aboutsummaryrefslogtreecommitdiffstats
path: root/g10 (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-12-17gpg: New AKL method "ntds"Werner Koch6-0/+68
* dirmngr/ks-engine-ldap.c (keyspec_to_ldap_filter): Change the new support for KEYDB_SEARCH_MODE_MAIL. (ks_ldap_get): Add a debug. * g10/options.h (AKL_NTDS): New. * g10/keyserver.c (keyserver_import_ntds): New. (keyserver_get_chunk): Allow KEYDB_SEARCH_MODE_MAIL. * g10/getkey.c (parse_auto_key_locate): Support "ntds". (get_pubkey_byname): Ditto.
2020-12-15dirmngr: Store all version 2 schema attributes.Werner Koch1-0/+3
* g10/call-dirmngr.c (ks_put_inq_cb): Emit "fpr" records. * dirmngr/ks-engine-ldap.c (extract_attributes): Add args extract-state and schemav2. Add data for the new schema version. remove the legacy code to handle UIDs in the "pub" line. (ks_ldap_put): Set new attributes for NTDS use the fingerprint as CN. Signed-off-by: Werner Koch <[email protected]>
2020-12-14dirmngr: Do not store the useless pgpSignerID in the LDAP.Werner Koch1-15/+0
* dirmngr/ks-engine-ldap.c (extract_attributes): Do not store the pgpSignerID. * g10/call-dirmngr.c (ks_put_inq_cb): Do not emit sig records. -- The pgpSignerID has no use in the LDAP and thus don't store it. David's idea back in 2004 was /* This bit is really for the benefit of people who store their keys in LDAP servers. It makes it easy to do queries for things like "all keys signed by Isabella". */ See-commit: 3ddd4410aef928827e1c8d4fb02c1ccd3f8eaea5 I consider this dangerous because such a query is not able to validate the signature, does not get revocation signatures, and also has no information about the validity of the signatures. Further many keys are spammed tehse days with faked signatures and it does not make sense to blow up the LDAP with such garbage. Signed-off-by: Werner Koch <[email protected]>
2020-12-07gpg: Make quick-gen-key with algo "card" work for keys without keytimeIngo Klöcker1-6/+4
* g10/keygen.c (quick_generate_keypair): Set pCARDKEY flag if algostr is "card" or "card/...". -- For keys stored on NetKey cards or PIV cards we do not necessarily know the creation time. Therefore set the cardkey flag if the generation of a key from the keys available on the currently inserted smartcard is requested with the special algo "card" or, in case of the extended unattended mode, with an algo like "card/sign". GnuPG-bug-id: 5141 Signed-off-by: Ingo Klöcker <[email protected]>
2020-12-07gpg,card: Allow no version information of Yubikey.NIIBE Yutaka1-1/+2
* g10/call-agent.c (learn_status_cb): Assume >= 2 when no version. * tools/card-call-scd.c (learn_status_cb): Likewise. -- GnuPG-bug-id: 5100 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-26gpg: Report an error for receiving key from agent.NIIBE Yutaka1-0/+1
* g10/export.c (do_export_one_keyblock): Report an error. -- GnuPG-bug-id: 5151 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-20gpg: Change API of agent_scd_serialno.NIIBE Yutaka3-21/+13
* g10/call-agent.c (agent_scd_serialno): Extend API to allow with R_SERIALNO == NULL. * g10/card-util.c (card_status): Use NULL for agent_scd_serialno. (factory_reset): Likewise. * g10/skclist.c (build_sk_list): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-20Fix the previous comment changes help doc string.NIIBE Yutaka1-1/+1
* scd/command.c (hlp_learn): Fix the doc string. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-20gpg,agent: Fix comments for KEYPAIRINFO status report.NIIBE Yutaka1-1/+1
-- Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-19gpg: Fix --card-edit command.NIIBE Yutaka1-1/+2
* g10/card-util.c (get_info_for_key_operation): Revert the change. -- Fixes-commit: 157f1de64e437cecd75335e9f4077ba9835e3da0 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-13gpg: Fix the encrypt+sign hash algo preference selection for ECDSA.Werner Koch3-36/+58
* g10/keydb.h (pref_hint): Change from union to struct and add field 'exact'. Adjust callers. * g10/pkclist.c (algo_available): Take care of the exact hint. * g10/sign.c (sign_file): Rework the hash detection from recipient prefs. -- This fixes a encrypt+sign case like: One recipient key has SHA512 as highest ranked hash preference but the the signing key is a 256 bit curve. Because we don't want to use a truncated hash with ECDSA, we need to have an exact match - this is in particular important for smartcard which check that the hash matches the curves. Signed-off-by: Werner Koch <[email protected]> Ported-from-stable: aeed0b93ff660fe271d8f98f8d5ce60aa5bf3ebe
2020-11-11w32: Replace some fopen by es_fopen.Werner Koch2-45/+6
* agent/protect-tool.c (read_file): Replace fopen by es_fopen. * dirmngr/dirmngr-client.c (read_pem_certificate): Ditto. (read_certificate): Ditto. * g10/keydb.c (rt_from_file): Ditto. * kbx/kbxutil.c (read_file): Ditto. * g10/plaintext.c (get_output_file) [__riscos__]: Remove code. Signed-off-by: Werner Koch <[email protected]>
2020-11-11gpg: Fix the previous commit.NIIBE Yutaka1-1/+3
* g10/delkey.c (do_delete_key): Fix the condition for the error. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-10gpg: In batch mode, delete-secret-key is not okay without --yes.NIIBE Yutaka1-1/+6
* g10/delkey.c (do_delete_key): Emit an error when not --yes. -- GnuPG-bug-id: 4667 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-10gpg: Fix agent_delete_key interaction.NIIBE Yutaka1-0/+1
* g10/call-agent.c (agent_delete_key): Set up CTX. -- Fixes-commit: 20acc7c0226550530085a674ef1bb41ebfa39408 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-09card: Run factory-reset in locked stated also in gpg-card.Werner Koch1-2/+3
* tools/card-call-scd.c (scd_apdu): Add more pseudo APDUs. * tools/card-misc.c (send_apdu): Handle them. * tools/gpg-card.c (cmd_factoryreset): Use lock commands. -- This is port of the code used with gpg-card-edit. Note that the command "apdu" now also understands some extra keywords. Signed-off-by: Werner Koch <[email protected]>
2020-11-09card: Run factory-reset in locked stated.Werner Koch2-7/+47
* scd/command.c (reset_notify): Add option --keep-lock. (do_reset): Add arg keep_lock. (cmd_lock): Send progress status. * g10/call-agent.c (agent_scd_apdu): Add more pseudo APDUs. * g10/card-util.c (send_apdu): Ditto. (factory_reset): Use lock commands. -- This is required so that for example Kleopatra does not detect the RESET and issues a SERIALNO of its own, thus conflicting with our SERIALNO undefined. Signed-off-by: Werner Koch <[email protected]>
2020-11-09gpg: Do not print rejected digest algo notes with --quiet.Werner Koch1-1/+5
* g10/misc.c (print_digest_rejected_note): Do not print in quiet mode. (print_sha1_keysig_rejected_note): Ditto. -- GnuPG-bug-id: 4893 Signed-off-by: Werner Koch <[email protected]>
2020-11-09gpg: Fix SOS handling when exporting SSH key with libgcrypt 1.8.NIIBE Yutaka1-10/+35
* g10/export.c (key_to_sshblob): Fix SOS correctly. -- GnuPG-bug-id: 5116 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-05gpg: Add canceled status message.Ben Kibbey1-1/+1
* common/status.h (STATUS_CANCELED_BY_USER): New. * g10/passphrase.c (passphrase_to_dek): Send STATUS_CANCELED_BY_USER instead of STATUS_MISSING_PASSPHRASE when canceled is set. -- This is to prevent further pinentry tries when the pinentry is canceled by the user during symmetric decryption. Signed-off-by: Ben Kibbey <[email protected]>
2020-11-04common: Fix duplicate implementation of try_make_homedir.Werner Koch1-24/+6
* g10/openfile.c (try_make_homedir): Move core of the code to ... * common/homedir.c (gnupg_maybe_make_homedir): new. * sm/keydb.c (try_make_homedir): Implement using new function. * common/homedir.c: Include i18n.h. * po/POTFILES.in: Add common/homedir.c. Signed-off-by: Werner Koch <[email protected]>
2020-11-03gpg: Switch to AES256 for symmetric encryption in de-vs mode.Werner Koch2-4/+31
* g10/gpg.c (set_compliance_option): For AES256 and SHA256 in de-vs mode. * g10/encrypt.c (setup_symkey): Add extra compliance check. (encrypt_simple): Avoid printing a second error oncplinace failure. -- Because we used the RFC4880 mode as base for the de-vs mode we got 3DES as symmetric encryption algorithm. With the default gnupg mode that was already used. The new extra compliance checks are added to detect whether a --personal-cipher-preference or --cipher-algo option tried to override the algorithms. They are still possible but now non-compliant algorithms will throw an error. Manual testing can be done with commands like this: gpg --no-options --compliance=de-vs \ --personal-cipher-preferences "S1 S7" \ --pinentry-mode loopback -v --passphrase abc -ac </etc/motd Here the command fails due to IDEA (S1) being the preferred cipher algorithm. Using "--s2k-digest-algo SHA1" instead of --personal-cipher-preferences will also fail. Signed-off-by: Werner Koch <[email protected]>
2020-11-02gpg: Allow setting notations with the empty string as value.Werner Koch2-0/+10
* g10/misc.c (pct_expando): Catch special case of the empty string. Also map a NULL to the empty string. * g10/photoid.c (show_photos): Make an empty string used as command fail. -- This patch also fixes a segv when calling gpg wrongly like gpg -N \[email protected] GnuPG-bug-id: 5117 Signed-off-by: Werner Koch <[email protected]>
2020-11-02gpg: Do not use weak digest algos if selected by recipient prefs.Werner Koch4-19/+31
* g10/misc.c (is_weak_digest): New. (print_digest_algo_note): Use it here. * g10/sig-check.c (check_signature_end_simple): Use it. * g10/sign.c (hash_for): Do not use recipient_digest_algo if it is in the least of weak digest algorithm. -- If a message is signed and encrypted to several recipients, the to be used digest algorithm is deduced from the preferences of the recipient. This is so that all recipients are able to check the the signature. However, if the sender has a declared an algorithm as week, that algorithm shall not be used - in this case we fallback to the standard way of selecting an algorithm. Note that a smarter way of selecting the algo is to check this while figuring out the algorithm - this needs more testing and thus we do it the simple way. Reported-by: Phil Pennock Signed-off-by: Werner Koch <[email protected]>
2020-11-02gpg: Fix iteration over signaturesIngo Klöcker1-1/+1
* g10/keyedit.c (keyedit_quick_revsig): Take signature of correct node -- GnuPG-bug-id: 5093
2020-11-02gpg: Fix debug output for key_check_all_keysigs with opaque MPI.NIIBE Yutaka1-3/+13
* g10/key-check.c (key_check_all_keysigs): Handle opaque MPI. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-02gpg: Fix check_signature2 for opaque MPI.NIIBE Yutaka1-2/+21
* g10/sig-check.c (check_signature2): Handle the case of opaque MPI. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-02gpg: Change the API for checksum to use const qualifier.NIIBE Yutaka2-2/+2
* g10/main.h (checksum): Use const. * g10/misc.c (checksum): Use const. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-02gpg: Fix counting buffer size in check_signature2.NIIBE Yutaka1-1/+1
* g10/sig-check.c (check_signature2): Use GCRYMPI_FMT_PGP. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-10-30gpg: Fix SOS handling with libgcrypt version <= 1.8.NIIBE Yutaka1-0/+19
* g10/misc.c (checksum_mpi): Don't depend new feature of gcry_mpi_print which supports opaque MPI. -- GnuPG-bug-id: 5116 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-10-30gpg: Fix first zero-byte case for SOS handling.NIIBE Yutaka2-2/+2
* g10/export.c (transfer_format_to_openpgp): Check the first byte. * g10/pkglue.c (sexp_extract_param_sos): Likewise. -- GnuPG-bug-id: 5116 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-10-28gpg: New command --quick-revoke-sigWerner Koch6-9/+277
* g10/gpg.c (enum cmd_and_opt_values): Add aQuickRevSig. (opts): Add --quick-revoke-sig. (main): Implement. * g10/keyedit.c (quick_find_keyblock): Add arg 'want_secret' and adjust all callers. (keyedit_quick_revsig): new. * g10/revoke.c (get_default_sig_revocation_reason): New. * g10/keylist.c (cmp_signodes): Make global. -- GnuPG-bug-id: 5093
2020-10-27gpg: Sort the signatures in standard key listings.Werner Koch6-142/+239
* g10/gpg.c (parse_list_options): Add "sort-sigs". (main): Make it the default. * g10/options.h (LIST_SORT_SIGS): New. * g10/keylist.c (cmp_signodes): New. (list_keyblock_print): Sort signatures and factor signature printing code out to ... (list_signature_print): new. -- In particular together with --full-timestamps this makes it easier to see the history of key signatures and their revocations. The self-signatures are also printed first. To disable this --list-options no-sort-sigs can be used. Also don't print the annoying "no recocation reason specified" message. Signed-off-by: Werner Koch <[email protected]>
2020-10-26g10: Make call to agent_scd_serialno more robust.Werner Koch2-5/+6
* g10/call-agent.c (agent_scd_serialno): Make sure that NULL is stored on error at r_serialno. * g10/card-util.c (card_status): Simplify freeing of seriaono. (factory_reset): Ditto. -- This pattern is what we use with other functions returning an allocated string and thus less surprising.
2020-10-26g10,sm: Use gnupg_access at two more placesWerner Koch1-1/+1
--
2020-10-26gpg: Fix double free on error.NIIBE Yutaka1-1/+2
* g10/card-util.c (card_status): Check an error return. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-10-26gpg,tools: Fix detecting OpenPGP card by serialno.NIIBE Yutaka1-4/+5
* tools/gpg-card.c (list_openpgp): Use ->apptype to determine card's APP. * g10/card-util.c (get_info_for_key_operation): Likewise. (current_card_status): Even if its SERIALNO is not like OpenPGP card, it's OpenPGP card when app says so. -- GnuPG-bug-id: 5100 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-10-20Replace all calls to stat by gnupg_stat.Werner Koch6-11/+11
* common/sysutils.c (gnupg_stat): New. * common/sysutils.h: Include sys/stat.h. -- Yet another wrapper for Unicode support on Windows. GnuPG-bug-id: 5098 Signed-off-by: Werner Koch <[email protected]>
2020-10-20Replace most calls to open by a new wrapper.Werner Koch2-6/+6
* common/sysutils.c (any8bitchar) [W32]: New. (gnupg_open): New. Replace most calls to open by this. * common/iobuf.c (any8bitchar) [W32]: New. (direct_open) [W32]: Use CreateFileW if needed. -- This is yet another step for full Unicode support on Windows. GnuPG-bug-id: 5098
2020-10-20Replace most of the remaining stdio calls by estream calls.Werner Koch4-11/+11
-- We need to use es_fopen on Windows to cope with non-ascii file names. This is quite a large but fortunately straightforward change. At a very few places we keep using stdio (for example due to the use of popen). GnuPG-bug-id: 5098 Signed-off-by: Werner Koch <[email protected]>
2020-10-20Replace all calls to access by gnupg_accessWerner Koch6-20/+26
* common/sysutils.c (gnupg_access): New. Replace all calls to access by this wrapper. * common/homedir.c (w32_shgetfolderpath): Change to return UTF-8 directory name. (standard_homedir): Adjust for change. (w32_commondir, gnupg_cachedir): Ditto. -- Also use SHGetFolderPathW instead of SHGetFolderPathA on Windows. This is required to correctly handle non-ascii filenames on Windows. GnuPG-bug-id: 5098
2020-10-09gpg,ecc: Fix SOS handling when receiving from agent.NIIBE Yutaka1-1/+16
* g10/export.c (transfer_format_to_openpgp): It's not simple opaque MPI, but SOS. -- Fixes-commit: f5bc94555458123f93d8b07816a68fb7485421e1 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-10-05gpg: Switch to ed25519+cv25519 as default algo.Werner Koch1-28/+29
* g10/keygen.c (DEFAULT_STD_KEY_PARAM): Change to former future default ago. (ask_algo): Change default and also the way we indicate the default algo in the list of algos. (ask_curve): Indicate the default curve. Signed-off-by: Werner Koch <[email protected]>
2020-10-02gpg: Fix parameter parsing form ed448.Werner Koch1-1/+1
* g10/keygen.c (parse_key_parameter_part): Set algo also for 448. -- Fixes-commit: a763bb2580b0d586a80b8ccd3654f41e49604f4f
2020-09-24gpg: New experimental import option "bulk-import"Werner Koch3-4/+40
* g10/options.h (IMPORT_BULK): New. * g10/import.c (parse_import_options): Add "bulk-import". * g10/call-keyboxd.c (in_transaction): New var. (gpg_keyboxd_deinit_session_data): Run a commit if in bulk import mode. (create_new_context): Run a begin transaction if in bulk import mode. -- Initial tests with this option are not very promising. Importing about 3000 real world keys with --use-keyboxd and full logging took: real 33m31.724s user 19m54.265s sys 2m49.662s With bulk-import this saves a mere 12%: real 29m36.542s user 19m3.391s sys 2m46.728s Signed-off-by: Werner Koch <[email protected]>
2020-09-24keyboxd: Implement multiple search descriptions.Werner Koch1-83/+103
* kbx/kbx-client-util.c (kbx_client_data_simple): New. * kbx/backend-sqlite.c (struct be_sqlite_local_s): Add field descidx. (be_sqlite_search): Use that. * g10/call-keyboxd.c (keydb_search): Implement multi mode. -- With that change the keyboxd is at par with the keybox code. Signed-off-by: Werner Koch <[email protected]>
2020-09-22gpg: Set the found-by flags in the keyblock in keyboxd mode.Werner Koch2-8/+34
* g10/keydb-private.h (struct keydb_handle_s): Add fields to return the ordinals of the last found blob. * g10/call-keyboxd.c (keydb_get_keyblock): Pass them to the keyblock parser. Signed-off-by: Werner Koch <[email protected]>
2020-09-21doc: Some documentation updates.Werner Koch1-1/+1
-- Also fixed some typos and documented soon to be used OIDs
2020-09-18common,agent,dirmngr,g10,tools: Fix split_fields API.NIIBE Yutaka1-3/+3
* common/stringhelp.h (split_fields): Use const * for the strings in the ARRAY. (split_fields_colon): Likewise. * common/stringhelp.c (split_fields, split_fields_colon): Fix the implementation. * agent/call-scd.c, agent/command.c: Follow the change. * common/t-stringhelp.c, dirmngr/loadswdb.c: Likewise. * g10/call-agent.c, tools/card-call-scd.c: Likewise. * tools/card-yubikey.c, tools/gpg-card.c: Likewise. * tools/gpg-card.h, tools/gpg-wks-client.c: Likewise. * tools/gpgconf-comp.c, tools/gpgconf.c: Likewise. * tools/wks-util.c: Likewise. -- The strings in the ARRAY don't need to be released by caller, as those are references. It's easier to follow the code when it's explicitly const *. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-09-16gpg,scd: Fix handling of KDF feature.NIIBE Yutaka1-2/+2
* g10/card-util.c (kdf_setup): Fix the default value. * scd/app-openpgp.c (do_setattr): Support kdf-setup "off" by Zeitcontrol. Make sure Gnuk and Yubikey work well. Signed-off-by: NIIBE Yutaka <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-19 02:41:27 +0000