. * g10/tofu.c: Likewise. * g10/trust.c: Likewise. * g10/trustdb.c: Likewise. -- I used Coccinelle and the following semantic patch to update the code: @@ expression E; @@ -E->is_expired +E->flags.expired @@ expression E; @@ -E->is_primary +E->flags.primary @@ expression E; @@ -E->is_revoked +E->flags.revoked Signed-off-by: Justus Winter <[email protected]>
2017-01-02Replace use of variable-length-arrays.Werner Koch1-3/+3
* common/t-iobuf.c (main): Replace variable-length-array. * g10/gpgcompose.c (mksubpkt_callback): Ditto. (encrypted): Ditto. * g10/t-stutter.c (log_hexdump): Ditto. (oracle_test): Ditto. * g10/tofu.c (get_policy): Ditto. Use "%zu" for size_t. * scd/app-openpgp.c (ecc_writekey): Replace variable-length-array. Check for zero length OID_LEN. Signed-off-by: Werner Koch <[email protected]>
2016-12-16g10: Use total days, not total messages to compute TOFU validityNeal H. Walfield1-12/+12
* g10/tofu.c (write_stats_status): Use the number of days with signatures / encryptions to compute the validity, not the total number of signatures / encryptions. (BASIC_TRUST_THRESHOLD): Adjust given the new semantics. (FULL_TRUST_THRESHOLD): Likewise. Signed-off-by: Neal H. Walfield <[email protected]>
2016-12-16g10: Extend TOFU_STATS to emit <sign-days> and <encyrption-days>Neal H. Walfield1-16/+63
* doc/DETAILS: Add SIGN-DAYS and ENCRYPT-DAYS to the TOFU_STATS status line. * g10/tofu.c (write_stats_status): Take additional parameters signature_days and encryption_days. Update callers. Include them in the tfs record and TOFU status lines. (show_statistics): Compute the number of days on which we saw a message signed by FINGERPRINT, and the number of days on which we encrypted a message to it. Signed-off-by: Neal H. Walfield <[email protected]>
2016-12-16g10: On a TOFU conflict, write the conflicting keys to the status fdNeal H. Walfield1-16/+36
* g10/tofu.c (ask_about_binding): Emit all of the conflicting keys and their statistics on the status fd. (get_trust): Likewise, if we don't call ask_about_binding. (show_statistics): Have the caller pass the policy as returned by get_policy. Add argument only_status_fd and don't emit any output on stdout if it is set. Update callers. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-12-16g10: Add missing space.Neal H. Walfield1-1/+1
* g10/tofu.c (tofu_register_encryption): Add missing space. Signed-off-by: Neal H. Walfield <[email protected]>
2016-12-08gpg: Fix the fix out-of-bounds access.Werner Koch1-2/+2
* g10/tofu.c (build_conflict_set): Revert to int* and fix calloc. -- The original code used an int array and thus better keep that and do not limit it to 128 entries. Fixes-commit: c3008bffac68b6f31e9ae9bad837cdce5de7c0db Fixes-commit: 3b5b94ceab7c0ed9501c5cf54b4efa17fcd7300a Signed-off-by: Werner Koch <[email protected]>
2016-12-08g10: Fix out-of-bounds access.Justus Winter1-1/+1
* g10/tofu.c (build_conflict_set): Use 'char'. Fixes-commit: c3008bffac68b6f31e9ae9bad837cdce5de7c0db Signed-off-by: Justus Winter <[email protected]>
2016-12-08gpg: Fix portability problem.Werner Koch1-2/+9
* g10/tofu.c (build_conflict_set): Replace variable dynamic array. -- Note that clang complained that CONFLICT_SET_COUNT could be negative. Thus I added an assert. Signed-off-by: Werner Koch <[email protected]>
2016-12-06g10: Remove dead code.Neal H. Walfield1-17/+0
* g10/tofu.c (tofu_set_policy_by_keyid): Remove function. Signed-off-by: Neal H. Walfield <[email protected]>
2016-12-02g10: Improve debugging output.Neal H. Walfield1-6/+12
* g10/tofu.c (string_to_long): Improve debugging output. (string_to_ulong): Likewise. Signed-off-by: Neal H. Walfield <[email protected]>
2016-12-01g10: In the TOFU module, make strings easier to translate.Neal H. Walfield1-187/+144
* g10/tofu.c: Remove dead code. (time_ago_str): Simplify implementation since we only want the most significant unit. (format_conflict_msg_part1): Use ngettext. (ask_about_binding): Likewise and only emit full sentences. (show_statistics): Likewise. Signed-off-by: Neal H. Walfield <[email protected]>
2016-11-29Improve some comments.Neal H. Walfield1-17/+17
2016-11-29g10: Extend TOFU_STATS to always show the validityNeal H. Walfield1-11/+19
* doc/DETAILS (TOFU_STATS): Rename the VALIDITY field to SUMMARY. Add a new field called VALIDITY. * g10/tofu.c (write_stats_status): Update output accordingly. -- Signed-off-by: Neal H. Walfield <[email protected]> Change TOFU_STATS as discussed offline with Werner, Justus and Andre.
2016-11-22g10: Use es_fopen instead of open.Neal H. Walfield1-11/+10
* g10/tofu.c: Don't include <utime.h>, <fcntl.h> or <unistd.h>. (busy_handler): Replace use of open with es_fopen. -- Signed-off-by: Neal H. Walfield <[email protected]> Thanks for Werner for pointing this out: es_fopen is more portable than open.
2016-11-22g10: If the set of UTKs changes, invalidate any changed policies.Neal H. Walfield1-0/+149
* g10/trustdb.c (tdb_utks): New function. * g10/tofu.c (check_utks): New function. (initdb): Call it. * tests/openpgp/tofu.scm: Modify test to check the effective policy of keys whose effective policy changes when we change the set of UTKs. -- Signed-off-by: Neal H. Walfield <[email protected]> If the set of ultimately trusted keys changes, then it is possible that a binding's effective policy changes. To deal with this, we detect when the set of ultimately trusted keys changes and invalidate all cached policies.
2016-11-22g10: Fix memory leak.Justus Winter1-2/+0
* g10/tofu.c (tofu_notice_key_changed): Remove spurious duplicate call to 'hexfingerprint'. Fixes-commit: 037f9de09298a31026ea2ab5fbd4a599b11cc34f Signed-off-by: Justus Winter <[email protected]>
2016-11-21g10: Cache the effective policy. Recompute it when required.Neal H. Walfield1-339/+487
* g10/tofu.c (initdb): Add column effective_policy to the bindings table. (record_binding): New parameters effective_policy and set_conflict. Save the effective policy. If SET_CONFLICT is set, then set conflict according to CONFLICT. Otherwise, preserve the current value of conflict. Update callers. (get_trust): Don't compute the effective policy here... (get_policy): ... do it here, if it was not cached. Take new parameters, PK, the public key, and NOW, the time that the operation started. Update callers. (show_statistics): New parameter PK. Pass it to get_policy. Update callers. (tofu_notice_key_changed): New function. * g10/gpgv.c (tofu_notice_key_changed): New stub. * g10/import.c (import_revoke_cert): Take additional argument CTRL. Pass it to keydb_update_keyblock. * g10/keydb.c (keydb_update_keyblock): Take additional argument CTRL. Update callers. [USE_TOFU]: Call tofu_notice_key_changed. * g10/test-stubs.c (tofu_notice_key_changed): New stub. * tests/openpgp/tofu.scm: Assume that manually setting a binding's policy to auto does not cause the tofu engine to forget about any conflict. -- Signed-off-by: Neal H. Walfield <[email protected]> We now store the computed policy in the tofu DB (in the effective_policy column of the bindings table) to avoid computing it every time, which is expensive. Further, policy is never overridden in case of a conflict. Instead, we detect a conflict if CONFLICT is not empty. This change is backwards compatible to existing DBs. The only minor incompatibility is that unresolved conflicts won't be automatically resolved in case we import a direct signature, or cross signatures.
2016-11-21g10: Correctly parameterize ngettext.Neal H. Walfield1-3/+6
* g10/tofu.c (ask_about_binding): Correctly parameterize ngettext. Signed-off-by: Neal H. Walfield <[email protected]>
2016-11-21g10: Don't use the same variable for multiple SQL compiled statementsNeal H. Walfield1-4/+4
* g10/tofu.c (struct tofu_dbs_s): Remove unused field record_binding_update2. Replace register_insert with register_signature and register_encryption. (tofu_register_signature): Don't use dbs->s.register_insert, but dbs->s.register_signature. (tofu_register_encryption): Don't use dbs->s.register_insert, but dbs->s.register_encryption. Signed-off-by: Neal H. Walfield <[email protected]>
2016-11-21g10: Add a convenience function for checking if a key is a primary keyNeal H. Walfield1-7/+6
* g10/keydb.h (pk_is_primary): New function. * g10/tofu.c (get_trust): Use it. (tofu_register_signature): Likewise. (tofu_register_encryption): Likewise. (tofu_set_policy): Likewise. (tofu_get_policy): Likewise. Signed-off-by: Neal H. Walfield <[email protected]>
2016-11-18g10: Fix flags to open for lock of ToFU.NIIBE Yutaka1-5/+2
* g10/tofu.c (busy_handler): Fix the flags and utime is not needed. -- The argument flags must include one of O_RDONLY, O_WRONLY, or O_RDWR. Adding O_TRUNC, the file is updated. So, utime is not needed. Fixes-commit: b2e1b17efa952afcf7aeec8b15e9d0088dba587a Signed-off-by: NIIBE Yutaka <[email protected]>
2016-11-18g10: Fix creating a lock for ToFU.NIIBE Yutaka1-1/+2
* g10/tofu.c (busy_handler): Add third argument which is mandatory for O_CREATE flag. -- Reported-by: Kristian Fiskerstrand Signed-off-by: NIIBE Yutaka <[email protected]>
2016-11-05Change all http://www.gnu.org in license notices to https://Werner Koch1-1/+1
--
2016-11-02g10,w32: Fix build on Windows.Justus Winter1-4/+1
* g10/tofu.c (begin_transaction): Use the new 'gnupg_usleep'. Signed-off-by: Justus Winter <[email protected]>
2016-10-31g10: Avoid gratuitious SQLite aborts and starving writers.Neal H. Walfield1-16/+82
* g10/tofu.c: Include <time.h>, <utime.h>, <fcntl.h> and <unistd.h>. (tofu_dbs_s): Add fields want_lock_file and want_lock_file_ctime. (begin_transaction): Only yield if DBS->WANT_LOCK_FILE_CTIME has changed since we took the lock. Don't use gpgrt_yield to yield, but sleep for 100ms. After taking the batch lock, update DBS->WANT_LOCK_FILE_CTIME. Also take the batch lock the first time we take the real lock. When taking the real lock, use immediate not deferred mode to avoid gratuitious aborts. (end_transaction): When dropping the outermost real lock, drop the batch lock. (busy_handler): New function. (opendbs): Set the busy handler to it when opening the DB. Initialize CTRL->TOFU.DBS->WANT_LOCK_FILE. (tofu_closedbs): Free DBS->WANT_LOCK_FILE. -- Signed-off-by: Neal H. Walfield <[email protected]> By default, SQLite defers transactions until they are actually needed. A consequence of this is that if we have two readers and both decide to do a write, then one has to abort. To avoid this problem, we can make the outermost transaction an immediate transaction. This has the disadvantage that we only allow a single reader at a time, but at least we don't have gratuitous aborts anymore. A second problem is that SQLite apparently doesn't actually create a queue of waiters. The result is that doing a sched_yield between dropping and retaking the batch transaction is not enough to allow the other process to make progress. Instead, we need to wait a while (emperically: 100ms seems reasonable). To avoid waiting when there is no contention, we use a new file's timestamp to signal that there is a waiter.
2016-10-30g10: Avoid reading in keys when possible.Neal H. Walfield1-2/+16
* g10/tofu.c (build_conflict_set): If CONFLICT_SET contains a single element, don't bother to check for cross sigs. Add parameter PK. Update callers. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-30g10: Fix bit setting.Neal H. Walfield1-4/+4
* g10/tofu.c (build_conflict_set): Fix bit setting. -- Signed-off-by: Neal H. Walfield <[email protected]> Fixes-commit: 1f1f56e606c1cb28eec68c60bd8bcb7ab30805de
2016-10-13g10: Be more careful when checking if a binding is signed by a UTK.Neal H. Walfield1-2/+25
* g10/tofu.c (signed_by_utk): When checking if a key is signed by an ultimately trusted key, only consider the signatures on the specified user id. * tests/openpgp/tofu.scm: Add test for the above. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-13g10: Be more careful when checking cross signatures.Neal H. Walfield1-2/+26
* g10/tofu.c (cross_sigs): When checking cross signatures, only consider the signatures on the specified user id. * tests/openpgp/tofu.scm: Add test for the above. * tests/openpgp/tofu/cross-sigs/ 1938C3A0E4674B6C217AC0B987DB2814EC38277E-1.gpg: New file. * tests/openpgp/tofu/cross-sigs/ 1938C3A0E4674B6C217AC0B987DB2814EC38277E-1.txt: New file. * tests/openpgp/tofu/cross-sigs/ 1938C3A0E4674B6C217AC0B987DB2814EC38277E-2.gpg: New file. * tests/openpgp/tofu/cross-sigs/ 1938C3A0E4674B6C217AC0B987DB2814EC38277E-2.txt: New file. * tests/openpgp/tofu/cross-sigs/ 1938C3A0E4674B6C217AC0B987DB2814EC38277E-3.txt: New file. * tests/openpgp/tofu/cross-sigs/ 1938C3A0E4674B6C217AC0B987DB2814EC38277E-secret.gpg: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-1.gpg: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-1.txt: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-2.gpg: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-2.txt: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-3.gpg: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-3.txt: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-4.gpg: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-secret.gpg: New file. * tests/openpgp/tofu/cross-sigs/README: New file. -- Signed-off-by: Neal H. Walfield
2016-10-13g10: Still check if the key is an UTK or cross signed in batch mode.Neal H. Walfield1-18/+13
* g10/tofu.c (get_trust): If POLICY is ask, but we can't ask, don't bail immediately. Instead, check if the key in question is an ultimately trusted key or cross signed. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-13g10: If an sqlite operation fails, map the error code to GPG_ERR_GENERALNeal H. Walfield1-2/+17
* g10/tofu.c (get_policy): If an sqlite operation fails, map the error code to GPG_ERR_GENERAL. (ask_about_binding): Likewise. (build_conflict_set): Likewise. (get_trust): Likewise. (show_statistics): Likewise. (tofu_register_signature): Likewise. (tofu_register_encryption): Likewise. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-12g10: When changing a TOFU binding's policy, update the conflict infoNeal H. Walfield1-17/+16
* g10/tofu.c (record_binding): Take an additional argument, CONFLICT. Set the binding's conflict accordingly. Update callers. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-12g10: Make a singular string singular.Neal H. Walfield1-1/+1
* g10/tofu.c (ask_about_binding): Make the singular string singular. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-12g10: Correctly determine whether a binding has a conflict.Neal H. Walfield1-1/+1
* g10/tofu.c (build_conflict_set): A binding has a conflict is conflict is *not* NULL, not if it is NULL. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-12g10: Fix a column's type in TOFU DB.Neal H. Walfield1-1/+1
* g10/tofu.c (initdb): Change policy from a boolean to an integer. -- Signed-off-by: Neal H. Walfield <[email protected]> Reported-by: Daniel Kahn Gillmor <[email protected]> Note: sqlite ignores type information so this change has no real impact.
2016-10-07Revert "g10: Fix singular term."Werner Koch1-1/+1
-- This reverts commit b0d2526bc4e5c663eeffe04500420c70cee98712. The number of format elements may not change in ngettext. The entire construct is anyway wrong because ngettext is passed a different value than what is used in the printf. We need to rework the use of most strings in tofu.c. Signed-off-by: Werner Koch <[email protected]>
2016-10-06g10: Fix singular term.Justus Winter1-1/+1
* g10/tofu.c (ask_about_binding): Fix singular message. Signed-off-by: Justus Winter <[email protected]>
2016-10-06g10: Use appropriate variant of 'abs'.Justus Winter1-6/+6
* g10/tofu.c (ask_about_binding): Use 'labs' instead of 'abs'. Signed-off-by: Justus Winter <[email protected]>
2016-09-19g10: Fix memory leak.Justus Winter1-0/+1
* g10/tofu.c (build_conflict_set): Free 'kb_all'. Signed-off-by: Justus Winter <[email protected]>
2016-09-17Fix more spellingDaniel Kahn Gillmor1-1/+1
* NEWS, acinclude.m4, agent/command-ssh.c, agent/command.c, agent/gpg-agent.c, agent/keyformat.txt, agent/protect-tool.c, common/asshelp.c, common/b64enc.c, common/recsel.c, doc/DETAILS, doc/HACKING, doc/Notes, doc/TRANSLATE, doc/dirmngr.texi, doc/faq.org, doc/gpg-agent.texi, doc/gpg.texi, doc/gpgsm.texi, doc/instguide.texi, g10/armor.c, g10/gpg.c, g10/keyedit.c, g10/mainproc.c, g10/pkclist.c, g10/tofu.c, g13/sh-cmd.c, g13/sh-dmcrypt.c, kbx/keybox-init.c, m4/pkg.m4, sm/call-dirmngr.c, sm/gpgsm.c, tests/Makefile.am, tests/gpgscm/Manual.txt, tests/gpgscm/scheme.c, tests/openpgp/gpgv-forged-keyring.scm, tests/openpgp/multisig.test, tests/openpgp/verify.scm, tests/pkits/README, tools/applygnupgdefaults, tools/gpg-connect-agent.c, tools/mime-maker.c, tools/mime-parser.c: minor spelling cleanup. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2016-09-16g10: On failure, propagate the return code.Neal H. Walfield1-0/+1
* g10/tofu.c (tofu_register_encryption): If get_trust fails, set RC. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-16g10: Improve some comments and a string.Neal H. Walfield1-9/+13
-- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-16g10: Don't ignore failure. On failure, rollback.Neal H. Walfield1-3/+15
* g10/tofu.c (tofu_set_policy): If record_binding fails, fail. If the function fails, rollback the transaction. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-16g10: Load the key block if the supplied user id list is NULL.Neal H. Walfield1-1/+1
* g10/tofu.c (tofu_register_encryption): Load the key block if USER_ID_LIST is NULL. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-16g10: Use the accessor functions for accessing and comparing key idsNeal H. Walfield1-7/+8
* g10/tofu.c (get_trust): Use the pk_main_keyid accessor function. (tofu_register_signature): Likewise. (tofu_register_encryption): Likewise. (tofu_set_policy): Likewise and also use pk_keyid and keyid_cmp. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-14g10: Fix whitespace.Neal H. Walfield1-1/+1
* g10/tofu.c (show_statistics): Fix whitespace. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-14g10: Correctly compute the euclidean distance.Neal H. Walfield1-8/+10
* g10/tofu.c (write_stats_status): Correctly compute the euclidean distance. (show_statistics): Likewise. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-14g10: Change the default TOFU policy for UTKs to good.Neal H. Walfield1-2/+2
* g10/tofu.c (get_trust): Change the default TOFU policy for UTKs to good. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-14g10: Add missing static qualifier.Neal H. Walfield1-1/+1
* g10/tofu.c (cross_sigs): Add missing static qualifier. -- Signed-off-by: Neal H. Walfield <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-22 19:29:59 +0000