aboutsummaryrefslogtreecommitdiffstats
path: root/dirmngr/crlcache.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2018-11-12dirmngr: Add FLUSHCRLs commandAndre Heinecke1-1/+3
Summary: * dirmngr/crlcache.c (crl_cache_flush): Also deinit the cache. * dirmngr/server.c (hlp_flushcrls, cmd_flushcrls): New. (register_commands): Add FLUSHCRLS. -- This allows it to flush the CRL cache of a running dirmngr server. This can be useful to debug / analyze CRL issues. GnuPG-Bug-Id: T3967 Differential Revision: https://dev.gnupg.org/D469 Signed-off-by: Andre Heinecke <[email protected]>
2018-04-20dirmngr: More binary I/O on Windows for CRLsAndre Heinecke1-2/+5
* dirmngr/crlcache.c (lock_db_file, crl_cache_insert): Open cache file in binary mode. -- CRLs on Windows would have line ending entries converted. This did not cause problems in a surprising amount of cases but can lead to unexpected and random parse / read errors. Especially with large CRLs like cacert. This bug has been around since 2004. GnuPG-Bug-Id: T3923 Signed-off-by: Andre Heinecke <[email protected]>
2017-11-17dirmngr: Fix double free of a hash context in the error case.Werner Koch1-6/+6
* dirmngr/crlcache.c: Clearly document that this fucntions takes ownership of MD. (abort_sig_check): Allow NULL for MD. (crl_parse_insert): Immediately set MD to NULL. Remove check for md before a calling abort_sig_check. -- GnuPG-bug-id: 3510 Signed-off-by: Werner Koch <[email protected]>
2017-02-21Clean up word replication.Yuri Chornoivan1-1/+1
-- This fixes extra word repetitions (like "the the" or "is is") in the code and docs. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2017-02-21dirmngr: Add special treatment for the standard hkps pool to ntbtls.Werner Koch1-1/+2
* dirmngr/validate.h (VALIDATE_FLAG_SYSTRUST): Remove (VALIDATE_FLAG_EXTRATRUST): Remove (VALIDATE_FLAG_TRUST_SYSTEM): New. (VALIDATE_FLAG_TRUST_CONFIG): New. (VALIDATE_FLAG_TRUST_HKP): New. (VALIDATE_FLAG_TRUST_HKPSPOOL): New. (VALIDATE_FLAG_MASK_TRUST): New. * dirmngr/validate.c (check_header_constants): New. (validate_cert_chain): Call new function. Simplify call to is_trusted_cert. * dirmngr/crlcache.c (crl_parse_insert): Pass VALIDATE_FLAG_TRUST_CONFIG to validate_cert_chain * dirmngr/server.c (cmd_validate): Use VALDIATE_FLAG_TRUST_SYSTEM and VALIDATE_FLAG_TRUST_CONFIG. * dirmngr/http-ntbtls.c (gnupg_http_tls_verify_cb): Check provided TLS context. Set trustclass flags using the new VALIDATE_FLAG_TRUST values. * dirmngr/certcache.c (cert_cache_init): Load the standard pool certificate prior to the --hkp-cacerts. -- Note that this changes the way the standard cert is used: We require that it is installed at /usr/share/gnupg and we do not allow to change it. If this is not desired, the the standard cert can be removed or replaced by a newer one. Signed-off-by: Werner Koch <[email protected]>
2017-02-17dirmngr: Add option --no-crl to the VALIDATE cmd.Werner Koch1-1/+2
* dirmngr/validate.h: Remove enums VALIDATE_MODE_*. (VALIDATE_FLAG_SYSTRUST, VALIDATE_FLAG_EXTRATRUST) (VALIDATE_FLAG_CRL, VALIDATE_FLAG_RECURSIVE) (VALIDATE_FLAG_OCSP, VALIDATE_FLAG_TLS) (VALIDATE_FLAG_NOCRLCHECK): New constants. * dirmngr/validate.c (validate_cert_chain): Change arg 'mode' to 'flags'. Change code accordingly. Remove NO-CRL in TLS mode kludge. * dirmngr/crlcache.c (crl_parse_insert): Change to use flag values for the validate_cert_chain call. * dirmngr/server.c (cmd_validate): Ditto. Add new option --no-crl. Signed-off-by: Werner Koch <[email protected]>
2017-01-11dirmngr: Remove warnings about unused global variables.Werner Koch1-1/+1
* dirmngr/crlcache.c (oidstr_issuingDistributionPoint): Comment. * dirmngr/ocsp.c (oidstr_certHash): Comment. Signed-off-by: Werner Koch <[email protected]>
2016-11-05Change all http://www.gnu.org in license notices to https://Werner Koch1-1/+1
--
2016-09-20dirmngr: Open file CRL's in binary modeAndre Heinecke1-1/+1
* dirmngr/crlcache.c (crl_cache_load): Open file in binary mode. -- This fixes conversion bugs with binary CRL's on Windows. GnuPG-bug-id: issue2448 Signed-off-by: Andre Heinecke <[email protected]>
2016-08-18dirmngr: Remove all system daemon features.Werner Koch1-1/+1
* dirmngr/dirmngr.h (opts): Remove fields 'system_service' and 'system_daemon'. * common/homedir.c (dirmngr_sys_socket_name): Remove. (dirmngr_user_socket_name): Rename to ... (dirmngr_socket_name): this. Change call callers. * common/asshelp.c (start_new_dirmngr): Remove the system socket feature. * tools/gpgconf.c (list_dirs): Do not print "dirmngr-sys-socket". * sm/server.c (gpgsm_server): Adjust for removed system socket feature. * dirmngr/server.c (cmd_getinfo): Ditto. (cmd_killdirmngr): Remove check for system daemon. (cmd_reloaddirmngr): Ditto. * dirmngr/dirmngr.c (USE_W32_SERVICE): Remove macro. (aService): Remove. (opts): Remove --service. (w32_service_control): Remove. (real_main, call_real_main) [W32]: Remove wrapper. (main): Remove Windows system service feature. Remove system dameon feature. Use only the "~/.gnupg/dirmngr_ldapservers.conf" file. * dirmngr/certcache.c (load_certs_from_dir): Remove warning in the system dameon case. * dirmngr/crlcache.c (DBDIR_D): Always use "~/.gnupg/crls.d". * dirmngr/ocsp.c (validate_responder_cert): Do not call validate_cert_chain which was used only in system daemon mode. * dirmngr/validate.c (validate_cert_chain): Always use the code. -- We are now starting dirmngr as needed as a user daemon. The deprecated system daemon mode does not anymore make sense. In case a system wide daemon is required, it is better to setup a dedicated account to run dirmngr and tweak socket permissions accordingly. Signed-off-by: Werner Koch <[email protected]>
2016-08-03dirmngr: Emit correct spelling of "superseded".Daniel Kahn Gillmor1-1/+1
* dirmngr/crlcache.c (list_one_crl_entry): Spell superseded correctly. * dirmngr/ocsp.c (ocsp_invalid): Likewise. This might break some tools which parse the existing output and expect misspellings, but i'm not sure there are many such tools, and we should use standardized orthography going forward. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2016-01-22dirmngr: Indicate that serial numbers are hexadecimal.Werner Koch1-3/+4
* dirmngr/misc.c (hexify_data): Add arg with_prefix. Adjust all callers. * dirmngr/crlcache.c (cache_isvalid): Print "0x" in front of the S/N. -- GnuPG-bug-id: 1147 Signed-off-by: Werner Koch <[email protected]>
2015-11-19dirmngr: Improve error handling.Justus Winter1-0/+1
* dirmngr/crlcache.c (crl_cache_cert_isvalid): Add missing break. -- Found using the Clang Static Analyzer. Signed-off-by: Justus Winter <[email protected]>
2015-11-17Fix typos found using codespell.Justus Winter1-2/+2
* agent/cache.c: Fix typos. * agent/call-pinentry.c: Likewise. * agent/call-scd.c: Likewise. * agent/command-ssh.c: Likewise. * agent/command.c: Likewise. * agent/divert-scd.c: Likewise. * agent/findkey.c: Likewise. * agent/gpg-agent.c: Likewise. * agent/w32main.c: Likewise. * common/argparse.c: Likewise. * common/audit.c: Likewise. * common/audit.h: Likewise. * common/convert.c: Likewise. * common/dotlock.c: Likewise. * common/exechelp-posix.c: Likewise. * common/exechelp-w32.c: Likewise. * common/exechelp-w32ce.c: Likewise. * common/exechelp.h: Likewise. * common/helpfile.c: Likewise. * common/i18n.h: Likewise. * common/iobuf.c: Likewise. * common/iobuf.h: Likewise. * common/localename.c: Likewise. * common/logging.c: Likewise. * common/openpgp-oid.c: Likewise. * common/session-env.c: Likewise. * common/sexputil.c: Likewise. * common/sysutils.c: Likewise. * common/t-sexputil.c: Likewise. * common/ttyio.c: Likewise. * common/util.h: Likewise. * dirmngr/cdblib.c: Likewise. * dirmngr/certcache.c: Likewise. * dirmngr/crlcache.c: Likewise. * dirmngr/dirmngr-client.c: Likewise. * dirmngr/dirmngr.c: Likewise. * dirmngr/dirmngr_ldap.c: Likewise. * dirmngr/dns-stuff.c: Likewise. * dirmngr/http.c: Likewise. * dirmngr/ks-engine-hkp.c: Likewise. * dirmngr/ks-engine-ldap.c: Likewise. * dirmngr/ldap-wrapper.c: Likewise. * dirmngr/ldap.c: Likewise. * dirmngr/misc.c: Likewise. * dirmngr/ocsp.c: Likewise. * dirmngr/validate.c: Likewise. * g10/encrypt.c: Likewise. * g10/getkey.c: Likewise. * g10/gpg.c: Likewise. * g10/gpgv.c: Likewise. * g10/import.c: Likewise. * g10/keydb.c: Likewise. * g10/keydb.h: Likewise. * g10/keygen.c: Likewise. * g10/keyid.c: Likewise. * g10/keylist.c: Likewise. * g10/keyring.c: Likewise. * g10/mainproc.c: Likewise. * g10/misc.c: Likewise. * g10/options.h: Likewise. * g10/packet.h: Likewise. * g10/parse-packet.c: Likewise. * g10/pkclist.c: Likewise. * g10/pkglue.c: Likewise. * g10/plaintext.c: Likewise. * g10/server.c: Likewise. * g10/sig-check.c: Likewise. * g10/sqlite.c: Likewise. * g10/tdbio.c: Likewise. * g10/test-stubs.c: Likewise. * g10/tofu.c: Likewise. * g10/trust.c: Likewise. * g10/trustdb.c: Likewise. * g13/create.c: Likewise. * g13/mountinfo.c: Likewise. * kbx/keybox-blob.c: Likewise. * kbx/keybox-file.c: Likewise. * kbx/keybox-init.c: Likewise. * kbx/keybox-search-desc.h: Likewise. * kbx/keybox-search.c: Likewise. * kbx/keybox-update.c: Likewise. * scd/apdu.c: Likewise. * scd/app-openpgp.c: Likewise. * scd/app-p15.c: Likewise. * scd/app.c: Likewise. * scd/ccid-driver.c: Likewise. * scd/command.c: Likewise. * scd/iso7816.c: Likewise. * sm/base64.c: Likewise. * sm/call-agent.c: Likewise. * sm/call-dirmngr.c: Likewise. * sm/certchain.c: Likewise. * sm/gpgsm.c: Likewise. * sm/import.c: Likewise. * sm/keydb.c: Likewise. * sm/minip12.c: Likewise. * sm/qualified.c: Likewise. * sm/server.c: Likewise. * tools/gpg-check-pattern.c: Likewise. * tools/gpgconf-comp.c: Likewise. * tools/gpgkey2ssh.c: Likewise. * tools/gpgparsemail.c: Likewise. * tools/gpgtar.c: Likewise. * tools/rfc822parse.c: Likewise. * tools/symcryptrun.c: Likewise. Signed-off-by: Justus Winter <[email protected]>
2015-10-28dirmngr: Fix NULL-deref while loading a CRL.Werner Koch1-1/+2
* dirmngr/crlcache.c (crl_parse_insert): Set error before leaping to failure. -- GnuPG-bug-id: 2082 Signed-off-by: Werner Koch <[email protected]>
2015-10-14cleanup: Fix confusion between gpg_error_t and gpg_err_code_t.NIIBE Yutaka1-1/+1
* dirmngr/crlcache.c (hash_dbfile): Use gpg_error_t for ERR. * kbx/keybox-update.c (keybox_set_flags): Call gpg_err_code_from_syserror.
2015-06-18dirmngr: Fix the cleanup zombies fix (685b782).Werner Koch1-7/+6
* dirmngr/ldap-wrapper.c (ldap_wrapper_thread): Do not close the stdout reader after EOF from read_log_data. * dirmngr/crlcache.c (crl_cache_reload_crl): Close the reader before the next iteration. -- I assumed that the log_fd also has a reader object but that reader object is used for stdout and needs to be closed by the consumer. The real bug with the non-released ldap_wrapper control objects was that when looping over distribution points we did not closed the used reader object before the next iteration. Now, the test case had more than one DP and thus we lost one reader object. Signed-off-by: Werner Koch <[email protected]>
2015-06-09dirmngr: Avoid crash due to an empty crls.d/DIR.txt.Werner Koch1-1/+3
* dirmngr/crlcache.c (check_dir_version): Avoid segv. -- GnuPG-bug-id: 1842 Debian-bug-id: 776611
2014-08-26Switch to the libgpg-error provided estream.Werner Koch1-5/+4
* configure.ac (NEED_GPG_ERROR_VERSION): Reguire 1.14. (GPGRT_ENABLE_ES_MACROS): Define. (estream_INIT): Remove. * m4/estream.m4: Remove. * common/estream-printf.c, common/estream-printf.h: Remove. * common/estream.c, common/estream.h: Remove. * common/init.c (_init_common_subsystems): Call gpgrt initialization.
2012-08-24Fix typos spotted during translationsDavid Prévot1-1/+1
* agent/genkey.c: s/to to/to/ * sm/*.c: s/failed to allocated/failed to allocate/ * sm/certlist.c, ./dirmngr/validate.c: s/should have not/should not have/ * g10/seskey.c: missing closing parenthesis * dirmngr/crlcache.c: s/may has/may have/ Consistency fix: * g10/gpg.c, kbx/kbxutil.c, sm/gpgsm.c: uppercase after Syntax * dirmngr/dirmngr_ldap: no period in Syntax * dirmngr/dirmngr-client.c: infinitive for option description: s/certificates are expected/expect certificates/
2012-06-05Change all quotes in strings and comments to the new GNU standard.Werner Koch1-48/+48
The asymmetric quotes used by GNU in the past (`...') don't render nicely on modern systems. We now use two \x27 characters ('...'). The proper solution would be to use the correct Unicode symmetric quotes here. However this has the disadvantage that the system requires Unicode support. We don't want that today. If Unicode is available a generated po file can be used to output proper quotes. A simple sed script like the one used for en@quote is sufficient to change them. The changes have been done by applying sed -i "s/\`\([^'\`]*\)'/'\1'/g" to most files and fixing obvious problems by hand. The msgid strings in the po files were fixed with a similar command.
2012-04-26avoid buffer strncpy-induced buffer overrunJim Meyering1-2/+8
* dirmngr/crlcache.c (open_dir): Ensure that both this_update and next_update member strings are NUL-terminated.
2011-02-04Nuked almost all trailing white space.post-nuke-of-trailing-wsWerner Koch1-123/+122
We better do this once and for all instead of cluttering all future commits with diffs of trailing white spaces. In the majority of cases blank or single lines are affected and thus this change won't disturb a git blame too much. For future commits the pre-commit scripts checks that this won't happen again.
2010-12-14Tweaks for gpgconf.Werner Koch1-3/+28
Fixed dirmngr bug 1010.
2010-12-14Change --dameon home directory to /gnupg under WinceWerner Koch1-1/+1
2010-10-18Fix a signing problem with the cardWerner Koch1-1/+13
2010-08-12Fix dirmngr problems on CE.Werner Koch1-3/+3
Add new dirmngr commands. Minor other fixes.
2010-08-06More work on the dirmngr. It now builds for W32 and W32CE and quickWerner Koch1-8/+2
tests show that it works on W32.
2010-07-23Some work on the dirmngrWerner Koch1-1/+1
2010-07-16Some work on porting dirmngr (unfinished)Werner Koch1-118/+119
Ported gpgtar to W32.
2010-06-09Merged Dirmngr with GnuPG.Werner Koch1-0/+2544
A few code changes to support dirmngr.
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-29 14:00:23 +0000