aboutsummaryrefslogtreecommitdiffstats
path: root/g10/tofu.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2016-12-08gpg: Fix the fix out-of-bounds access.Werner Koch1-2/+2
* g10/tofu.c (build_conflict_set): Revert to int* and fix calloc. -- The original code used an int array and thus better keep that and do not limit it to 128 entries. Fixes-commit: c3008bffac68b6f31e9ae9bad837cdce5de7c0db Fixes-commit: 3b5b94ceab7c0ed9501c5cf54b4efa17fcd7300a Signed-off-by: Werner Koch <[email protected]>
2016-12-08g10: Fix out-of-bounds access.Justus Winter1-1/+1
* g10/tofu.c (build_conflict_set): Use 'char'. Fixes-commit: c3008bffac68b6f31e9ae9bad837cdce5de7c0db Signed-off-by: Justus Winter <[email protected]>
2016-12-08gpg: Fix portability problem.Werner Koch1-2/+9
* g10/tofu.c (build_conflict_set): Replace variable dynamic array. -- Note that clang complained that CONFLICT_SET_COUNT could be negative. Thus I added an assert. Signed-off-by: Werner Koch <[email protected]>
2016-12-06g10: Remove dead code.Neal H. Walfield1-17/+0
* g10/tofu.c (tofu_set_policy_by_keyid): Remove function. Signed-off-by: Neal H. Walfield <[email protected]>
2016-12-02g10: Improve debugging output.Neal H. Walfield1-6/+12
* g10/tofu.c (string_to_long): Improve debugging output. (string_to_ulong): Likewise. Signed-off-by: Neal H. Walfield <[email protected]>
2016-12-01g10: In the TOFU module, make strings easier to translate.Neal H. Walfield1-187/+144
* g10/tofu.c: Remove dead code. (time_ago_str): Simplify implementation since we only want the most significant unit. (format_conflict_msg_part1): Use ngettext. (ask_about_binding): Likewise and only emit full sentences. (show_statistics): Likewise. Signed-off-by: Neal H. Walfield <[email protected]>
2016-11-29Improve some comments.Neal H. Walfield1-17/+17
2016-11-29g10: Extend TOFU_STATS to always show the validityNeal H. Walfield1-11/+19
* doc/DETAILS (TOFU_STATS): Rename the VALIDITY field to SUMMARY. Add a new field called VALIDITY. * g10/tofu.c (write_stats_status): Update output accordingly. -- Signed-off-by: Neal H. Walfield <[email protected]> Change TOFU_STATS as discussed offline with Werner, Justus and Andre.
2016-11-22g10: Use es_fopen instead of open.Neal H. Walfield1-11/+10
* g10/tofu.c: Don't include <utime.h>, <fcntl.h> or <unistd.h>. (busy_handler): Replace use of open with es_fopen. -- Signed-off-by: Neal H. Walfield <[email protected]> Thanks for Werner for pointing this out: es_fopen is more portable than open.
2016-11-22g10: If the set of UTKs changes, invalidate any changed policies.Neal H. Walfield1-0/+149
* g10/trustdb.c (tdb_utks): New function. * g10/tofu.c (check_utks): New function. (initdb): Call it. * tests/openpgp/tofu.scm: Modify test to check the effective policy of keys whose effective policy changes when we change the set of UTKs. -- Signed-off-by: Neal H. Walfield <[email protected]> If the set of ultimately trusted keys changes, then it is possible that a binding's effective policy changes. To deal with this, we detect when the set of ultimately trusted keys changes and invalidate all cached policies.
2016-11-22g10: Fix memory leak.Justus Winter1-2/+0
* g10/tofu.c (tofu_notice_key_changed): Remove spurious duplicate call to 'hexfingerprint'. Fixes-commit: 037f9de09298a31026ea2ab5fbd4a599b11cc34f Signed-off-by: Justus Winter <[email protected]>
2016-11-21g10: Cache the effective policy. Recompute it when required.Neal H. Walfield1-339/+487
* g10/tofu.c (initdb): Add column effective_policy to the bindings table. (record_binding): New parameters effective_policy and set_conflict. Save the effective policy. If SET_CONFLICT is set, then set conflict according to CONFLICT. Otherwise, preserve the current value of conflict. Update callers. (get_trust): Don't compute the effective policy here... (get_policy): ... do it here, if it was not cached. Take new parameters, PK, the public key, and NOW, the time that the operation started. Update callers. (show_statistics): New parameter PK. Pass it to get_policy. Update callers. (tofu_notice_key_changed): New function. * g10/gpgv.c (tofu_notice_key_changed): New stub. * g10/import.c (import_revoke_cert): Take additional argument CTRL. Pass it to keydb_update_keyblock. * g10/keydb.c (keydb_update_keyblock): Take additional argument CTRL. Update callers. [USE_TOFU]: Call tofu_notice_key_changed. * g10/test-stubs.c (tofu_notice_key_changed): New stub. * tests/openpgp/tofu.scm: Assume that manually setting a binding's policy to auto does not cause the tofu engine to forget about any conflict. -- Signed-off-by: Neal H. Walfield <[email protected]> We now store the computed policy in the tofu DB (in the effective_policy column of the bindings table) to avoid computing it every time, which is expensive. Further, policy is never overridden in case of a conflict. Instead, we detect a conflict if CONFLICT is not empty. This change is backwards compatible to existing DBs. The only minor incompatibility is that unresolved conflicts won't be automatically resolved in case we import a direct signature, or cross signatures.
2016-11-21g10: Correctly parameterize ngettext.Neal H. Walfield1-3/+6
* g10/tofu.c (ask_about_binding): Correctly parameterize ngettext. Signed-off-by: Neal H. Walfield <[email protected]>
2016-11-21g10: Don't use the same variable for multiple SQL compiled statementsNeal H. Walfield1-4/+4
* g10/tofu.c (struct tofu_dbs_s): Remove unused field record_binding_update2. Replace register_insert with register_signature and register_encryption. (tofu_register_signature): Don't use dbs->s.register_insert, but dbs->s.register_signature. (tofu_register_encryption): Don't use dbs->s.register_insert, but dbs->s.register_encryption. Signed-off-by: Neal H. Walfield <[email protected]>
2016-11-21g10: Add a convenience function for checking if a key is a primary keyNeal H. Walfield1-7/+6
* g10/keydb.h (pk_is_primary): New function. * g10/tofu.c (get_trust): Use it. (tofu_register_signature): Likewise. (tofu_register_encryption): Likewise. (tofu_set_policy): Likewise. (tofu_get_policy): Likewise. Signed-off-by: Neal H. Walfield <[email protected]>
2016-11-18g10: Fix flags to open for lock of ToFU.NIIBE Yutaka1-5/+2
* g10/tofu.c (busy_handler): Fix the flags and utime is not needed. -- The argument flags must include one of O_RDONLY, O_WRONLY, or O_RDWR. Adding O_TRUNC, the file is updated. So, utime is not needed. Fixes-commit: b2e1b17efa952afcf7aeec8b15e9d0088dba587a Signed-off-by: NIIBE Yutaka <[email protected]>
2016-11-18g10: Fix creating a lock for ToFU.NIIBE Yutaka1-1/+2
* g10/tofu.c (busy_handler): Add third argument which is mandatory for O_CREATE flag. -- Reported-by: Kristian Fiskerstrand Signed-off-by: NIIBE Yutaka <[email protected]>
2016-11-05Change all http://www.gnu.org in license notices to https://Werner Koch1-1/+1
--
2016-11-02g10,w32: Fix build on Windows.Justus Winter1-4/+1
* g10/tofu.c (begin_transaction): Use the new 'gnupg_usleep'. Signed-off-by: Justus Winter <[email protected]>
2016-10-31g10: Avoid gratuitious SQLite aborts and starving writers.Neal H. Walfield1-16/+82
* g10/tofu.c: Include <time.h>, <utime.h>, <fcntl.h> and <unistd.h>. (tofu_dbs_s): Add fields want_lock_file and want_lock_file_ctime. (begin_transaction): Only yield if DBS->WANT_LOCK_FILE_CTIME has changed since we took the lock. Don't use gpgrt_yield to yield, but sleep for 100ms. After taking the batch lock, update DBS->WANT_LOCK_FILE_CTIME. Also take the batch lock the first time we take the real lock. When taking the real lock, use immediate not deferred mode to avoid gratuitious aborts. (end_transaction): When dropping the outermost real lock, drop the batch lock. (busy_handler): New function. (opendbs): Set the busy handler to it when opening the DB. Initialize CTRL->TOFU.DBS->WANT_LOCK_FILE. (tofu_closedbs): Free DBS->WANT_LOCK_FILE. -- Signed-off-by: Neal H. Walfield <[email protected]> By default, SQLite defers transactions until they are actually needed. A consequence of this is that if we have two readers and both decide to do a write, then one has to abort. To avoid this problem, we can make the outermost transaction an immediate transaction. This has the disadvantage that we only allow a single reader at a time, but at least we don't have gratuitous aborts anymore. A second problem is that SQLite apparently doesn't actually create a queue of waiters. The result is that doing a sched_yield between dropping and retaking the batch transaction is not enough to allow the other process to make progress. Instead, we need to wait a while (emperically: 100ms seems reasonable). To avoid waiting when there is no contention, we use a new file's timestamp to signal that there is a waiter.
2016-10-30g10: Avoid reading in keys when possible.Neal H. Walfield1-2/+16
* g10/tofu.c (build_conflict_set): If CONFLICT_SET contains a single element, don't bother to check for cross sigs. Add parameter PK. Update callers. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-30g10: Fix bit setting.Neal H. Walfield1-4/+4
* g10/tofu.c (build_conflict_set): Fix bit setting. -- Signed-off-by: Neal H. Walfield <[email protected]> Fixes-commit: 1f1f56e606c1cb28eec68c60bd8bcb7ab30805de
2016-10-13g10: Be more careful when checking if a binding is signed by a UTK.Neal H. Walfield1-2/+25
* g10/tofu.c (signed_by_utk): When checking if a key is signed by an ultimately trusted key, only consider the signatures on the specified user id. * tests/openpgp/tofu.scm: Add test for the above. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-13g10: Be more careful when checking cross signatures.Neal H. Walfield1-2/+26
* g10/tofu.c (cross_sigs): When checking cross signatures, only consider the signatures on the specified user id. * tests/openpgp/tofu.scm: Add test for the above. * tests/openpgp/tofu/cross-sigs/ 1938C3A0E4674B6C217AC0B987DB2814EC38277E-1.gpg: New file. * tests/openpgp/tofu/cross-sigs/ 1938C3A0E4674B6C217AC0B987DB2814EC38277E-1.txt: New file. * tests/openpgp/tofu/cross-sigs/ 1938C3A0E4674B6C217AC0B987DB2814EC38277E-2.gpg: New file. * tests/openpgp/tofu/cross-sigs/ 1938C3A0E4674B6C217AC0B987DB2814EC38277E-2.txt: New file. * tests/openpgp/tofu/cross-sigs/ 1938C3A0E4674B6C217AC0B987DB2814EC38277E-3.txt: New file. * tests/openpgp/tofu/cross-sigs/ 1938C3A0E4674B6C217AC0B987DB2814EC38277E-secret.gpg: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-1.gpg: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-1.txt: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-2.gpg: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-2.txt: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-3.gpg: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-3.txt: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-4.gpg: New file. * tests/openpgp/tofu/cross-sigs/ DC463A16E42F03240D76E8BA8B48C6BD871C2247-secret.gpg: New file. * tests/openpgp/tofu/cross-sigs/README: New file. -- Signed-off-by: Neal H. Walfield
2016-10-13g10: Still check if the key is an UTK or cross signed in batch mode.Neal H. Walfield1-18/+13
* g10/tofu.c (get_trust): If POLICY is ask, but we can't ask, don't bail immediately. Instead, check if the key in question is an ultimately trusted key or cross signed. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-13g10: If an sqlite operation fails, map the error code to GPG_ERR_GENERALNeal H. Walfield1-2/+17
* g10/tofu.c (get_policy): If an sqlite operation fails, map the error code to GPG_ERR_GENERAL. (ask_about_binding): Likewise. (build_conflict_set): Likewise. (get_trust): Likewise. (show_statistics): Likewise. (tofu_register_signature): Likewise. (tofu_register_encryption): Likewise. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-12g10: When changing a TOFU binding's policy, update the conflict infoNeal H. Walfield1-17/+16
* g10/tofu.c (record_binding): Take an additional argument, CONFLICT. Set the binding's conflict accordingly. Update callers. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-12g10: Make a singular string singular.Neal H. Walfield1-1/+1
* g10/tofu.c (ask_about_binding): Make the singular string singular. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-12g10: Correctly determine whether a binding has a conflict.Neal H. Walfield1-1/+1
* g10/tofu.c (build_conflict_set): A binding has a conflict is conflict is *not* NULL, not if it is NULL. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-10-12g10: Fix a column's type in TOFU DB.Neal H. Walfield1-1/+1
* g10/tofu.c (initdb): Change policy from a boolean to an integer. -- Signed-off-by: Neal H. Walfield <[email protected]> Reported-by: Daniel Kahn Gillmor <[email protected]> Note: sqlite ignores type information so this change has no real impact.
2016-10-07Revert "g10: Fix singular term."Werner Koch1-1/+1
-- This reverts commit b0d2526bc4e5c663eeffe04500420c70cee98712. The number of format elements may not change in ngettext. The entire construct is anyway wrong because ngettext is passed a different value than what is used in the printf. We need to rework the use of most strings in tofu.c. Signed-off-by: Werner Koch <[email protected]>
2016-10-06g10: Fix singular term.Justus Winter1-1/+1
* g10/tofu.c (ask_about_binding): Fix singular message. Signed-off-by: Justus Winter <[email protected]>
2016-10-06g10: Use appropriate variant of 'abs'.Justus Winter1-6/+6
* g10/tofu.c (ask_about_binding): Use 'labs' instead of 'abs'. Signed-off-by: Justus Winter <[email protected]>
2016-09-19g10: Fix memory leak.Justus Winter1-0/+1
* g10/tofu.c (build_conflict_set): Free 'kb_all'. Signed-off-by: Justus Winter <[email protected]>
2016-09-17Fix more spellingDaniel Kahn Gillmor1-1/+1
* NEWS, acinclude.m4, agent/command-ssh.c, agent/command.c, agent/gpg-agent.c, agent/keyformat.txt, agent/protect-tool.c, common/asshelp.c, common/b64enc.c, common/recsel.c, doc/DETAILS, doc/HACKING, doc/Notes, doc/TRANSLATE, doc/dirmngr.texi, doc/faq.org, doc/gpg-agent.texi, doc/gpg.texi, doc/gpgsm.texi, doc/instguide.texi, g10/armor.c, g10/gpg.c, g10/keyedit.c, g10/mainproc.c, g10/pkclist.c, g10/tofu.c, g13/sh-cmd.c, g13/sh-dmcrypt.c, kbx/keybox-init.c, m4/pkg.m4, sm/call-dirmngr.c, sm/gpgsm.c, tests/Makefile.am, tests/gpgscm/Manual.txt, tests/gpgscm/scheme.c, tests/openpgp/gpgv-forged-keyring.scm, tests/openpgp/multisig.test, tests/openpgp/verify.scm, tests/pkits/README, tools/applygnupgdefaults, tools/gpg-connect-agent.c, tools/mime-maker.c, tools/mime-parser.c: minor spelling cleanup. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2016-09-16g10: On failure, propagate the return code.Neal H. Walfield1-0/+1
* g10/tofu.c (tofu_register_encryption): If get_trust fails, set RC. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-16g10: Improve some comments and a string.Neal H. Walfield1-9/+13
-- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-16g10: Don't ignore failure. On failure, rollback.Neal H. Walfield1-3/+15
* g10/tofu.c (tofu_set_policy): If record_binding fails, fail. If the function fails, rollback the transaction. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-16g10: Load the key block if the supplied user id list is NULL.Neal H. Walfield1-1/+1
* g10/tofu.c (tofu_register_encryption): Load the key block if USER_ID_LIST is NULL. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-16g10: Use the accessor functions for accessing and comparing key idsNeal H. Walfield1-7/+8
* g10/tofu.c (get_trust): Use the pk_main_keyid accessor function. (tofu_register_signature): Likewise. (tofu_register_encryption): Likewise. (tofu_set_policy): Likewise and also use pk_keyid and keyid_cmp. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-14g10: Fix whitespace.Neal H. Walfield1-1/+1
* g10/tofu.c (show_statistics): Fix whitespace. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-14g10: Correctly compute the euclidean distance.Neal H. Walfield1-8/+10
* g10/tofu.c (write_stats_status): Correctly compute the euclidean distance. (show_statistics): Likewise. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-14g10: Change the default TOFU policy for UTKs to good.Neal H. Walfield1-2/+2
* g10/tofu.c (get_trust): Change the default TOFU policy for UTKs to good. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-14g10: Add missing static qualifier.Neal H. Walfield1-1/+1
* g10/tofu.c (cross_sigs): Add missing static qualifier. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-14g10: Default to the "good" TOFU policy for keys signed by a UTK.Neal H. Walfield1-0/+97
* g10/tofu.c (signed_by_utk): New function. (get_trust): If a key is signed by an ultimately trusted key, then set any bindings to good. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-07g10: Use the time a signature was seen, not the embedded time, for statsNeal H. Walfield1-4/+3
* g10/tofu.c (ask_about_binding): Use the time that a signature was seen, not allegedly generated, when generating statistics. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-07g10: Check for a new binding a bit later.Neal H. Walfield1-9/+9
* g10/tofu.c (build_conflict_set): Check for the current key after looking for conflicts and removing any '!'. -- Signed-off-by: Neal H. Walfield <[email protected]> Fixes-commit: 1f1f56e6
2016-09-07g10: Change TOFU code to respect --faked-system-time.Neal H. Walfield1-22/+36
* g10/tofu.c (record_binding): New parameter now. Update callers. Don't use SQLite's strftime('%s','now') to get the current time, use NOW. (ask_about_binding): Likewise. (get_trust): New parameter now. Update callers. (show_statistics): Likewise. (tofu_register_signature): Don't use SQLite's strftime('%s','now') to get the current time, use gnupg_get_time(). (tofu_register_encryption): Likewise. -- Signed-off-by: Neal H. Walfield <[email protected]>
2016-09-07g10: Use the correct conversion function.Neal H. Walfield1-8/+8
* g10/tofu.c (show_statistics): Use string_to_ulong, not string_to_long. -- Signed-off-by: Neal H. Walfield <[email protected]> Fixes-commit: 875ac921
2016-09-07g10: Add missing sqrtu32.h and sqrtu32.c.Neal H. Walfield1-3/+1
-- Signed-off-by: Neal H. Walfield <[email protected]> Fixes-commit: 875ac92.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-22 20:59:40 +0000