aboutsummaryrefslogtreecommitdiffstats
path: root/agent/command-ssh.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Clean up word replication.Yuri Chornoivan2017-02-211-3/+3
| | | | | | | | | -- This fixes extra word repetitions (like "the the" or "is is") in the code and docs. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* agent: No cards is not an error.NIIBE Yutaka2017-02-171-0/+6
| | | | | | * agent/command-ssh.c (card_key_list): Care the case of no cards. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Send back all public keys for available cards.NIIBE Yutaka2017-02-171-8/+68
| | | | | | | | | * agent/call-scd.c (card_cardlist_cb, agent_card_cardlist): New. * agent/command-ssh.c (card_key_list): New. (ssh_handler_request_identities): Call card_key_list and loop for the list to send public keys for all available cards. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Tell the Pinentry the client's pid.Werner Koch2017-02-031-0/+40
| | | | | | | | | | | * configure.ac: Check for SO_PEERCRED et al. * agent/agent.h (server_control_s): Add field 'client_pid'. * agent/command.c (start_command_handler): Set CLIENT_PID. * agent/command-ssh.c (get_client_pid): New. (start_command_handler_ssh): Set CLIENT_PID. * agent/call-pinentry.c (start_pinentry): Tell Pinentry the client-pid. Signed-off-by: Werner Koch <[email protected]>
* Update copyright notices for 2017.Werner Koch2017-01-231-2/+2
| | | | | | | | -- Also some http:// -> https:// fixes. Signed-off-by: Werner Koch <[email protected]>
* agent: Ask specific SERIALNO for pksign/pkdecrypt.NIIBE Yutaka2017-01-161-1/+1
| | | | | | | | | * agent/call-scd.c (agent_card_serialno): Add DEMAND argument. * agent/command-ssh.c (card_key_available): Follow the change. * agent/learncard.c (agent_handle_learn): Likewise. * agent/divert-scd.c (ask_for_card): Use DEMAND argument. Signed-off-by: NIIBE Yutaka <[email protected]>
* Change all http://www.gnu.org in license notices to https://Werner Koch2016-11-051-1/+1
| | | | --
* Fix typos.Justus Winter2016-10-271-1/+1
| | | | | -- Signed-off-by: Justus Winter <[email protected]>
* agent: Add --card option for READKEY.NIIBE Yutaka2016-10-201-31/+1
| | | | | | | | | | * agent/findkey.c (agent_write_shadow_key): New. * agent/command-ssh.c (card_key_available): Use agent_write_shadow_key. * agent/learncard.c (agent_handle_learn): Likewise. * agent/command.c (cmd_readkey): Add --card option. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* Fix more spellingDaniel Kahn Gillmor2016-09-171-1/+1
| | | | | | | | | | | | | | | | | | | * NEWS, acinclude.m4, agent/command-ssh.c, agent/command.c, agent/gpg-agent.c, agent/keyformat.txt, agent/protect-tool.c, common/asshelp.c, common/b64enc.c, common/recsel.c, doc/DETAILS, doc/HACKING, doc/Notes, doc/TRANSLATE, doc/dirmngr.texi, doc/faq.org, doc/gpg-agent.texi, doc/gpg.texi, doc/gpgsm.texi, doc/instguide.texi, g10/armor.c, g10/gpg.c, g10/keyedit.c, g10/mainproc.c, g10/pkclist.c, g10/tofu.c, g13/sh-cmd.c, g13/sh-dmcrypt.c, kbx/keybox-init.c, m4/pkg.m4, sm/call-dirmngr.c, sm/gpgsm.c, tests/Makefile.am, tests/gpgscm/Manual.txt, tests/gpgscm/scheme.c, tests/openpgp/gpgv-forged-keyring.scm, tests/openpgp/multisig.test, tests/openpgp/verify.scm, tests/pkits/README, tools/applygnupgdefaults, tools/gpg-connect-agent.c, tools/mime-maker.c, tools/mime-parser.c: minor spelling cleanup. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* agent: SSH support fix.NIIBE Yutaka2016-08-101-1/+3
| | | | | | | | | * agent/command-ssh.c (ssh_handler_request_identities): Keep error message same. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Fix regression in recent ssh changes.Werner Koch2016-08-091-3/+9
| | | | | | | | | | | | * agent/command-ssh.c (sexp_key_construct): Lowercase the algo name. -- We need to use a lowercase version of the algo in S-expression. Unfortunately Libgcrypt has no function for this, thus we need to malloc and first. Fixes-commit: ebf24e3 Signed-off-by: Werner Koch <[email protected]>
* agent: SSH support improvement.NIIBE Yutaka2016-08-091-1/+1
| | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (ssh_handler_request_identities): Skip a key with error, not giving up to handle the request itself. * agent/cvt-openpgp.c (extract_private_key): Support "ecdsa" key. -- Note that "ecdsa" key is still in use by old versions of gpg-agent through its SSH handling (until 2.1.14). With old versions of gpg-agent, adding ECDSA key by ssh-add command, "ecdsa" key will be created. So, "ecdsa" key should be supported. For g10/gpg, "ecdsa" and "ecdh" was only used in some experimental versions of libgcrypt, with parameters. We now use "ecc" for all cases in released versions. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: More clean up of SSH support.NIIBE Yutaka2016-08-081-94/+29
| | | | | | | | | | | | | | | | | | | | | * common/util.h (get_pk_algo_from_key): New. * common/sexputil.c (get_pk_algo_from_key): The implementation. * agent/gpg-agent.c: Remove include of openpgpdefs.h. * agent/command-ssh.c (struct ssh_key_type_spec): Use integer ALGO. (ssh_key_types): Update with GCRY_PK_*. (make_cstring, sexp_extract_identifier): Remove. (sexp_key_construct): Use gcry_pk_algo_name to get ALGO string. (ssh_key_to_blob): Use cadr to get value list. (ssh_key_type_lookup): Lookup with integer ALGO. (ssh_receive_key): Follow the change of ssh_key_type_lookup. (ssh_send_key_public): Likewise. Use get_pk_algo_from_key to get ALGO. -- This fixes the regresson introduced by the commit 894789c3299dc47a8c1ccaaa7070382f0fae0262. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Clean up SSH support.NIIBE Yutaka2016-08-061-127/+11
| | | | | | | | | * agent/command-ssh.c (file_to_buffer): Remove. (ssh_handler_request_identities): Use agent_public_key_from_file. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Add known keys to sshcontrol.Justus Winter2016-07-191-7/+9
| | | | | | | | | * agent/command-ssh.c (ssh_identity_register): Add a key to sshcontrol even if it is already in the private key store. * tests/openpgp/ssh.scm: Test this. GnuPG-bug-id: 2316 Signed-off-by: Justus Winter <[email protected]>
* Replace use of opt.homedir by accessor functions.Werner Koch2016-06-071-2/+2
| | | | | | | | | | | | | | | | | | | * common/homedir.c (the_gnupg_homedir): New var. (gnupg_set_homedir): New. (gnupg_homedir): New. * g10/options.h (struct opt): Remove 'homedir' and replace all users by the new accessor functions. * g13/g13-common.h (struct opt): Ditto. * scd/scdaemon.h (struct opt): Ditto. * sm/gpgsm.h (struct opt): Ditto. * dirmngr/dirmngr.h (struct opt): Ditto. * agent/preset-passphrase.c (opt_homedir): Ditto. * agent/protect-tool.c (opt_homedir): Ditto. -- This will make detection of a non-default homedir easier. Signed-off-by: Werner Koch <[email protected]>
* agent: Implement new protection mode openpgp-s2k3-ocb-aes.Werner Koch2016-04-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/protect.c (agent_protect): Add arg use_ocb. Change all caller to pass -1 for default. * agent/protect-tool.c: New option --debug-use-ocb. (oDebugUseOCB): New. (opt_debug_use_ocb): New. (main): Set option. (read_and_protect): Implement option. * agent/protect.c (OCB_MODE_SUPPORTED): New macro. (PROT_DEFAULT_TO_OCB): New macro. (do_encryption): Add args use_ocb, hashbegin, hashlen, timestamp_exp, and timestamp_exp_len. Implement OCB. (agent_protect): Change to support OCB. (do_decryption): Add new args is_ocb, aadhole_begin, and aadhole_len. Implement OCB. (merge_lists): Allow NULL for sha1hash. (agent_unprotect): Change to support OCB. (agent_private_key_type): Remove debug output. -- Instead of using the old OpenPGP way of appending a hash of the plaintext and encrypt that along with the plaintext, the new scheme uses a proper authenticated encryption mode. See keyformat.txt for a description. Libgcrypt 1.7 is required. This mode is not yet enabled because there would be no way to return to an older GnuPG version. To test the new scheme use gpg-protect-tool: ./gpg-protect-tool -av -P abc -p --debug-use-ocb <plain.key >prot.key ./gpg-protect-tool -av -P abc -u <prot.key Any key from the private key storage should work. Signed-off-by: Werner Koch <[email protected]>
* ssh: Accept OpenSSH *cert-v01 key variants.Werner Koch2016-01-121-38/+136
| | | | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (SPEC_FLAG_WITH_CERT): New. (ssh_key_types): Add OpenSSH cert types. (stream_read_string): Allow a dummy read. (ssh_receive_mpint_list): Pass SPEC by reference. (ssh_receive_mpint_list): New arg CERT and use it. (ssh_receive_key): Read certificate into an estream object and modify parser to make use of that object. -- This is a first step to support certificate via the agent. The only effect of this change is the removal of an error message parsing the certificate. Note that ssh-add sends the private key anyway first and only then follows with the certificate+private key. What we need to implement next is a way to store the certificate in the agent and return it on request. Signed-off-by: Werner Koch <[email protected]>
* Fix typos found using codespell.Justus Winter2015-11-171-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/cache.c: Fix typos. * agent/call-pinentry.c: Likewise. * agent/call-scd.c: Likewise. * agent/command-ssh.c: Likewise. * agent/command.c: Likewise. * agent/divert-scd.c: Likewise. * agent/findkey.c: Likewise. * agent/gpg-agent.c: Likewise. * agent/w32main.c: Likewise. * common/argparse.c: Likewise. * common/audit.c: Likewise. * common/audit.h: Likewise. * common/convert.c: Likewise. * common/dotlock.c: Likewise. * common/exechelp-posix.c: Likewise. * common/exechelp-w32.c: Likewise. * common/exechelp-w32ce.c: Likewise. * common/exechelp.h: Likewise. * common/helpfile.c: Likewise. * common/i18n.h: Likewise. * common/iobuf.c: Likewise. * common/iobuf.h: Likewise. * common/localename.c: Likewise. * common/logging.c: Likewise. * common/openpgp-oid.c: Likewise. * common/session-env.c: Likewise. * common/sexputil.c: Likewise. * common/sysutils.c: Likewise. * common/t-sexputil.c: Likewise. * common/ttyio.c: Likewise. * common/util.h: Likewise. * dirmngr/cdblib.c: Likewise. * dirmngr/certcache.c: Likewise. * dirmngr/crlcache.c: Likewise. * dirmngr/dirmngr-client.c: Likewise. * dirmngr/dirmngr.c: Likewise. * dirmngr/dirmngr_ldap.c: Likewise. * dirmngr/dns-stuff.c: Likewise. * dirmngr/http.c: Likewise. * dirmngr/ks-engine-hkp.c: Likewise. * dirmngr/ks-engine-ldap.c: Likewise. * dirmngr/ldap-wrapper.c: Likewise. * dirmngr/ldap.c: Likewise. * dirmngr/misc.c: Likewise. * dirmngr/ocsp.c: Likewise. * dirmngr/validate.c: Likewise. * g10/encrypt.c: Likewise. * g10/getkey.c: Likewise. * g10/gpg.c: Likewise. * g10/gpgv.c: Likewise. * g10/import.c: Likewise. * g10/keydb.c: Likewise. * g10/keydb.h: Likewise. * g10/keygen.c: Likewise. * g10/keyid.c: Likewise. * g10/keylist.c: Likewise. * g10/keyring.c: Likewise. * g10/mainproc.c: Likewise. * g10/misc.c: Likewise. * g10/options.h: Likewise. * g10/packet.h: Likewise. * g10/parse-packet.c: Likewise. * g10/pkclist.c: Likewise. * g10/pkglue.c: Likewise. * g10/plaintext.c: Likewise. * g10/server.c: Likewise. * g10/sig-check.c: Likewise. * g10/sqlite.c: Likewise. * g10/tdbio.c: Likewise. * g10/test-stubs.c: Likewise. * g10/tofu.c: Likewise. * g10/trust.c: Likewise. * g10/trustdb.c: Likewise. * g13/create.c: Likewise. * g13/mountinfo.c: Likewise. * kbx/keybox-blob.c: Likewise. * kbx/keybox-file.c: Likewise. * kbx/keybox-init.c: Likewise. * kbx/keybox-search-desc.h: Likewise. * kbx/keybox-search.c: Likewise. * kbx/keybox-update.c: Likewise. * scd/apdu.c: Likewise. * scd/app-openpgp.c: Likewise. * scd/app-p15.c: Likewise. * scd/app.c: Likewise. * scd/ccid-driver.c: Likewise. * scd/command.c: Likewise. * scd/iso7816.c: Likewise. * sm/base64.c: Likewise. * sm/call-agent.c: Likewise. * sm/call-dirmngr.c: Likewise. * sm/certchain.c: Likewise. * sm/gpgsm.c: Likewise. * sm/import.c: Likewise. * sm/keydb.c: Likewise. * sm/minip12.c: Likewise. * sm/qualified.c: Likewise. * sm/server.c: Likewise. * tools/gpg-check-pattern.c: Likewise. * tools/gpgconf-comp.c: Likewise. * tools/gpgkey2ssh.c: Likewise. * tools/gpgparsemail.c: Likewise. * tools/gpgtar.c: Likewise. * tools/rfc822parse.c: Likewise. * tools/symcryptrun.c: Likewise. Signed-off-by: Justus Winter <[email protected]>
* agent: Fix function return type for check_cb and agent_askpin.NIIBE Yutaka2015-10-091-3/+3
| | | | | | | | | | | | * agent/call-pinentry.c (unlock_pinentry): Return gpg_error_t. (start_pinentry, setup_qualitybar): Likewise. (agent_askpin): Fix return value check of check_cb. * agent/command-ssh.c (reenter_compare_cb): Return gpg_error_t. (ssh_identity_register): Fix return value check of agent_askpin. * agent/cvt-openpgp.c (try_do_unprotect_cb): Return gpg_error_t. * agent/findkey.c (try_unprotect_cb): Likewise. * agent/genkey.c (reenter_compare_cb): Return gpg_error_t. (agent_ask_new_passphrase): Fix return value check of agent_askpin.
* agent: Fix alignment problem with the second passphrase struct.Werner Koch2015-10-021-3/+12
| | | | | | | | | | | | | | | | | | | | * agent/genkey.c (agent_ask_new_passphrase): Use a separate malloc for PI2. Check return value of the malloc function. * agent/command-ssh.c (ssh_identity_register): Use a separate malloc for PI2. Wipe PI2. -- For whatever stupid reasons I once allocated only one memory area and split that into PI and PI2. This is actually a common pattern with malloc but here we used a made up object size and do not take the extra alignment required into account. One of these not yet hit by a (sig)bus PC/VAX hacker bugs. Instead of trying to fix the alignment, it is better to use a second calloc for the second struct. GnuPG-bug-id: 2112 Signed-off-by: Werner Koch <[email protected]>
* agent: Fix registering SSH Key of Ed25519.NIIBE Yutaka2015-09-161-6/+8
| | | | | | | | * agent/command-ssh.c (stream_read_string): Add the prefix of 0x40. -- GnuPG-bug-id: 2096
* agent: Protect commit 135b1e3 against misbehaving Libgcrypt.Werner Koch2015-09-011-1/+1
| | | | | | * agent/command-ssh.c (ssh_key_to_blob): Check DATALEN. Signed-off-by: Werner Koch <[email protected]>
* agent: Fix SSH public key for EdDSA.NIIBE Yutaka2015-08-311-0/+5
| | | | * agent/command-ssh.c (ssh_key_to_blob): Remove the prefix 0x40.
* agent: Raise the maximum password length. Don't hard code it.Neal H. Walfield2015-08-241-4/+4
| | | | | | | | | | | | | * agent/agent.h (MAX_PASSPHRASE_LEN): Define. * agent/command-ssh.c (ssh_identity_register): Use it instead of a hard-coded literal. * agent/cvt-openpgp.c (convert_from_openpgp_main): Likewise. * agent/findkey.c (unprotect): Likewise. * agent/genkey.c (agent_ask_new_passphrase): Likewise. -- Signed-off-by: Neal H. Walfield <[email protected]>. GnuPG-bug-id: 2038
* agent: Use different translation func for Pinentry strings.Werner Koch2015-06-301-14/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * po/Makevars (XGETTEXT_OPTIONS): Add keyword "L_". * common/i18n.c (i18n_localegettext): New stub. * common/i18n.h: Expand the LunderscoreIMPL macro. * agent/agent.h (L_): New. (LunderscoreIMPL): New. * agent/call-pinentry.c (setup_qualitybar): Add arg ctrl anc change caller. * agent/findkey.c (try_unprotect_cb): Add local var ctrl. * agent/genkey.c (check_passphrase_constraints): Replace xtryasprintf by xtrystrdup to avoid gcc warning. Unfortinately this changes the string. (agent_ask_new_passphrase): Cleanup the use of initial_errtext. -- Static strings in gpg-agent need to be translated according to the locale set by the caller. This is required so that a gpg-agent can be started in one locale and a gpg can be run in another. If we don't do this the static strings (prompt, buttons) are not or in the wrong locale translated while dynamic strings (e.g. key description) uses the locale of gpg. This is only the first part of the change the actual local switching still needs to be implemented. Debian-bug-id: 788983 Signed-off-by: Werner Koch <[email protected]>
* agent: Send the new SETKEYINFO command to the Pinentry.Werner Koch2015-04-141-2/+2
| | | | | | | | | | * agent/call-pinentry.c (agent_askpin): Add args keyinfo and cache_mode. Change all callers to pass (NULL,0) for them. Send SETKEYINFO command. * agent/findkey.c (unprotect): Pass the keygrip and the cache_mode for the new args. Signed-off-by: Werner Koch <[email protected]>
* agent: Fix length test in sshcontrol parser.Werner Koch2015-03-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (ssh_search_control_file): Check S before upcasing it. -- In contradiction to the comment we did not check the length of HEXGRIP and thus the GPG_ERR_INV_LENGTH was never triggered. Detected by Stack 0.3: bug: anti-simplify model: | %cmp8 = icmp ne i32 %i.0, 40, !dbg !986 --> false stack: - /home/wk/s/gnupg/agent/command-ssh.c:1226:0 ncore: 2 core: - /home/wk/s/gnupg/agent/command-ssh.c:1225:0 - buffer overflow - /home/wk/s/gnupg/agent/command-ssh.c:1225:0 - buffer overflow
* agent: Remove useless conditions.Werner Koch2015-03-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/genkey.c (agent_ask_new_passphrase): Remove useless condition. * agent/command-ssh.c (ssh_identity_register): Ditto. -- Detected by Stack 0.3: bug: anti-simplify model: | %tobool22 = icmp ne i8* %arraydecay21, null, !dbg !717 --> true stack: - /home/wk/s/gnupg/agent/genkey.c:385:0 ncore: 1 core: - /home/wk/s/gnupg/agent/genkey.c:362:0 - pointer overflow bug: anti-simplify model: | %tobool35 = icmp ne i8* %arraydecay34, null, !dbg !1053 --> true stack: - /home/wk/s/gnupg/agent/command-ssh.c:3120:0 ncore: 1 core: - /home/wk/s/gnupg/agent/command-ssh.c:3103:0 - pointer overflow
* agent: Keep the session environment for restricted connections.Werner Koch2014-12-191-34/+2
| | | | | | | | | | | | | | | | | * agent/command-ssh.c (setup_ssh_env): Move code to ... * agent/gpg-agent.c (agent_copy_startup_env): .. new function. Change calllers. * agent/command.c (start_command_handler): Call that fucntion for restricted connections. -- A remote connection is and should not be able to setup the local session environment. However, unless --keep-display is used we would be left without an environment and thus pinentry can't be used. The fix is the same as used for ssh-agent connection: We use the default environment as used at the startup of the agent. Signed-off-by: Werner Koch <[email protected]>
* agent: Replace some sprintf.Werner Koch2014-12-021-4/+1
| | | | | | | | | * agent/call-scd.c (agent_card_pksign): Replace sprintf by bin2hex. * agent/command-ssh.c (ssh_identity_register): Ditto. * agent/pkdecrypt.c (agent_pkdecrypt): Replace sprintf by put_membuf_printf. Signed-off-by: Werner Koch <[email protected]>
* Change a couple of files to use abbreviated copyright notes.Werner Koch2014-11-041-2/+2
| | | | | | | | | -- Also fixed some of my own copyright notices due to the termination of my assignment. The one displayed by --version is kept at FSF because we had contributors in 2014 with FSF assignments and it gives the FSF some visibility.
* agent: Support pinentries with integrated repeat passphrase feature.Werner Koch2014-10-241-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | * agent/agent.h (struct pin_entry_info_s): Add fields repeat_okay and with_repeat. * agent/call-pinentry.c (close_button_status_cb): Rewrite and check for PIN_REPEAT. Change users to check only the relevant bit. (agent_askpin): Support repeat logic of new Pinentries. * agent/command-ssh.c (ssh_identity_register): Use the new repeat feature. * agent/genkey.c (agent_ask_new_passphrase): Ditto. -- If we need to confirm a passphrase entry (e.g. for new passphrase) we set a flag into the pinentry info block. The we try to use the new pinentry command SETREPEATERROR; if that fails, we continue as usual. If that succeeds we ask the pinentry to show the repeat (confirmation) prompt and on successful return we set another flag in the pinentry info block so that the caller can skip its own confirmation check. A new status line from the pinentry indicates that the feature is actually supported (it may not be supported on certain systems for example when using the ncurses backend). Signed-off-by: Werner Koch <[email protected]>
* agent: Remove left over debug output.Werner Koch2014-09-181-2/+0
| | | | | * agent/command-ssh.c (ssh_signature_encoder_eddsa): Remove debug output.
* agent: Fix auth key comment handling.NIIBE Yutaka2014-05-081-1/+3
| | | | | * agent/command-ssh.c (ssh_send_key_public): Handle the case with no comment.
* agent: Add command DELETE_KEY.Werner Koch2014-04-151-2/+4
| | | | | | | | | | | * agent/command.c (cmd_delete_key): New. * agent/findkey.c (modify_description): Add '%C' feature. (remove_key_file): New. (agent_delete_key): New. * agent/command-ssh.c (search_control_file): Make arg R_DISABLE optional. * configure.ac: Require libgpg-error 1.13.
* agent: EdDSA support for SSH.NIIBE Yutaka2014-04-041-23/+7
| | | | | * agent/command-ssh.c (ssh_signature_encoder_eddsa): Signature is two 32-byte opaque data which should not be interpreted as number.
* agent: Replace es_mopen by es_fopenmem for ssh.Werner Koch2014-03-231-27/+15
| | | | | | | | | | | * agent/command-ssh.c (ssh_read_key_public_from_blob): Use es_fopenmem. (ssh_handler_request_identities): Ditto. (ssh_request_process): Ditto. -- es_fopenmem is easier to understand than the more general function es_mopen. Thus we better use the former for clarity.
* agent: Put ssh key type as comment into sshcontrol.Werner Koch2014-03-221-13/+20
| | | | | | | | * agent/command-ssh.c (ssh_key_type_spec): Add field name. (ssh_key_types): Add human readable names. (add_control_entry): Add arg SPEC and print key type as comment. (ssh_identity_register): Add arg SPEC. (ssh_handler_add_identity): Add var SPEC and pass ssh_receive_key.
* agent: Support the Ed25519 signature algorithm for ssh.Werner Koch2014-03-221-521/+761
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (SPEC_FLAG_IS_EdDSA): New. (ssh_key_types): Add entry for ssh-ed25519. (ssh_identifier_from_curve_name): Move to the top. (stream_read_skip): New. (stream_read_blob): New. (ssh_signature_encoder_rsa): Replace MPIS array by an s-exp and move the s-exp parsing to here. (ssh_signature_encoder_dsa): Ditto. (ssh_signature_encoder_ecdsa): Ditto. (ssh_signature_encoder_eddsa): New. (sexp_key_construct): Rewrite. (ssh_key_extract): Rename to ... (ssh_key_to_blob): .. this and rewrite most of it. (ssh_receive_key): Add case for EdDSA. (ssh_convert_key_to_blob, key_secret_to_public): Remove. (ssh_send_key_public): Rewrite. (ssh_handler_request_identities): Simplify. (data_sign): Add rename args. Add new args HASH and HASHLEN. Make use of es_fopenmen and es_fclose_snatch. Remove parsing into MPIs which is now doe in the sgnature encoder functions. (ssh_handler_sign_request): Take care of Ed25519. (ssh_key_extract_comment): Rewrite using gcry_sexp_nth_string. -- To make the code easier readable most of the Ed25591 work has been done using a new explicit code path. Warning: Libgcrypt 1.6.1 uses a non optimized implementation for Ed25519 and timing attacks might be possible. While working on the code I realized that it could need more rework; it is at some places quite baroque and more complicated than needed. Given that we require Libgcrypt 1.6 anyway, we should make more use of modern Libgcrypt functions.
* agent: Cleanups to prepare implementation of Ed25519.Werner Koch2014-03-221-1/+2
| | | | | | | | | | | | * agent/cvt-openpgp.c: Remove. (convert_to_openpgp): Use gcry_sexp_extract_param. * agent/findkey.c (is_eddsa): New. (agent_is_dsa_key, agent_is_eddsa_key): Check whether ecc means EdDSA. * agent/pksign.c (agent_pksign_do): Add args OVERRIDEDATA and OVERRIDEDATALEN. * common/ssh-utils.c (is_eddsa): New. (get_fingerprint): Take care or EdDSA.
* agent: Fix UPDATESTARTUPTTY for ssh.Werner Koch2014-03-071-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (setup_ssh_env): Fix env setting. -- gniibe reported this to gnupg-devel on 2012-07-04: [...] (2) UPDATESTARTUPTTY doesn't work to switch TTY for pinentry for SSH. [...] Current implementation: In the function start_command_handler_ssh, the logic puts priority on ctrl->session_env which is initialized by agent_init_default_ctrl. There are always GPG_TTY and TERM defined, because lines around 968 in gpg-agent.c, it says: /* Make sure that we have a default ttyname. */ While UPDATESTARTUPTTY updates opt.startup_env, it doesn't affect at all. Here is a patch to point the issue. Tested and works for me. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 9f5578c29adba6d4f7d3650121d07322c2f8d254)
* ssh: Add support for Putty.Werner Koch2014-03-071-0/+146
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/gpg-agent.c [W32]: Include Several Windows header. (opts): Change help text for enable-ssh-support. (opts, main): Add option --enable-putty-support (putty_support, PUTTY_IPC_MAGIC, PUTTY_IPC_MAXLEN): New for W32. (agent_init_default_ctrl): Add and asssert call. (putty_message_proc, putty_message_thread): New. (handle_connections) [W32]: Start putty message thread. * common/sysutils.c (w32_get_user_sid): New for W32 only * tools/gpgconf-comp.c (gc_options_gpg_agent): Add --enable-ssh-support and --enable-putty-support. Make the configuration group visible at basic level. * agent/command-ssh.c (serve_mmapped_ssh_request): New for W32 only. -- This patch enables support for Putty. It has been tested with Putty 0.62 using an Unix created ssh key copied to the private-keys-v1.d directory on Windows and with a manually crafted sshcontrol file. It also works with a smartcard key. May thanks to gniibe who implemented a proxy in Python to test the putty/gpg-agent communication. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 9f32499f99a0817f63f7a73b09bdcebe60d4775d) Resolved conflicts: NEWS agent/agent.h agent/gpg-agent.c: Convert from pth to npth. common/sysutils.c common/sysutils.h
* agent: Fix binary vs. text mode problem in ssh.Werner Koch2014-03-071-32/+39
| | | | | | | | | | | | | | | | | | * agent/command-ssh.c (file_to_buffer) (ssh_handler_request_identities): Open streams in binary mode. (start_command_handler_ssh): Factor some code out to .. (setup_ssh_env): new function. -- This is for now a theoretical fix because there is no ssh client yet which uses the GnuPG style IPC. OpenSSL for Cygwin uses only a quite similar one. gniibe suggested to implement that IPC style in Libassuan so that a Cygwin version of OpenSSL may be used with GnuPG. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit ed056d67c7c93306b68829f83a2565e978dcfd9b) Also fixed one typo.
* Fix commit 04e2c83f.Werner Koch2013-08-281-1/+2
| | | | | * agent/command-ssh.c (stream_read_string): Do not assign to a NULL ptr.
* agent: Fix two compiler warnings.Werner Koch2013-08-281-0/+2
| | | | | | | | | | | | | | * agent/command.c (cmd_preset_passphrase, pinentry_loopback): Use %zu in format string. * scd/ccid-driver.c (ccid_get_atr): Ditto. * agent/command-ssh.c (stream_read_string): Init arg STRING_SIZE to avoid maybe_unitialized warning. -- Actually the first one might have been a problem on big endian machines. Signed-off-by: Werner Koch <[email protected]>
* agent: Extend cmd KEYINFO to return data from sshcontrol.Werner Koch2013-08-081-15/+95
| | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (struct control_file_s): Rename to ssh_control_file_s. (ssh_open_control_file, ssh_close_control_file) (ssh_read_control_file, ssh_search_control_file): New. (control_file_t): Rename and move to ... * agent/agent.h (ssh_control_file_t): here. * agent/command.c (do_one_keyinfo): Add args is_ssh, ttl, disabled, and confirm. Rename unknown keytype indicator from '-' to 'X'. Extend output. (cmd_keyinfo): Add options --ssh-list and --with-ssh. -- This extension allows the development of frontends to manage the sshcontrol file. Signed-off-by: Werner Koch <[email protected]>
* Modernize two format string file name quotes.Werner Koch2013-06-271-2/+2
| | | | --
* Remove some unused variables.Werner Koch2013-02-221-0/+2
| | | | | | | * tools/gpgconf-comp.c (gc_process_gpgconf_conf): Remove unused used_components. * agent/command-ssh.c (ssh_signature_encoder_ecdsa): Mark unused arg. * g13/g13.c (main): Comment variable of yet unimplemented options.
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-22 18:08:30 +0000