aboutsummaryrefslogtreecommitdiffstats
path: root/sm (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-04-21keyboxd: Fix searching for exact mail addresses.Werner Koch1-1/+2
* kbx/kbxserver.c (cmd_search): Use the openpgp hack for calling classify_user_id. * kbx/backend-sqlite.c (run_select_statement): Remove angle brackets in exact addrspec mode. * g10/call-keyboxd.c (keydb_search): Do not duplicate the left angle bracket. * sm/keydb.c (keydb_search): Ditto. -- Note that the openpgp hack flag of classify_user_id is actually a misnomer because we actually hack a round a problem in gpgsm. And it is only over there that we don't set it there. In keyboxd the flag should be set. And we need to remove the angle brackets of course because that is how we create the addrspec column values. Signed-off-by: Werner Koch <[email protected]>
2021-04-21gpg,sm: Ignore the log-file option from common.conf.Werner Koch1-8/+1
* g10/gpg.c (main): Don't use the default log file from common.conf. * sm/gpgsm.c (main): Ditto. -- That was acutally not intended and contradicts the description in doc/example/common.conf. Signed-off-by: Werner Koch <[email protected]>
2021-04-20sm: New command --show-certsWerner Koch3-0/+109
* sm/keylist.c (do_show_certs): New. (gpgsm_show_certs): New. * sm/gpgsm.c (aShowCerts): New. (opts): Add --show-certs. (main): Call gpgsm_show_certs. -- I have been using libksba test programs for countless times to look at certificates and I always wanted to add such a feature to gpgsm. This is simply much more convenient. Signed-off-by: Werner Koch <[email protected]>
2021-04-19build: Fix build problems on macOS for gpgsm tests and gpg-card.Werner Koch1-1/+1
* tools/gpg-card.c: Include ctype.h. * sm/Makefile.am (t_common_ldadd): Add LIBICONV. -- GnuPG-bug-id: 5400 Signed-off-by: Werner Koch <[email protected]>
2021-04-19gpg,gpgsm: Move use-keyboxd to the new conf file common.confWerner Koch1-2/+32
* common/comopt.c, common/comopt.h: New. * common/Makefile.am: Add them. * g10/gpg.c: Include comopt.h. (main): Also parse common.conf. * sm/gpgsm.c: Include comopt.h. (main): Set a flag for the --no-logfile option. Parse common.conf. * tools/gpgconf-comp.c (known_options_gpg): Remove "use-keyboxd", add pseudo option "use_keyboxd". (known_pseudo_options_gpg): Add pseudo option "use_keyboxd". (known_options_gpgsm): Remove "use-keyboxd". * tests/openpgp/defs.scm (create-gpghome): Create common.conf. * doc/examples/common.conf: New. -- Note that --use-keybox still works but prints a warning. We will eventually remove this option becuase it was marked as an experimental feature anyway. It would be too confusing if gpg and gpgsm use different key storages. Further, other components (e.g. dirmngr or gpg-wks-client) which call gpg or gpgsm need to be aware that the keyboxd is used and pass that option on the command line. Now that common.conf is always read (even if --no-options is used) those tools will work instantly.
2021-03-24sm: Add a few more OIDs to the table for nicer keylistingsWerner Koch1-0/+4
--
2021-03-08sm: Init nPth which might be used by some helper code.Werner Koch1-2/+11
* sm/gpgsm.c: Include npth.h. (main): Init nPth. -- Actually we currently do not use extra threads but we need to link to the npth version of the common functions because there is an option to use threads. Now, without initialized npth, we could experience a crash in gnupg_sleep, which uses npth_usleep in the npth based common functions. Fixes-commit: 046f419f806036248c058c4bd44368f8596287b7
2021-02-25sm: Do not print certain issuer not found diags in quiet mode.Werner Koch2-21/+28
* sm/certchain.c (find_up_dirmngr): Print one diagnostic only in verbose mode. Do not print issuer not found diags in quiet mode. * sm/minip12.c (parse_bag_data): Add missing verbose condition. -- GnuPG-bug-id: 4757
2021-02-25sm: Fix issuer certificate look error due to legacy error code.Werner Koch1-65/+69
* sm/certchain.c (find_up): Get rid of the legacy return code -1 and chnage var name rc to err. (gpgsm_walk_cert_chain): Change var name rc to err. (do_validate_chain): Get rid of the legacy return code -1. -- This was detected while fixing GnuPG-bug-id: 4757
2021-02-24sm: Silence some output on --quietWerner Koch5-7/+29
* sm/encrypt.c (gpgsm_encrypt): Take care of --quiet. * sm/gpgsm.c: Include minip12.h. (set_debug): Call p12_set_verbosity. * sm/import.c (parse_p12): Dump keygrip only in debug mode. * sm/minip12.c (opt_verbose, p12_set_verbosity): New. (parse_bag_encrypted_data): Print info messages only in verbose mode. -- GnuPG-bug-id: 4757
2021-02-22sm: Extend the list of known OIDs.Werner Koch1-4/+16
* sm/keylist.c (oidtranstbl): Add a couple of OIDs and mark them for key usage.
2021-02-10Require GpgRT version 1.41.Werner Koch1-5/+0
* configure.ac (NEED_GPG_ERROR_VERSION): Rename to NEED_GPGRT_VERSION and set to 1.41. * common/sysutils.c (gnupg_access): Remove code for older gpgrt versions. * kbx/backend-sqlite.c: Ditto. * sm/gpgsm.c (main): Ditto. -- We already have a requirement for a newer Libgcrypt and thus we can also require a more recent libgpgrt (aka libgpg-error) which was released before Libgcrypt.
2021-02-01sm: Add a few OIDs and merge OID tables.Werner Koch1-52/+44
* sm/keylist.c (OID_FLAG_KP): New. (key_purpose_map): Merge into ... (oidtranstbl): this. (get_oid_desc): New arg 'matchflag'. Use function in place of direct access to key_purpose_map. Signed-off-by: Werner Koch <[email protected]>
2021-01-28Include the library version in the compliance checks.Werner Koch3-2/+3
* common/compliance.c (gnupg_gcrypt_is_compliant): New. (gnupg_rng_is_compliant): Also check library version. * g10/mainproc.c (proc_encrypted): Use new function. (check_sig_and_print): Ditto. * sm/decrypt.c (gpgsm_decrypt): Ditto. * sm/encrypt.c (gpgsm_encrypt): Ditto. * sm/verify.c (gpgsm_verify): Ditto -- This will eventually allow us to declare Libgcrypt 1.9 to be de-vs compliant. GnuPG can use this information then for its own checks. As of now GnuPG tests the version of the used library but that is a bit cumbersome to maintain. Signed-off-by: Werner Koch <[email protected]>
2021-01-19Require Libgcrypt 1.9Werner Koch1-11/+0
* configure.ac: Require at least Libgcrypt 1.9.0. Remove all GCRYPT_VERSION_NUMBER dependent code. -- Only Libgcrypt 1.9 implements EAX which is a mandatory algorithm in RFC4880bis. Signed-off-by: Werner Koch <[email protected]>
2020-11-04common: Fix duplicate implementation of try_make_homedir.Werner Koch1-24/+1
* g10/openfile.c (try_make_homedir): Move core of the code to ... * common/homedir.c (gnupg_maybe_make_homedir): new. * sm/keydb.c (try_make_homedir): Implement using new function. * common/homedir.c: Include i18n.h. * po/POTFILES.in: Add common/homedir.c. Signed-off-by: Werner Koch <[email protected]>
2020-10-26g10,sm: Use gnupg_access at two more placesWerner Koch1-1/+1
--
2020-10-20Replace most calls to open by a new wrapper.Werner Koch1-1/+1
* common/sysutils.c (any8bitchar) [W32]: New. (gnupg_open): New. Replace most calls to open by this. * common/iobuf.c (any8bitchar) [W32]: New. (direct_open) [W32]: Use CreateFileW if needed. -- This is yet another step for full Unicode support on Windows. GnuPG-bug-id: 5098
2020-10-20Replace most of the remaining stdio calls by estream calls.Werner Koch3-26/+28
-- We need to use es_fopen on Windows to cope with non-ascii file names. This is quite a large but fortunately straightforward change. At a very few places we keep using stdio (for example due to the use of popen). GnuPG-bug-id: 5098 Signed-off-by: Werner Koch <[email protected]>
2020-10-20Replace all calls to access by gnupg_accessWerner Koch2-5/+6
* common/sysutils.c (gnupg_access): New. Replace all calls to access by this wrapper. * common/homedir.c (w32_shgetfolderpath): Change to return UTF-8 directory name. (standard_homedir): Adjust for change. (w32_commondir, gnupg_cachedir): Ditto. -- Also use SHGetFolderPathW instead of SHGetFolderPathA on Windows. This is required to correctly handle non-ascii filenames on Windows. GnuPG-bug-id: 5098
2020-10-05gpgsm: Fix detection of too old keyboxd.Werner Koch1-3/+4
* sm/keydb.c (warn_version_mismatch): Add arg ctrl and pass on. (create_new_context): Pass ctrl to warn function.
2020-09-22sm: Fix returning of the ephemeral flag in keyboxd mode.Werner Koch1-6/+8
* sm/keydb.c (search_status_cb): Skip over the ubid.
2020-09-21sm: Implement delete key in keyboxd modeWerner Koch2-5/+29
* sm/keydb.c (keydb_delete): Implement keyboxd mode. (keydb_update_cert): Disable unused function. * kbx/backend-sqlite.c (be_sqlite_delete): Delete from issuer. -- Signed-off-by: Werner Koch <[email protected]>
2020-09-10sm: Implement initial support for keyboxd.Werner Koch10-91/+382
* sm/gpgsm.h (MAX_FINGERPRINT_LEN): New. * sm/keydb.c (struct keydb_local_s): Change definition of search_result. (keydb_get_cert): Implement keyboxd mode. (keydb_get_flags): Temporary hack for keyboxd mode. Needs to be fixed. (struct store_parm_s, store_inq_cb): New. (keydb_insert_cert): Implement keyboxd mode. (keydb_locate_writable): Make static. (keydb_search_reset): Implement keyboxd mode. (search_status_cb): New. (keydb_search): Implement keyboxd mode. Replace return code -1 by GPG_ERR_NOT_FOUND. (keydb_set_cert_flags): Replace return code -1 by GPG_ERR_NOT_FOUND. * sm/keylist.c (list_cert_colon): Adjust for replacement of -1 by GPG_ERR_NOT_FOUND. (list_internal_keys): Ditto. * sm/sign.c (add_certificate_list): Ditto. * sm/certchain.c (find_up_search_by_keyid): Ditto. (find_up_external, find_up, find_up_dirmngr): Ditto. (gpgsm_walk_cert_chain): Ditto. (get_regtp_ca_info): Ditto. * sm/certlist.c (gpgsm_add_to_certlist): Ditto. (gpgsm_find_cert): Ditto. * sm/delete.c (delete_one): Ditto. * sm/export.c (gpgsm_export): Ditto. (gpgsm_p12_export): Ditto. * sm/import.c (gpgsm_import_files): Ditto. -- Note that keyboxd is not yet able to handle the ephemeral flag. This needs fixing here and in keyboxd. Delete et al. is also not yet implemented. A basic key listing works, though. Signed-off-by: Werner Koch <[email protected]>
2020-09-10keyboxd: Use D-lines instead of a separate thread.Werner Koch1-1/+1
* kbx/kbx-client-util.c (kbx_client_data_new): Add arg 'dlines'. * g10/call-keyboxd.c (open_context): Set DLINES to true. * sm/keydb.c (open_context): Ditto. -- This allows to compile time switch between the D-line and the fd-passing data communication between gpg/gpgsm and keyboxd. A quick test with about 3000 OpenPGP keys showed that D-lines are only 10% slower than the fd-passing based implementation. Given that the thread adds extra complexity we go for now with the D-line approach. Signed-off-by: Werner Koch <[email protected]>
2020-09-09kbx: Change X.509 S/N search definition.Werner Koch1-8/+4
* kbx/keybox-search-desc.h (struct keydb_search_desc): Do not overload SNLLEN with a hex flag. Add SNHEX. * kbx/keybox-search.c (keybox_search): Adjust. * common/userids.c (classify_user_id): Adjust. * sm/keydb.c (keydb_search_desc_dump): Adjust. * g10/keydb.c (keydb_search_desc_dump): Adjust. Signed-off-by: Werner Koch <[email protected]>
2020-09-03sm: New options to prepare the use of keyboxd.Werner Koch6-81/+423
* sm/Makefile.am (AM_CFLAGS): Add npth flags. (common_libs): Use npth version of the lib. (gpgsm_LDADD): Add npth libs. * sm/gpgsm.c (oUseKeyboxd, oKeyboxdProgram): New. (opts): New options --use-keyboxd and --keyboxd-program. (main): Set them. (gpgsm_deinit_default_ctrl): New. (main): Call it. * sm/server.c (gpgsm_server): Ditto. * sm/gpgsm.h (opt): Add fields use_keyboxd and keyboxd_program. (keydb_local_s): New type. (struct server_control_s): Add field keybd_local. * sm/keydb.c: Include assuan.h, asshelp.h, and kbx-client-util.h. (struct keydb_local_s): New. (struct keydb_handle): Add fields for keyboxd use. (gpgsm_keydb_deinit_session_data): New. (warn_version_mismatch): New. (create_new_context): New. (open_context): New. (keydb_new): Implement keyboxd mode. (keydb_release): Ditto. (keydb_get_resource_name): Ditto. * sm/keydb.c: Add stub support for all other functions. Signed-off-by: Werner Koch <[email protected]>
2020-09-03sm: Add arg ctrl to keydb_new.Werner Koch13-22/+24
* sm/keydb.c (keydb_new): Add arg and change all callers. -- This will be used later.
2020-09-01Use only one copy of the warn_server_mismatch function.Werner Koch2-67/+6
* common/asshelp.c (warn_server_version_mismatch): New. Actually a slightly modified version of warn_version_mismatch found in other modules. * common/status.c (gnupg_status_strings): New. * g10/cpr.c (write_status_strings2): New. * g10/call-agent.c (warn_version_mismatch): Use the new unified warn_server_version_mismatch function. * g10/call-dirmngr.c (warn_version_mismatch): Ditto. * g10/call-keyboxd.c (warn_version_mismatch): Ditto. * sm/call-agent.c (warn_version_mismatch): Ditto. * sm/call-dirmngr.c (warn_version_mismatch): Ditto. * tools/card-call-scd.c (warn_version_mismatch): Ditto. Signed-off-by: Werner Koch <[email protected]>
2020-08-28sm: Fix a bug in the rfc2253 parserWerner Koch1-1/+1
* sm/certdump.c (parse_dn_part): Fix parser flaw. -- This could in theory result in reading bytes after a after Nul in a string and thus possible segv on unallocated memory or reading other parts of the memory. However, it is harmless because the rfc2253 strings have been constructed by libksba. GnuPG-bug-id: 5037 Signed-off-by: Werner Koch <[email protected]>
2020-08-25sm: Do not require a default keyring for --gpgconf-list.Werner Koch1-0/+1
* sm/gpgsm.c (main): No default keyring for gpgconf mode. -- GnuPG-bug-id: 4867 Signed-off-by: Werner Koch <[email protected]>
2020-08-20build: New configure option --disable-testsWerner Koch1-0/+4
* configure.ac: Add option --disable-tests. Print warnings in the summary. (DISABLE_TESTS): New am_conditional. -- GnuPG-bug-id: 4960
2020-08-19gpg,gpgsm: Record the creation time of a private key.Werner Koch1-3/+11
* sm/call-agent.c (gpgsm_agent_genkey): Pass --timestamp option. (gpgsm_agent_import_key): Ditto. * g10/call-agent.c (agent_genkey): Add arg timestamp and pass it on. (agent_import_key): Ditto. * g10/import.c (transfer_secret_keys): Pass the creation date to the agent. * g10/keygen.c (common_gen): Ditto. -- Having the creation time in the private key file makes it a lot easier to re-create an OpenPGP public keyblock in case it was accidentally lost. Signed-off-by: Werner Koch <[email protected]>
2020-08-19Silence compiler warnings.NIIBE Yutaka1-1/+1
* common/openpgp-oid.c (map_openpgp_pk_to_gcry): Use cast for enum conversion. * dirmngr/dns-stuff.c (get_dns_srv): Use explicit conversion from int to float. * sm/gpgsm.c (parse_keyserver_line): Initialize ERR. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-08-14Add --chuid to gpg, gpg-card, and gpg-connect-agent.Werner Koch1-6/+10
* g10/gpg.c (oChUid): New. (opts): Add --chuid. (main): Implement --chuid. Delay setting of homedir until the new chuid is done. * sm/gpgsm.c (main): Delay setting of homedir until the new chuid is done. * tools/gpg-card.c (oChUid): New. (opts): Add --chuid. (changeuser): New helper var. (main): Implement --chuid. * tools/gpg-connect-agent.c (oChUid): New. (opts): Add --chuid. (main): Implement --chuid. -- Signed-off-by: Werner Koch <[email protected]>
2020-08-06gpgsm: New option --chuid.Werner Koch1-1/+12
* sm/gpgsm.c (oChUid, opts): New option --chuid. (main): Implement option. -- This option will at least be useful for Scute. Signed-off-by: Werner Koch <[email protected]>
2020-08-04sm: Also show the SHA-256 fingerprint.Werner Koch1-1/+13
* sm/keylist.c (list_cert_colon): Emit a new "fp2" record. (list_cert_raw): Print the SHA2 fingerprint. (list_cert_std): Ditto. Signed-off-by: Werner Koch <[email protected]>
2020-07-30w32: Add NETLIBS for sm/t-minip12.NIIBE Yutaka1-1/+1
* sm/Makefile.am (t_minip12_LDADD): Add NETLIBS. -- GnuPG-bug-id: 4944 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-07-30w32: Add link to $(NETLIB) for -lws2_32.NIIBE Yutaka1-1/+1
* dirmngr/Makefile.am (dirmngr_LDADD): Add $(NETLIBS). * sm/Makefile.am (gpgsm_LDADD): Ditto. * tools/Makefile.am (gpg_wks_client_LDADD): Ditto. -- GnuPG-bug-id: 4994 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-07-08Do not use the pinentry's qualitybarWerner Koch1-1/+1
* agent/genkey.c (agent_ask_new_passphrase): No qualitybar. * g10/call-agent.c (agent_get_passphrase): Ditto. * sm/call-agent.c (gpgsm_agent_ask_passphrase): Ditto. -- The concept of a passphrase quality indicator is anyway questionable because user are smart enough to trick them out and they also tend to limit the actually used entropy. Except for the red/green switching (to show whether constraints are fulfilled) our qualitybar is pretty bad and thus worse than none. Signed-off-by: Werner Koch <[email protected]>
2020-07-08gpgsm: Replace all assert calls by log_assert.Werner Koch19-44/+29
-- Signed-off-by: Werner Koch <[email protected]>
2020-07-03sm: Exclude rsaPSS from de-vs compliance mode.Werner Koch8-76/+145
* common/compliance.h (PK_ALGO_FLAG_RSAPSS): New. * common/compliance.c (gnupg_pk_is_compliant): Add arg alog_flags and test rsaPSS. Adjust all callers. (gnupg_pk_is_allowed): Ditto. * sm/misc.c (gpgsm_ksba_cms_get_sig_val): New wrapper function. (gpgsm_get_hash_algo_from_sigval): New. * sm/certcheck.c (gpgsm_check_cms_signature): Change type of sigval arg. Add arg pkalgoflags. Use the PK_ALGO_FLAG_RSAPSS. * sm/verify.c (gpgsm_verify): Use the new wrapper and new fucntion to also get the algo flags. Pass algo flags along. Signed-off-by: Werner Koch <[email protected]>
2020-06-29sm: Fix regression in Friday's commitWerner Koch1-2/+2
* sm/gpgsm.c (main): Set ERR also for encrypt. -- Fixes-commit: ccbb0cfeefed096a9841b6557d10eef12d55b721 Signed-off-by: Werner Koch <[email protected]>
2020-06-26sm: Try not to output a partial new message after an error.Werner Koch1-2/+19
* sm/gpgsm.c (main) <aSign,aEncr>: Uses gpgrt_fcancel on error. -- When creating a signature or encrypting and the respective key is not available or the user canceled the PIN entry gpgsm prints the initial part of the message due to internal buffering in gpgrt. By using gpgrt_fcancel we can avoid this at least as long as the data is less than the standard buffer size (which is currently 8k). If is not a complete solution but the best we can do easily. Outputting to the tty is anyway more of a testing aid than for real use. This makes use of the new gpgrt_fcancel API. Signed-off-by: Werner Koch <[email protected]>
2020-06-26sm: Print the serial number of a cert also in decimal.Werner Koch3-3/+89
* sm/certdump.c: Include membuf.h. (gpgsm_print_serial_decimal): New. * sm/keylist.c (list_cert_raw): Print s/n also in decimal (list_cert_std): Ditto. -- Many CA's print the serial number in decimal on their cards. Signed-off-by: Werner Koch <[email protected]>
2020-06-25sm: Fix support verification of nistp521 signatures.Werner Koch1-1/+1
* sm/certcheck.c (do_encode_md): Fix obvious bug. -- Fixes-commit: 596212e71abf33b30608348b782c093dace83110 Signed-off-by: Werner Koch <[email protected]>
2020-06-17sm: Support verification of nistp521 signatures.Werner Koch1-5/+8
* sm/certcheck.c (do_encode_md): Take care of nistp521. -- That curve is a bit odd in that it does not match a common hash digest length. We fix that here for just this case instead of writing more general code to support all allowed cases (i.e. hash shorter than Q). Signed-off-by: Werner Koch <[email protected]>
2020-06-03sm: Fix recently introduced regression in CSR creation.Werner Koch1-1/+5
* sm/certreqgen.c (create_request): Also set SIGKEYLEN. -- Fixes-commit: 44676819f2873705b78849e7b2fd22214b691642 Signed-off-by: Werner Koch <[email protected]>
2020-05-19sm: Create ECC certificates with AKI and SKI by default.Werner Koch1-31/+127
* sm/certreqgen.c (create_request): Create AKI and SKI by default. -- GnuPG-bug-id: 4098 Signed-off-by: Werner Koch <[email protected]>
2020-05-18sm: Support creation of EdDSA certificates.Werner Koch4-63/+183
* sm/misc.c (transform_sigval): Support EdDSA. * sm/certreqgen.c (create_request): Support EdDSA cert creation. * sm/certcheck.c (gpgsm_check_cert_sig): Map some ECC algo OIDs to hash algos. * sm/call-agent.c (struct sethash_inq_parm_s): New. (sethash_inq_cb): New. (gpgsm_agent_pksign): Add mode to pass plain data for EdDSA. -- Tested using a parameter file Key-Type: EdDSA Key-Length: 1024 Key-Grip: 09D9AE3D494F7888C93BE5106AD8A734A87617F0 Key-Usage: sign Serial: random Name-DN: CN=dummy test ed25519 where the keygrip is from a gpg generated Ed25519 key. ECDSA was tested using Key-Type: ECDSA Key-Length: 1024 Key-Grip: 8E06A180EFFE4C65B812150CAF19BF30C0689A4C Key-Usage: sign Serial: random Name-DN: CN=dummy test nistp256 and RSA using Key-Type: RSA Key-Length: 2048 Key-Grip: C6A6390E9388CDBAD71EAEA698233FE5E04F001E Key-Usage: sign Serial: random Name-DN: CN=dummy test rsa The command used in all cases is gpgsm -v --gen-key --batch a.parm >a.crt gpgsm -v --import <a.crt More support, in particular in the user interface, is required and will follow soon. GnuPG-bug-id: 4888 Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-22 12:21:26 +0000