aboutsummaryrefslogtreecommitdiffstats
path: root/sm/gpgsm.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* gpg,agent,kbx,sm,scd,tpm2d,g13: Use assuan_control.gniibe/t6606NIIBE Yutaka2023-08-021-0/+1
| | | | | | | | | | | | | | | * agent/gpg-agent.c (thread_init_once): Call assuan_control. * g10/gpg.c (main): Likewise. * g13/g13.c (main): Likewise. * kbx/keyboxd.c (thread_init_once): Likewise. * scd/scdaemon.c (main): Likewise. * sm/gpgsm.c (main): Likewise. * tpm2d/tpm2daemon.c (main): Likewise. -- GnuPG-bug-id: 6606 Signed-off-by: NIIBE Yutaka <[email protected]>
* agent,dirmgr,gpg,g13,kbx,scd,sm,tmp2d: Remove ASSUAN_SYSTEM_NPTH.NIIBE Yutaka2023-07-241-5/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/gpg-agent.c (ASSUAN_SYSTEM_NPTH_IMPL): Remove. (initialize_modules): Don't call assuan_set_system_hooks. (main): Don't call assuan_sock_set_system_hooks. * dirmngr/dirmngr.c (ASSUAN_SYSTEM_NPTH_IMPL): Remove. (thread_init): Don't call assuan_set_system_hooks. * g10/gpg.c (ASSUAN_SYSTEM_NPTH_IMPL): Remove. (main): Don't call assuan_set_system_hooks. * g13/g13.c (ASSUAN_SYSTEM_NPTH_IMPL): Remove. (main): Set the syscall clamp with gpgrt_set_syscall_clamp. Don't call assuan_set_system_hooks. * kbx/keyboxd.c (ASSUAN_SYSTEM_NPTH_IMPL): Remove. (initialize_modules): Don't call assuan_set_system_hooks. (main): Don't call assuan_sock_set_system_hooks. * scd/scdaemon.c (ASSUAN_SYSTEM_NPTH_IMPL): Remove. (main): Don't call assuan_set_system_hooks. * sm/gpgsm.c (ASSUAN_SYSTEM_NPTH_IMPL): Remove. (main): Don't call assuan_set_system_hooks. * tpm2d/tpm2daemon.c (ASSUAN_SYSTEM_NPTH_IMPL): Remove. (main): Don't call assuan_set_system_hooks. -- GnuPG-bug-id: 6606 Signed-off-by: NIIBE Yutaka <[email protected]>
* common: Introduce FD_DBG to display gnupg_fd_t value.NIIBE Yutaka2023-07-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/sysutils.h (FD_DBG): New. * agent/gpg-agent.c (check_nonce): Use FD_DBG. (do_start_connection_thread, start_connection_thread_ssh): Likewise. * common/iobuf.c (fd_cache_close, file_filter, do_open): Likewise. (do_iobuf_fdopen): Likewise. * dirmngr/dirmngr.c (check_nonce, start_connection_thread) (handle_connections): Likewise. * dirmngr/http.c (_my_socket_new, _my_socket_ref): Likewise. (_my_socket_unref): Likewise. * g10/decrypt.c (decrypt_message_fd): Likewise. * g10/encrypt.c (encrypt_crypt): Likewise. * g10/openfile.c (open_outfile): Likewise. * g10/plaintext.c (get_output_file, hash_datafile_by_fd): Likewise. * g10/verify.c (gpg_verify): Likewise. * kbx/keyboxd.c (check_nonce, do_start_connection_thread): Likewise. * scd/scdaemon.c (start_connection_thread): Likewise. (handle_connections): Likewise. * sm/gpgsm.c (open_es_fread, open_es_fwrite): Likewise. * tpm2d/tpm2daemon.c (start_connection_thread): Likewise. (handle_connections): Likewise. -- GnuPG-bug-id: 6597 Signed-off-by: NIIBE Yutaka <[email protected]>
* sm: Fix open_es_fread and open_es_fwrite for gnupg_fd_t.NIIBE Yutaka2023-07-131-8/+10
| | | | | | | | | | * sm/gpgsm.c (open_es_fread, open_es_fwrite): Use gnupg_fd_t and open_stream_nc. -- GnuPG-bug-id: 6580 Signed-off-by: NIIBE Yutaka <[email protected]>
* sm: Major rewrite of the PKCS#12 parserWerner Koch2023-06-281-1/+1
| | | | | | | | | | | | | | | | * sm/minip12.c: Reworked most of the parser. (p12_set_verbosity): Add arg debug and change all callers. * sm/t-minip12.c: Major rewrite to run regression tests unattended. * sm/Makefile.am (module_maint_tests): Move t-Minit to ... (module_tests): here. * tests/cms/samplekeys/Description-p12: New. -- Note that cram_octet_string stuff has not yet been reworked. I need to locate the sample files first. GnuPG-bug-id: 6536
* gpgsm: New option --input-size-hint.Werner Koch2023-06-151-0/+6
| | | | | | | | | | | | | | | | | | * sm/gpgsm.c (oInputSizeHint): New. (opts): Add "--input-size-hint". (main): Set option. * sm/server.c (option_handler): Add option "input-size-hint". * sm/gpgsm.h (struct server_control_s): Add field input_size_hint. * sm/encrypt.c (gpgsm_encrypt): Set the toatl file size. * sm/decrypt.c (gpgsm_decrypt): Ditto. * sm/sign.c (gpgsm_sign): Ditto. * sm/verify.c (gpgsm_verify): Ditto. -- This option allows to set a value for the progress output line. Note that as of now there is no other way to set the file size. GnuPG-bug-id: 6534
* sm: Emit STATUS_FAILURE for non-implemented commands.Werner Koch2023-05-221-4/+12
| | | | * sm/gpgsm.c (main): Do it here.
* kbx: Use custom estream bufferingWerner Koch2023-05-081-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * kbx/keybox-init.c (ll_buffer_size): New var intialized to 128k (stream_buffers): New var. (keybox_set_buffersize): New. (_keybox_ll_open, _keybox_ll_close): Implement buffering. * sm/gpgsm.c (oKbxBufferSize): New. (opts): Add option --kbx-buffer-size. (main): Call keybox_set_buffersize. * g10/gpg.c: Include keybox.h. * (oKbxBufferSize): New. (opts): Add option --kbx-buffer-size. (main): Call keybox_set_buffersize. -- Running a test on Windows using a pubring.kbx with Total number of blobs: 2098 openpgp: 1294 x509: 803 and a size of 42MiB with gpgsm -k --with-validation --disable-dirmngr --kbx-buffer-size N >nul gives these performance figures using procmon | N(k) | file events | time(s) | |------+-------------+---------| | 0 | 4900000 | 86 | | 16 | 2456000 | 58 | | 32 | 1233000 | 43 | | 64 | 622000 | 37 | | 128 | 317000 | 32 | | 256 | 164000 | 31 | | 512 | 88000 | 30 | Using _open instead of CreateFile give the same number of file events but increased the time slight by one second for the measured buffer size of 64k and 128k. Benchmarks for gpg have not been conducted.
* gpgsm: New option --no-pretty-dnWerner Koch2023-03-161-1/+6
| | | | | | | | * sm/gpgsm.c (oNoPrettyDN): New. (opts): Add --no-pretty-dn. (main): Implement. * sm/gpgsm.h (opt): Add no_pretty_dn. * sm/certdump.c (gpgsm_es_print_name): Act upon.
* gpg,gpgsm: New option --log-timeWerner Koch2023-03-081-0/+10
| | | | | | | | | | | * g10/gpg.c (oLogTime): New. (opts): Add "log-time". (opt_log_time): New var. (main): Implement. * sm/gpgsm.c (oLogTime): New. (opts): Add "log-time". (opt_log_time): New var. (main): Implement.
* gpgsm: Print revocation date and reason in cert listings.Werner Koch2022-12-051-0/+4
| | | | | | | | | | | | | | | | | | | | | | * dirmngr/ocsp.c (ocsp_isvalid): Add args r_revoked_at and r_revocation_reason. * dirmngr/server.c (cmd_isvalid): Emit a new REVOCATIONINFO status. (cmd_checkocsp): Ditto. * sm/call-dirmngr.c (struct isvalid_status_parm_s): Add new fields. (isvalid_status_cb): Parse REVOCATIONINFO. (gpgsm_dirmngr_isvalid): Add args r_revoked_at and r_revocation_reason. * sm/gpgsm.h (struct server_control_s): Add fields revoked_art and revocation_reason. * sm/keylist.c (list_cert_raw): Print revocation date. (list_cert_std): Ditto. -- Note that for now we do this only for OCSP because it is an important piece of information when using the chain model. For a sample key see commit 7fa1d3cc821dca1ea8e1c80a0bdd527177c185ee.
* gpgsm: Change default algo to AES-256.Werner Koch2022-12-011-1/+1
| | | | * sm/gpgsm.c (DEFAULT_CIPHER_ALGO): Change.
* common: New common option no-autostart.Werner Koch2022-08-221-0/+3
| | | | | | | | | | | | | | | | | | | | * common/comopt.c (opts): Add "no-autostart". (parse_comopt): Set it. * common/comopt.h (comopt): Add no_autostart. * g10/gpg.c (main): Take care of the new option. * sm/gpgsm.c (main): Ditto. * tools/gpg-connect-agent.c (INCLUDED_BY_MAIN_MODULE): Add. (main): Parse common options and handle new option. * tools/gpg-card.c (main): Ditto. (cmd_yubikey): Fix minor error reporting issue. * common/util.h (GNUPG_MODULE_NAME_CARD): New const. * common/homedir.c (gnupg_module_name): Support it. -- Having a global option makes it easier to use disable autostart on a server which is required to use a remote gpg-agent reliable.
* gpgsm: New option --compatibility-flags.Werner Koch2022-06-131-0/+21
| | | | | | | | | | * sm/gpgsm.c (oCompatibilityFlags): New option. (compatibility_flags): new. (main): Parse and print them in verbose mode. * sm/gpgsm.h (opt): Add field compat_glags.: (COMPAT_ALLOW_KA_TO_ENCR): New. * sm/keylist.c (print_capabilities): Take care of the new flag. * sm/certlist.c (cert_usage_p): Ditto.
* w32: Do no use Registry item DefaultLogFile for the main tools.Werner Koch2022-04-201-1/+1
| | | | | | | | | | | | | | | | * g10/gpg.c (main): Set LOG_NO_REGISTRY. * sm/gpgsm.c (main): Ditto. * tools/gpg-connect-agent.c (main): Ditto. * tools/gpgconf.c (main): Ditto. (show_other_registry_entries): Print "DefaultLogFile". -- The intention of this mostly forgotten registry entry was to allow for easy debugging of the tools. However, with the global config file common.conf things are anyway better. We disable the use for the commonly used tools so that it does not look like calling gpg on the command line seems to block with no output if the log server (e.g. tcp://1.2.3.4:11111) is not reachable.
* gpgsm: New option --require-complianceWerner Koch2022-03-081-2/+5
| | | | | | | | | | | | * sm/gpgsm.c (oRequireCompliance): New. (opts): Add --require-compliance. (main): Set option. * sm/gpgsm.h (opt): Add field require_compliance. (gpgsm_errors_seen): Declare. * sm/verify.c (gpgsm_verify): Emit error if non de-vs compliant. * sm/encrypt.c (gpgsm_encrypt): Ditto. * sm/decrypt.c (gpgsm_decrypt): Ditto. --
* sm: New option --ignore-cert-with-oid.Werner Koch2022-02-031-0/+6
| | | | | | | * sm/gpgsm.c (oIgnoreCertWithOID): New. (opts): Add option. (main): Store its value. * sm/call-agent.c (learn_cb): Test against that list.
* sm: Partly revert last commit.Werner Koch2022-02-011-6/+0
| | | | | | | | | * sm/gpgsm.c (set_debug): Remove doubled code. -- It was already there; sorry. Fixes-commit: 51edea995d352a7b557fb0315fa5091dc42065cb
* gpg,sm: Set --verbose and clear --quiet in debug mode.Werner Koch2022-02-011-0/+6
| | | | | * g10/gpg.c (set_debug): Tweak options. * sm/gpgsm.c (set_debug): Ditto.
* gpgsm: Retire the new --ldapserver.Werner Koch2022-01-271-1/+6
| | | | | | | | | | | * sm/gpgsm.c (oKeyServer_deprecated): New. (opts): Assign "ldapserver" to the new option and mark it as obsolete. -- We want to use "ldapserver" in dirmngr but need to keep using "keyserver" in gpgsm for existant versions of Kleopatra etc. GnuPG-bug-id: 5801
* gpgconf: Return --ldapserver and --keyserver from dirmngr.Werner Koch2022-01-251-2/+1
| | | | | | | | | | | * dirmngr/dirmngr.c: Reorder two option groups. * tools/gpgconf-comp.c (known_options_gpgsm): Rename "keyserver" to "ldapserver" and set level to invisible. (known_options_dirmngr): Add "ldapserver" at the basic level. * sm/gpgsm.c (opts): No more help text for "ldapserver". -- GnuPG-bug-id: 5800
* gpg,gpgsm: Add option --min-rsa-length.Werner Koch2021-11-181-1/+5
| | | | | | | | | | | | | | | * common/compliance.c (min_compliant_rsa_length): New. (gnupg_pk_is_compliant): Take in account. (gnupg_pk_is_allowed): Ditto. (gnupg_set_compliance_extra_info): New. * g10/gpg.c (oMinRSALength): New. (opts): Add --min-rsa-length. (main): Set value. * g10/options.h (opt): Add field min_rsa_length. * sm/gpgsm.c (oMinRSALength): New. (opts): Add --min-rsa-length. (main): Set value. * sm/gpgsm.h (opt): Add field min_rsa_length.
* sm: New option --ldapserver as an alias for --keyserver.Werner Koch2021-06-161-1/+2
| | | | | | | | | | | | | * sm/gpgsm.c (opts): Add option --ldapserver and make --keyserver an alias. -- We should use "keyserver" for OpenPGP and thus it is better to allow for "ldapserver" here - it is the same convention as now used in dirmngr. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit d6df1bf84969bf5f5781e33bc1c2f6cb2aee0093)
* gpg,sm: Simplify keyserver spec parsing.Werner Koch2021-06-161-143/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | * common/keyserver.h: Remove. * sm/gpgsm.h (struct keyserver_spec): Remove. (opt): Change keyserver to a strlist_t. * sm/gpgsm.c (keyserver_list_free): Remove. (parse_keyserver_line): Remove. (main): Store keyserver in an strlist. * sm/call-dirmngr.c (prepare_dirmngr): Adjust for the strlist. Avoid an ambiguity in dirmngr by adding a prefix if needed. * g10/options.h (struct keyserver_spec): Move definition from keyserver.h to here. Remove most fields. * g10/keyserver.c (free_keyserver_spec): Adjust. (cmp_keyserver_spec): Adjust. (parse_keyserver_uri): Simplify. (keyidlist): Remove fakev3 arg which does not make any sense because we don't even support v3 keys. -- We now rely on the dirmngr to parse the keyserver specs. Thus a bad specification will not be caught immediately. However, even before that dirmngr had stricter tests. Signed-off-by: Werner Koch <[email protected]> Ported-from: 9f586700ec4ceac97fd47cd799878a8847342ffa
* sm: Support AES-GCM decryption.Werner Koch2021-06-021-3/+6
| | | | | | | | | | | | * tests/cms/samplemsgs/: Add sample messages. * sm/gpgsm.c (main): Use gpgrt_fcancel on decryption error. * sm/decrypt.c (decrypt_gcm_filter): New. (gpgsm_decrypt): Use this filter if requested. Check authtag. -- Note that the sample message pwri-sample.gcm.p7m is broken: The authtag is duplicated to the authEncryptedContentInfo. I used a temporary code during testing hack to that test message out.
* gpg,sm: Ignore the log-file option from common.conf.Werner Koch2021-04-211-8/+1
| | | | | | | | | | | * g10/gpg.c (main): Don't use the default log file from common.conf. * sm/gpgsm.c (main): Ditto. -- That was acutally not intended and contradicts the description in doc/example/common.conf. Signed-off-by: Werner Koch <[email protected]>
* sm: New command --show-certsWerner Koch2021-04-201-0/+12
| | | | | | | | | | | | | | | * sm/keylist.c (do_show_certs): New. (gpgsm_show_certs): New. * sm/gpgsm.c (aShowCerts): New. (opts): Add --show-certs. (main): Call gpgsm_show_certs. -- I have been using libksba test programs for countless times to look at certificates and I always wanted to add such a feature to gpgsm. This is simply much more convenient. Signed-off-by: Werner Koch <[email protected]>
* gpg,gpgsm: Move use-keyboxd to the new conf file common.confWerner Koch2021-04-191-2/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/comopt.c, common/comopt.h: New. * common/Makefile.am: Add them. * g10/gpg.c: Include comopt.h. (main): Also parse common.conf. * sm/gpgsm.c: Include comopt.h. (main): Set a flag for the --no-logfile option. Parse common.conf. * tools/gpgconf-comp.c (known_options_gpg): Remove "use-keyboxd", add pseudo option "use_keyboxd". (known_pseudo_options_gpg): Add pseudo option "use_keyboxd". (known_options_gpgsm): Remove "use-keyboxd". * tests/openpgp/defs.scm (create-gpghome): Create common.conf. * doc/examples/common.conf: New. -- Note that --use-keybox still works but prints a warning. We will eventually remove this option becuase it was marked as an experimental feature anyway. It would be too confusing if gpg and gpgsm use different key storages. Further, other components (e.g. dirmngr or gpg-wks-client) which call gpg or gpgsm need to be aware that the keyboxd is used and pass that option on the command line. Now that common.conf is always read (even if --no-options is used) those tools will work instantly.
* sm: Init nPth which might be used by some helper code.Werner Koch2021-03-081-2/+11
| | | | | | | | | | | | | | * sm/gpgsm.c: Include npth.h. (main): Init nPth. -- Actually we currently do not use extra threads but we need to link to the npth version of the common functions because there is an option to use threads. Now, without initialized npth, we could experience a crash in gnupg_sleep, which uses npth_usleep in the npth based common functions. Fixes-commit: 046f419f806036248c058c4bd44368f8596287b7
* sm: Silence some output on --quietWerner Koch2021-02-241-1/+5
| | | | | | | | | | | | * sm/encrypt.c (gpgsm_encrypt): Take care of --quiet. * sm/gpgsm.c: Include minip12.h. (set_debug): Call p12_set_verbosity. * sm/import.c (parse_p12): Dump keygrip only in debug mode. * sm/minip12.c (opt_verbose, p12_set_verbosity): New. (parse_bag_encrypted_data): Print info messages only in verbose mode. -- GnuPG-bug-id: 4757
* Require GpgRT version 1.41.Werner Koch2021-02-101-5/+0
| | | | | | | | | | | | | | * configure.ac (NEED_GPG_ERROR_VERSION): Rename to NEED_GPGRT_VERSION and set to 1.41. * common/sysutils.c (gnupg_access): Remove code for older gpgrt versions. * kbx/backend-sqlite.c: Ditto. * sm/gpgsm.c (main): Ditto. -- We already have a requirement for a newer Libgcrypt and thus we can also require a more recent libgpgrt (aka libgpg-error) which was released before Libgcrypt.
* Replace most calls to open by a new wrapper.Werner Koch2020-10-201-1/+1
| | | | | | | | | | | | * common/sysutils.c (any8bitchar) [W32]: New. (gnupg_open): New. Replace most calls to open by this. * common/iobuf.c (any8bitchar) [W32]: New. (direct_open) [W32]: Use CreateFileW if needed. -- This is yet another step for full Unicode support on Windows. GnuPG-bug-id: 5098
* Replace all calls to access by gnupg_accessWerner Koch2020-10-201-1/+1
| | | | | | | | | | | | | | | | * common/sysutils.c (gnupg_access): New. Replace all calls to access by this wrapper. * common/homedir.c (w32_shgetfolderpath): Change to return UTF-8 directory name. (standard_homedir): Adjust for change. (w32_commondir, gnupg_cachedir): Ditto. -- Also use SHGetFolderPathW instead of SHGetFolderPathA on Windows. This is required to correctly handle non-ascii filenames on Windows. GnuPG-bug-id: 5098
* sm: New options to prepare the use of keyboxd.Werner Koch2020-09-031-3/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * sm/Makefile.am (AM_CFLAGS): Add npth flags. (common_libs): Use npth version of the lib. (gpgsm_LDADD): Add npth libs. * sm/gpgsm.c (oUseKeyboxd, oKeyboxdProgram): New. (opts): New options --use-keyboxd and --keyboxd-program. (main): Set them. (gpgsm_deinit_default_ctrl): New. (main): Call it. * sm/server.c (gpgsm_server): Ditto. * sm/gpgsm.h (opt): Add fields use_keyboxd and keyboxd_program. (keydb_local_s): New type. (struct server_control_s): Add field keybd_local. * sm/keydb.c: Include assuan.h, asshelp.h, and kbx-client-util.h. (struct keydb_local_s): New. (struct keydb_handle): Add fields for keyboxd use. (gpgsm_keydb_deinit_session_data): New. (warn_version_mismatch): New. (create_new_context): New. (open_context): New. (keydb_new): Implement keyboxd mode. (keydb_release): Ditto. (keydb_get_resource_name): Ditto. * sm/keydb.c: Add stub support for all other functions. Signed-off-by: Werner Koch <[email protected]>
* sm: Do not require a default keyring for --gpgconf-list.Werner Koch2020-08-251-0/+1
| | | | | | | | * sm/gpgsm.c (main): No default keyring for gpgconf mode. -- GnuPG-bug-id: 4867 Signed-off-by: Werner Koch <[email protected]>
* Silence compiler warnings.NIIBE Yutaka2020-08-191-1/+1
| | | | | | | | | | * common/openpgp-oid.c (map_openpgp_pk_to_gcry): Use cast for enum conversion. * dirmngr/dns-stuff.c (get_dns_srv): Use explicit conversion from int to float. * sm/gpgsm.c (parse_keyserver_line): Initialize ERR. Signed-off-by: NIIBE Yutaka <[email protected]>
* Add --chuid to gpg, gpg-card, and gpg-connect-agent.Werner Koch2020-08-141-6/+10
| | | | | | | | | | | | | | | | | | | * g10/gpg.c (oChUid): New. (opts): Add --chuid. (main): Implement --chuid. Delay setting of homedir until the new chuid is done. * sm/gpgsm.c (main): Delay setting of homedir until the new chuid is done. * tools/gpg-card.c (oChUid): New. (opts): Add --chuid. (changeuser): New helper var. (main): Implement --chuid. * tools/gpg-connect-agent.c (oChUid): New. (opts): Add --chuid. (main): Implement --chuid. -- Signed-off-by: Werner Koch <[email protected]>
* gpgsm: New option --chuid.Werner Koch2020-08-061-1/+12
| | | | | | | | | | * sm/gpgsm.c (oChUid, opts): New option --chuid. (main): Implement option. -- This option will at least be useful for Scute. Signed-off-by: Werner Koch <[email protected]>
* sm: Fix regression in Friday's commitWerner Koch2020-06-291-2/+2
| | | | | | | | * sm/gpgsm.c (main): Set ERR also for encrypt. -- Fixes-commit: ccbb0cfeefed096a9841b6557d10eef12d55b721 Signed-off-by: Werner Koch <[email protected]>
* sm: Try not to output a partial new message after an error.Werner Koch2020-06-261-2/+19
| | | | | | | | | | | | | | | | | * sm/gpgsm.c (main) <aSign,aEncr>: Uses gpgrt_fcancel on error. -- When creating a signature or encrypting and the respective key is not available or the user canceled the PIN entry gpgsm prints the initial part of the message due to internal buffering in gpgrt. By using gpgrt_fcancel we can avoid this at least as long as the data is less than the standard buffer size (which is currently 8k). If is not a complete solution but the best we can do easily. Outputting to the tty is anyway more of a testing aid than for real use. This makes use of the new gpgrt_fcancel API. Signed-off-by: Werner Koch <[email protected]>
* sm: Allow decryption using dhSinglePass-stdDH-sha1kdf-scheme.Werner Koch2020-05-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * sm/decrypt.c (ecdh_decrypt): Support dhSinglePass-stdDH-sha1kdf-scheme. Factor key derive code out to ... (ecdh_derive_kek): new global function. Allow for hashs shorter than the key. (hash_ecc_cms_shared_info): Make file-only. * sm/encrypt.c (ecdh_encrypt): Replace derive code by a call to the new ecdh_derive_kek. Add test code to create data using dhSinglePass-stdDH-sha1kdf-scheme. * sm/gpgsm.h (opt): Add member force_ecdh_sha1kdf. * sm/gpgsm.c: Add option --debug-force-ecdh-sha1kdf. -- I did some test against Governikus_Signer: 2.9.2.0 MCard security Provider: 2.4.0 Algorithm catalog from: 05.12.2019 using a Signature Card v2.0 and a nistp256 certificate. Encrypting with Governikus used the stdDH-sha1kdf scheme which we can now decrypt. Encrypting with GPGSM uses for that curve the recommended scheme sha256kdf but Governikus was not able to decrypt this (no usable error message). Encrypting using stdDH-sha1kdf with GPGSM by using the new --debug-force-ecdh-sha1kdf option showed that Governikus was able to decrypt this. FWIW: RFC5753 (Use of Elliptic Curve Cryptography (ECC) Algorithms) has this requirement: Implementations that support EnvelopedData with the ephemeral-static ECDH standard primitive: - MUST support the dhSinglePass-stdDH-sha256kdf-scheme key agreement algorithm, the id-aes128-wrap key wrap algorithm, and the id-aes128-cbc content encryption algorithm; and which Governikus seems not to fulfill. GnuPG-bug-id: 4098 Signed-off-by: Werner Koch <[email protected]>
* sm: Cleanup the use of GCRY_PK_ECC and GCRY_PK_ECDSA.Werner Koch2020-05-081-0/+1
| | | | | | | | | | | * common/sexputil.c (pubkey_algo_to_string): New. * sm/certcheck.c (do_encode_md): Replace GCRY_PK_ECDSA by GCRY_PK_ECC. * sm/certreqgen-ui.c (check_keygrip): Add all ECC algorithms. * sm/gpgsm.c (our_pk_test_algo): Also allow EdDSA. * sm/verify.c (gpgsm_verify): Map ECC algo to ECDSA. Use new pubkey algo name function Signed-off-by: Werner Koch <[email protected]>
* sm: Consider certificates w/o CRL DP as valid.Werner Koch2020-03-271-0/+6
| | | | | | | | | | | | | | | | | | | * sm/certchain.c (is_cert_still_valid): Shortcut if tehre is no DP. * common/audit.c (proc_type_verify): Print "n/a" if a cert has no distribution point. * sm/gpgsm.h (opt): Add field enable_issuer_based_crl_check. * sm/gpgsm.c (oEnableIssuerBasedCRLCheck): New. (opts): Add option --enable-issuer-based-crl-check. (main): Set option. -- If the issuer does not provide a DP and the user wants such an issuer, we expect that a certificate does not need revocation checks. The new option --enable-issuer-based-crl-check can be used to revert to the old behaviour which requires that a suitable LDAP server has been configured to lookup a CRL by issuer. Signed-off-by: Werner Koch <[email protected]>
* gpgconf: Further simplify the gpgconf option processing.Werner Koch2020-03-141-18/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/gc-opt-flags.h (GC_OPT_FLAG_RUNTIME): Move to ... * tools/gpgconf-comp.c: here. (known_options_scdaemon): Remove "options". (known_options_dirmngr): Remove "options". (known_options_gpgsm): Remove "options". (known_options_gpg): Remove "options" and "keyserver". (struct gc_option_s): Rename active t gpgconf_list. (gc_component_list_options): Do not act upon active. (option_check_validity): Ditto. (is_known_option): Make it work correctly for unknown options. (retrieve_options_from_program): Use renamed flag gpgconf_list only to detect duplicated items from --gpgconf-list. Do not set runtime. Only e set the options if set by --gpgconf-list; never clear them. * agent/gpg-agent.c: Simplify the --gpgconf-list output. * dirmngr/dirmngr.c: Ditto. * g10/gpg.c: Ditto. * kbx/keyboxd.c: Ditto. * scd/scdaemon.c: Ditto. * sm/gpgsm.c: Ditto. * tests/openpgp/gpgconf.scm: Use "compliance" instead of "keyserver" for the string arg test. -- There is no need to read the list of options from the components unless they convey a default value. It is better to consult only the list we have in gpgconf-comp.c to decide on whether an option should be displayed. Right, this might mess up thing if a newer gpgconf version is used with an older component, but we already print warnings in this case and in general we do not want to support this anymore - the times of gpg 1.4. and 2.0 are long over now. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* gpgsm: Re-group the options in the --help output.Werner Koch2020-03-061-112/+127
| | | | | | | | | -- This looks better and is also required for further simplifications of gpgconf. Signed-off-by: Werner Koch <[email protected]>
* gpgconf: Support reading global options (part 2).Werner Koch2020-03-061-5/+9
| | | | | | | | | | | | | | | | | | | * tools/gpgconf-comp.c: Remove all regular option descriptions. They are now read in from the component. Also remove a few meanwhile obsolete options. * agent/gpg-agent.c: Add option description which were only set in gpgconf-comp.c. * dirmngr/dirmngr.c: Ditto. * scd/scdaemon.c: Ditto. * sm/gpgsm.c: Ditto. * g10/gpg.c: Ditto. -- This second part removes all regular option descriptions because they can be read from the components. A few were missing in the components and thus moved to there. Signed-off-by: Werner Koch <[email protected]>
* Use gpgrt's new option parser for gpgc, gpgsm, and gpg-agent.Werner Koch2020-02-201-97/+88
| | | | | | | | | | | | | | * g10/gpgv.c: Use new option parser. * sm/gpgsm.c: Ditto. * agent/gpg-agent.c: Ditto. (opts): Add option --no-options. -- This is the next part of changes. The latest libgpg-error is required so that that re-reading options (SIGHUP) works. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* gpg: Use gpgrt's new option parser to provide a global conf file.Werner Koch2020-02-201-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | * common/util.h: Remove argparse.h. * common/argparse.c: Undef GPGRT_ENABLE_ARGPARSE_MACROS. * configure.ac (GPGRT_ENABLE_ARGPARSE_MACROS): Define. * agent/gpg-agent.c: Undef GPGRT_ENABLE_ARGPARSE_MACROS and include argparse.h. Do this also for all main modules which use our option parser except for gpg. Replace calls to strusage by calls to gpgrt_strusage everywhere. * g10/gpg.c (opts): Change type to gpgrt_opt_t. Flag oOptions and oNoOptions with ARGPARSE_conffile and ARGPARSE_no_conffile. (main): Change type of pargs to gpgrt_argparse_t. Rework the option parser to make use of the new gpgrt_argparser. -- This is not yet finished but a make check works. gpg has the most complex and oldest option handling and thus this is the first migration target. SE-Linux checks and version-ed config files are missing and will be added later. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* build: Always use EXTERN_UNLESS_MAIN_MODULE pattern.Werner Koch2020-02-101-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | * common/util.h (EXTERN_UNLESS_MAIN_MODULE): Add the definion only here but now without the Norcroft-C. Change all other places where it gets defined. * common/iobuf.h (iobuf_debug_mode): Declare unconditionally as extern. * common/iobuf.c (iobuf_debug_mode): Define it here. * agent/gpg-agent.c (INCLUDED_BY_MAIN_MODULE): Define here and also in all main modules of all other programs. * g10/main.h: Put util.h before the local header files. -- This change is required for use with gcc/ld's LTO feature which does not allow common blocks. Further gcc 10 will make -fno-common the default and thus this chnage is always needed. What a pitty. Co-authored-by: Tomáš Mráz GnuPG-bug-id: 4831 Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 21d9bd8b87a9f793a106095e3838eb71825189d7) - Applied respective chnages also to gpg-card and keyboxd. Signed-off-by: Werner Koch <[email protected]>
* gpg,sm: Avoid useless ASFW diagnostic in loopback mode.Werner Koch2020-01-131-0/+8
| | | | | | | | | | | * common/sysutils.c (inhibit_set_foregound_window): New var. (gnupg_inhibit_set_foregound_window): New func. (gnupg_allow_set_foregound_window): Use var. * g10/gpg.c (main): Inhibit in loopback mode. * sm/gpgsm.c (main): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-18 02:37:45 +0000