aboutsummaryrefslogtreecommitdiffstats
path: root/sm/keylist.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-09-10sm: Implement initial support for keyboxd.Werner Koch1-2/+3
* sm/gpgsm.h (MAX_FINGERPRINT_LEN): New. * sm/keydb.c (struct keydb_local_s): Change definition of search_result. (keydb_get_cert): Implement keyboxd mode. (keydb_get_flags): Temporary hack for keyboxd mode. Needs to be fixed. (struct store_parm_s, store_inq_cb): New. (keydb_insert_cert): Implement keyboxd mode. (keydb_locate_writable): Make static. (keydb_search_reset): Implement keyboxd mode. (search_status_cb): New. (keydb_search): Implement keyboxd mode. Replace return code -1 by GPG_ERR_NOT_FOUND. (keydb_set_cert_flags): Replace return code -1 by GPG_ERR_NOT_FOUND. * sm/keylist.c (list_cert_colon): Adjust for replacement of -1 by GPG_ERR_NOT_FOUND. (list_internal_keys): Ditto. * sm/sign.c (add_certificate_list): Ditto. * sm/certchain.c (find_up_search_by_keyid): Ditto. (find_up_external, find_up, find_up_dirmngr): Ditto. (gpgsm_walk_cert_chain): Ditto. (get_regtp_ca_info): Ditto. * sm/certlist.c (gpgsm_add_to_certlist): Ditto. (gpgsm_find_cert): Ditto. * sm/delete.c (delete_one): Ditto. * sm/export.c (gpgsm_export): Ditto. (gpgsm_p12_export): Ditto. * sm/import.c (gpgsm_import_files): Ditto. -- Note that keyboxd is not yet able to handle the ephemeral flag. This needs fixing here and in keyboxd. Delete et al. is also not yet implemented. A basic key listing works, though. Signed-off-by: Werner Koch <[email protected]>
2020-09-03sm: Add arg ctrl to keydb_new.Werner Koch1-1/+1
* sm/keydb.c (keydb_new): Add arg and change all callers. -- This will be used later.
2020-08-04sm: Also show the SHA-256 fingerprint.Werner Koch1-1/+13
* sm/keylist.c (list_cert_colon): Emit a new "fp2" record. (list_cert_raw): Print the SHA2 fingerprint. (list_cert_std): Ditto. Signed-off-by: Werner Koch <[email protected]>
2020-07-08gpgsm: Replace all assert calls by log_assert.Werner Koch1-2/+1
-- Signed-off-by: Werner Koch <[email protected]>
2020-07-03sm: Exclude rsaPSS from de-vs compliance mode.Werner Koch1-1/+4
* common/compliance.h (PK_ALGO_FLAG_RSAPSS): New. * common/compliance.c (gnupg_pk_is_compliant): Add arg alog_flags and test rsaPSS. Adjust all callers. (gnupg_pk_is_allowed): Ditto. * sm/misc.c (gpgsm_ksba_cms_get_sig_val): New wrapper function. (gpgsm_get_hash_algo_from_sigval): New. * sm/certcheck.c (gpgsm_check_cms_signature): Change type of sigval arg. Add arg pkalgoflags. Use the PK_ALGO_FLAG_RSAPSS. * sm/verify.c (gpgsm_verify): Use the new wrapper and new fucntion to also get the algo flags. Pass algo flags along. Signed-off-by: Werner Koch <[email protected]>
2020-06-26sm: Print the serial number of a cert also in decimal.Werner Koch1-2/+8
* sm/certdump.c: Include membuf.h. (gpgsm_print_serial_decimal): New. * sm/keylist.c (list_cert_raw): Print s/n also in decimal (list_cert_std): Ditto. -- Many CA's print the serial number in decimal on their cards. Signed-off-by: Werner Koch <[email protected]>
2020-05-07sm: Print the key types as standard key algorithm strings.Werner Koch1-12/+13
* sm/fingerprint.c (gpgsm_get_key_algo_info): Factor code out to ... (gpgsm_get_key_algo_info2): new. (gpgsm_pubkey_algo_string): New. * sm/keylist.c (list_cert_colon): Put curve into field 17 (list_cert_raw): Print the unified key algotithm string instead of the algo and size. (list_cert_std): Ditto. -- It is important to known whether a 256 bit ECC uses a NIST or a Brainpool curve. Signed-off-by: Werner Koch <[email protected]>
2020-04-16sm: Lookup missing issuers first using authorityInfoAccess.Werner Koch1-1/+1
* sm/call-dirmngr.c (gpgsm_dirmngr_lookup): Add optional arg URL and adjust all callers. * sm/certchain.c (oidstr_caIssuers): New. (struct find_up_store_certs_s): Add additional fields. (find_up_store_certs_cb): Store the fingerprint. (find_up_via_auth_info_access): New. (find_up): Try the AIA URI first. -- Note that --auto-issuer-key-retrieve is required to use that. GnuPG-bug-id: 4898 Signed-off-by: Werner Koch <[email protected]>
2019-05-15sm: Add a couple of debug calls to the keydb module.Werner Koch1-0/+2
* sm/gpgsm.h (DBG_CLOCK_VALUE, DBG_CLOCK): New. (DBG_LOOKUP_VALUE, DBG_LOOKUP): New. * sm/gpgsm.c: new debug flags "lookup" and "clock" * sm/keydb.c: Add log_clock calls to most functions. (keydb_search_desc_dump): New. (keydb_search) [DBG_LOOKUP]: Print descrh decription. * sm/keylist.c (list_cert_std): Flush FP in debug mode to better syncronize the output with the debug output -- Signed-off-by: Werner Koch <[email protected]>
2019-03-14kbx: Unify the fingerprint search modes.Werner Koch1-2/+0
* kbx/keybox-search-desc.h (KEYDB_SEARCH_MODE_FPR16) (KEYDB_SEARCH_MODE_FPR20, KEYDB_SEARCH_MODE_FPR32): Remove. Switch all users to KEYDB_SEARCH_MODE_FPR along with the fprlen value. -- These search modes were added over time and there has until recently be no incentive to remove the cruft. With the change for v5 keys I finally went over all places and allowed the generic fingerprint mode along with a given length of the fingerprint at all places. Consequently the other modes can now be removed. Signed-off-by: Werner Koch <[email protected]>
2019-03-01sm: Print Yubikey attestation extensions with --dump-cert.Werner Koch1-3/+37
* sm/keylist.c (oidtranstbl): Add Yubikey OIDs. (OID_FLAG_HEX): New. (print_hex_extn): New. (list_cert_raw): Make use of that flag. Signed-off-by: Werner Koch <[email protected]>
2019-02-28sm: Don't mark a cert as de-vs compliant if it leads to SHA-1 sigs.Werner Koch1-4/+9
* sm/keylist.c (print_compliance_flags): Also check the diges_also. -- A certificate with algorithm sha1WithRSAEncryption can be de-vs compliant (e.g. if the next in the chain used sha256WithRSAEncryption to sign it and RSA is long enough) but flagging it as such is useless because that certificate can't be used because it will create signatures using the non-compliant SHA-1 algorithm. Well, it could be used for encryption. But also evaluating the key-usage flags here would make it harder for the user to understand why certain certificates are listed as de-vs compliant and others are not. Signed-off-by: Werner Koch <[email protected]>
2017-10-19sm: Fix colon listing of fields > 12 in crt records.Werner Koch1-2/+1
* sm/keylist.c (print_capabilities): Move colon printing ... (list_cert_colon): to here. -- Fixes-commit: 7af008bfe1641938a6c2c995cb065829fa05a693 Signed-off-by: Werner Koch <[email protected]>
2017-10-17gpg,sm: New option --with-key-screening.Werner Koch1-3/+48
* common/pkscreening.c: New. * common/pkscreening.h: New. * common/Makefile.am (common_sources): Add them. * g10/gpg.c (opts): New option --with-key-screening. * g10/options.h (struct opt): New field with_key_screening. * g10/keylist.c: Include pkscreening.h. (print_pk_screening): New. (list_keyblock_print): Call it. (print_compliance_flags): Call it. * sm/gpgsm.c (opts): New option --with-key-screening. * sm/gpgsm.h (scruct opt): New field with_key_screening. * sm/keylist.c: Include pkscreening.h. (print_pk_screening): New. (print_compliance_flags): Call it. Add new arg cert. (list_cert_colon): Pass arg cert (list_cert_std): Call print_pk_screening. * sm/fingerprint.c (gpgsm_get_rsa_modulus): New. -- This new option can be used to detect ROCA affected keys. To scan an entire keyring and print the affected fingerprints use this: gpg -k --with-key-screening --with-colons | gawk -F: \ '$1~/pub|sub|sec|ssb|crt/ && $18~/\<6001\>/ {found=1;next}; $1=="fpr" && found {print $10}; {found=0}' The same works for gpgsm. Note that we need gawk due to the "\<" in the r.e. Signed-off-by: Werner Koch <[email protected]>
2017-10-17sm: Fix colon listing of fields > 12 in crt records.Werner Koch1-2/+1
* sm/keylist.c (print_capabilities): Move colon printing ... (list_cert_colon): to here. -- Fixes-commit: 7af008bfe1641938a6c2c995cb065829fa05a693 Signed-off-by: Werner Koch <[email protected]>
2017-08-08sm: Always print the keygrip in colon mode.Werner Koch1-7/+7
* sm/keylist.c (list_cert_colon): Always print the keygrip as described in the manual. Signed-off-by: Werner Koch <[email protected]>
2017-06-01gpg,common: Move the compliance framework.Justus Winter1-2/+3
* common/Makefile.am (common_sources): Add new files. * common/compliance.c: New file. Move 'gnupg_pk_is_compliant' here, and tweak it to not rely on types private to gpg. * common/compliance.h: New file. Move the compliance enum here. * g10/keylist.c (print_compliance_flags): Adapt callsite. * g10/main.h (gnupg_pk_is_compliant): Remove prototype. * g10/misc.c (gnupg_pk_is_compliant): Remove function. * g10/options.h (opt): Use the new compliance enum. * sm/keylist.c (print_compliance_flags): Use the common functions. Signed-off-by: Justus Winter <[email protected]>
2017-04-28Spelling fixes in docs and comments.NIIBE Yutaka1-1/+1
-- In addition, fix trailing spaces in tests/inittests. GnuPG-bug-id: 3121 Reported-by: ka7 (klemens) Signed-off-by: NIIBE Yutaka <[email protected]>
2017-03-20gpg: Add new field no 18 to the colon listing.Werner Koch1-3/+15
* g10/misc.c (gnupg_pk_is_compliant): New. * g10/keylist.c (print_compliance_flags): New. (list_keyblock_colon): Call it here. * sm/keylist.c (print_compliance_flags): New. (list_cert_colon): Call it here. -- This patch is to convey information about DE_VS compliant keys to the caller. The double digit value is used so that parsers do the right thing and don't just look for a single digit. Signed-off-by: Werner Koch <[email protected]>
2017-03-07Remove -I option to common.NIIBE Yutaka1-2/+2
* dirmngr/Makefile.am (AM_CPPFLAGS): Remove -I$(top_srcdir)/common. * g10/Makefile.am (AM_CPPFLAGS): Ditto. * g13/Makefile.am (AM_CPPFLAGS): Ditto. * kbx/Makefile.am (AM_CPPFLAGS): Ditto. * scd/Makefile.am (AM_CPPFLAGS): Ditto. * sm/Makefile.am (AM_CPPFLAGS): Ditto. * tools/Makefile.am (AM_CPPFLAGS): Ditto. * Throughout: Follow the change. Signed-off-by: NIIBE Yutaka <[email protected]>
2017-02-21Clean up word replication.Yuri Chornoivan1-1/+1
-- This fixes extra word repetitions (like "the the" or "is is") in the code and docs. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2016-11-10gpg,sm: Add STATUS_ERROR keydb_search and keydb_add-resource.Werner Koch1-4/+3
* g10/keydb.c (keydb_add_resource): Make ANY_REGISTERED file-global. Write a STATUS_ERROR. (maybe_create_keyring_or_box): Check for non-accessible but existant file. (keydb_search): Write a STATUS_ERROR if no keyring has been registered but continue to return NOT_FOUND. * sm/keydb.c (keydb_add_resource): Rename ANY_PUBLIC to ANY_REGISTERED and make file-global. Write a STATUS_ERROR. (keydb_search): Write a STATUS_ERROR if no keyring has been registered but continue to return NOT_FOUND. Also add new arg CTRL and change all callers to pass it down. Signed-off-by: Werner Koch <[email protected]>
2016-11-10sm: Remove unused arg SECRET from keydb functions.Werner Koch1-1/+1
* sm/keydb.c (struct resource_item): Remove field 'secret'. (keydb_add_resource): Remove arg 'secret' and change all callers. (keydb_new): Ditto. Signed-off-by: Werner Koch <[email protected]>
2016-11-05Change all http://www.gnu.org in license notices to https://Werner Koch1-1/+1
--
2016-08-01gpgsm: Fix machine-readable key listing.Justus Winter1-1/+0
* sm/keylist.c (list_cert_colon): Drop superfluous colon. GnuPG-bug-id: 2432 Signed-off-by: Justus Winter <[email protected]>
2014-06-03Add new option --with-secret.Werner Koch1-5/+9
* g10/gpg.c: Add option --with-secret. * g10/options.h (struct opt): Add field with_secret. * g10/keylist.c (public_key_list): Pass opt.with_secret to list_all and list_one. (list_all, list_one): Add arg mark_secret. (list_keyblock_colon): Add arg has_secret. * sm/gpgsm.c: Add option --with-secret. * sm/server.c (option_handler): Add option "with-secret". * sm/gpgsm.h (server_control_s): Add field with_secret. * sm/keylist.c (list_cert_colon): Take care of with_secret. Also move the token string from the wrong field 14 to 15. -- This option is useful for key managers which need to know whether a key has a secret key. This change allows to collect this information in one pass.
2012-06-05Change all quotes in strings and comments to the new GNU standard.Werner Koch1-1/+1
The asymmetric quotes used by GNU in the past (`...') don't render nicely on modern systems. We now use two \x27 characters ('...'). The proper solution would be to use the correct Unicode symmetric quotes here. However this has the disadvantage that the system requires Unicode support. We don't want that today. If Unicode is available a generated po file can be used to output proper quotes. A simple sed script like the one used for en@quote is sufficient to change them. The changes have been done by applying sed -i "s/\`\([^'\`]*\)'/'\1'/g" to most files and fixing obvious problems by hand. The msgid strings in the po files were fixed with a similar command.
2011-12-07gpgsm: Add new validation model "steed".Werner Koch1-9/+19
* sm/gpgsm.h (VALIDATE_FLAG_STEED): New. * sm/gpgsm.c (gpgsm_parse_validation_model): Add model "steed". * sm/server.c (option_handler): Allow validation model "steed". * sm/certlist.c (gpgsm_cert_has_well_known_private_key): New. * sm/certchain.c (do_validate_chain): Handle the well-known-private-key attribute. Support the "steed" model. (gpgsm_validate_chain): Ditto. * sm/verify.c (gpgsm_verify): Return "steed" in the trust status line. * sm/keylist.c (list_cert_colon): Print the new 'w' flag. -- This is the first part of changes to implement the STEED proposal as described at http://g10code.com/steed.html . The idea for X.509 is not to use plain self-signed certificates but certificates signed by a dummy CA (i.e. one for which the private key is known). Having a single CA as an indication for the use of STEED might help other X.509 implementations to implement STEED.
2011-12-06gpgsm: Allow arbitrary extensions for cert creation.Werner Koch1-0/+1
* sm/certreqgen.c (pSUBJKEYID, pEXTENSION): New. (read_parameters): Add new keywords. (proc_parameters): Check values of new keywords. (create_request): Add SubjectKeyId and extensions. (parse_parameter_usage): Support "cert" and the encrypt alias "encr".
2011-04-25Fix regression in gpg's mail address parsing.Werner Koch1-1/+1
Since 2009-12-08 gpg was not able to find email addresses indicated by a leading '<'. This happened when I merged the user id classification code of gpgsm and gpg.
2011-03-01Support X.509 certificate creation.Werner Koch1-0/+1
Using "gpgsm --genkey" allows the creation of a self-signed certificate via a new prompt. Using "gpgsm --genkey --batch" should allow the creation of arbitrary certificates controlled by a parameter file. An example parameter file is Key-Type: RSA Key-Length: 1024 Key-Grip: 2C50DC6101C10C9C643E315FE3EADCCBC24F4BEA Key-Usage: sign, encrypt Serial: random Name-DN: CN=some test key Name-Email: [email protected] Name-Email: [email protected] Hash-Algo: SHA384 not-after: 2038-01-16 12:44 This creates a self-signed X.509 certificate using the key given by the keygrip and using SHA-384 as hash algorithm. The keyword signing-key can be used to sign the certificate with a different key. See sm/certreggen.c for details.
2011-02-04Nuked almost all trailing white space.post-nuke-of-trailing-wsWerner Koch1-66/+66
We better do this once and for all instead of cluttering all future commits with diffs of trailing white spaces. In the majority of cases blank or single lines are affected and thus this change won't disturb a git blame too much. For future commits the pre-commit scripts checks that this won't happen again.
2010-10-08Add new option --with-keygripWerner Koch1-0/+10
2010-02-02Various changes to eventually support openpgp keys in pgp-agent.Werner Koch1-1/+1
Comment fixes. Minor chnages in preparation of a W32CE port.
2009-12-08Unification of the search descriptor usage.Werner Koch1-1/+1
2009-07-292009-07-29 Marcus Brinkmann <[email protected]>Marcus Brinkmann1-0/+2
* keylist.c (print_capabilities): Print a trailing colon.
2009-04-02Print the card's S/N in a secret key listing.Werner Koch1-1/+9
2009-03-25Print NO_SECKEY status line in gpgsm.Werner Koch1-2/+2
This fixes bug#1020.
2009-03-20Fix keygrip computation for TCOS 3 cards.Werner Koch1-0/+1
Emit PROGRESS status lines during --learn-card.
2009-03-18Add server option with-ephemeral-keys.Werner Koch1-1/+1
Extend SCD LEARN command.
2009-03-06New gpg-agent command to list key information.Werner Koch1-3/+38
Gpgsm does now print the S/N of cards. Consider ephemeral keys during listing an export.
2009-01-12Minor fixesWerner Koch1-1/+1
2008-10-21Help dirmngr to use supplied trust anchors.Werner Koch1-1/+1
2008-10-20Marked all unused args on non-W32 platforms.Werner Koch1-0/+6
2008-08-13Print a 'f' for validated non-root certificates in gpgsm colon style listing.Werner Koch1-0/+2
Doc fixes.
2008-06-26Minor fixes.Werner Koch1-2/+2
2008-06-26Start support of TCOS 3 cards.Werner Koch1-15/+107
Support restriction attribute. Fix utf-8 printing problems. Use AES by default.
2008-05-06Fixed bug#907.Werner Koch1-0/+3
Fixed a segv in keybox and made it more robust.
2008-03-13Fixed an email/DN bug.Werner Koch1-2/+2
Changed pinentry prompts.
2008-02-13Always search missing certifcates using a running Dirmngr's cache.Werner Koch1-3/+3
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-13 18:28:09 +0000