security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-02-01 16:33:02 +01:00
Code Activity

Rewrite dns-cert.c to not use the gpg-only iobuf stuff.

Browse Source 
* common/dns-cert.c: Remove iobuf.h.
(get_dns_cert): Rename to _get_dns_cert.  Remove MAX_SIZE arg.  Change
iobuf arg to a estream-t.  Rewrite function to make use of estream
instead of iobuf.  Require all parameters.  Return an gpg_error_t
error instead of the type.  Add arg ERRSOURCE.
* common/dns-cert.h (get_dns_cert): New macro to pass the error source
to _gpg_dns_cert.
* common/t-dns-cert.c (main): Adjust for changes in get_dns_cert.
* g10/keyserver.c (keyserver_import_cert): Ditto.
* doc/gpg.texi (GPG Configuration Options): Remove max-cert-size.
This commit is contained in:
Werner Koch 2011-11-30 17:14:08 +01:00
parent 2a3ac60517
commit b7dfb7fa7c
7 changed files with 186 additions and 109 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
common/ChangeLog
View File

@ -1,3 +1,18 @@
2011-11-30 Werner Koch <wk@gnupg.org>
Rewrite dns-cert.c to not use the gpg-only iobuf stuff.
* dns-cert.c: Remove iobuf.h.
(get_dns_cert): Rename to _get_dns_cert. Remove MAX_SIZE arg.
Change iobuf arg to a estream-t. Rewrite function to make use of
estream instead of iobuf. Require all parameters. Return an
gpg_error_t error instead of the type. Add arg ERRSOURCE.
* dns-cert.h (get_dns_cert): New macro to pass the error source to
_gpg_dns_cert.
* t-dns-cert.c (main): Adjust for changes in get_dns_cert.
* estream.c (es_fopenmem_init): New.
* estream.h (es_fopenmem_init): New.
2011-11-29 Werner Koch <wk@g10code.com> 2011-11-29 Werner Koch <wk@g10code.com>
* estream.c (func_mem_create): Don't set FUNC_REALLOC if GROW is * estream.c (func_mem_create): Don't set FUNC_REALLOC if GROW is

195
common/dns-cert.c
View File

@ -37,7 +37,6 @@
#endif #endif
#include "util.h" #include "util.h"
#include "iobuf.h"
#include "dns-cert.h" #include "dns-cert.h"
/* Not every installation has gotten around to supporting CERTs /* Not every installation has gotten around to supporting CERTs
@ -63,48 +62,58 @@
#define CERTTYPE_OID 254 /* OID private. */ #define CERTTYPE_OID 254 /* OID private. */
/* Returns -1 on error, 0 for no answer, 1 for PGP provided and 2 for /* Returns 0 on success or an error code. If a PGP CERT record was
IPGP provided. Note that this function returns the first CERT found, a new estream with that key will be returned at R_KEY and
found with a supported type; it is expected that only one CERT the other return parameters are set to NULL/0. If an IPGP CERT
record is used. */ record was found the fingerprint is stored as an allocated block at
int R_FPR and its length at R_FPRLEN; an URL is is allocated as a
get_dns_cert (const char *name, size_t max_size, IOBUF * iobuf, string and returned at R_URL. Note that this function returns the
unsigned char **fpr, size_t * fpr_len, char **url) first CERT found with a supported type; it is expected that only
one CERT record is used. */
gpg_error_t
_get_dns_cert (const char *name, estream_t *r_key,
unsigned char **r_fpr, size_t *r_fprlen, char **r_url,
gpg_err_source_t errsource)
{ {
#ifdef USE_DNS_CERT #ifdef USE_DNS_CERT
#ifdef USE_ADNS #ifdef USE_ADNS
gpg_error_t err;
adns_state state; adns_state state;
adns_answer *answer = NULL; adns_answer *answer = NULL;
int rc;
unsigned int ctype; unsigned int ctype;
int count; int count;
rc = adns_init (&state, adns_if_noerrprint, NULL); *r_key = NULL;
if (rc) *r_fpr = NULL;
*r_fprlen = 0;
*r_url = NULL;
if (adns_init (&state, adns_if_noerrprint, NULL))
{ {
err = gpg_err_make (errsource, gpg_err_code_from_syserror ());
log_error ("error initializing adns: %s\n", strerror (errno)); log_error ("error initializing adns: %s\n", strerror (errno));
return -1; return err;
} }
rc = adns_synchronous (state, name, (adns_r_unknown | my_adns_r_cert), if (adns_synchronous (state, name, (adns_r_unknown | my_adns_r_cert),
adns_qf_quoteok_query, &answer); adns_qf_quoteok_query, &answer))
if (rc)
{ {
err = gpg_err_make (errsource, gpg_err_code_from_syserror ());
/* log_error ("DNS query failed: %s\n", strerror (errno)); */ /* log_error ("DNS query failed: %s\n", strerror (errno)); */
adns_finish (state); adns_finish (state);
return -1; return err;
} }
if (answer->status != adns_s_ok) if (answer->status != adns_s_ok)
{ {
/* log_error ("DNS query returned an error: %s (%s)\n", */ /* log_error ("DNS query returned an error: %s (%s)\n", */
/* adns_strerror (answer->status), */ /* adns_strerror (answer->status), */
/* adns_errabbrev (answer->status)); */ /* adns_errabbrev (answer->status)); */
adns_free (answer); err = gpg_err_make (errsource, GPG_ERR_NOT_FOUND);
adns_finish (state); goto leave;
return 0;
} }
for (rc = 0, count = 0; !rc && count < answer->nrrs; count++) err = gpg_err_make (errsource, GPG_ERR_NOT_FOUND);
for (count = 0; count < answer->nrrs; count++)
{ {
int datalen = answer->rrs.byteblock[count].len; int datalen = answer->rrs.byteblock[count].len;
const unsigned char *data = answer->rrs.byteblock[count].data; const unsigned char *data = answer->rrs.byteblock[count].data;
@ -121,8 +130,12 @@ get_dns_cert (const char *name, size_t max_size, IOBUF * iobuf,
{ {
/* CERT type is PGP. Gpg checks for a minimum length of 11, /* CERT type is PGP. Gpg checks for a minimum length of 11,
thus we do the same. */ thus we do the same. */
*iobuf = iobuf_temp_with_content ((char *)data, datalen); *r_key = es_fopenmem_init (0, "rwb", data, datalen);
rc = 1; if (!*r_key)
err = gpg_err_make (errsource, gpg_err_code_from_syserror ());
else
err = 0;
goto leave;
} }
else if (ctype == CERTTYPE_IPGP && datalen && datalen < 1023 else if (ctype == CERTTYPE_IPGP && datalen && datalen < 1023
&& datalen >= data[0] + 1 && fpr && fpr_len && url) && datalen >= data[0] + 1 && fpr && fpr_len && url)
@ -130,50 +143,68 @@ get_dns_cert (const char *name, size_t max_size, IOBUF * iobuf,
/* CERT type is IPGP. We made sure that the data is /* CERT type is IPGP. We made sure that the data is
plausible and that the caller requested this plausible and that the caller requested this
information. */ information. */
*fpr_len = data[0]; *r_fprlen = data[0];
if (*fpr_len) if (*r_fprlen)
{ {
*fpr = xmalloc (*fpr_len); *r_fpr = xtrymalloc (*r_fprlen);
memcpy (*fpr, data + 1, *fpr_len); if (!*r_fpr)
{
err = gpg_err_make (errsource, gpg_err_code_from_syserror ());
goto leave;
}
memcpy (*r_fpr, data + 1, *r_fprlen);
} }
else else
*fpr = NULL; *r_fpr = NULL;
if (datalen > *fpr_len + 1) if (datalen > *r_fprlen + 1)
{ {
*url = xmalloc (datalen - (*fpr_len + 1) + 1); *url = xtrymalloc (datalen - (*r_fprlen + 1) + 1);
memcpy (*url, data + (*fpr_len + 1), datalen - (*fpr_len + 1)); if (!*r_url)
(*url)[datalen - (*fpr_len + 1)] = '\0'; {
err = gpg_err_make (errsource, gpg_err_code_from_syserror ());
xfree (*r_fpr);
*r_fpr = NULL;
goto leave;
}
memcpy (*url, data + (*r_fprlen + 1), datalen - (*r_fprlen + 1));
(*url)[datalen - (*r_fprlen + 1)] = '\0';
} }
else else
*url = NULL; *r_url = NULL;
rc = 2; err = 0;
goto leave;
} }
} }
leave:
adns_free (answer); adns_free (answer);
adns_finish (state); adns_finish (state);
return rc; return err;
#else /*!USE_ADNS*/ #else /*!USE_ADNS*/
gpg_error_t err;
unsigned char *answer; unsigned char *answer;
int ret = -1;
int r; int r;
u16 count; u16 count;
if (fpr) *r_key = NULL;
*fpr = NULL; *r_fpr = NULL;
*r_fprlen = 0;
*r_url = NULL;
if (url) /* Allocate a 64k buffer which is the limit for an DNS response. */
*url = NULL; answer = xtrymalloc (65536);
if (!answer)
return gpg_err_make (errsource, gpg_err_code_from_syserror ());
answer = xmalloc (max_size); err = gpg_err_make (errsource, GPG_ERR_NOT_FOUND);
r = res_query (name, C_IN, T_CERT, answer, max_size); r = res_query (name, C_IN, T_CERT, answer, 65536);
/* Not too big, not too small, no errors and at least 1 answer. */ /* Not too big, not too small, no errors and at least 1 answer. */
if (r >= sizeof (HEADER) && r <= max_size if (r >= sizeof (HEADER) && r <= 65536
&& (((HEADER *) answer)->rcode) == NOERROR && (((HEADER *) answer)->rcode) == NOERROR
&& (count = ntohs (((HEADER *) answer)->ancount))) && (count = ntohs (((HEADER *) answer)->ancount)))
{ {
@ -188,8 +219,10 @@ get_dns_cert (const char *name, size_t max_size, IOBUF * iobuf,
rc = dn_skipname (pt, emsg); rc = dn_skipname (pt, emsg);
if (rc == -1) if (rc == -1)
goto fail; {
err = gpg_err_make (errsource, GPG_ERR_INV_OBJ);
goto leave;
}
pt += rc + QFIXEDSZ; pt += rc + QFIXEDSZ;
/* There are several possible response types for a CERT request. /* There are several possible response types for a CERT request.
@ -204,7 +237,10 @@ get_dns_cert (const char *name, size_t max_size, IOBUF * iobuf,
rc = dn_skipname (pt, emsg); /* the name we just queried for */ rc = dn_skipname (pt, emsg); /* the name we just queried for */
if (rc == -1) if (rc == -1)
break; {
err = gpg_err_make (errsource, GPG_ERR_INV_OBJ);
goto leave;
}
pt += rc; pt += rc;
@ -248,39 +284,54 @@ get_dns_cert (const char *name, size_t max_size, IOBUF * iobuf,
/* 15 bytes takes us to here */ /* 15 bytes takes us to here */
if (ctype == CERTTYPE_PGP && iobuf && dlen) if (ctype == CERTTYPE_PGP && dlen)
{ {
/* PGP type */ /* PGP type */
*iobuf = iobuf_temp_with_content ((char *) pt, dlen); *r_key = es_fopenmem_init (0, "rwb", pt, dlen);
ret = 1; if (!*r_key)
break; err = gpg_err_make (errsource, gpg_err_code_from_syserror ());
else
err = 0;
goto leave;
} }
else if (ctype == CERTTYPE_IPGP else if (ctype == CERTTYPE_IPGP
&& dlen && dlen < 1023 && dlen >= pt[0] + 1 && dlen && dlen < 1023 && dlen >= pt[0] + 1)
&& fpr && fpr_len && url)
{ {
/* IPGP type */ /* IPGP type */
*fpr_len = pt[0]; *r_fprlen = pt[0];
if (*r_fprlen)
if (*fpr_len)
{ {
*fpr = xmalloc (*fpr_len); *r_fpr = xtrymalloc (*r_fprlen);
memcpy (*fpr, &pt[1], *fpr_len); if (!*r_fpr)
{
err = gpg_err_make (errsource,
gpg_err_code_from_syserror ());
goto leave;
}
memcpy (*r_fpr, &pt[1], *r_fprlen);
} }
else else
*fpr = NULL; *r_fpr = NULL;
if (dlen > *fpr_len + 1) if (dlen > *r_fprlen + 1)
{ {
*url = xmalloc (dlen - (*fpr_len + 1) + 1); *r_url = xtrymalloc (dlen - (*r_fprlen + 1) + 1);
memcpy (*url, &pt[*fpr_len + 1], dlen - (*fpr_len + 1)); if (!*r_fpr)
(*url)[dlen - (*fpr_len + 1)] = '\0'; {
err = gpg_err_make (errsource,
gpg_err_code_from_syserror ());
xfree (*r_fpr);
*r_fpr = NULL;
goto leave;
}
memcpy (*r_url, &pt[*r_fprlen + 1], dlen - (*r_fprlen + 1));
(*r_url)[dlen - (*r_fprlen + 1)] = '\0';
} }
else else
*url = NULL; *r_url = NULL;
ret = 2; err = 0;
break; goto leave;
} }
/* Neither type matches, so go around to the next answer. */ /* Neither type matches, so go around to the next answer. */
@ -288,18 +339,18 @@ get_dns_cert (const char *name, size_t max_size, IOBUF * iobuf,
} }
} }
fail: leave:
xfree (answer); xfree (answer);
return ret; return err;
#endif /*!USE_ADNS */ #endif /*!USE_ADNS */
#else /* !USE_DNS_CERT */ #else /* !USE_DNS_CERT */
(void)name; (void)name;
(void)max_size; (void)r_key;
(void)iobuf; (void)r_fpr;
(void)fpr; (void)r_fprlen;
(void)fpr_len; (void)r_url;
(void)url;
return -1; return gpg_err_make (errsource, GPG_ERR_NOT_SUPPORTED);
#endif #endif
} }

9
common/dns-cert.h
View File

@ -19,8 +19,13 @@
#ifndef GNUPG_COMMON_DNS_CERT_H #ifndef GNUPG_COMMON_DNS_CERT_H
#define GNUPG_COMMON_DNS_CERT_H #define GNUPG_COMMON_DNS_CERT_H
int get_dns_cert (const char *name, size_t max_size, iobuf_t *iobuf, gpg_error_t _get_dns_cert (const char *name, estream_t *r_key,
unsigned char **fpr, size_t *fpr_len, char **url); unsigned char **r_fpr, size_t *r_fprlen,
char **r_url,
gpg_err_source_t errsource);
#define get_dns_cert(a,b,c,d,e) \
_get_dns_cert ((a),(b),(c),(d),(e), GPG_ERR_SOURCE_DEFAULT);
#endif /*GNUPG_COMMON_DNS_CERT_H*/ #endif /*GNUPG_COMMON_DNS_CERT_H*/

32
common/t-dns-cert.c
View File

@ -23,18 +23,17 @@
#include <assert.h> #include <assert.h>
#include "util.h" #include "util.h"
#include "iobuf.h"
#include "dns-cert.h" #include "dns-cert.h"
int int
main (int argc, char **argv) main (int argc, char **argv)
{ {
gpg_error_t err;
unsigned char *fpr; unsigned char *fpr;
size_t fpr_len; size_t fpr_len;
char *url; char *url;
int rc; estream_t key;
iobuf_t iobuf;
char const *name; char const *name;
if (argc) if (argc)
@ -55,18 +54,19 @@ main (int argc, char **argv)
printf ("CERT lookup on `%s'\n", name); printf ("CERT lookup on `%s'\n", name);
rc = get_dns_cert (name, 65536, &iobuf, &fpr, &fpr_len, &url); err = get_dns_cert (name, &key, &fpr, &fpr_len, &url);
if (rc == -1) if (err)
fputs ("lookup result: error\n", stdout); printf ("get_dns_cert failed: %s <%s>\n",
else if (!rc) gpg_strerror (err), gpg_strsource (err));
fputs ("lookup result: no answer\n", stdout); else if (key)
else if (rc == 1)
{ {
printf ("lookup result: %d bytes\n", int count = 0;
(int)iobuf_get_temp_length(iobuf));
iobuf_close (iobuf); while (es_getc (key) != EOF)
count++;
printf ("Key found (%d bytes)\n", count);
} }
else if (rc == 2) else
{ {
if (fpr) if (fpr)
{ {
@ -85,9 +85,11 @@ main (int argc, char **argv)
else else
printf ("No URL found\n"); printf ("No URL found\n");
xfree (fpr);
xfree (url);
} }
es_fclose (key);
xfree (fpr);
xfree (url);
return 0; return 0;
} }

3
doc/gpg.texi
View File

@ -1584,9 +1584,12 @@ are available for all keyserver types, some common options are:
Set the proxy to use for HTTP and HKP keyservers. This overrides the Set the proxy to use for HTTP and HKP keyservers. This overrides the
"http_proxy" environment variable, if any. "http_proxy" environment variable, if any.
@ifclear gpgtwoone
@item max-cert-size @item max-cert-size
When retrieving a key via DNS CERT, only accept keys up to this size. When retrieving a key via DNS CERT, only accept keys up to this size.
Defaults to 16384 bytes. Defaults to 16384 bytes.
@end ifclear
@item debug @item debug
Turn on debug output in the keyserver helper program. Note that the Turn on debug output in the keyserver helper program. Note that the

5
g10/ChangeLog
View File

@ -1,3 +1,8 @@
2011-11-30 Werner Koch <wk@g10code.com>
* keyserver.c (keyserver_import_cert): Adjust for changed
get_dns_cert.
2011-11-28 Werner Koch <wk@g10code.com> 2011-11-28 Werner Koch <wk@g10code.com>
* keyserver.c (DEFAULT_MAX_CERT_SIZE): Increase from 16k to 64k. * keyserver.c (DEFAULT_MAX_CERT_SIZE): Increase from 16k to 64k.

36
g10/keyserver.c
View File

@ -1691,9 +1691,10 @@ int
keyserver_import_cert (ctrl_t ctrl, keyserver_import_cert (ctrl_t ctrl,
const char *name,unsigned char **fpr,size_t *fpr_len) const char *name,unsigned char **fpr,size_t *fpr_len)
{ {
gpg_error_t err;
char *domain,*look,*url; char *domain,*look,*url;
IOBUF key; estream_t key;
int type,rc=G10ERR_GENERAL;
look=xstrdup(name); look=xstrdup(name);
@ -1701,30 +1702,25 @@ keyserver_import_cert (ctrl_t ctrl,
if(domain) if(domain)
*domain='.'; *domain='.';
type=get_dns_cert(look,max_cert_size,&key,fpr,fpr_len,&url); err = get_dns_cert (look, &key, fpr, fpr_len, &url);
if (!type || type == -1) if (err)
{ ;
/* There might be an error in res_query which leads to an error else if (key)
return (-1) in the case that nothing was found. Thus we take
all errors as key not found. */
rc = G10ERR_NO_PUBKEY;
}
else if (type==1)
{ {
int armor_status=opt.no_armor; int armor_status=opt.no_armor;
/* CERTs are always in binary format */ /* CERTs are always in binary format */
opt.no_armor=1; opt.no_armor=1;
/* FIXME: Pass CTRL. */ err = import_keys_es_stream (ctrl, key, NULL, fpr, fpr_len,
rc = import_keys_stream (NULL, key, NULL, fpr, fpr_len, opt.keyserver_options.import_options);
opt.keyserver_options.import_options);
opt.no_armor=armor_status; opt.no_armor=armor_status;
iobuf_close(key); es_fclose (key);
key = NULL;
} }
else if(type==2 && *fpr) else if (*fpr)
{ {
/* We only consider the IPGP type if a fingerprint was provided. /* We only consider the IPGP type if a fingerprint was provided.
This lets us select the right key regardless of what a URL This lets us select the right key regardless of what a URL
@ -1736,7 +1732,7 @@ keyserver_import_cert (ctrl_t ctrl,
spec=parse_keyserver_uri(url,1,NULL,0); spec=parse_keyserver_uri(url,1,NULL,0);
if(spec) if(spec)
{ {
rc = keyserver_import_fprint (ctrl, *fpr,*fpr_len,spec); err = keyserver_import_fprint (ctrl, *fpr,*fpr_len,spec);
free_keyserver_spec(spec); free_keyserver_spec(spec);
} }
} }
@ -1745,7 +1741,7 @@ keyserver_import_cert (ctrl_t ctrl,
/* If only a fingerprint is provided, try and fetch it from /* If only a fingerprint is provided, try and fetch it from
our --keyserver */ our --keyserver */
rc = keyserver_import_fprint (ctrl, *fpr,*fpr_len,opt.keyserver); err = keyserver_import_fprint (ctrl, *fpr,*fpr_len,opt.keyserver);
} }
else else
log_info(_("no keyserver known (use option --keyserver)\n")); log_info(_("no keyserver known (use option --keyserver)\n"));
@ -1754,12 +1750,12 @@ keyserver_import_cert (ctrl_t ctrl,
found, but no keyserver" " known (use option found, but no keyserver" " known (use option
--keyserver)\n" ? */ --keyserver)\n" ? */
xfree(url);
} }
xfree(url);
xfree(look); xfree(look);
return rc; return err;
} }
/* Import key pointed to by a PKA record. Return the requested /* Import key pointed to by a PKA record. Return the requested