aboutsummaryrefslogtreecommitdiffstats
path: root/g10/tofu.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* common: Prepare for parsing mail sub-addresses.Werner Koch2018-11-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | * common/mbox-util.c (mailbox_from_userid): Add arg subaddress and implement. Change all callers to pass false for it. * common/t-mbox-util.c (run_mbox_no_sub_test): New. (run_filter): Add arg no_sub. (main): Call new test and add option --no-sub. -- Some stats: In the about 5300000 keys on the SKS servers we found 3055 unique mailboxes with a '+' in it. After removing leading and trailing '+' as well as multiple '+' (e.g. "c++" or "foo+bar+baz") 2697 were left which seem to be valid sub-addresses. To filter mailboxes out from a line delimited list with user-ids (e.g. an SQL output), the command t-mbox-util --verbose --filter can be used; to output w/o sub-addresses add --no-sub. GnuPG-bug-id: 4200 Signed-off-by: Werner Koch <[email protected]>
* Merge branch 'STABLE-BRANCH-2-2' into masterWerner Koch2017-12-181-25/+57
|\ | | | | | | | | | | -- Signed-off-by: Werner Koch <[email protected]>
| * gpg: Return an error from hexfingerprint on malloc error.Werner Koch2017-12-131-25/+57
| | | | | | | | | | | | | | * g10/keyid.c (hexfingerprint): Return NULL on malloc failure. Chnage all callers. Signed-off-by: Werner Koch <[email protected]>
* | Adjust for changed macro names in libgpg-error master.Werner Koch2017-12-111-2/+2
| | | | | | | | | | | | | | | | | | | | * common/logging.h (GPGRT_LOGLVL_): New replacement macros for older libgpg-error versions. -- Updates-commit: b56dfdfc1865ceb7c3c025d79996e049faee7fdf Signed-off-by: Werner Koch <[email protected]>
* | gpg: Fix wrong Tofu DB consistency check.Werner Koch2017-10-181-4/+7
| | | | | | | | | | | | | | | | | | | | | | * g10/tofu.c (build_conflict_set): Do not assume MAX_FINGERPRINT_LEN is the size of the fingerprint. -- This problem was exhibited by commit ecbbafb88d920e713439b6b1b8e1b41a6f8d0e38. Signed-off-by: Werner Koch <[email protected]>
* | gpg: Prepare for a longer fingerprintWerner Koch2017-09-271-2/+3
|/ | | | | | | | | | | | | | | | | | * g10/card-util.c (change_cafpr): Use MAX_FINGERPRINT_LEN. * g10/cipher.c (write_header): Use snprintf. * g10/gpg.h (MAX_FINGERPRINT_LEN): Change to 32. (MAX_FORMATTED_FINGERPRINT_LEN): Change to 59 * g10/keyid.c (format_hexfingerprint): Add v5 fingerprint format. * g10/tofu.c (get_policy): Use MAX_FINGERPRINT_LEN for the buffer but keep the raw length for now. -- Note that this patch only increases the size of the buffer and adds a new formatting for v5 fingerprints. Moe work is required to fix internal data structures like those in trustdb.gpg and the tofu tables. Signed-off-by: Werner Koch <[email protected]>
* tofu: Compare squares instead of square roots.Marcus Brinkmann2017-07-101-10/+8
| | | | | | | | | | | | | * g10/Makefile.am (tofu_source) [USE_TOFU]: Remove sqrtu32.h and sqrtu32.c. * g10/sqrtu32.h, g10/sqrtu32.c: Removed files. * g10/tofu.c: Compare squares instead of square roots. -- The original code is a factor 11.5 slower than using libm's sqrt(), which in turn is a factor 3.5 slower than using one multiplication on the other side of the comparison. Also, it's much simpler now. Signed-off-by: Marcus Brinkmann <[email protected]>
* gpg: Do not mark ", " translatable.Werner Koch2017-05-151-2/+2
| | | | | | | | | | * g10/tofu.c (ask_about_binding): Remove useless translation markers. -- Translation and in particular punctuation marks can only be translated with context. Thus making a sole comma translatable is useless. Signed-off-by: Werner Koch <[email protected]>
* common: Let format_text return an error.Werner Koch2017-05-151-2/+12
| | | | | | | | | | | | | | | * common/stringhelp.c (format_text): Return NULL on error. * common/t-stringhelp.c (test_format_text): Adjust for change. * g10/gpgcompose.c (show_help): Abort on out of core. * g10/tofu.c (ask_about_binding): Abort on format_text error. (show_statistics): Ditto. (show_warning): Ditto. -- For better re-usability function in common/ shot better not use xmalloc functions. Signed-off-by: Werner Koch <[email protected]>
* Spelling fixes in docs and comments.NIIBE Yutaka2017-04-281-2/+2
| | | | | | | | | | -- In addition, fix trailing spaces in tests/inittests. GnuPG-bug-id: 3121 Reported-by: ka7 (klemens) Signed-off-by: NIIBE Yutaka <[email protected]>
* g10: Minor fixes.NIIBE Yutaka2017-04-171-1/+1
| | | | | | | | | * g10/export.c (cleartext_secret_key_to_openpgp): No initialization. (do_export_one_keyblock): Initialize with GPG_ERR_NOT_FOUND. * g10/getkey.c (get_best_pubkey_byname): Add non-null check. * g10/tofu.c (tofu_set_policy): ERR initialize to 0. Signed-off-by: NIIBE Yutaka <[email protected]>
* common: Simplify format_text.NIIBE Yutaka2017-04-121-5/+5
| | | | | | | | | | | * common/stringhelp.c (format_text): Don't allow IN_PLACE formatting. * common/stringhelp.h: Change the API with no IN_PLACE. * common/t-stringhelp.c (test_format_text): Follow the change. * g10/gpgcompose.c (show_help): Likewise. * g10/tofu.c (format_conflict_msg_part1, ask_about_binding) (show_statistics, show_warning): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* g10: Minor clean up for TOFU.NIIBE Yutaka2017-04-111-1/+1
| | | | | | * g10/tofu.c (ask_about_binding): Fix for qualifier. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Pass CTRL to many more functions.Werner Koch2017-03-311-10/+11
| | | | | | | | | | -- For proper operations as a server we need to avoid global variables. Thus we need to pass the session state CTRL to most functions. Quite a lot of changes but fortunately straightforward to do. Signed-off-by: Werner Koch <[email protected]>
* gpg: Make sure the conflict set includes the current key.Neal H. Walfield2017-03-171-3/+25
| | | | | | | | | | | | | * g10/tofu.c (get_trust): Sanity check CONFLICT_SET after calling get_policy. If POLICY is 'auto' and the default policy is 'ask', make sure CONFLICT_SET includes the current key. -- Signed-off-by: Neal H. Walfield <[email protected]> GnuPG-bug-id: 2959 Debian-bug-id: 854829 Signed-off-by: Neal H. Walfield <[email protected]>
* g10: Move more flags into the flag bitfield.Justus Winter2017-03-081-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/packet.h (PKT_user_id): Move 'is_primary', 'is_revoked', and 'is_expired' into the flags bitfield, and drop the prefix. * g10/call-dirmngr.c: Adapt accordingly. * g10/export.c: Likewise. * g10/getkey.c: Likewise. * g10/import.c: Likewise. * g10/kbnode.c: Likewise. * g10/keyedit.c: Likewise. * g10/keylist.c: Likewise. * g10/keyserver.c: Likewise. * g10/mainproc.c: Likewise. * g10/pkclist.c: Likewise. * g10/pubkey-enc.c: Likewise. * g10/tofu.c: Likewise. * g10/trust.c: Likewise. * g10/trustdb.c: Likewise. -- This patch has been created by applying the following semantic patch: @@ expression E; @@ -E->is_expired +E->flags.expired @@ expression E; @@ -E->is_primary +E->flags.primary @@ expression E; @@ -E->is_revoked +E->flags.revoked Signed-off-by: Justus Winter <[email protected]>
* Remove -I option to common.NIIBE Yutaka2017-03-071-8/+8
| | | | | | | | | | | | | * dirmngr/Makefile.am (AM_CPPFLAGS): Remove -I$(top_srcdir)/common. * g10/Makefile.am (AM_CPPFLAGS): Ditto. * g13/Makefile.am (AM_CPPFLAGS): Ditto. * kbx/Makefile.am (AM_CPPFLAGS): Ditto. * scd/Makefile.am (AM_CPPFLAGS): Ditto. * sm/Makefile.am (AM_CPPFLAGS): Ditto. * tools/Makefile.am (AM_CPPFLAGS): Ditto. * Throughout: Follow the change. Signed-off-by: NIIBE Yutaka <[email protected]>
* Clean up word replication.Yuri Chornoivan2017-02-211-1/+1
| | | | | | | | | -- This fixes extra word repetitions (like "the the" or "is is") in the code and docs. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* gpg: Don't assume that strtoul interprets "" as 0.Neal H. Walfield2017-02-021-2/+4
| | | | | | | | | | | | | | | | | | | | | | * g10/tofu.c (show_statistics): If there are not records, return 0 instead of NULL. -- Signed-off-by: Neal H. Walfield <[email protected]> GnuPG-bug-id: 2853 According to SUSv3: If the subject sequence is empty or does not have the expected form, no conversion is performed ... If no conversion could be performed, 0 is returned and errno may be set to [EINVAL]. http://pubs.opengroup.org/onlinepubs/007908799/xsh/strtol.html It appears that MacOS X sets errno to EINVAL, but glibc doesn't. Hence, we map NULL to 0 explicitly.
* gpg: Ensure TOFU bindings associated with UTKs are registered as usualNeal H. Walfield2017-02-021-6/+13
| | | | | | | | | * g10/tofu.c (get_trust): Call get_policy before short-circuiting the policy lookup for ultimately trusted keys to make sure the binding is added to the bindings table, if necessary. Signed-off-by: Neal H. Walfield <[email protected]> GnuPG-bug-id: 2929
* gpg: If there is a TOFU conflict, elide the too few message warning.Neal H. Walfield2017-02-021-1/+3
| | | | | | | * g10/tofu.c (tofu_get_validity): If there was a conflict, don't also print out a warning about too few messages. Signed-off-by: Neal H. Walfield <[email protected]>
* gpg: Only print out TOFU statistics for conflicts in interactive modeNeal H. Walfield2017-02-021-14/+69
| | | | | | | | | | | | | * g10/tofu.c (get_trust): Add arguments POLICYP and CONFLICT_SETP. If they are not NULL, return the policy and conflict set (if there is one), respectively. Update callers. If MAY_ASK is FALSE, don't print out the statistics. (tofu_register_encryption): If there is a conflict and we haven't yet printed the statistics about the conflicting bindings, do so now. (tofu_get_validity): Likewise. Signed-off-by: Neal H. Walfield <[email protected]> GnuPG-bug-id: 2914
* gpg: Add newline to output.Neal H. Walfield2017-02-021-1/+1
| | | | | | * g10/tofu.c (ask_about_binding): Add newline to output. Signed-off-by: Neal H. Walfield <[email protected]>
* gpg: Remove period at end of warning.Neal H. Walfield2017-02-021-1/+1
| | | | | | | * g10/tofu.c (tofu_register_encryption): Remove period at end of warning. Signed-off-by: Neal H. Walfield <[email protected]>
* Replace use of variable-length-arrays.Werner Koch2017-01-021-3/+3
| | | | | | | | | | | | | * common/t-iobuf.c (main): Replace variable-length-array. * g10/gpgcompose.c (mksubpkt_callback): Ditto. (encrypted): Ditto. * g10/t-stutter.c (log_hexdump): Ditto. (oracle_test): Ditto. * g10/tofu.c (get_policy): Ditto. Use "%zu" for size_t. * scd/app-openpgp.c (ecc_writekey): Replace variable-length-array. Check for zero length OID_LEN. Signed-off-by: Werner Koch <[email protected]>
* g10: Use total days, not total messages to compute TOFU validityNeal H. Walfield2016-12-161-12/+12
| | | | | | | | | | * g10/tofu.c (write_stats_status): Use the number of days with signatures / encryptions to compute the validity, not the total number of signatures / encryptions. (BASIC_TRUST_THRESHOLD): Adjust given the new semantics. (FULL_TRUST_THRESHOLD): Likewise. Signed-off-by: Neal H. Walfield <[email protected]>
* g10: Extend TOFU_STATS to emit <sign-days> and <encyrption-days>Neal H. Walfield2016-12-161-16/+63
| | | | | | | | | | | | | * doc/DETAILS: Add SIGN-DAYS and ENCRYPT-DAYS to the TOFU_STATS status line. * g10/tofu.c (write_stats_status): Take additional parameters signature_days and encryption_days. Update callers. Include them in the tfs record and TOFU status lines. (show_statistics): Compute the number of days on which we saw a message signed by FINGERPRINT, and the number of days on which we encrypted a message to it. Signed-off-by: Neal H. Walfield <[email protected]>
* g10: On a TOFU conflict, write the conflicting keys to the status fdNeal H. Walfield2016-12-161-16/+36
| | | | | | | | | | | | * g10/tofu.c (ask_about_binding): Emit all of the conflicting keys and their statistics on the status fd. (get_trust): Likewise, if we don't call ask_about_binding. (show_statistics): Have the caller pass the policy as returned by get_policy. Add argument only_status_fd and don't emit any output on stdout if it is set. Update callers. -- Signed-off-by: Neal H. Walfield <[email protected]>
* g10: Add missing space.Neal H. Walfield2016-12-161-1/+1
| | | | | | * g10/tofu.c (tofu_register_encryption): Add missing space. Signed-off-by: Neal H. Walfield <[email protected]>
* gpg: Fix the fix out-of-bounds access.Werner Koch2016-12-081-2/+2
| | | | | | | | | | | | * g10/tofu.c (build_conflict_set): Revert to int* and fix calloc. -- The original code used an int array and thus better keep that and do not limit it to 128 entries. Fixes-commit: c3008bffac68b6f31e9ae9bad837cdce5de7c0db Fixes-commit: 3b5b94ceab7c0ed9501c5cf54b4efa17fcd7300a Signed-off-by: Werner Koch <[email protected]>
* g10: Fix out-of-bounds access.Justus Winter2016-12-081-1/+1
| | | | | | | * g10/tofu.c (build_conflict_set): Use 'char'. Fixes-commit: c3008bffac68b6f31e9ae9bad837cdce5de7c0db Signed-off-by: Justus Winter <[email protected]>
* gpg: Fix portability problem.Werner Koch2016-12-081-2/+9
| | | | | | | | | | * g10/tofu.c (build_conflict_set): Replace variable dynamic array. -- Note that clang complained that CONFLICT_SET_COUNT could be negative. Thus I added an assert. Signed-off-by: Werner Koch <[email protected]>
* g10: Remove dead code.Neal H. Walfield2016-12-061-17/+0
| | | | | | * g10/tofu.c (tofu_set_policy_by_keyid): Remove function. Signed-off-by: Neal H. Walfield <[email protected]>
* g10: Improve debugging output.Neal H. Walfield2016-12-021-6/+12
| | | | | | | * g10/tofu.c (string_to_long): Improve debugging output. (string_to_ulong): Likewise. Signed-off-by: Neal H. Walfield <[email protected]>
* g10: In the TOFU module, make strings easier to translate.Neal H. Walfield2016-12-011-187/+144
| | | | | | | | | | | * g10/tofu.c: Remove dead code. (time_ago_str): Simplify implementation since we only want the most significant unit. (format_conflict_msg_part1): Use ngettext. (ask_about_binding): Likewise and only emit full sentences. (show_statistics): Likewise. Signed-off-by: Neal H. Walfield <[email protected]>
* Improve some comments.Neal H. Walfield2016-11-291-17/+17
|
* g10: Extend TOFU_STATS to always show the validityNeal H. Walfield2016-11-291-11/+19
| | | | | | | | | | | * doc/DETAILS (TOFU_STATS): Rename the VALIDITY field to SUMMARY. Add a new field called VALIDITY. * g10/tofu.c (write_stats_status): Update output accordingly. -- Signed-off-by: Neal H. Walfield <[email protected]> Change TOFU_STATS as discussed offline with Werner, Justus and Andre.
* g10: Use es_fopen instead of open.Neal H. Walfield2016-11-221-11/+10
| | | | | | | | | | | * g10/tofu.c: Don't include <utime.h>, <fcntl.h> or <unistd.h>. (busy_handler): Replace use of open with es_fopen. -- Signed-off-by: Neal H. Walfield <[email protected]> Thanks for Werner for pointing this out: es_fopen is more portable than open.
* g10: If the set of UTKs changes, invalidate any changed policies.Neal H. Walfield2016-11-221-0/+149
| | | | | | | | | | | | | | | | * g10/trustdb.c (tdb_utks): New function. * g10/tofu.c (check_utks): New function. (initdb): Call it. * tests/openpgp/tofu.scm: Modify test to check the effective policy of keys whose effective policy changes when we change the set of UTKs. -- Signed-off-by: Neal H. Walfield <[email protected]> If the set of ultimately trusted keys changes, then it is possible that a binding's effective policy changes. To deal with this, we detect when the set of ultimately trusted keys changes and invalidate all cached policies.
* g10: Fix memory leak.Justus Winter2016-11-221-2/+0
| | | | | | | | * g10/tofu.c (tofu_notice_key_changed): Remove spurious duplicate call to 'hexfingerprint'. Fixes-commit: 037f9de09298a31026ea2ab5fbd4a599b11cc34f Signed-off-by: Justus Winter <[email protected]>
* g10: Cache the effective policy. Recompute it when required.Neal H. Walfield2016-11-211-339/+487
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/tofu.c (initdb): Add column effective_policy to the bindings table. (record_binding): New parameters effective_policy and set_conflict. Save the effective policy. If SET_CONFLICT is set, then set conflict according to CONFLICT. Otherwise, preserve the current value of conflict. Update callers. (get_trust): Don't compute the effective policy here... (get_policy): ... do it here, if it was not cached. Take new parameters, PK, the public key, and NOW, the time that the operation started. Update callers. (show_statistics): New parameter PK. Pass it to get_policy. Update callers. (tofu_notice_key_changed): New function. * g10/gpgv.c (tofu_notice_key_changed): New stub. * g10/import.c (import_revoke_cert): Take additional argument CTRL. Pass it to keydb_update_keyblock. * g10/keydb.c (keydb_update_keyblock): Take additional argument CTRL. Update callers. [USE_TOFU]: Call tofu_notice_key_changed. * g10/test-stubs.c (tofu_notice_key_changed): New stub. * tests/openpgp/tofu.scm: Assume that manually setting a binding's policy to auto does not cause the tofu engine to forget about any conflict. -- Signed-off-by: Neal H. Walfield <[email protected]> We now store the computed policy in the tofu DB (in the effective_policy column of the bindings table) to avoid computing it every time, which is expensive. Further, policy is never overridden in case of a conflict. Instead, we detect a conflict if CONFLICT is not empty. This change is backwards compatible to existing DBs. The only minor incompatibility is that unresolved conflicts won't be automatically resolved in case we import a direct signature, or cross signatures.
* g10: Correctly parameterize ngettext.Neal H. Walfield2016-11-211-3/+6
| | | | | | * g10/tofu.c (ask_about_binding): Correctly parameterize ngettext. Signed-off-by: Neal H. Walfield <[email protected]>
* g10: Don't use the same variable for multiple SQL compiled statementsNeal H. Walfield2016-11-211-4/+4
| | | | | | | | | | | | * g10/tofu.c (struct tofu_dbs_s): Remove unused field record_binding_update2. Replace register_insert with register_signature and register_encryption. (tofu_register_signature): Don't use dbs->s.register_insert, but dbs->s.register_signature. (tofu_register_encryption): Don't use dbs->s.register_insert, but dbs->s.register_encryption. Signed-off-by: Neal H. Walfield <[email protected]>
* g10: Add a convenience function for checking if a key is a primary keyNeal H. Walfield2016-11-211-7/+6
| | | | | | | | | | | * g10/keydb.h (pk_is_primary): New function. * g10/tofu.c (get_trust): Use it. (tofu_register_signature): Likewise. (tofu_register_encryption): Likewise. (tofu_set_policy): Likewise. (tofu_get_policy): Likewise. Signed-off-by: Neal H. Walfield <[email protected]>
* g10: Fix flags to open for lock of ToFU.NIIBE Yutaka2016-11-181-5/+2
| | | | | | | | | | | | * g10/tofu.c (busy_handler): Fix the flags and utime is not needed. -- The argument flags must include one of O_RDONLY, O_WRONLY, or O_RDWR. Adding O_TRUNC, the file is updated. So, utime is not needed. Fixes-commit: b2e1b17efa952afcf7aeec8b15e9d0088dba587a Signed-off-by: NIIBE Yutaka <[email protected]>
* g10: Fix creating a lock for ToFU.NIIBE Yutaka2016-11-181-1/+2
| | | | | | | | | | * g10/tofu.c (busy_handler): Add third argument which is mandatory for O_CREATE flag. -- Reported-by: Kristian Fiskerstrand Signed-off-by: NIIBE Yutaka <[email protected]>
* Change all http://www.gnu.org in license notices to https://Werner Koch2016-11-051-1/+1
| | | | --
* g10,w32: Fix build on Windows.Justus Winter2016-11-021-4/+1
| | | | | | * g10/tofu.c (begin_transaction): Use the new 'gnupg_usleep'. Signed-off-by: Justus Winter <[email protected]>
* g10: Avoid gratuitious SQLite aborts and starving writers.Neal H. Walfield2016-10-311-16/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/tofu.c: Include <time.h>, <utime.h>, <fcntl.h> and <unistd.h>. (tofu_dbs_s): Add fields want_lock_file and want_lock_file_ctime. (begin_transaction): Only yield if DBS->WANT_LOCK_FILE_CTIME has changed since we took the lock. Don't use gpgrt_yield to yield, but sleep for 100ms. After taking the batch lock, update DBS->WANT_LOCK_FILE_CTIME. Also take the batch lock the first time we take the real lock. When taking the real lock, use immediate not deferred mode to avoid gratuitious aborts. (end_transaction): When dropping the outermost real lock, drop the batch lock. (busy_handler): New function. (opendbs): Set the busy handler to it when opening the DB. Initialize CTRL->TOFU.DBS->WANT_LOCK_FILE. (tofu_closedbs): Free DBS->WANT_LOCK_FILE. -- Signed-off-by: Neal H. Walfield <[email protected]> By default, SQLite defers transactions until they are actually needed. A consequence of this is that if we have two readers and both decide to do a write, then one has to abort. To avoid this problem, we can make the outermost transaction an immediate transaction. This has the disadvantage that we only allow a single reader at a time, but at least we don't have gratuitous aborts anymore. A second problem is that SQLite apparently doesn't actually create a queue of waiters. The result is that doing a sched_yield between dropping and retaking the batch transaction is not enough to allow the other process to make progress. Instead, we need to wait a while (emperically: 100ms seems reasonable). To avoid waiting when there is no contention, we use a new file's timestamp to signal that there is a waiter.
* g10: Avoid reading in keys when possible.Neal H. Walfield2016-10-301-2/+16
| | | | | | | | | * g10/tofu.c (build_conflict_set): If CONFLICT_SET contains a single element, don't bother to check for cross sigs. Add parameter PK. Update callers. -- Signed-off-by: Neal H. Walfield <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-15 22:58:53 +0000