* src/engine-gpgsm.c (gpgsm_verify): Fix handling both
plaintext and signed_text as NULL.
--
Previously if plaintext was NULL and signed_text was NULL
it would set MESSAGE_FD to NULL which resulted in a
crash.
Ignoring the plaintext of an opaque signature might
make sense in some cases and engine-gpg handles it.
* src/genkey.c (get_key_parameter): Provide a fallback ENDTAG.
--
It would actually be more correct to return an error in this case but
it is possible tha there are users who did not provide an endtag and
out of luck they also didn't trigger a segv.
GnuPG-bug-id: 4192
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/debug.c (_gpgme_debug_buffer): Bail out of BUF is NULL.
* src/genkey.c (gpgme_op_genkey): Do no deref a NULL in
TRACE_LOGBUF.
(gpgme_op_genkey_start): Ditto. Return an error if PARMS is NULL.
--
This robustness patch should solve one part of
GnuPG-bug-id: 4192
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/context.h (gpgme_context): Extend with trust_model.
* src/engine-gpg.c (engine_gpg): Extend with trust_model.
(gpg_set_engine_flags): Take trust_model from context.
(build_argv): Handle trust_model.
(gpg_release): Free trust_model.
* src/gpgme.c (gpgme_set_ctx_flag): Handle trust-model flag.
(gpgme_release): Release trust-model.
* doc/gpgme.texi: Document new flag for gpgme_set_ctx_flag.
(Context Flags): New subsection for the context flags.
* tests/run-keylist.c (show_usage, main): Add new --trust-model
parameter.
--
This gives a GPGME user fine grained control over the
trust-model.
Changing the trust model for only a single application depends
on:
GnuPG-Bug-Id: T4134
Maniphest Tasks: T4134
Differential Revision: https://dev.gnupg.org/D466
* src/keylist.c (gpgme_get_key): Move r_key init above
the first invalid value check.
--
This fixes the case where someone passes an unitialized
r_key and no fingerprint.
* configure.ac: Bump core LT version to C32/A21/R0. Bump C++ LT
version to C14/A8/R0.
* lang/qt/tests/Makefile.am (CLEANFILES): Add reader status files.
* Makefile.am (EXTRA_DIST): Add conf/whatisthis.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme.h.in: Obsolete "class" also for Python.
* lang/python/gpgme.i: Silenece a swig warning. Silence a gcc
warning.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (op_createkey): Remove subkey-algo param.
(GPG_AGENT_ALLOWS_KEYGEN_TRHOUGH_BROWSER): Fix typo.
* lang/js/src/Keyring.js: Remove subkey-algo support.
* lang/js/src/permittedOperations.js: Ditto.
--
We do not want to expose details of the protocol's key generation and
thus the subkey-algo does not make sense. Right now we support only
the default and future-default algorithms. A user can configure them
anyway using new-default-key-algo in gpg.conf. Eventually we may
officially support a more flexible way of creating special structured
OpenPGP keys but right now that is not part of the API.
Signed-off-by: Werner Koch <wk@gnupg.org>
* Egon Spengler was right, crossing the streams is bad.
* Restored both src/gpgme.def and src/libgpgme.vers to use the
estreams symbols without the leading underscore.
* The new_from_estream() function added to lang/python/src/core.py and
set to alias the new_from_stream() function remains.
* Opted for the solution favouring Linux onthree main grounds:
1. Andre reported major problems with Windows as well, so the number
of potentially affected systems would vastly increase.
2. All the BSDs and OS X have spent far more time and development
work in order to accommodate the eccentricities of both Microsoft
and the GNU Project (ref. GCC), so they're more likely to be able
to cope with doing so again than the other way around.
3. If I really have to I can write a custom installer for OS X to
try this and, if it fails, to then patch the two symbol entries and
recompile from scratch. That said, I may not have to since it
actually behaved during the most recent tests for this
commit; into ten separate CPython installations and all five
supported versions (standard source installs and OS X Framework
installs for each version).
Tested-by: Ben McGinnes <ben@adversary.org>
Signed-off-by: Ben McGinnes <ben@adversary.org>
* It turns out that even though some platforms detect differing
symbols for estreams, the two types do not appear to be in
conflict. At least they don't from the BSD/OS X side of things.
As a consequence both versions are now included.
Tested-by: Ben McGinnes <ben@adversary.org>
Signed-off-by: Ben McGinnes <ben@adversary.org>
* lang/python/src/core.py: Adjusted new_from_estream function to alias
new_from_stream instead of fd.
* fixed the _gpgme import errors introduced in commit
08cd34afb7 by changing the exported
functions/types to match the inner module where all the work is
done, rather than the outer one(s).
Tested-by: Ben McGinnes <ben@adversary.org>
Signed-off-by: Ben McGinnes <ben@adversary.org>
* src/gpgme-json.c (op_verify): Only create output and
use it for clearsigned and opaque signed.
--
Just passing output to gpgme_op_verify changes the behavior to
no longer do a verify of the signature.
* src/gpgme-json.c (op_delete): Delete primary key on
subkey gen error.
--
This can happen for example if the user cancels the
pinentry to unlock the primary key when adding the
subkey. To avoid an artifact of a pimary key without
an encryption capable subkey we delete the created
key and treat the whole operation as failed.
* src/gpgme-json.c (encode_and_chunk): Don't error on NULL
request.
--
This fixes the error that is passed when parthing the json
object failed and request would be NULL.
Instead of the JSON parser error it would otherwise report
that encode and chunk failed.
* src/gpgme-json.c (verify_result_to_json): Remove "file_name".
--
Having the file name in the verify result may lead developers to
assume that the file name is covered by the signature. This is not
the case and can easily be checked by hex-editing a signed message.
We better don't output it at all.
The same is true for the is_mime flag but that is anyway only an
advisory and I can't see damage from a faulty one.
Note that we keep file_name in gpgme's output for ABI stability and
because some tools want to display meta information even if they are
subject to tampering. This is similar to the non-encrypted subject in
mails.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (recipient_to_json, decrypt_result_to_json):
New.
(op_decrypt, hlp_decrypt): Update.
--
The op_decrypt as one of the first operations did not yet
match the current 1 <> 1 mapping of gpgme types to json
dictonaries.
info and dec_info are bad names but used for compatibility reasons.
* src/gpgme-json.c (op_createkey, hlp_createkey): Add subkey_algo
handling.
(hlp_createkey): Fix documentation of expiry.
--
Due to the funny quick-gen-key interface generating a key
with an explicit algo would result in bad defaults (only an SC key),
without a subkey.
This adds handling that should probably be in GnuPG proper to fix
the semantics of createkey by adding default subkey_algo handling.
* src/cJSON.c, src/gpgme-json.c (CALLOC_ONLY): New define
to change xmalloc / xtrymalloc to use calloc.
--
Some people consider malloc dangerous as it might allow an
information leak.
* src/gpgme-json.c (encode_and_chunk): Don't error out
if no chunksize is provided.
--
This fixes 82e4b900a9 which
caused every call without chunksize to error out.
* src/data.c (PROPERTY_TABLE_ALLOCATION_CHUNK): New.
(insert_into_property_table): Use it here. Clear all flags.
--
Fixes-commit: 085cdeddef
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/data.h (data_prop_t): New enum.
(struct gpgme_data): Add field propidx.
* src/data.c (property_t): New.
(property_table, property_table_size, property_table_lock): New.
(insert_into_property_table): New.
(remove_from_property_table): New.
(_gpgme_data_get_dserial): New.
(_gpgme_data_set_prop): New.
(_gpgme_data_get_prop): New.
(_gpgme_data_new): Connect new object to property_table.
(_gpgme_data_release): Remove from property_table.
(gpgme_data_read): With DATA_PROP_BLANKOUT set don't fill the buffer.
* src/data-mem.c (gpgme_data_release_and_get_mem): Likewise.
* src/decrypt.c (struct op_data): Add field plaintext_dserial.
(_gpgme_op_decrypt_init_result): Add arg plaintext and init new field.
(_gpgme_decrypt_status_handler): Set DATA_PROP_BLANKOUT on decryption
failure.
(_gpgme_decrypt_start): Pass PLAIN to the init function.
* src/decrypt-verify.c (decrypt_verify_start): Ditto.
* configure.ac: Check for stdint.h and bail out if uint64_t is not
available.
--
This is a best effort feature to not output plaintext after a
decryption failure (e.g. due to no or broken authenticated
encryption). It always work when using a memory object and reading it
after the decryption but it can't work reliable when the user is
reading from the data object while the decryption process is still
running.
This is quite a large change because the data objects and the context
objects are allowed to be owned by different threads. Thus a
synchronization is needed and we do this with a global table of all
data objects to which the context objects can do soft-linking via a
unique data object serial number.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (create_keylist_patterns): Use CNT as first arg for
xcalloc.
(process_request): s/strdup/xtrystrdup/.
--
calloc takes two arguments so to be able to detect integer overflow.
Thus if we switch from malloc to calloc we should utilize that.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme.h.in (gpgme_data_new_from_estream): New.
* src/data-estream.c: New.
* src/data.h (gpgme_data): New union member e_stream.
--
The estream functions (gpgrt_fopen et al.) are any waypart of the
required libgpg-error library and thus it makes sense to provide this
convenience interface.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (native_messaging_repl): Free request and
response after each loop.
--
If we only accept once request we should not loop. If we loop
we should do it properly.
* src/gpgme-json.c (native_messaging_repl): Ensure that the
request is NULL terminated.
--
This avoids potential memory leaks and access to unmapped memory
in case the request was not terminated.
Other request functions use es_read_line which gurantees NULL
termination.
* src/gpgme-json.c (encode_and_chunk): Try to always
return at least an error.
(process_request): Double check that it does not return NULL.
--
If process_request returns NULL the following strlen on it
would crash.
* src/gpgme-json.c (create_keylist_patterns): Reserve two
pointers more then linefeeds.
(create_keylist_patterns): Fix loop to count linebreaks.
(create_keylist_patterns): Use calloc for good measure.
--
This fixes crashes and memory corruption as cnt did not
match i.
* src/gpgme-json.c (process_request): Init res. Check for
json object before encode and chunk.
--
If json is invalid we can't read chunksize and would crash
in encode and chunk.
* src/cJSON.c: Add comments on the origin of the code.
(parse_string): Allocate an extra byte for safeness.
(cJSON_AddItemToArray): Allo ARRAY to be NULL.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/cJSON.c (parse_string): Correctly detect bad hex.
--
The call to parse_hex4 checks that only hex digits follow and in the
error case returns 0. However, by the time of the combined check for
an invalid value and the error PTR has already been set to the last
hex character and thus if the end-of-string or a quote character was
one of the bad hex digits the loop will miss the end of the string
which does not match with the simple buffer length allocation test at
the begin of the function.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (add_secret_fprs): New helper.
(op_export, hlp_export): Extend for with-sec fprs.
--
This is a request from Mailvelope, to import an export
they need the information for which keys from the export
a secret key is also available. For simplicity it is
much preferred to get this information in a single call
without the need to do and parse a keylisting additionally
in a second native-messaging call.
So we make it optional to include that info in the export.
* src/engine-gpg.c (engine_gpg): Add diagnostics member.
(gpg_release): Release diagnostics data.
(gpg_new): Set up logger-fd and diagnostics.
(gpg_getauditlog): New. Copy diagnostics to a user data.
(engine_ops): Add getauditlog.
* src/engine-gpgsm.c (gpgsm_getauditlog): Return not implemented
for GPGME_AUDITLOG_DIAG.
* src/getauditlog.c (getauditlog_start): Don't reset engine
for diagnostics.
* src/gpgme.h.in (GPGME_AUDITLOG_DIAG): New.
(GPGME_AUDITLOG_DEFAULT): New alias to 0.
* tests/run-decrypt.c (show_usage, main): Add --diagnostics.
* doc/gpgme.texi(Additional Logs): Document getauditlog.
--
This enables users of GPGME to get more verbose information
from gpg which can assist users in figuring out a problem
that was before hidden behind a generalized error like
"Decryption Failed".
For GPGSM it is not yet available as it is problematic to
get it properly in server mode and GPGSM already had the
original audit log mechanism in place.
GPGME_AUDITLOG_DEFAULT was added for a more explicit
documentation.
* src/gpgme-json.c (op_keylist, hlp_keylist): Add locate.
--
The same rationale for the KEYLIST_MODE_LOCATE in GPGME
also applies here. It makes the API a little less magic.
* src/gpgme-json.c (main): Add possibilty to set log file.
--
This is similar to how GPGME_DEBUG works. It takes ; on
Windows as seperator and : on linux. Followed by a file name.
For Linux it might make sense to use a different seperator
to allow setting a socket explicitly. But this is better
in line with the current GPGME_DEBUG behavior.
The change helps on Windows where we don't have a
log socket.
* src/gpgme-json.c (hlp_createkey, op_createkey): New.
(process_request, hlp_help): Add it.
--
This uses an unrestricted context for now until
GnuPG-Bug-Id: T4010
is implemented in GnuPG.
