aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* agent: Keep the session environment for restricted connections.Werner Koch2014-12-195-35/+43
| | | | | | | | | | | | | | | | | * agent/command-ssh.c (setup_ssh_env): Move code to ... * agent/gpg-agent.c (agent_copy_startup_env): .. new function. Change calllers. * agent/command.c (start_command_handler): Call that fucntion for restricted connections. -- A remote connection is and should not be able to setup the local session environment. However, unless --keep-display is used we would be left without an environment and thus pinentry can't be used. The fix is the same as used for ssh-agent connection: We use the default environment as used at the startup of the agent. Signed-off-by: Werner Koch <[email protected]>
* agent: Fix string prepended to remotely initiated prompts.Werner Koch2014-12-191-1/+1
| | | | | | | * agent/command.c (cmd_setkeydesc): Use %0A and not \n. Make translatable. Signed-off-by: Werner Koch <[email protected]>
* build: Remove option to build without agent.Werner Koch2014-12-181-1/+2
| | | | * configure.ac (build-agent): Set to yes.
* gpgconf: Exit with failure if --launch fails.Werner Koch2014-12-173-4/+13
| | | | | | | * tools/gpgconf-comp.c (gc_component_launch): Return an error code. * tools/gpgconf.c (main): Exit if launch failed. -- GnuPG-bug-id: 1791
* po: Update Japanese Translation.NIIBE Yutaka2014-12-171-27/+14
| | | | | | -- Investigated who is P.KATOH, and fixed the header, accordingly.
* Post release updatesWerner Koch2014-12-162-1/+4
| | | | --
* Release 2.1.1gnupg-2.1.1Werner Koch2014-12-161-4/+25
|
* po: auto updateWerner Koch2014-12-1626-211/+1093
| | | | --
* po: Update the German translationWerner Koch2014-12-161-7/+32
|
* po: Update Czech translationPetr Pisar2014-12-161-999/+911
|
* gpg: Show private DO information in the card status.Werner Koch2014-12-161-0/+16
| | | | | | | | | | * g10/call-agent.c (agent_release_card_info): Free private_do. (learn_status_cb): Parse PRIVATE-DO-n stati. -- Reported-by: Damien Goutte-Gattat <[email protected]> Provided patch extended to release the memory.
* po: Update Russian translationIneiev2014-12-161-2933/+2103
|
* po: Update zh_TW translationJedi2014-12-161-2427/+975
|
* gpg: Add sub-command "factory-reset" to --card-edit.Werner Koch2014-12-1510-15/+252
| | | | | | | | | | | | | | | | | | * common/util.h (GPG_ERR_OBJ_TERM_STATE): New. * scd/iso7816.c (map_sw): Add this error code. * scd/app-openpgp.c (do_getattr): Return the life cycle indicator. * scd/app.c (select_application): Allow a return value of GPG_ERR_OBJ_TERM_STATE. * scd/scdaemon.c (set_debug): Print the DBG_READER value. * g10/call-agent.c (start_agent): Print a status line for the termination state. (agent_scd_learn): Make arg "info" optional. (agent_scd_apdu): New. * g10/card-util.c (send_apdu): New. (factory_reset): New. (card_edit): Add command factory-reset. Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix regression in notation data regression.Werner Koch2014-12-152-11/+14
| | | | | | | | | | | * g10/misc.c (pct_expando): Reorder conditions for clarity. * g10/sign.c (write_signature_packets): Fix notation data creation. -- Also re-added the check for signature version > 3. Reported-by: MFPA Signed-off-by: Werner Koch <[email protected]>
* gpg: Avoid extra LF in notaion data listing.Werner Koch2014-12-151-1/+6
| | | | * g10/keylist.c (show_notation): Use log_printf.
* doc: Typo fixes.Werner Koch2014-12-141-9/+9
| | | | --
* scd: Fix possibly inhibited checkpin of the admin pin.Werner Koch2014-12-121-1/+1
| | | | | | | * scd/app-openpgp.c (do_check_pin): Do not check a byte of a released buffer. Signed-off-by: Werner Koch <[email protected]>
* gpg: Let --card--status create a shadow key (card key stub).Werner Koch2014-12-126-40/+26
| | | | | | | | | | | | | | | | | | * agent/command.c (cmd_learn): Add option --sendinfo. * agent/learncard.c (agent_handle_learn): Add arg "send" andsend certifciate only if that is set. * g10/call-agent.c (agent_scd_learn): Use --sendinfo. Make INFO optional. (agent_learn): Remove. * g10/keygen.c (gen_card_key): Replace agent_learn by agent_scd_learn. -- The requirement of using --card-status on the first use of card on a new box is a bit annoying but the alternative of always checking whether a card is available before a decryption starts does not sound promising either. Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix possible read of unallocated memoryWerner Koch2014-12-121-4/+6
| | | | | | | | | | | | | | | | | * g10/parse-packet.c (can_handle_critical): Check content length before calling can_handle_critical_notation. -- The problem was found by Jan Bee and gniibe proposed the used fix. Thanks. This bug can't be exploited: Only if the announced length of the notation is 21 or 32 a memcmp against fixed strings using that length would be done. The compared data is followed by the actual signature and thus it is highly likely that not even read of unallocated memory will happen. Nevertheless such a bug needs to be fixed. Signed-off-by: Werner Koch <[email protected]>
* build: Replace deprecated autconf macro.Werner Koch2014-12-112-2/+2
| | | | | | | | | | * m4/intl.m4: s/AM_PROG_MKDIR_P/AC_PROG_MKDIR_P/ * m4/po.m4: Ditto. -- In preparation of moving to automake 1.14. GnuPG-bug-id: 1776
* dirmngr: Improve dead host detection.Werner Koch2014-12-081-0/+2
| | | | | * dirmngr/ks-engine-hkp.c (handle_send_request_error): Mark host dead also for 2 other error messages.
* http: Improve diagnostic messages.Werner Koch2014-12-081-9/+32
| | | | | | | | | | | | | * common/http.c (send_request): Print TLS alert info (connect_server): Detect bogus DNS entry. -- 1. Prints the TLS alert description. 2. Detect case where the DNS returns an IP address but the server is not reachable at this address. This may happen for a server which is reachable only at IPv6 but but the local machine has no full IPv6 configuration.
* gpg: Obsolete some keyserver helper options.Werner Koch2014-12-083-34/+24
| | | | | | | | | | | | | | | | | | * g10/options.h (opt): Remove keyserver_options.other. * g10/gpg.c (main): Obsolete option --honor-http-proxt. * g10/keyserver.c (add_canonical_option): Replace by ... (warn_kshelper_option): New. (parse_keyserver_uri): Obsolete "x-broken-http". -- Some of these options are deprecated for 10 years and they do not make any sense without the keyserver helpers. For one we print a hint on how to replace it: gpg: keyserver option 'ca-cert-file' is obsolete; \ please use 'hkp-cacert' in dirmngr.conf Signed-off-by: Werner Koch <[email protected]>
* gpg: Add OpenPGP card vendor 0x1337.Werner Koch2014-12-081-0/+2
| | | | --
* dirmngr: Return a proper error for all dead hosts.Werner Koch2014-12-081-55/+76
| | | | | | | | | | | | | | * dirmngr/ks-engine-hkp.c (map_host): Change to return an gpg_error_t. Return an error code for all dead hosts. (make_host_part): Change to return an gpg_error_t. Change all callers. -- The functions used to return an error code via ERRNO. However, this does not allow to return extra error codes in a portable way. Thus we change the function to directly return a gpg_error_t. Signed-off-by: Werner Koch <[email protected]>
* gpg: Write a status line for a failed --send-keys.Werner Koch2014-12-081-1/+4
| | | | * g10/keyserver.c (keyserver_put): Write an status error.
* scd: Fix for EdDSA.NIIBE Yutaka2014-12-081-3/+5
| | | | | * scd/app-openpgp.c (get_algo_byte): It catches 22. (store_fpr): It's MPI usually, but it's opaque bytes for EdDSA.
* Document no-allow-mark-trusted optionAndre Heinecke2014-12-051-12/+11
| | | | | | | | | | | | | | doc: Document no-allow-mark-trusted for gpg-agent * doc/gpg-agent.texi: Change allow-mark-trusted doc to no-allow-mark-trusted. -- Since rev. 78a56b14 allow-mark-trusted is the default option and was replaced by no-allow-mark-trusted to disable the interactive prompt. Signed-off-by: Andre Heinecke <[email protected]>
* scd: Fix for NIST P-256.NIIBE Yutaka2014-12-052-7/+13
| | | | | | * g10/card-util.c (card_store_subkey): Error check. * scd/app-opengpg.c (ecc_writekey): Support NIST P-256. (do_writekey): Error check.
* gpg: Allow import of large keys.Werner Koch2014-12-043-4/+16
| | | | | | | | | | | | | * g10/import.c (import): Skip too large keys. * kbx/keybox-file.c (IMAGELEN_LIMIT): Change limit from 2MB to 5MB. -- The key which triggered the problem was 0x57930DAB0B86B067. With this patch it can be imported. Keys larger than the now increased limit of 5MB will are skipped and the already existing not_imported counter is bumped up. Signed-off-by: Werner Koch <[email protected]>
* indentation: Update g10/import.cWerner Koch2014-12-041-1067/+1161
| | | | --
* gpg: Remove option aliases --[no-]throw-keyid and --notation-data.Werner Koch2014-12-034-8/+8
| | | | | | | | | * g10/gpg.c (opts): Remove them. * g10/options.h (opt): s/throw_keyid/throw_keyids/ and change users. -- See mails starting http://lists.gnupg.org/pipermail/gnupg-devel/2014-November/029128.html
* agent: Replace some sprintf.Werner Koch2014-12-023-18/+8
| | | | | | | | | * agent/call-scd.c (agent_card_pksign): Replace sprintf by bin2hex. * agent/command-ssh.c (ssh_identity_register): Ditto. * agent/pkdecrypt.c (agent_pkdecrypt): Replace sprintf by put_membuf_printf. Signed-off-by: Werner Koch <[email protected]>
* tools: Improve watchgnupg portability.Werner Koch2014-12-012-1/+4
| | | | | | | | | * configure.ac (AC_CHECK_HEADERS): Check for sys.select.h * tools/watchgnupg.c: Include it. -- It seems http://www.musl-libc.org/ is quite limited and requires the use sys/select.h instead of unistd.h et al.
* gpg: Fix export bug using exact search with only one key in the keybox.Werner Koch2014-12-013-1/+7
| | | | | | | | * g10/export.c (do_export_stream): Disable caching. * g10/keyserver.c (keyidlist): Ditto. -- GnuPG-bug-id: 1774
* scd: Implement socket redirection.Werner Koch2014-12-012-27/+69
| | | | | | | | | | | | * scd/scdaemon.c (ENAMETOOLONG): New. (redir_socket_name): New. (cleanup): Take care of a redirected socket. (main): Pass redir_socket_name to create_server_socket. (create_socket_name): Remove superfluous length check. (create_server_socket): Add arg r_redir_name and implement redirection. Replace assert for older Assuan by an error message. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Implement socket redirection.Werner Koch2014-12-011-12/+48
| | | | | | | | | | * dirmngr/dirmngr.c (ENAMETOOLONG): new. (redir_socket_name): New. (main): Add Assuan socket redirection. (cleanup): Adjust cleanup for redirection. -- Signed-off-by: Werner Koch <[email protected]>
* agent: Fix compile problem for old Libassuan.Werner Koch2014-12-011-1/+0
| | | | --
* agent: Implement socket redirection.Werner Koch2014-11-281-38/+86
| | | | | | | | | | | * agent/gpg-agent.c (ENAMETOOLONG): New. (redir_socket_name, redir_socket_name_extra) (redir_socket_name_ssh): New. (remove_socket): Take care of the redir names. (main): Pass the redir names to create_server_socket. (create_socket_name): Remove length check - that is anyway done later. (create_server_socket): Add arg r_redir_name and implement redirection if Libassuan is at least 2.14.
* gpg: Change another BUG() call to a regular error message.Werner Koch2014-11-281-6/+11
| | | | | | * g10/mainproc.c (proc_tree): Replace BUG by a proper error messages. Signed-off-by: Werner Koch <[email protected]>
* Add option --no-autostart.Werner Koch2014-11-2811-8/+81
| | | | | | | | | | | | | | * g10/gpg.c: Add option --no-autostart. * sm/gpgsm.c: Ditto. * g10/options.h (opt): Add field autostart. * sm/gpgsm.h (opt): Ditto. * g10/call-agent.c (start_agent): Print note if agent was not autostarted. * sm/call-agent.c (start_agent): Ditto. * g10/call-dirmngr.c (create_context): Likewise. * sm/call-dirmngr.c (start_dirmngr_ext): Ditto. Signed-off-by: Werner Koch <[email protected]>
* gpg-agent: Add restricted connection feature.Мирослав Николић2014-11-276-145/+312
| | | | | | | | | | | | | | | | | | | | | | | * agent/agent.h (opt): Add field extra_socket. (server_control_s): Add field restricted. * agent/command.c: Check restricted flag on many commands. * agent/gpg-agent.c (oExtraSocket): New. (opts): Add option --extra-socket. (socket_name_extra): New. (cleanup): Cleanup that socket name. (main): Implement oExtraSocket. (create_socket_name): Add arg homedir and change all callers. (create_server_socket): Rename arg is_ssh to primary and change callers. (start_connection_thread): Take ctrl as arg. (start_connection_thread_std): New. (start_connection_thread_extra): New. (handle_connections): Add arg listen_fd_extra and replace the connection starting code by parameterized loop. * common/asshelp.c (start_new_gpg_agent): Detect the use of the restricted mode and don't fail on sending the pinentry environment. * common/util.h (GPG_ERR_FORBIDDEN): New.
* agent: Make auditing of the option list easier.Мирослав Николић2014-11-271-73/+81
| | | | * agent/gpg-agent.c (opts): Use ARGPARSE_ macros.
* dirmngr: Only report hkps scheme when availableKristian Fiskerstrand2014-11-261-1/+9
| | | | | | | | | | | | | | | | * dirmngr/ks-engine-hkp.c (ks_hkp_help): Make use of TLS macros. -- Only report support for the hkps scheme when GnuPG / dirmngr has been built with a TLS library. This helps debuging and enable the user to detect whether support for hkps is included by doing a `gpg-connect-agent --dirmngr 'keyserver --help' /bye`. Currently hkps will be listed as a supported scheme but trying to add a keyserver using it will silently fail. As a digression, https is never listed as a valid scheme.
* gpg: Change a bug() call to a regular error message.Werner Koch2014-11-261-1/+6
| | | | | | | | | * g10/decrypt-data.c (decrypt_data): Return an error code instead of calling BUG(). -- This code path can be triggered by fuzzing gpg and thus with some likeness also by corrupt messages for other reasons.
* Fix buffer overflow in openpgp_oid_to_str.Werner Koch2014-11-252-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | * common/openpgp-oid.c (openpgp_oid_to_str): Fix unsigned underflow. * common/t-openpgp-oid.c (BADOID): New. (test_openpgp_oid_to_str): Add test cases. -- The code has an obvious error by not considering invalid encoding for arc-2. A first byte of 0x80 can be used to make a value of less then 80 and we then subtract 80 from that value as required by the OID encoding rules. Due to the unsigned integer this results in a pretty long value which won't fit anymore into the allocated buffer. The fix is obvious. Also added a few simple test cases. Note that we keep on using sprintf instead of snprintf because managing the remaining length of the buffer would probably be more error prone than assuring that the buffer is large enough. Getting rid of sprintf altogether by using direct conversion along with membuf_t like code might be possible. Reported-by: Hanno Böck Signed-off-by: Werner Koch <[email protected]> Ported from libksba commit f715b9e156dfa99ae829fc694e5a0abd23ef97d7
* build: Require libgpg-error 1.16.Werner Koch2014-11-241-1/+1
| | | | | | | -- 1.15 has a bug which will lead to a segv when sending keys. Better updated the requirements to avoid bug reports.
* gpg: Fix use of uninit.value in listing sig subpkts.Werner Koch2014-11-241-1/+5
| | | | | | | | | | | | | * g10/parse-packet.c (dump_sig_subpkt): Print regex subpacket sanitized. -- We may not use "%s" to print an arbitrary buffer. At least "%.*s" should have been used. However, it is in general preferable to escape control characters while printf user data. Reported-by: Hanno Böck Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix off-by-one read in the attribute subpacket parser.Werner Koch2014-11-241-2/+10
| | | | | | | | | * g10/parse-packet.c (parse_attribute_subpkts): Check that the attribute packet is large enough for the subpacket type. -- Reported-by: Hanno Böck Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-01 13:55:47 +0000