aboutsummaryrefslogtreecommitdiffstats
path: root/dirmngr (follow)
Commit message (Collapse)AuthorAgeFilesLines
* dirmngr: Mark hosts dead on ENETDOWN.Werner Koch2017-01-111-0/+5
| | | | | | | * dirmngr/ks-engine-hkp.c (handle_send_request_error): Take care of ENETDOWN. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Fix Tor access for v6 addresses.Werner Koch2017-01-111-1/+63
| | | | | | | | | | | | | | | | | | | * dirmngr/http.c (use_socks): New. (my_sock_new_for_addr): New. (connect_server): Replace assuan_sock_new by my_sock_new_for_addr. -- Libassuan always uses 127.0.0.1 to connect to the local Tor proxy. https.c used to create a socket for the actual address family and thus the connect call in Libassuan fails when it tries to connect to a v6 address using a v4 socket. It would be cleaner to have the my_sock_new_for_addr function as a public interface in Libassuan; for now we need to duplicate some code. from Libassuan. GnuPG-bug-id: 2902 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Remove warnings about unused global variables.Werner Koch2017-01-112-2/+2
| | | | | | | * dirmngr/crlcache.c (oidstr_issuingDistributionPoint): Comment. * dirmngr/ocsp.c (oidstr_certHash): Comment. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Implement debug option "network" for http.Werner Koch2017-01-111-0/+1
| | | | | | * dirmngr/dirmngr.c (parse_rereadable_options): Set http debugging. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Add debug code to http.c.Werner Koch2017-01-112-22/+54
| | | | | | | | | | | | | * dirmngr/http.c (opt_verbose, opt_debug): New vars. (http_set_verbose): New function. (_my_socket_new): Add debug output. (_my_socket_ref, _my_socket_unref, session_unref): Call log_debug if OPT_DEBUG has ben set to 2 in a debugger. (http_session_new, http_session_ref): Ditto. (send_request, http_start_data): Print debug output for the request. (parse_response): Change to use log_debug_string for the response. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Use "pgpkey-hkps" and "pgpkey-hkp" for SRV record lookups.Werner Koch2017-01-091-29/+34
| | | | | | | | | | | | | * dirmngr/ks-engine-hkp.c (map_host): Chnage arg NO_SRV to SRVTAG. (make_host_part): Rewrite. -- This fixes a regression from 2.0 and 1.4 where these tags have been in used since 2009. For whatever reason this was not ported to 2.1 and "hkp" was always used. GnuPG-bug-id: 2451 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Do not use a SRV record for HKP if a port was specified.Werner Koch2017-01-093-28/+40
| | | | | | | | | | | | | | | | | * dirmngr/http.h (parsed_uri_s): Add field EXPLICIT_PORT. * dirmngr/http.c (do_parse_uri): That it. * dirmngr/ks-engine-hkp.c (map_host): Add arg NO_SRV. (make_host_part): Ditto. (ks_hkp_resolve): Set NO_SRV from EXPLICIT_PORT. (ks_hkp_search): Ditto. (ks_hkp_get): Ditto. (ks_hkp_put): Ditto. -- This implements the behaviour of the keyserver helpers from 1.4 and 2.0. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Implement experimental SRV record lookup for WKD.Werner Koch2017-01-081-1/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/server.c (cmd_wkd_get): Support SRV records. -- This patch changes the way a WKD query is done. Now we first look for a SRV record for service "openpgpkey" and port "tcp" under the to-be-queried domain. If such a record was found and the target host matches the to-be-queried domain or is a suffix to that domain, that target host is used instead of the domain name. The SRV record also allows to change the port and obviously can be used for load-balancing. For example a query for the submission address of example.org with the SRV record specification _openpgpkey._tcp IN SRV 0 0 0 wkd.foo.org. IN SRV 0 0 0 wkd.example.net. IN SRV 0 0 4711 wkd.example.org. (queried using the name "_openpgpkey._tcp.example.org") would fetch from this URL: https://wkd.example.org:4711/.well-known/openpgpkey/submission-address Note that the first two SRV records won't be used because foo.org and example.net do not match example.org. We require that the target host is identical to the domain or be a subdomain of it. This is so that an attacker modifying the SRV records needs to setup a server in a sub-domain of the actual domain and can't use an arbitrary domain. Whether this is a sufficient requirement is not clear and needs further discussion. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Improve debug output for TLS.Werner Koch2017-01-081-0/+8
| | | | | | * dirmngr/misc.c (dump_cert): Also print SubjectAltNames. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Change internal SRV lookup API.Werner Koch2017-01-085-37/+31
| | | | | | | | | | | | | * dirmngr/dns-stuff.c (get_dns_srv): Add args SERVICE and PROTO. * dirmngr/http.c (connect_server): Simplify SRV lookup. * dirmngr/ks-engine-hkp.c (map_host): Ditto. * dirmngr/t-dns-stuff.c (main): Adjust for changed get_dns_srv. -- This new API is more convenient because it includes commonly used code. Note that right now http.c's SRV record code is not used. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Strip root zone suffix from libdns SRV results.Werner Koch2017-01-081-0/+4
| | | | | | | | | * dirmngr/dns-stuff.c (getsrv_libdns): Strip trailing dot from the target. -- See-also: b200e636ab20d2aa93d9f71f3789db5a04af0a56 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Make sure Tor mode is also set for DNS on SIGHUP.Werner Koch2017-01-035-37/+14
| | | | | | | | | | | | | | | | | | | * dirmngr/dns-stuff.c (enable_dns_tormode): Always succeed. (reload_dns_stuff): Reset tor port. * dirmngr/dirmngr.c (set_tor_mode): Also enable Tor mode for DNS. (main): Remove warning that Tor mode may not fully work. * dirmngr/server.c (cmd_dns_cert): Remove explicit Tor for DNS initialization. * dirmngr/t-dns-stuff.c (main): Remove option --new-circuit and error checking for enable_dns_tormode. -- This patch also resets the port on SIGHUP so that after starting Tor SIGHUP is sufficient to use Tor. Without the SIGHUP and when not using the Tor browser Dirmngr would keep on trying the Tor browser port. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: New debug message on correctly initialized libdns.Werner Koch2017-01-031-1/+4
| | | | | | | | | | * dirmngr/dns-stuff.c (libdns_init): Add debug level diagnostic on success. -- This output may help to avoid questions when evaluating an Assuan log. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Strip root zone suffix from libdns cname results.Werner Koch2017-01-021-0/+11
| | | | | | | | * dirmngr/dns-stuff.c (resolve_name_libdns): Strip trailing dot. (get_dns_cname_libdns): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Fix for --disable-libdns usage.NIIBE Yutaka2016-12-231-3/+9
| | | | | | | | | | | | | | * dirmngr/dns-stuff.c (enable_recursive_resolver, set_dns_nameserver) (reload_dns_stuff): Conditionalize with USE_LIBDNS. (get_h_errno_as_gpg_error): Map HOST_NOT_FOUND to GPG_ERR_NO_NAME. -- get_dns_srv assumes error code of GPG_ERR_NO_NAME when no SRV record available. Signed-off-by: NIIBE Yutaka <[email protected]> GnuPG-bug-id: 2889
* dirmngr: New option --resolver-timeout.Werner Koch2016-12-205-5/+55
| | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dns-stuff.c (DEFAULT_TIMEOUT): New. (opt_timeout): New var. (set_dns_timeout): New. (libdns_res_open): Set the default timeout. (libdns_res_wait): Use configurable timeout. (resolve_name_libdns): Ditto. * dirmngr/dirmngr.c (oResolverTimeout): New const. (opts): New option --resolver-timeout. (parse_rereadable_options): Set that option. (main) <aGPGConfList>: Add --nameserver and --resolver-timeout. * tools/gpgconf-comp.c (gc_options_dirmngr): Add --resolver-timeout and --nameserver. * dirmngr/http.c (connect_server): Fix yesterday introduced bug in error diagnostic. -- This timeout is a pretty crude thing because libdns has a few other internal timeouts as well. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Fix problems with the getsrv function.Werner Koch2016-12-196-42/+103
| | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dns-stuff.c (opt_debug, opt_verbose): New vars. (set_dns_verbose): New func. (libdns_switch_port_p): Add debug output. (resolve_dns_name): Ditto. (get_dns_cert): Ditto. (get_dns_cname): Ditto. (getsrv_libdns, getsrv_standard): Change SRVCOUNT to an unsigend int. (getsrv): Rename to ... ((get_dns_srv): this. Add arg R_COUNT and return an error. Add debug output. * dirmngr/http.c: Adjust for chnaged getsrv(). * dirmngr/ks-engine-hkp.c (map_host): Ditto. * dirmngr/t-dns-stuff.c (main): Ditto. Call set_dns_verbose. * dirmngr/dirmngr.c (parse_rereadable_options): Call set_dns_verbose. -- Due to our switch to Libdns getsrv didn't worked correctly because it returned -1 for an NXDOMAIN. However, it is perfectly okay to have no SRV record and thus we change the way this function is called to be aligned with the other functions and also map NXDOMAIN to a zero SRV record count. Signed-off-by: Werner Koch <[email protected]>
* dirmngr,w32: Hack around a select problem.Werner Koch2016-12-191-2/+3
| | | | | | | | | | | | | | | | | * dirmngr/dns.c (FD_SETSIZE): Bump up to 1024. (dns_poll): Return an error instead of hitting an assertion failure. -- For unknown reasons socket() return fd with values 244, 252, 268. The latter is above the FD_SETSIZE of 256. It seems that select has been build with a highler FD_SETSIZE limit. Bump up to a reasonable large value. A better solution would be to grab some code from npth_eselect to replace select. We could also use npth_eselect direclty in dns-stuff.c instead of using dns_res_poll. Signed-off-by: Werner Koch <[email protected]>
* Remove unused debug flags and add "dns" and "network".Werner Koch2016-12-192-0/+6
| | | | | | | | | | | | | | | | | | * g10/options.h (DBG_CARD_IO_VALUE, DBG_CARD_IO): Remove. * g10/gpg.c (debug_flags): Remove "cardio". * agent/agent.h (DBG_COMMAND_VALUE, DBG_COMMAND): Remove. * agent/gpg-agent.c (debug_flags): Remove "command". * scd/scdaemon.h (DBG_COMMAND_VALUE, DBG_COMMAND): Remove. * scd/scdaemon.c (debug_flags): Remove "command". * dirmngr/dirmngr.h (DBG_DNS_VALUE, DBG_DNS): New. (DBG_NETWORK_VALUE, DNG_NETWORK): New. * dirmngr/dirmngr.c (debug_flags): Add "dns" and "network". -- Note that "dns" and "network" are not yet used but will soon be added to dirmngr. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Fix setup of libdns for W32.Werner Koch2016-12-172-2/+61
| | | | | | | | | | | * configure.ac (DNSLIB) {W32]: Add -liphlpapi. * dirmngr/dns-stuff.c [W32]: Include iphlpapi.h and define WIN32_LEAN_AND_MEAN. (libdns_init) [W32]: Use GetNetworkParams to get the nameserver. * dirmngr/t-dns-stuff.c (init_sockets): New. (main): Call it. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Auto-switch from Tor port to Torbrowser port.Werner Koch2016-12-161-7/+61
| | | | | | | | | | | | | * dirmngr/dns-stuff.c (libdns_tor_port): New var. (set_dns_nameserver): Clear that var. (libdns_init): Init var to the default port. (libdns_switch_port_p): New func. (resolve_dns_name): Use function to switch the port (get_dns_cert): Ditto. (getsrv): Ditto. (get_dns_cname): Ditto. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Use one context for all libdns queries.Werner Koch2016-12-164-1/+56
| | | | | | | | | | | | | | | | | * dirmngr/dns-stuff.c (libdns_reinit_pending): New var. (enable_recursive_resolver): Set var. (set_dns_nameserver): Ditto. (libdns_init): Avoid double initialization. (libdns_deinit): New. (reload_dns_stuff): New. (libdns_res_open): Act upon LIBDNS_REINIT_PENDING. * dirmngr/t-dns-stuff.c (main): Call reload_dns_stuff to release memory. * dirmngr/dirmngr.c (cleanup): Ditto. (dirmngr_sighup_action): Call reload_dns_stuff to set LIBDNS_REINIT_PENDING. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Pass Tor credentials to libdns.Werner Koch2016-12-161-9/+13
| | | | | | | | | * dirmngr/dns-stuff.c (tor_credentials): Replace by ... (tor_socks_user, tor_socks_password): new vars. (enable_dns_tormode): Set these new vars. (libdns_res_open): Tell libdns the socks credentials. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Factor common libdns code out.Werner Koch2016-12-161-95/+86
| | | | | | | | | | | | * dirmngr/dns-stuff.c (libdns_res_open): New. Replace all libdns_init and dns-res_open by a call to this func. (libdns_res_submit): New wrapper. Replace all dns_res_sumbit calls. (libdns_res_wait): New function. (resolve_name_libdns): Replace loop by libdns_res_wait. (get_dns_cert_libdns): Ditto. (getsrv_libdns): Ditto. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: First patch to re-enable Tor support.Werner Koch2016-12-151-32/+100
| | | | | | | | | | | | * dirmngr/dns-stuff.c (SOCKS_PORT, TOR_PORT, TOR_PORT2): New constants. (libdns_init): Start adding tor support. (resolve_name_libdns): Pass socks hosts to dns_res_open. (get_dns_cert_libdns): Ditto. (getsrv_libdns): Ditto. (get_dns_cname_libdns): Ditto. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: New configure option --disable-libdns.Werner Koch2016-12-146-7/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * configure.ac: Add option --disable-libdns (USE_LIBDNS): New ac_subst and am_conditional. (USE_C99_CFLAGS): Set only if libdns is used. * dirmngr/Makefile.am (dirmngr_SOURCES): Move dns.c and dns.h to ... (dirmngr_SOURCES) [USE_LIBDNS0: here. (t_common_src): Ditto. * dirmngr/dirmngr.c (oRecursiveResolver): New constant. (opts): New option "--recursive-resolver". (parse_rereadable_options): Set option. * dirmngr/t-dns-stuff.c (main): Add option --recursive-resolver. * dirmngr/server.c (cmd_getinfo): Depend output of "dnsinfo" on the new variables. * dirmngr/dns-stuff.c: Include dns.h only if USE_DNSLIB is defined. Also build and call dnslib functions only if USE_DNSLIB is defined. (recursive_resolver): New var. (enable_recursive_resolver): New func. (recursive_resolver_p): New func. -- In case users run into problems building GnuPG, the configure option allows to disable that support and continue w/o Tor support using the system resolver. --recursive-resolver was easy enough to implement and may be useful in some situation. It does not fully work, though. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Implement CERT record lookup via libdns.Werner Koch2016-12-141-2/+188
| | | | | | | * dirmngr/dns-stuff.c (get_dns_cert_libdns): New. (get_dns_cert_standard): Fix URL malloc checking. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Implement CNAME and SRV record lookup via libdns.Werner Koch2016-12-141-64/+283
| | | | | | | | | | | | * dirmngr/dns-stuff.c (dns_free): New macro. (libdns): Move var to the top. (libdns_error_to_gpg_error): Map error codes to the new gpg-error codes. (resolve_name_libdns): Restructure code. (getsrv_libdns): New. (get_dns_cname_libdns): New. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Fix bugs in the standard resolver code.Werner Koch2016-12-141-24/+60
| | | | | | | | | | | | | | | * dirmngr/dns-stuff.c: Include dirmngr-err.h to set the correct error source. (get_h_errno_as_gpg_error): New. (get_dns_cert_libdns): Fix error code. (getsrv_libdns): Add arg R_COUNT and return an error code. (getsrv_standard): Ditto. Fix handling of res_query errors and provide the correct size for the return buffer. (getsrv): Adjust for changed worker functions. (get_dns_cname_standard): Fix handling of res_query errors and provide the correct size for the return buffer. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Require a c99 compilerWerner Koch2016-12-141-4/+5
| | | | | | | | | | | | | | | | | | * configure.ac (USE_C99_CFLAGS): New ac_subst. Set to -std=gnu99 for gcc. * dirmngr/Makefile.am (AM_CFLAGS): Add USE_C99_CFLAGS. (t_http_CFLAGS): Ditto. (t_ldap_parse_uri_CFLAGS): Ditto. (t_dns_stuff_CFLAGS): Ditto. -- C99 and the GCC option is required for use with dns.c which makes heavy use of C99 features. We should consider to switch GnuPG entirely to C99 but enable gcc warnings to detect features which are not supported by not-real-c99 compilers and which makes audits harder (VLA etc.). Signed-off-by: Werner Koch <[email protected]>
* dirmngr: New libdns snapshotJustus Winter2016-12-142-63/+160
|
* dirmngr: Add basic libdns supportJustus Winter2016-12-144-14/+12736
| | | | | | | | | | | | | | | | * dirmngr/dns.c: New file. * dirmngr/dns.h: New file. * dirmngr/Makefile.am (dirmngr_SOURCES): Add new files. * dirmngr/dns-stuff.c: Include dns.h.xxx use libdns (libdns): New global var for the libdns state. (libdns_error_to_gpg_error): New. (libdns_init): New. (resolve_name_libdns): New. (get_dns_cert_libdns): New stub. (getsrv_libdns): New stub. (get_dns_cname_libdns): New stub. Signed-off-by: Justus Winter <[email protected]>
* dirmngr,build: Remove support for ADNS.Justus Winter2016-12-142-490/+24
| | | | | | | | | | | | | | | * autogen.rc: Remove '--with-adns' argument. * configure.ac: Remove check for ADNS. * dirmngr/dns-stuff.c: Remove all code that uses ADNS. * dirmngr/server.c (cmd_getinfo): Update status line. * doc/dirmngr.texi: Do not mention ADNS. -- We used ADNS to support queries over Tor. However, our patch to ADNS that adds Tor support was never accepted upstream. Furthermore, there are other shortcomings that let us to consider alternatives. Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Improve ntbtls support.NIIBE Yutaka2016-12-141-4/+71
| | | | | | | | | * dirmngr/http.c [HTTP_USE_NTBTLS] (close_tls_session): Release. (send_request): Call ntbtls_set_transport. (cookie_read, cookie_write): Implement. (cookie_close): Add initial implementation for ntbtls. Signed-off-by: NIIBE Yutaka <[email protected]>
* Fix 2 compiler warnings.Werner Koch2016-12-081-1/+4
| | | | | | | | * dirmngr/loadswdb.c: Set ERR on malloc failure. * g10/passphrase.c (passphrase_to_dek): Initialize all fields of HELP_S2K. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Add option --standard-resolver.Werner Koch2016-12-017-319/+430
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (oStandardResolver): New constant. (opts): New option --standard-resolver. (parse_rereadable_options): Set option. * dirmngr/dns-stuff.c: Refactor all code to support the new option. (standard_resolver): New var. (enable_standard_resolver, standard_resolver_p): New func. * dirmngr/http.c (connect_server): Remove USE_DNS_SRV build conditional. * dirmngr/ks-engine-hkp.c (map_host): Ditto. * dirmngr/server.c (cmd_getinfo) <dnsinfo>: Take care of new option * configure.ac (HAVE_ADNS_IF_TORMODE): Remove var ADNSLIB. ac_define USE_ADNS in the adns checking code. Remove options --disable-dns-srv and --disable-dns-cert. Always look for the system resolver. Print warning if no system resolver was found. (USE_DNS_CERT, USE_DNS_SRV): Remove ac_defines. (HAVE_SYSTEM_RESOLVER): New ac_define. (USE_DNS_SRV): Remove am_conditional; not used anyway. -- This option allows for runtime switching to the system's standard resolver. This is mainly useful to work around possible bugs in the optional resolver libraries (as of now ADNS). Note that on Windows there is no code to use systems's resolver and thus for full functionality dirmngr must be build with a separate resolver. This patch also does way with configure options to disable the use of CERT and SRV records. Signed-off-by: Werner Koch <[email protected]>
* agent,dirmngr: Tiny restructuring.Werner Koch2016-11-291-4/+12
| | | | | | | | | | * agent/gpg-agent.c (handle_connections): Add a comment. * dirmngr/dirmngr.c (main): Move assuan_sock_close of the listening socket to ... (handle_connections): here. Add a comment why we keep the listening socket open during a shutdown. Signed-off-by: Werner Koch <[email protected]>
* agent,dirmngr: Handle corner case in shutdown mode.Werner Koch2016-11-291-5/+7
| | | | | | | | | | | | | * agent/gpg-agent.c (handle_connections): Keep on selecting on the inotify fd even when a shutdown is pending. * dirmngr/dirmngr.c (handle_connections): Ditto. Also simplifyy the use of the HAVE_INOTIFY_INIT cpp conditional. -- Without that patch we won't notice a removed socket when a shutdown is pending. This is somewhat related to bug report 2849. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Lazily launch ldap reaper thread.Daniel Kahn Gillmor2016-11-292-20/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (main): Avoid calling ldap_wrapper_launch_thread() Before we need it. * dirmngr/ldap-wrapper.c (ldap_wrapper): Call ldap_wrapper_launch_thread() just in time (before any attempt to use an ldap subprocess). -- A dirmngr process that never looks anything up in LDAP has no need for a reaper thread, but one was started automatically. This thread wakes up every two seconds to look for ldap processes that might never have been running. We won't start more than one reaper thread for any given dirmngr due to the static int "done" in ldap_wrapper_launch_thread(), so it's safe to call this every time there is a use of ldap_wrapper. If someone wants to do further dirmngr optimizations for ldap users, the reaper thread itself could use dynamically-calculated timeouts (and probably needs to be alerted dynamically when a new ldap subprocess is available so it can re-calculate those timeouts). Note: It's not clear to me how to test ldap access effectively; i know of no public ldap services that i can verify against, and i do not run my own ldap servers. If someone has a publicly-available ldap server that developers can run tests against, i would be happy to hear about it. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* dirmngr: Use a longer timer tick interval.Werner Koch2016-11-181-10/+3
| | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (TIMERTICK_INTERVAL): Always use 60 seconds like we did for WindowsCE. -- Given that the timer tick is only used for housekeeping tasks and these are done every 10 minutes, it makes no sense to use 2 seconds. The minor drawback is tha the housekeeping may be delayed by one minute. NB: For the purpose of power saving, we already make sure that the process wakes up at the full second so that it is synchronized to the wakeup time of other processes. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: More w32 system daemon cleanupDaniel Kahn Gillmor2016-11-181-14/+0
| | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (handle_tick): Remove w32 tests for shutdown_pending; no longer needed. -- In d83ba4897bf217d1045c58d1b99e52bd31c58812, we removed the Windows-specific system daemon features, where shutdown_pending was set from w32_service_control(). shutdown_pending is now never assigned outside of handle_signal() or within an inotify test, neither of which are available on w32. As a result, this stanza in handle_tick() should be dead code, and can be removed to keep things simple. Signed-off-by: Daniel Kahn Gillmor <[email protected]> s/win32/w32/ to please RMS ;-) -wk
* dirmngr: Use a default keyserver if none is explicitly setDaniel Kahn Gillmor2016-11-171-1/+5
| | | | | | | | | | | | | | | | | | * configure.ac: Define DIRMNGR_DEFAULT_KEYSERVER. * dirmngr/server.c (ensure_keyserver): Use it if no keyservers are set. * doc/dirmngr.texi: Document this behavior. -- A user who doesn't specify a keyserver, but asks gnupg to fetch a key currently just gets a simple error messages "No keyserver available". If the user is asking to contact a keyserver, we should have a reasonable default, and not require them to fiddle with settings when they might not know what settings to choose. This patch makes the default hkps://hkps.pool.sks-keyservers.net. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* dirmngr: Add system CAs if no hkp-cacert is givenDaniel Kahn Gillmor2016-11-171-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (http_session_new): If the user isn't talking to the HKPS pool, and they have not specified any hkp-cacert, then we should default to the system CAs, rather than nothing. * doc/dirmngr.texi: Document choice of CAs. -- Consider three possible classes of dirmngr configuration: a) no hkps:// keyserver URLs at all (communication with keyservers is entirely in the clear) b) hkps:// keyserver URLs, but no hkp-cacert directives c) hkps:// keyserver URLs, and at least one hkp-cacert directive class (a) provides no confidentiality of requests. class (b) currently will never work because the server certificate cannot be validated. class (c) is currently supported as intended. This patch allows users with configurations in class (b) to work as most users expect (relying on the system certificate authorities), without affecting users in classes (a) or (c). Signed-off-by: Daniel Kahn Gillmor <[email protected]> o minor indentation fix - wk
* dirmngr: Register hkp-cacert even if the file doesn't exist yetDaniel Kahn Gillmor2016-11-172-9/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (parse_readable_options): If we're unable to turn an argument for hkp-cacert into an absolute filename, terminate completely. * dirmngr/http.c (http_register_tls_ca): Show a warning if file is not immediately accessible, but register it anyway. -- Without this changeset, the condition of the filesystem when dirmngr is initialized will have an effect on later activities of dirmngr. For example, if a file identified by a hkp-cacert directive doesn't exist when dirmngr starts, dirmngr will behave as though it simply didn't have the hkp-cacert directive set at all, even if the file should appear later. dirmngr currently behaves differently if no hkp-cacert directives have been set then it does when at least one hkp-cacert directive has been set. For example, its choice of CA cert for hkps://hkps.pool.sks-keyservers.net depends on whether a TLS CA file has been registered. That behavior shouldn't additionally depend on the state of the filesystem at the time of dirmngr launch. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* dirmngr: Auto-sownload the swdb.lstWerner Koch2016-11-172-10/+24
| | | | | | | | | | | | | | | | * dirmngr/dirmngr.h (struct opt): Add field allow_version_check. * dirmngr/dirmngr.c (oAllowVersionCheck): New. (opts): Add --allow-version-check. (network_activity_seen): New variable. (parse_rereadable_options): Set opt.allow_version_check. (main) <aGPGConfList>: Do not anymore set the no change flag for Windows. Add allow-version-check. (netactivity_action): Set network_activity_seen. (housekeeping_thread): Call dirmngr_load_swdb. * tools/gpgconf-comp.c (gc_options_dirmngr): Add allow-version-check. Make "use-tor" available at Basic level. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Improve downloading of swdb.lst.Werner Koch2016-11-171-18/+54
| | | | | | | | | * dirmngr/loadswdb.c (time_of_saved_swdb): Aslo return the "verified" timestamp. (dirmngr_load_swdb): Avoid unnecessary disk or network access witout FORCE. Do not update swdb.lst if it did not change. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Add command to only load the swdb.Werner Koch2016-11-164-385/+379
| | | | | | | | | | | | | | | | | | | | | | | * dirmngr/loadswdb.c: New. * dirmngr/Makefile.am (dirmngr_SOURCES): Add that file. * dirmngr/server.c: Remove includes cpparray.h and exectool.h. (cmd_loadswdb): New. (parse_version_number,parse_version_string): Remove. (my_mktmpdir, cmp_version): Remove. (fetch_into_tmpdir): Remove. (struct verify_swdb_parm_s): Remove. (verify_swdb_status_cb): Remove. (cmd_versioncheck): Remove. (register_commands): Register LOADSWDB. Remove VERSIONCHECK. -- This change is required to to the new design where gpgconf does the version check w/o network access and only dirmngr is responsible for getting the swdb. In the next installment the loading will be triggered as needed. Signed-off-by: Werner Koch <[email protected]>
* scd,dirmngr: Keep the standard fds when daemonizing.Werner Koch2016-11-161-1/+11
| | | | | | | | | | | | | * dirmngr/dirmngr.c (main): Before calling setsid do not close the standard fds but connect them to /dev/null. * scd/scdaemon.c (main): Ditto. Noet that the old test for a log stream was even reverted. -- Note that this was fixed for gpg-agent 10 years ago on 2006-11-09. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Prepare to trigger jobs by network activity.Werner Koch2016-11-113-1/+44
| | | | | | | | | | | * dirmngr/http.c (netactivity_cb): New. (http_register_netactivity_cb): New. (notify_netactivity): New. (connect_server): Call that function. * dirmngr/dirmngr.c (main): Call http_register_netactivity_cb. (netactivity_action): New stub handler. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Improve concurrency in the non-adns case.Werner Koch2016-11-102-35/+60
| | | | | | | | * dirmngr/dns-stuff.c (map_adns_status_to_gpg_error): New. (resolve_name_adns, get_dns_cert, get_dns_cname): Use that function. (getsrv) [!USE_ADNS]: Call res_query outside of nPth. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-05 18:54:45 +0000