* src/engine-assuan.c (inquire_cb): Implement returning data.
* tests/opassuan/t-command.c (inq_cb): Send some test data.
--
The old code only allowed to send an empty response which was good
enough for scdaemon's KNOWNCARDP inquire but not to send actual data.
A quick test using a test smartcard might be
./t-command 'scd setattr --inquire PRIVATE-DO-1'
and then reading the data back using
gpg-connect-agent 'scd getattr PRIVATE-DO-1' /bye
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/genkey.c (setexpire, gpgme_op_setexpire_start,
gpgme_op_setexpire): Move to ...
* src/setexpire.c: New.
* src/Makefile.am (main_sources): Add that file.
* src/context.h (ctx_op_data_id_t): Add OPDATA_SETEXPIRE.
* lang/qt/tests/t-various.cpp (testSetExpire): Test error handling.
--
Errors (and failures) emitted via status-fd need to be handled
explicitly, i.e. we need to provide an appropriate status handler with
corresponding op_data_t. Additionally, we need to set a passphrase
command handler if a passphrase callback is set in the context, e.g.
during tests.
GnuPG-bug-id: 4395
* src/gpgme.h.in (gpgme_op_setexpire_start, gpgme_op_setexpire): New.
* src/libgpgme.vers, src/gpgme.def: Add new functions.
* src/genkey.c (setexpire): New.
(gpgme_op_setexpire_start, gpgme_op_setexpire): New.
* src/engine.h, src/engine.c: (_gpgme_engine_op_setexpire): New.
* src/engine-backend.h (engine_ops): Add 'setexpire' and adjust all
engine initializers.
* src/engine-gpg.c (gpg_setexpire): New.
(_gpgme_engine_ops_gpg): Set setexpire to gpg_setexpire.
* doc/gpgme.texi: Document new functions.
* tests/run-genkey.c: Add option --setexpire.
--
This extends GPGME to support the --quick-set-expire command
added by GnuPG 2.1.22. This allows changing subkeys expiry
date without going through the editinteractor interface.
Co-authored-by: Andre Heinecke <aheinecke@gnupg.org>
GnuPG-bug-id: 4999
* src/export.c (export_start): Allow that mode.
--
The test tools uses gpgme_op-export_ext and thus did not caught it.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme.h.in: Clarify that the trustlist function should not be
used.
* src/engine.c (_gpgme_engine_op_trustlist): Always return an error.
* src/engine-backend.h (struct engine_ops): Remove trustlist member.
* src/engine-gpg.c (gpg_trustlist): Remove.
(struct engine_ops): Remove that member. Also in all other engines.
* tests/gpg/t-trustlist.c: Remove.
* lang/python/tests/t-trustlist.py: Remove.
--
This never worked in reality because the required feature has been
removed from GnuPG version 1.3.2 soon after introduction of this
feature in gpgme - 17 years ago. It was anyway marked as
experimental. We keep the API and ABI, though.
GnuPG-bug-id: 4834
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/verify.c (parse_trust): Fix detection of "chain" keyword.
--
Fixes-commit: da6f3dc0c5
from 2007 shortly after introducing this. I doubt that this info has
ever been used (it is for qualified signatures, which are only
supported using the legacy German RegTP rules for them which were soon
overturned by the commercial CAs).
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/Makefile.am (gpgme_w32_extra_libs): New.
(libgpgme_la_LIBADD, libgpgme_glib_la_LIBADD): Use it.
--
Since w32-io.c directly uses functions from ws2_32 it should
not rely on libgpg-error to pull in this dependency.
* src/engine-gpg.c (gpg_keylist_build_options): Send --with-keygrip
if --with-secret is used.
--
Since GnuPG 2.2.19 the keygrip was not anymore send if only
--with-secret was used in a public key listing. Given that
--with-secret requires computation of the keygrip anyway, there is no
point in not requesting the keyrip in this case.
GnuPG-bug-id: 4820
* src/Makefile.am (gpgme_tool_LDADD): Add @GPG_ERROR_LIBS@.
--
Since gpgme-tool uses gpg_strerror, it should be linked
to -lgpg-error.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* src/posix-util.c (find_executable): New.
(walk_path_str): Factored out from walk_path.
(walk_path): Replaced by find_executable.
(_gpgme_get_gpg_path, _gpgme_get_gpgconf_path): Use find_executable.
--
This should help to locate GnuPG on MacOS systems where
it is not part of the PATH environment variable and
should reduce the need to have fixed path known
at GPGME compile time.
mailvelope/issue699
* src/gpgme.h.in (struct _gpgme_user_id): Add field 'uidhash'.
* src/key.c (gpgme_key_unref): Free it.
* src/keylist.c (keylist_colon_handler): Set it.
* tests/run-keylist.c (main): Print it.
--
The uidhash value is part of gpg's output since the year 2005. This
now adds support to gpgme. The application for uidhash is to select
a user id in an edit interactor: Instead of giving the number of the
user id, the uidhash value can be be used to avoid tracking the user
id numbers.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/engine-gpg.c (gpg_decrypt): only send --no-keyring when we are
not verifying.
--
Without this change, the signature verification would fail. This
problem was introduced in bded8ebc59 in
an attempt to avoid an error when *not* verifying. Clearly more test
suite coverage is needed to avoid introducing this sort of problem in
the future.
GnuPG-bug-id: 3464
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
* src/keylist.c (keylist_colon_handler): Do not clear
out the tmp_uid when a subpacket line is encountered.
--
When the uid is cleared no more signatures following
the subpacket are parsed, so we now no longer clear
it when a subpacket is encountered.
* src/context.h (gpgme_context): Add new flag for extended-edit.
* src/engine-gpg.c (append_args_from_sig_notations): Add flags to
control the kind of notations.
(gpg_edit): Respect extended-edit and notations.
(gpg_encrypt_sign, gpg_sign): Update call to
append_args_from_sig_notations.
* src/gpgme.c (gpgme_set_ctx_flag, gpgme_get_ctx_flag): Support
extended-edit.
* NEWS, doc/gpgme.texi: Mention extended-edit.
--
This provides a way to get the extended key-edit interface without
breaking bad state machines that rely on the current command flow.
A use case for this is to enable multiple local signatures, which
can be used together with annotations for:
GnuPG-Bug-Id: T4734
* src/engine-gpg.c (build_argv): Properly check for all
arguments and allocate memory for them.
--
This fixes a potential buffer overflow which could be created
by using unusual and partially contradictory options.
Like offline and auto-key-locate together while
using ignore-mdc-error.
As the list of arguments should not be user controlled the
impact of this is very low.
To ensure that this does not happen in the future an
assert is also added with this patch.
* src/debug.c (_gpgme_debug_buffer): Switch between two output
formats.
--
The new format is much more practical than the bunch of hex digits
followed by just 16 ascii chars. To get the old behaviour use a debug
level of 10.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/posix-io.c (_gpgme_is_fd_valid): New out-commented function.
--
This code is sometimes useful to track down invalid file descriptors.
We keep it commented in the code.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/wait.c (_gpgme_run_io_cb): Fix return code.
--
The function needs to return an gpg_error_t and not ERRNO.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/debug.c (_gpgme_debug): Take better care of NULL userinfo.
(_gpgme_debug_end): Rework.
(_trace_sysres): Print ERRNO and not the supplied RES.
--
The TRACE_SYSRES patch fixes
Regression-due-to: 7a1e7006d0
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/debug.c (_gpgme_debug): Add arg LINE. Chnage all callers.
(_gpgme_debug_begin): Remove.
* src/debug.h (TRACE_SEQ): Use the LINE arg of _gpgme_debug.
--
This includes chnages to always print fds in decimal as weel as
tweaking the TARCE_SEQ function to make use of the new machinery.
The standard 'tag' can now always be NULL and no tag information will
be printed.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/debug.c (debug_lock): Remove. Also remove all users.
(_gpgme_debug): Use gpgrt_bsprintf to prepare the output and finally
print using standard fprintf. Reformat to prefix to be narrower.
--
Note that the locks are now implicitly done using the systems stdio.
The threadid is now printed with 4 digits in hex and thus without the
angle brackets and the 0x. However it is still a hex number even if it
may look like an octal number. The hex letters are uppercase to make
searching in locks easier iff the threadid happens to have a letter in
it.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/cJSON.c: Include stdint.h.
(parse_number): Avoid overflob in SUBSCALE and cap integer values.
--
GnuPG-bug-id: 4330
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/engine-gpg.c (append_args_from_recipients_string): Detect bad
options.
* src/engine-gpgsm.c (set_recipients_from_string): Implement option
parsing.
--
The only option we actually implement is "--" but the code layout is
now very simlar to engine-gpg and can easily be extended if ever
needed.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/engine-gpgsm.c (gpgsm_encrypt): Fix argument check.
--
It is pretty obvious thar the string based new encrypt function has
never been tested for S/MIME. The fix was easy. A followup patch
will extend it to allow for keywords in the future.
GnuPG-bug-id: 4556
Fixes-commit: a1f76b3b54
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/engine-gpgsm.c [!USE_DESCRIPTOR_PASSING] (gpgsm_new): Remove
last call to _gpgme_io_set_close_notify.
--
It is called just after the code in question for all cases.
GnuPG-bug-id: 4456
Fixes-commit: dd21ec997c
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* src/w32-util.c (_gpgme_access): Respect mode parameter.
(_gpgme_create_process_utf8): Convert startupinfo, too.
--
This both did not show up in testing as we only use
mode F_OK and STARTUPINFOA is basically the same as
STARTUPINFOW.
Fixes commit: a82e3a0ae5
GnuPG-Bug-Id: T4453
* src/dirinfo.c (get_gpgconf_item): Use _gpgme_access.
* src/posix-util.c (_gpgme_access): Add forward to normal access.
* src/sys-util.h (_gpgme_access): New for posix and w32.
* src/w32-io.c (_gpgme_io_spawn): Use _gpgme_crate_process_utf8.
* src/w32-util.c (utf8_to_wchar, utf8_to_wchar0): The usual w32 conv.
(find_program_in_dir): Use _gpgme_access.
(find_program_at_standard_place): Use wchar API and convert to UTF-8.
(_gpgme_access): Convert UTF-8 to wchar and use wchar API.
(_gpgme_create_process_utf8): Convert UTF-8 to wchar and use wchar API.
--
While we should not say that we have full support for unicode path
installations of GnuPG, this ensures that GPGME works if GPGME
itself is installed in a unicode path. e.g.: Libreoffice supports
this.
GnuPG-Bug-Id: T4453
Based on a patch provided by Egor Pugin. Thanks.
* src/w32-io.c (_gpgme_io_spawn): Show MessageBox only once.
--
This prevents multiple message boxes from showing when
the GPGME installation is unworkable.
GnuPG-Bug-Id: T4453
* src/debug.c (_gpgme_debug): Use gpgrt_vasprintf instead of
vfprintf to have a more portable format.
--
This fixes crashes on Windows because "%zu" is used which
is not natively supported on Windows but which gpgrt supports.
* src/assuan-support.c (my_spawn): Fix using strtoul for
a long.
--
This was commented on in129def87b262 and is correct.
It is signed here to better handle cases where an
invalid handle value (-1) would be passed.
* src/assuan-support.c (my_spawn): Add hack to
mark the logger fd for w32spawn translation.
--
The w32 spawn code needs to modify argv with
an updated fd that matches the real id
in the spawned process.
It uses spawn_fd_item_s.arg_loc for that.
We hack it here so that the arg_loc is set
for gpgsm's logger-fd without changing
the assuan API.
GnuPG-Bug-Id: T4426
* src/engine-gpgsm.c (struct engine_gpgsm): Add fields diag_cb and
diagnostics.
(close_notify_handler): Close the diag fd on status fd close.
Handle diag close.
(gpgsm_cancel): Handle diag.
(gpgsm_release): Free DIAGNOSTICS.
(gpgsm_new): Support the diag feature.
(start): Set a handler for the diag fd.
(gpgsm_getauditlog): Support GPGME_AUDITLOG_DIAG.
--
Co-authored-by: Andre Heinecke <aheinecke@gnupg.org>
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/cJSON.c (MAX_DEPTH): New. Maximum recursion depth.
(parse_value, parse_array, parse_object): Carry and check
depth argument.
(cJSON_ParseWithOpts): Initialize depth.
--
This fixes a stack overflow if we get weird recursive
json data.
GnuPG-Bug-Id: T4331
* src/w32-util.c (_gpgme_get_gpgconf_path): Add NULL top strconcat.
--
Fortunately this is called early and the stack like cleared out so
that we have not seen wrong behaviour until now. We should really fix
all these annoying HANDLE/int cast warnings and alike so that real
bugs are not drowned by them.
GnuPG-bug-id: 4369
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (subkey_to_json): here
--
Avoid Windows ugliness of allowing different CRTs in the same
process.
Fixes-commit: 7f24233719
Signed-off-by: Werner Koch <wk@gnupg.org>
* configure.ac: Add -Wno-format-truncation and
-Wno-sizeof-pointer-div.
* src/b64dec.c (_gpgme_b64dec_proc): Add fallthrough annotation.
* src/cJSON.c (parse_string): Ditto.
* src/gpgme-json.c (main): Ditto.
--
gcc 8 enables a couple of new warnings. Some of them are useless for
us. In particular:
util.h:42:26: warning: division 'sizeof (char *) / sizeof (char)'
does not compute the number of array elements [-Wsizeof-pointer-div]
#define DIM(v) (sizeof(v)/sizeof((v)[0])) ^
trustlist.c:101:22: note:
in expansion of macro 'DIM' if (strlen (p) == DIM(item->keyid) - 1)
Which is a real standard way to use DIM, here the right hand side is
equivalent to sizeof but nevertheless it is correct. Yes sir, we know
C.
The format string warnings I have seen were assuming that the time
structure returns valued out of scope - but if the system is that
broken, the s_n_printf catches this.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/genkey.c (gpgme_op_genkey_start): Fix check for
parms.
--
This fixes a regression introduced by:
174af15725
So that the error was triggered by usual args.
GnuPG-Bug-Id: T4265
* src/debug.h (TRACE_BEG, TRACE_LOG, TRACE_SUC): Use variadic macros
and remove the TRACE_BEG1 et al. Change all users to always pass a
format string.
(TRACE): Ditto.
* src/debug.c (_gpgme_debugf): New.
* configure.ac <GCC>: Add -Wno-format-zero-length.
--
This makes it easier for use to enable format checks. The zero-length
format is required to allow for an empty format due to the comman
problematic of __VA_ARGS__.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme.m4 (_AM_PATH_GPGME_CONFIG): Use gpgrt-config with gpgme.pc
when possible.
(AM_PATH_GPGME_GLIB): Likewise with gpgme-glib.pc.
--
Keeping AM_PATH_GPGME_PTHREAD, as is, untouched.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* src/gpgme-glib.pc.in: New.
* src/gpgme.pc.in (avail_lang): Remove.
--
Provide gpgme-glib.pc for gpgme-glib library. The avial_lang
information is no use because *.pc is for C.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* configure.ac: Generate src/gpgme.pc.
* src/Makefile.am (pkgconfigdir, pkgconfig_DATA): New.
(EXTRA_DIST): Add gpgme.pc.in.
* src/gpgme.pc.in: New.
* src/gpgme-config.in: Use variables.
--
Some usages of gpgme-config is not compatible to pkg-config style;
The --glib option and --thread option which affect the output
by --cflags or --libs are not supported by gpgme.pc.
gpgme-config's embedding information for gpg-error and libassuan at
the build time of gpgme is considered inflexible than pkg-config
style. It is now handled by dependency of gpgme.pc (Requires field).
To use gpgme.pc, newer libgpg-error (>= 1.33) and libassuan (>= 2.5.3)
are required, which provide gpg-error.pc and libassuan.pc respectively.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* src/w32-io.c (close_handle, _close_handle): New macro and function;
use in place of all CloseHandle calls.
(wait_for_single_object, _wait_for_single_object): Likewise.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/assuan-support.c (my_waitpid): Do not close the PID = it is not
a handle.
--
At some time in the distant past we might have used the process object
as pid which obviously required a close. However this was changed and
so what we did here was to close an arbitrary handle (one which
matches the pid).
GnuPG-bug-id: 4237
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/w32-io.c (hddesc_t): New.
(reader_context_s, writer_context_s): Replace file_sock and file_hd by
the hddesc_t hdd.
(fd_table): Ditto. Add want_reader and want_writer.
(hddesc_lock): New lock variable.
(new_hddesc, ref_hddesc): New.
(release_hddesc): New.
(reader, writer): Call release_hddesc.
(create_reader, create_writer): Change for new hddesc scheme.
(destroy_reader, destroy_writer): Replace closing by a call to
release_hddesc.
(_gpgme_io_pipe): Change for new hddesc scheme.
(_gpgme_io_close): Ditto.
(_gpgme_io_dup): Ditto. Use want_reader and want_writer.
(_gpgme_io_socket): Change for new hddesc scheme.
--
GnuPG-bug-id: 4237
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/debug.h (TRACE_SUC3): New.
(TRACE_LOGBUFX): New.
* src/posix-io.c: Use TRACE_LOGBUFX instead of TRACE_LOGBUF.
* src/w32-glib-io.c: Ditto.
--
This will also be changed for w32-io as part of another commit.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/w32-util.c (_gpgme_w32_cancel_synchronous_io): Fix name of DLL
and print trace info only on error.
--
Fixes-commit: 63ba09b541
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/w32-util.c (_gpgme_w32_cancel_synchronous_io): New.
* src/w32-io.c (destroy_reader): Use it here.
--
This has not been tested but should on Vista and later help to fix a
possible hang.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/w32-io.c (fd_table_size): New. Used in most places instead of
the MAX_SLAFD constant.
(reader_table, writer_table, notify_table): Merge them into ...
(fd_table): this table. Chnage all affected code to take just one
lock.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/w32-io.c (find_reader, find_writer): Remove unused start_it
arg. It is always passed as true. Change callers.
Signed-off-by: Werner Koch <wk@gnupg.org>
* configure.ac: Remove WindwosCE support.
* contrib/: Remove all; it was only used for WindowsCE.
* src/w32-ce.c, src/w32-ce.h: Remove files.
* src/Makefile.am (system_components): Remove these files.
* src/ath.c, src/ath.h: Remove W32CE support.
* src/data-compat.c (gpgme_data_new_from_filepart): Ditto.
(gpgme_data_new_from_file): Ditto.
* src/debug.c (debug_init, _gpgme_debug): Ditto.
* src/gpgme-tool.c (gpgme_server): Ditto.
(main): Ditto.
* src/priv-io.h: Do not include w32-ce.h.
* src/util.h: Remove WindowsCE support.
* src/w32-io.c: Ditto.
* src/w32-util.c: Ditto.
* src/debug.h (TRACE_SUC4): New.
--
There is no more hardware to test our code, the support for Windows CE
terminated along time ago. Note that our code worked only with the
old WindowsCE with that overall system limit of 31 processes.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/w32-io.c (set_synchronize): Remove.
(create_reader, create_writer): No need for set_synchronize.
--
The set_synchronize dates back to 2001 at a time when I wrote the
Windows support on WindowsME and Windows2000. Maybe this was required
then due to bugs in that old NT or partly NT based Windows versions.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/engine-gpgsm.c (gpgsm_verify): Fix handling both
plaintext and signed_text as NULL.
--
Previously if plaintext was NULL and signed_text was NULL
it would set MESSAGE_FD to NULL which resulted in a
crash.
Ignoring the plaintext of an opaque signature might
make sense in some cases and engine-gpg handles it.
* src/genkey.c (get_key_parameter): Provide a fallback ENDTAG.
--
It would actually be more correct to return an error in this case but
it is possible tha there are users who did not provide an endtag and
out of luck they also didn't trigger a segv.
GnuPG-bug-id: 4192
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/debug.c (_gpgme_debug_buffer): Bail out of BUF is NULL.
* src/genkey.c (gpgme_op_genkey): Do no deref a NULL in
TRACE_LOGBUF.
(gpgme_op_genkey_start): Ditto. Return an error if PARMS is NULL.
--
This robustness patch should solve one part of
GnuPG-bug-id: 4192
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/context.h (gpgme_context): Extend with trust_model.
* src/engine-gpg.c (engine_gpg): Extend with trust_model.
(gpg_set_engine_flags): Take trust_model from context.
(build_argv): Handle trust_model.
(gpg_release): Free trust_model.
* src/gpgme.c (gpgme_set_ctx_flag): Handle trust-model flag.
(gpgme_release): Release trust-model.
* doc/gpgme.texi: Document new flag for gpgme_set_ctx_flag.
(Context Flags): New subsection for the context flags.
* tests/run-keylist.c (show_usage, main): Add new --trust-model
parameter.
--
This gives a GPGME user fine grained control over the
trust-model.
Changing the trust model for only a single application depends
on:
GnuPG-Bug-Id: T4134
Maniphest Tasks: T4134
Differential Revision: https://dev.gnupg.org/D466
* src/keylist.c (gpgme_get_key): Move r_key init above
the first invalid value check.
--
This fixes the case where someone passes an unitialized
r_key and no fingerprint.
* configure.ac: Bump core LT version to C32/A21/R0. Bump C++ LT
version to C14/A8/R0.
* lang/qt/tests/Makefile.am (CLEANFILES): Add reader status files.
* Makefile.am (EXTRA_DIST): Add conf/whatisthis.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme.h.in: Obsolete "class" also for Python.
* lang/python/gpgme.i: Silenece a swig warning. Silence a gcc
warning.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (op_createkey): Remove subkey-algo param.
(GPG_AGENT_ALLOWS_KEYGEN_TRHOUGH_BROWSER): Fix typo.
* lang/js/src/Keyring.js: Remove subkey-algo support.
* lang/js/src/permittedOperations.js: Ditto.
--
We do not want to expose details of the protocol's key generation and
thus the subkey-algo does not make sense. Right now we support only
the default and future-default algorithms. A user can configure them
anyway using new-default-key-algo in gpg.conf. Eventually we may
officially support a more flexible way of creating special structured
OpenPGP keys but right now that is not part of the API.
Signed-off-by: Werner Koch <wk@gnupg.org>
* Egon Spengler was right, crossing the streams is bad.
* Restored both src/gpgme.def and src/libgpgme.vers to use the
estreams symbols without the leading underscore.
* The new_from_estream() function added to lang/python/src/core.py and
set to alias the new_from_stream() function remains.
* Opted for the solution favouring Linux onthree main grounds:
1. Andre reported major problems with Windows as well, so the number
of potentially affected systems would vastly increase.
2. All the BSDs and OS X have spent far more time and development
work in order to accommodate the eccentricities of both Microsoft
and the GNU Project (ref. GCC), so they're more likely to be able
to cope with doing so again than the other way around.
3. If I really have to I can write a custom installer for OS X to
try this and, if it fails, to then patch the two symbol entries and
recompile from scratch. That said, I may not have to since it
actually behaved during the most recent tests for this
commit; into ten separate CPython installations and all five
supported versions (standard source installs and OS X Framework
installs for each version).
Tested-by: Ben McGinnes <ben@adversary.org>
Signed-off-by: Ben McGinnes <ben@adversary.org>
* It turns out that even though some platforms detect differing
symbols for estreams, the two types do not appear to be in
conflict. At least they don't from the BSD/OS X side of things.
As a consequence both versions are now included.
Tested-by: Ben McGinnes <ben@adversary.org>
Signed-off-by: Ben McGinnes <ben@adversary.org>
* lang/python/src/core.py: Adjusted new_from_estream function to alias
new_from_stream instead of fd.
* fixed the _gpgme import errors introduced in commit
08cd34afb7 by changing the exported
functions/types to match the inner module where all the work is
done, rather than the outer one(s).
Tested-by: Ben McGinnes <ben@adversary.org>
Signed-off-by: Ben McGinnes <ben@adversary.org>
* src/gpgme-json.c (op_verify): Only create output and
use it for clearsigned and opaque signed.
--
Just passing output to gpgme_op_verify changes the behavior to
no longer do a verify of the signature.
* src/gpgme-json.c (op_delete): Delete primary key on
subkey gen error.
--
This can happen for example if the user cancels the
pinentry to unlock the primary key when adding the
subkey. To avoid an artifact of a pimary key without
an encryption capable subkey we delete the created
key and treat the whole operation as failed.
* src/gpgme-json.c (encode_and_chunk): Don't error on NULL
request.
--
This fixes the error that is passed when parthing the json
object failed and request would be NULL.
Instead of the JSON parser error it would otherwise report
that encode and chunk failed.
* src/gpgme-json.c (verify_result_to_json): Remove "file_name".
--
Having the file name in the verify result may lead developers to
assume that the file name is covered by the signature. This is not
the case and can easily be checked by hex-editing a signed message.
We better don't output it at all.
The same is true for the is_mime flag but that is anyway only an
advisory and I can't see damage from a faulty one.
Note that we keep file_name in gpgme's output for ABI stability and
because some tools want to display meta information even if they are
subject to tampering. This is similar to the non-encrypted subject in
mails.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (recipient_to_json, decrypt_result_to_json):
New.
(op_decrypt, hlp_decrypt): Update.
--
The op_decrypt as one of the first operations did not yet
match the current 1 <> 1 mapping of gpgme types to json
dictonaries.
info and dec_info are bad names but used for compatibility reasons.
* src/gpgme-json.c (op_createkey, hlp_createkey): Add subkey_algo
handling.
(hlp_createkey): Fix documentation of expiry.
--
Due to the funny quick-gen-key interface generating a key
with an explicit algo would result in bad defaults (only an SC key),
without a subkey.
This adds handling that should probably be in GnuPG proper to fix
the semantics of createkey by adding default subkey_algo handling.
* src/cJSON.c, src/gpgme-json.c (CALLOC_ONLY): New define
to change xmalloc / xtrymalloc to use calloc.
--
Some people consider malloc dangerous as it might allow an
information leak.
* src/gpgme-json.c (encode_and_chunk): Don't error out
if no chunksize is provided.
--
This fixes 82e4b900a9 which
caused every call without chunksize to error out.
* src/data.c (PROPERTY_TABLE_ALLOCATION_CHUNK): New.
(insert_into_property_table): Use it here. Clear all flags.
--
Fixes-commit: 085cdeddef
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/data.h (data_prop_t): New enum.
(struct gpgme_data): Add field propidx.
* src/data.c (property_t): New.
(property_table, property_table_size, property_table_lock): New.
(insert_into_property_table): New.
(remove_from_property_table): New.
(_gpgme_data_get_dserial): New.
(_gpgme_data_set_prop): New.
(_gpgme_data_get_prop): New.
(_gpgme_data_new): Connect new object to property_table.
(_gpgme_data_release): Remove from property_table.
(gpgme_data_read): With DATA_PROP_BLANKOUT set don't fill the buffer.
* src/data-mem.c (gpgme_data_release_and_get_mem): Likewise.
* src/decrypt.c (struct op_data): Add field plaintext_dserial.
(_gpgme_op_decrypt_init_result): Add arg plaintext and init new field.
(_gpgme_decrypt_status_handler): Set DATA_PROP_BLANKOUT on decryption
failure.
(_gpgme_decrypt_start): Pass PLAIN to the init function.
* src/decrypt-verify.c (decrypt_verify_start): Ditto.
* configure.ac: Check for stdint.h and bail out if uint64_t is not
available.
--
This is a best effort feature to not output plaintext after a
decryption failure (e.g. due to no or broken authenticated
encryption). It always work when using a memory object and reading it
after the decryption but it can't work reliable when the user is
reading from the data object while the decryption process is still
running.
This is quite a large change because the data objects and the context
objects are allowed to be owned by different threads. Thus a
synchronization is needed and we do this with a global table of all
data objects to which the context objects can do soft-linking via a
unique data object serial number.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (create_keylist_patterns): Use CNT as first arg for
xcalloc.
(process_request): s/strdup/xtrystrdup/.
--
calloc takes two arguments so to be able to detect integer overflow.
Thus if we switch from malloc to calloc we should utilize that.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme.h.in (gpgme_data_new_from_estream): New.
* src/data-estream.c: New.
* src/data.h (gpgme_data): New union member e_stream.
--
The estream functions (gpgrt_fopen et al.) are any waypart of the
required libgpg-error library and thus it makes sense to provide this
convenience interface.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (native_messaging_repl): Free request and
response after each loop.
--
If we only accept once request we should not loop. If we loop
we should do it properly.
* src/gpgme-json.c (native_messaging_repl): Ensure that the
request is NULL terminated.
--
This avoids potential memory leaks and access to unmapped memory
in case the request was not terminated.
Other request functions use es_read_line which gurantees NULL
termination.
* src/gpgme-json.c (encode_and_chunk): Try to always
return at least an error.
(process_request): Double check that it does not return NULL.
--
If process_request returns NULL the following strlen on it
would crash.
* src/gpgme-json.c (create_keylist_patterns): Reserve two
pointers more then linefeeds.
(create_keylist_patterns): Fix loop to count linebreaks.
(create_keylist_patterns): Use calloc for good measure.
--
This fixes crashes and memory corruption as cnt did not
match i.
* src/gpgme-json.c (process_request): Init res. Check for
json object before encode and chunk.
--
If json is invalid we can't read chunksize and would crash
in encode and chunk.
* src/cJSON.c: Add comments on the origin of the code.
(parse_string): Allocate an extra byte for safeness.
(cJSON_AddItemToArray): Allo ARRAY to be NULL.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/cJSON.c (parse_string): Correctly detect bad hex.
--
The call to parse_hex4 checks that only hex digits follow and in the
error case returns 0. However, by the time of the combined check for
an invalid value and the error PTR has already been set to the last
hex character and thus if the end-of-string or a quote character was
one of the bad hex digits the loop will miss the end of the string
which does not match with the simple buffer length allocation test at
the begin of the function.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (add_secret_fprs): New helper.
(op_export, hlp_export): Extend for with-sec fprs.
--
This is a request from Mailvelope, to import an export
they need the information for which keys from the export
a secret key is also available. For simplicity it is
much preferred to get this information in a single call
without the need to do and parse a keylisting additionally
in a second native-messaging call.
So we make it optional to include that info in the export.
* src/engine-gpg.c (engine_gpg): Add diagnostics member.
(gpg_release): Release diagnostics data.
(gpg_new): Set up logger-fd and diagnostics.
(gpg_getauditlog): New. Copy diagnostics to a user data.
(engine_ops): Add getauditlog.
* src/engine-gpgsm.c (gpgsm_getauditlog): Return not implemented
for GPGME_AUDITLOG_DIAG.
* src/getauditlog.c (getauditlog_start): Don't reset engine
for diagnostics.
* src/gpgme.h.in (GPGME_AUDITLOG_DIAG): New.
(GPGME_AUDITLOG_DEFAULT): New alias to 0.
* tests/run-decrypt.c (show_usage, main): Add --diagnostics.
* doc/gpgme.texi(Additional Logs): Document getauditlog.
--
This enables users of GPGME to get more verbose information
from gpg which can assist users in figuring out a problem
that was before hidden behind a generalized error like
"Decryption Failed".
For GPGSM it is not yet available as it is problematic to
get it properly in server mode and GPGSM already had the
original audit log mechanism in place.
GPGME_AUDITLOG_DEFAULT was added for a more explicit
documentation.
* src/gpgme-json.c (op_keylist, hlp_keylist): Add locate.
--
The same rationale for the KEYLIST_MODE_LOCATE in GPGME
also applies here. It makes the API a little less magic.
* src/gpgme-json.c (main): Add possibilty to set log file.
--
This is similar to how GPGME_DEBUG works. It takes ; on
Windows as seperator and : on linux. Followed by a file name.
For Linux it might make sense to use a different seperator
to allow setting a socket explicitly. But this is better
in line with the current GPGME_DEBUG behavior.
The change helps on Windows where we don't have a
log socket.
* src/gpgme-json.c (hlp_createkey, op_createkey): New.
(process_request, hlp_help): Add it.
--
This uses an unrestricted context for now until
GnuPG-Bug-Id: T4010
is implemented in GnuPG.
* src/gpgme-json.c (MIN_REPLY_CHUNK_SIZE): Lower value to
new real minimum.
(DEF_REPLY_CHUNK_SIZE): Don't chunk by default.
(pending_data): Remove type and base64.
(make_data_object): Remove chunksize handling as this is now
generic.
(encode_and_chunk): Setup the pending_data buffer for chunking
if required.
(op_getmore): Changed to generically work on a response.
(hlp_getmore): Update accordingly.
(hlp_help): Document chunksize as generic parameter for all commands.
(process_request): Use encode_and_chunk on the response.
(hlp_encrypt, op_encrypt, hlp_decrypt, op_decrypt),
(hlp_verify, op_verify, hlp_sign, op_sign),
(op_keylist, hlp_keylist, hlp_export, op_export): Update accordingly.
--
To include handling for json properties e.g. in a keylist in
the chunk mechanism the mechanism is now more general.
If the chunksize property is provided the response will
always look exactly like a "getmore" response. E.g.
e.g.:
{
"op": "keylist",
"chunksize": 64
}
Results in:
{
"more": true,
"base64": true,
"response": "ewoJImtleXMiOglbewoJCQkicmV2b2tlZCI6"
}
For simplicity this is even true if the chunksize is larger
then the response.
The client has to combine all "response" chunks and base64
decode them to get valid json.
The complete response (including json) is never larger then
the chunksize but might be smaller. Except for interactive
use due to additional format characters.
* src/gpgme-json.c (sigsum_to_json): Add bool repr.
(signature_to_json, verify_result_to_json): Extend and follow better
pattern.
(hlp_decrypt, hlp_verify): Expand doc.
--
This should make it more clear which values are mapped as
the naming is more direct and clear and help to use
the gpgme documentation to understand the verify_result values.
* src/gpgme-json.c (op_config_opt, hlp_config_opt): New operation.
(process_request, hlp_help): Add it.
--
This is more conveniant API for most query operations where
a single option is required.
An example would be:
{
"op": "config_opt",
"component": "gpg",
"option": "default-key"
}
Which results in:
{
"option": {
"name": "default-key",
"description": "use NAME as default secret key",
"argname": "NAME",
"flags": 0,
"level": 0,
"type": 1,
"alt_type": 1,
"value": [{
"string": "F462B6B1",
"is_none": false
}]
}
}
* src/decrypt.c (op_data_t): Add field first_status_error.
(parse_status_error): Set it.
(_gpgme_decrypt_status_handler): Prefer an ERROR code over a
NO_SECKEY.
--
GnuPG-bug-id: 3983
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/cJSON.c: Use gpgrt fucntion only if available.
--
We have a hack in gpgme-json to allow building with older libgpg-error
versions. That whole thing will not work but the instead the binary
will print an error at runtime that it needs to be build with a newer
libgcrypt. There was a little bug here for the Debian packages
libgpg-error versions which failed to build cJSON. cJSON is only
needed be the full gpgme-json but nevertheless the Makefile wants to
build it. The fix is straightforward.
GnuPG-bug-id: 3971
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme.h.in (_gpgme_op_decrypt_result): Add flag
legacy_cipher_nomdc.
* src/decrypt.c (parse_status_error): Set this flag.
* tests/run-decrypt.c (print_result): print it.
(main): Print the result even on error.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/engine-gpg.c (read_status): Remove the handling of
GPGME_STATUS_END_STREAM; this was used only by the former experimental
--pipemode of gpg but that is not even anymore invoked here.
(struct engine_gpg): Remove cmd.linked_data and .linked_idx.
(build_argv): Remove code for linked_data.
(gpg_new): Ditto.
(gpg_set_command_handler): Remove arr linked_data.
* src/engine-backend.h (engine_ops): Remove arg data from
set_command_handler.
* src/engine.c (_gpgme_engine_set_command_handler): Remove arg
linked_data and adjust all callers.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (op_export, op_delete): Return GPG_ERR_FORBIDDEN if
"secret" is used.
--
This should not be possible from a browser and we need to make this
fully clear. Actually gpg-agent won't allow that anyway but having
this explicitly is better.
If that is ever needed a dedicated command line option may enable
this, for example when used by regular programs and not by the browser.
But that requires other changes as well.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (create_onetime_context): New.
(release_onetime_context): New.
(op_sign): Use the new fucntions to create a separate context.
(op_encrypt): Use a separate context for key listings.
(create_keylist_patterns): Remove unneeded cast.
--
get_context retruns a static per-process context and can thus not be
used as a separate context. Use dedicated fucntions for this.
Signed-off-by: Werner Koch <wk@gnupg.org>
* src/gpgme-json.c (op_encrypt): Add optional signing_keys param.
(get_keys, create_keylist_patterns): Add param for json object name.
--
If the optional parameter signing_keys is provided to encrypt
it becomes an encrypt-sign operation.
* src/gpgme-json.c (add_summary_to_object): Changed to:
sigsum_to_json.
(add_signature_to_object): Changed to signature_to_json.
(add_signatures_to_object): Changed to verify_result_to_json.
(add_ei_to_object): Changed to engine_info_to_json.
(op_decrypt, op_verify, op_version): Use new functions.
--
This pattern of gpgme_type to json object conversion
is much cleaner then the error returning "add to object"
functions.
