aboutsummaryrefslogtreecommitdiffstats
path: root/dirmngr (follow)
Commit message (Collapse)AuthorAgeFilesLines
* dirmngr: Use system certs if --hkp-cacert is not used.Werner Koch2017-09-183-1/+26
| | | | | | | | | | | | | | | | * dirmngr/certcache.c (any_cert_of_class): New var. (put_cert): Set it. (cert_cache_deinit): Clear it. (cert_cache_any_in_class): New func. * dirmngr/http-ntbtls.c (gnupg_http_tls_verify_cb): Add hack to override empty list of HKP certs. -- This patch carries the changes for GNUTLS from commit 7c1613d41566f7d8db116790087de323621205fe over to NTBTLS. NTBTLS works quite different and thus we need to do it this way. Signed-off-by: Werner Koch <[email protected]>
* dirmngr,w32: Fix http connection timeout problem.Werner Koch2017-07-311-1/+5
| | | | | | | | * dirmngr/http.c (connect_with_timeout) [W32]: Take care of EAGAIN. -- GnuPG-bug-id: 3319 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Do not use a blocking connect in Tor mode.Werner Koch2017-07-262-0/+25
| | | | | | | * dirmngr/http.c (http_raw_connect): Disable the timeout in Tor mode. (send_request): Ditto. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Auto-enable Tor on startup or reload.Werner Koch2017-07-262-3/+13
| | | | | | | | * dirmngr/dirmngr.c (dirmngr_use_tor): Test for Tor availibility. -- GnuPG-bug-id: 2935 Signed-off-by: Werner Koch <[email protected]>
* agent,dirmngr: Check for homedir removal also using stat(2).Werner Koch2017-07-261-4/+18
| | | | | | | | | | | | | | | | | * agent/gpg-agent.c (have_homedir_inotify): New var. (reliable_homedir_inotify): New var. (main): Set reliable_homedir_inotify. (handle_tick): Call stat on the homedir. (handle_connections): Mark availibility of the inotify watch. * dirmngr/dirmngr.c (handle_tick): Call stat on the homedir. (TIMERTICK_INTERVAL_SHUTDOWN): New. (handle_connections): Depend tick interval on the shutdown state. -- The stat call is used on systems which do not support inotify and also when we assume that the inotify does not work reliable. Signed-off-by: Werner Koch <[email protected]>
* w32: Also change the directory on daemon startup.Werner Koch2017-07-251-2/+5
| | | | | | | | | | | | | | | * agent/gpg-agent.c (main): Always to the chdir. * dirmngr/dirmngr.c (main): Ditto. * scd/scdaemon.c (main): Ditto. -- Note that only dirmngr did not call the chdir with --no-detach. thus we kept it this way. Tested gpg-agent by checking the properties shown by procexp. Gnupg-bug-id: 2670 Signed-off-by: Werner Koch <[email protected]>
* common: New functions gnupg_daemon_rootdir and gnupg_chdir.Werner Koch2017-07-251-2/+4
| | | | | | | | | | | * common/sysutils.c (gnupg_chdir): New. * common/homedir.c (gnupg_daemon_rootdir): New. * agent/gpg-agent.c (main): Use these functions instead chdir("/"). * dirmngr/dirmngr.c (main): Ditto. * scd/scdaemon.c (main): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
* Revert "w32: Change directory on daemon startup."Werner Koch2017-07-251-10/+3
| | | | | | -- This reverts commit 78ebc62604d77600b9865950610717d28c6027a2. Gnupg-bug-id: 2670
* dirmngr: Add annotation for fallthrough.NIIBE Yutaka2017-07-251-41/+41
| | | | | | * dirmngr/dns.c: Add /* FALL THROUGH */ to clarify. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Print a SOURCE status for WKD requests.Werner Koch2017-07-241-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/server.c (cmd_wkd_get): Print a SOURCE status. -- This status allows to see whether the the WKD requests has been resolved from the standard address or from a SRV record derived one. We return only host and port and not the .well-known suffix because that is obvious. HTTP redirects are not taken in account because they may chnage at any time due to load balancing etc and not relevant for gpg which may use the URL to detect changes in the WKD results. For example my current setup returns S SOURCE https://wkd.gnupg.org for [email protected]. Without a SRV record S SOURCE https://gnupg.org would have been returned. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: New function dirmngr_status_printf.Werner Koch2017-07-242-0/+21
| | | | | | * dirmngr/server.c (dirmngr_status_printf): New. Signed-off-by: Werner Koch <[email protected]>
* w32: Change directory on daemon startup.Marcus Brinkmann2017-07-241-3/+10
| | | | | | | | | | | | * agent/gpg-agent.c [HAVE_W32_SYSTEM]: Include <direct.h>. (main) [HAVE_W32_SYSTEM]: Change working directory to \. * dirmngr/dirmngr.c [HAVE_W32_SYSTEM]: Include <direct.h>. (main) [HAVE_W32_SYSTEM]: Change working directory to \. * scd/scdaemon.c [HAVE_W32_SYSTEM]: Include <direct.h>. (main) [HAVE_W32_SYSTEM]: Change working directory to \. Signed-off-by: Marcus Brinkmann <[email protected]> GnuPG-bug-id: 2670
* dirmngr: More minor fix.NIIBE Yutaka2017-07-241-0/+4
| | | | | | * dirmngr/http.c (send_request): Care the case of !USE_TLS. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: More minor fixes.NIIBE Yutaka2017-07-242-1/+2
| | | | | | | * dirmngr/http.c (http_verify_server_credentials): Duplicated const. * dirmngr/ldap.c (parse_one_pattern): Add comment. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Minor fix for Windows.NIIBE Yutaka2017-07-241-1/+1
| | | | | | * dirmngr/http.c (connect_with_timeout): Use FD2INT. Signed-off-by: NIIBE Yutaka <[email protected]>
* dnsmngr: Fix use of CPP.NIIBE Yutaka2017-07-201-5/+23
| | | | | | | | * dirmngr/dns.c (HAVE_STATIC_ASSERT, HAVE___ATOMIC_FETCH_ADD) (DNS_HAVE_SOCKADDR_UN, HAVE_SOCK_NONBLOCK): Don't use defined to be expanded for expression evaluation. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Forbid redirects from .onion to clearnet URIs.Justus Winter2017-07-192-0/+50
| | | | | | | | | | | * dirmngr/ks-engine-hkp.c (send_request): Forbid redirects from .onion to clearnet URIs. * dirmngr/ks-engine-http.c (ks_http_fetch): Likewise. -- This protects users from misconfigured .onion services. GnuPG-bug-id: 3087 Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Implement TLS over http proxies.Justus Winter2017-07-191-1/+90
| | | | | | | | | * dirmngr/http.c (send_request): If a http proxy is to be used, and we want to use TLS, try to use the CONNECT method to get a connection to the target server. GnuPG-bug-id: 2940 Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Log http response in debug mode.Justus Winter2017-07-191-2/+2
| | | | | | * dirmngr/http.c (parse_response): Log http response in debug mode. Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Amend TLS handling.Justus Winter2017-07-191-1/+3
| | | | | | | * dirmngr/http.c (http_wait_response): Get the 'use_tls' flag from the write cookie, not from the URI. Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Fix connecting to http proxies.Justus Winter2017-07-191-1/+1
| | | | | | | * dirmngr/http.c (send_request): Do not use the 'srvtag' intended for the target host to connect to the http proxy. Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Fix handling of proxy URIs.Justus Winter2017-07-191-2/+3
| | | | | | * dirmngr/http.c (send_request): We do not support socks4. Signed-off-by: Justus Winter <[email protected]>
* Fix usage of ARGPARSE_OPTS.NIIBE Yutaka2017-07-192-2/+2
| | | | | | | | | * agent/gpg-agent.c, agent/preset-passphrase.c, dirmngr/dirmngr-client.c, dirmngr/dirmngr_ldap.c, kbx/kbxutil.c, tools/gpg-check-pattern.c, tools/gpgconf.c, tools/gpgsplit.c, tools/symcryptrun.c: Use ARGPARSE_end. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Honor http keyserver URLs.Justus Winter2017-07-183-6/+15
| | | | | | | | | | | | | | | * dirmngr/http.c (parse_uri): Keep an unmodified copy of the URI. * dirmngr/http.h (struct parsed_uri_s): New field 'original'. * dirmngr/ks-action.c (ks_action_get): Properly handle http and https URLs. -- If a key has a http or https URL as preferred keyserver, fetch the key from there. Previously, dirmngr unconditionally interpreted these URLs as hkp servers. GnuPG-bug-id: 2924 Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Fix memory leak.Justus Winter2017-07-181-1/+1
| | | | | | * dirmngr/http.c (parse_uri): Properly free partial results. Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Fix memory leak.Justus Winter2017-07-181-0/+5
| | | | | | * dirmngr/http.c (http_release_parsed_uri): Free 'params'. Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Fix license note in server.cWerner Koch2017-07-121-15/+0
| | | | | | | | | | -- This double license note was accidentally added while only wanting to add another copyright line. Fixes-commit: 3419a339d9c4e800bf30e9021e05982d8c1021c1 Signed-off-by: Werner Koch <[email protected]>
* build: Add missing LIBASSUAN_CFLAGS to dirmngr/.Werner Koch2017-06-231-3/+5
| | | | | | | | | | * dirmngr/Makefile.am (t_http_CFLAGS): Add LIBASSUAN_CFLAGS. (t_ldap_parse_uri_CFLAGS): Ditto. (t_dns_stuff_CFLAGS): Ditto. -- GnuPG-bug-id: 2424 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Properly handle SRV records.Justus Winter2017-06-201-51/+72
| | | | | | | | | | | | | | | | | | | | | | | * dirmngr/ks-engine-hkp.c (enum ks_protocol): New type. (struct hostinfo_s): New flags indicating whether we already did a A lookup, or a SRV lookup per protocol. Turn 'port' into an array. (create_new_hostinfo): Initialize new fields. (add_host): Update the port for the given protocol. (map_host): Simplify hosttable lookup misses. Check the SRV records for both protocols on demand, do the A lookup just once. Return the correct port. -- Previously, if a host had both a SRV record for hkp and hkps, the wrong port was used for the protocol that was used second, because the hostinfo did not store a port per protocol, and the hosttable does not discriminate between hosts using the protocol. Fix this by querying the SRV records on demand, storing a port per protocol, and returning the right port. GnuPG-bug-id: 3033 Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Refactor variable-sized array code.Justus Winter2017-06-201-55/+74
| | | | | | | | | | | | | | | | | | | | | * dirmngr/ks-engine-hkp.c (struct hostinfo_s): Add explicit length and size fields. (MAX_POOL_SIZE): New macro. (create_new_hostinfo): Initialize new fields. (host_in_pool_p): Adapt. (select_random_host): Likewise. (add_host): Likewise. Move the resizing logic here. (hostinfo_sort_pool): New function. (map_host): Simplify. Move the resizing logic away from here. (ks_hkp_mark_host): Adapt. (ks_hkp_print_hosttable): Likewise. -- The current code assumes that the pool array is only filled when the hostinfo object is created. This patch removes that limitation. GnuPG-bug-id: 3033 Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Fix typo.Justus Winter2017-06-201-1/+1
| | | | | -- Signed-off-by: Justus Winter <[email protected]>
* Change license of some files to LGPLv2.1.Werner Koch2017-06-192-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * COPYING.LIB: Rename to COPYING.LGPL3. * COPYING.LGPL21: New. * COPYING.GPL2: New. * Makefile.am: Distribute them. * AUTHORS: Update license pointers. Add BSI as copyright holder. * common/compliance.c, common/compliance.h: Add BSI copyright notice. Break overlong lines. * dirmngr/loadswdb.c: Add BSI copyright notices. * dirmngr/server.c: Ditto. * tools/call-dirmngr.c: Change license to LGPLv2.1. Add BSI copyright notice. * tools/call-dirmngr.h: Ditto. * tools/gpg-wks-client.c: Ditto. * tools/gpg-wks-server.c: Ditto. * tools/gpg-wks.h: Ditto. * tools/mime-maker.c: Ditto. * tools/mime-maker.h: Ditto. * tools/mime-parser.c: Ditto. * tools/mime-parser.h: Ditto. * tools/send-mail.c: Ditto. * tools/send-mail.h: Ditto. * tools/wks-receive.c: Ditto. * tools/wks-util.c: Ditto. * tools/rfc822parse.c, tools/rfc822parse.h: Change license to LGPLv2.1. -- For better deployment it seems to be better to make the Web Key Directory code more easily available. Some code was been developed under contract of the BSI. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Implement querying nameservers over IPv6.Justus Winter2017-06-131-1/+179
| | | | | | | | | | | | | | | | * dirmngr/dns.c (dns_so_check): Reinitialize sockets on address family mismatch. (enum dns_res_state): New states for querying over IPv6. (dns_res_exec): Implement the new states by copying and modifying the IPv4 variants. Branch to their respective counterparts if the current list of resolvers using the current address family is exhausted. -- This allows dirmngr to resolve names on systems where the nameservers are only reachable via IPv6. GnuPG-bug-id: 2990 Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Implement HTTP connect timeouts of 15 or 2 seconds.Werner Koch2017-06-086-8/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (oConnectTimeout, oConnectQuickTimeout): New enums. (opts): New options --connect-timeout and --connect-quick-timeout. (DEFAULT_CONNECT_TIMEOUT): New. (DEFAULT_CONNECT_QUICK_TIMEOUT): New. (parse_rereadable_options): Handle new options. (post_option_parsing): New. Use instead of direct calls to set_debug() and set_tor_mode (). (main): Setup default timeouts. (dirmngr_init_default_ctrl): Set standard connect timeout. * dirmngr/dirmngr.h (opt): New fields connect_timeout and connect_quick_timeout. (server_control_s): New field timeout. * dirmngr/ks-engine-finger.c (ks_finger_fetch): Pass timeout to http_raw_connect. * dirmngr/ks-engine-hkp.c (send_request): Call http_session_set_timeout. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/server.c (cmd_wkd_get, cmd_ks_search, cmd_ks_get) (cmd_ks_fetch): Implement --quick option. -- The standard connect timeouts are way to long so we add a timeout to the connect calls. Also implement the --quick option which is already used by gpg for non-important requests (e.g. looking up a key for verification). Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Allow a timeout for HTTP and other TCP connects.Werner Koch2017-06-083-17/+200
| | | | | | | | | | | | | | | | | | | | | | | * dirmngr/http.c: Include fcntl.h. (http_session_s): Add field 'connect_timeout'. (http_session_new): Clear that. (http_session_set_timeout): New function. (my_wsagetlasterror) [W32]: New. (connect_with_timeout): New function. (connect_server): Add arg 'timeout' and call connect_with_timeout. (send_request): Add arg 'timeout' and pass it to connect_server. (http_raw_connect): Add arg 'timeout'. (http_open): Pass TIMEOUT from the session to connect_server. -- Note that the non-blocking connect we implement is traditional a pretty non-portable thing due to slighly different semantics. The code uses the strategy W. Richard Stevens suggested in 1998. Hopefully current OS versions got it all right. The code has not been tested on Windows. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: This towel should better detect a changed resolv.conf.Werner Koch2017-05-251-4/+6
| | | | | | | | | * dirmngr/dns-stuff.c (resolv_conf_changed_p): Fix initialization time issue. -- Fixes-commit: b5f356e9fba2d99909f8f54d7b7e6836bed87b68 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Re-init libdns resolver on towel change of resolv.confWerner Koch2017-05-251-1/+46
| | | | | | | | | | | | | | | * dirmngr/dns-stuff.c: Include sys/stat.h. (RESOLV_CONF_NAME): New macro to replace a string. (resolv_conf_changed_p): New. (libdns_init): Call new function (libdns_res_open): Ditto. -- Don't panic. This is a simple change Suggested-by: Stefan Bühler <[email protected]> to avoid complicated if-up.d hooks to reload resolv.conf. Signed-off-by: Werner Koch <[email protected]>
* dirmngr,w32: Fix ldap crl read on windowsAndre Heinecke2017-05-151-4/+7
| | | | | | | | | | | | | | | Summary: * dirmngr/ldap-wrapper-ce.c (outstream_cookie_s): Add buffer_read_pos. (buffer_get_data): Use seperate read pos. -- Using a single buffer pos for reading and writing caused the read to return 0 as it read from the end of the buffer. Now we use a seperate reader position. Differential: D427 Signed-off-by: Andre Heinecke <[email protected]>
* g10, sm, dirmngr, common: Add comment for fall through.NIIBE Yutaka2017-05-103-2/+3
| | | | | | | | | | | | | | | * common/b64dec.c (b64dec_proc): Comment to clarify. * dirmngr/cdblib.c (cdb_make_put): Use same pattern to clarify. * dirmngr/dirmngr-client.c (read_pem_certificate): Likewise. * dirmngr/ks-engine-hkp.c (ks_hkp_get): Likewise. * g10/armor.c (unarmor_pump): Likewise. * g10/gpg.c (main): Likewise. * g10/import.c (read_block): Likewise. * g10/keygen.c (make_backsig): Likewise. * g10/pkclist.c (check_signatures_trust): Likewise. * sm/gpgsm.c (main): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* Spelling fixes in docs and comments.NIIBE Yutaka2017-04-289-17/+17
| | | | | | | | | | -- In addition, fix trailing spaces in tests/inittests. GnuPG-bug-id: 3121 Reported-by: ka7 (klemens) Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Fix aliasing problem in dns.c.NIIBE Yutaka2017-04-251-16/+18
| | | | | | | | | | * dirmngr/dns.c (dns_ai_setent): Care about aliasing. -- Co-authored-by: Tomas Mraz GnuPG-bug-id: 3105 Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Fix final close of LISTEN_FD.NIIBE Yutaka2017-04-181-3/+3
| | | | | | * dirmngr/dirmngr.c (handle_connections): Close LISTEN_FD. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Fix API difference for Windows.NIIBE Yutaka2017-04-181-9/+10
| | | | | | | | | * dirmngr/http.c (read_server, write_server): Use assuan_fd_t. (http_wait_response): Use FD2INT to get unsigned integer fd. (read_server, write_server): Likewise. (simple_cookie_read, simple_cookie_write): Use assuan_fd_t. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: More fix for test program.NIIBE Yutaka2017-04-141-0/+4
| | | | | | * dirmngr/t-http.c (main): Care about no TLS. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: More fix for Windows.NIIBE Yutaka2017-04-131-6/+6
| | | | | | | | | * dirmngr/http.c (simple_cookie_read, simple_cookie_write): Only valid with HTTP_USE_NTBTLS. (_my_socket_new): Simply cast to int since it's for debug. (_my_socket_ref, _my_socket_unref): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Fix http.c for sockaddr_storage.NIIBE Yutaka2017-04-131-6/+7
| | | | | | | dirmngr/http.c (use_socks): Use sockaddr_storage. (my_sock_new_for_addr, connect_server): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Fix alignment of ADDR.NIIBE Yutaka2017-04-132-16/+19
| | | | | | | | | | | * dirmngr/dns-stuff.h (dns_addrinfo_s): Use struct sockaddr_storage for size and alignment. * dirmngr/dns-stuff.c (resolve_name_libdns): Follow the change. (resolve_dns_name): Use struct sockaddr_storage. (resolve_addr_standard, resolve_dns_addr): Likewise. (resolve_dns_addr): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Fix thread key type.NIIBE Yutaka2017-04-131-1/+1
| | | | | | * dirmngr/dirmngr.c (my_tlskey_current_fd): Use npth_key_t. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: More fix for Windows.NIIBE Yutaka2017-04-131-1/+5
| | | | | | | * dirmngr/dns.c (socket_fd_t, STDCALL): New. (dns_te_initname): Use. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Fix type of sock.NIIBE Yutaka2017-04-121-1/+1
| | | | | | * dirmngr/http.c (send_request): Use assuan_fd_t for SOCK. Signed-off-by: NIIBE Yutaka <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-14 12:06:54 +0000