* common/homedir.c (w32_bin_is_bin, w32_portable_app) [W32]: New.
(check_portable_app) [W32]: New.
(standard_homedir, default_homedir) [W32]: Support the portable flag.
(w32_rootdir, w32_commondir) [W32]: Ditto.
(gnupg_bindir) [W32]: Ditto.
--
A portable use of GnuPG under Windows means that GnuPG uses a home
directory depending on the location of the actual binary. No registry
variables are considered. The portable mode is enabled if in the
installation directory of the the binary "gpgconf.exe" and a file
"gpgconf.ctl" are found. The latter file shall be empty or consist
only of empty or '#'-style comment lines.
Signed-off-by: Werner Koch <wk@gnupg.org>
* configure.ac (missing_iconv): Set and die if we have no libiconv.
* m4/iconv.m4: Update from libiconv 1.14.
* tools/Makefile.am (gpgtar_LDADD): Add LIBICONV.
* jnlib/utf8conv.c: Always include iconv.h
(load_libiconv): Remove this w32 only function.
(iconv_open, iconv, iconv_close): Remove W32 function pointer.
(set_native_charset): Do not call load_libiconv.
(jnlib_iconv_open, jnlib_iconv, jnlib_iconv_close): Ditto.
--
This patch removes the on-demand-loading of libiconv which we did for
13 years or so. The rationale back then was that libiconv is too
large and often not used. Nowadays all kind of Unix software has been
ported to Windows and many of them require libiconv. Thus in the end
there is no saving from not requiring it. It also remove a common
source of trouble with awrong or missing iconv.dll.
Signed-off-by: Werner Koch <wk@gnupg.org>
* agent/gpg-agent.c (opts, main): Add option --no-allow-mark-trusted.
Put this option into the gpgconf-list.
(main): Enable opt.allow_mark_trusted by default.
* tools/gpgconf-comp.c (gc_options_gpg_agent): Replace
allow-mark-trusted by no-allow-mark-trusted.
* agent/trustlist.c (agent_marktrusted): Always set the "relax" flag.
--
These changes have been in effect for the Gpg4win Windows version
since 2011-01-24 and thus first released with Gpg4win 2.1.0. Given
the current state of PKIX it does not make any sense to lure the Unix
user into false security by making it harder to trust self-signed or
CAcert certificates.
Signed-off-by: Werner Koch <wk@gnupg.org>
* agent/gpg-agent.c [W32]: Include Several Windows header.
(opts): Change help text for enable-ssh-support.
(opts, main): Add option --enable-putty-support
(putty_support, PUTTY_IPC_MAGIC, PUTTY_IPC_MAXLEN): New for W32.
(agent_init_default_ctrl): Add and asssert call.
(putty_message_proc, putty_message_thread): New.
(handle_connections) [W32]: Start putty message thread.
* common/sysutils.c (w32_get_user_sid): New for W32 only
* tools/gpgconf-comp.c (gc_options_gpg_agent): Add
--enable-ssh-support and --enable-putty-support. Make the
configuration group visible at basic level.
* agent/command-ssh.c (serve_mmapped_ssh_request): New for W32 only.
--
This patch enables support for Putty. It has been tested with Putty
0.62 using an Unix created ssh key copied to the private-keys-v1.d
directory on Windows and with a manually crafted sshcontrol file. It
also works with a smartcard key.
May thanks to gniibe who implemented a proxy in Python to test the
putty/gpg-agent communication.
Signed-off-by: Werner Koch <wk@gnupg.org>
* agent/command-ssh.c (file_to_buffer)
(ssh_handler_request_identities): Open streams in binary mode.
(start_command_handler_ssh): Factor some code out to ..
(setup_ssh_env): new function.
--
This is for now a theoretical fix because there is no ssh client yet
which uses the GnuPG style IPC. OpenSSL for Cygwin uses only a quite
similar one. gniibe suggested to implement that IPC style in
Libassuan so that a Cygwin version of OpenSSL may be used with GnuPG.
Signed-off-by: Werner Koch <wk@gnupg.org>
* configure.ac (AH_BOTTOM): Define GCRYPT_NO_DEPRECATED.
--
Frankly, I don't understand why gcc prints them. We don't use them.
Signed-off-by: Werner Koch <wk@gnupg.org>
* agent/command-ssh.c (SPEC_FLAG_IS_ECDSA): New.
(struct ssh_key_type_spec): Add fields CURVE_NAME and HASH_ALGO.
(ssh_key_types): Add types ecdsa-sha2-nistp{256,384,521}.
(ssh_signature_encoder_t): Add arg spec and adjust all callers.
(ssh_signature_encoder_ecdsa): New.
(sexp_key_construct, sexp_key_extract, ssh_receive_key)
(ssh_convert_key_to_blob): Support ecdsa.
(ssh_identifier_from_curve_name): New.
(ssh_send_key_public): Retrieve and pass the curve_name.
(key_secret_to_public): Ditto.
(data_sign): Add arg SPEC and change callers to pass it.
(ssh_handler_sign_request): Get the hash algo from SPEC.
* common/ssh-utils.c (get_fingerprint): Support ecdsa.
* agent/protect.c (protect_info): Add flag ECC_HACK.
(agent_protect): Allow the use of the "curve" parameter.
* agent/t-protect.c (test_agent_protect): Add a test case for ecdsa.
* agent/command-ssh.c (ssh_key_grip): Print a better error code.
--
The 3 standard curves are now supported in gpg-agent's ssh-agent
protocol implementation. I tested this with all 3 curves and keys
generated by OpenSSH 5.9p1.
Using existing non-ssh generated keys will likely fail for now. To fix
this, the code should first undergo some more cleanup; then the fixes
are pretty straightforward. And yes, the data structures are way too
complicated.
(cherry picked from commit 649b31c663)
Solved conflicts:
agent/protect.c
agent/t-protect.c
common/ssh-utils.c (different variabale name)
* common/estream.c (cookie_ioctl_function_t): New type.
(es_fclose_snatch): New function.
(COOKIE_IOCTL_SNATCH_BUFFER): New constant.
(struct estream_internal): Add field FUNC_IOCTL.
(es_initialize): Clear FUNC_IOCTL.
(es_func_mem_ioctl): New function.
(es_fopenmem): Init FUNC_IOCTL.
--
(back ported from commit id 7737a2c269)
Signed-off-by: Werner Koch <wk@gnupg.org>
* agent/command-ssh.c (ssh_signature_encoder_dsa): Rewrite.
--
Using es_fopenmem instead of a preallocated buffer is safer and easier
to read.
(cherry picked from commit f76a0312c3)
* agent/command-ssh.c: Remove dirent.h.
(control_file_s): Add struct item.
(rewind_control_file): New.
(search_control_file): Factor code out to ...
(read_control_file_item): New.
(ssh_handler_request_identities): Change to iterate over entries in
sshcontrol.
--
Formerly we scanned the private key directory for matches of entries
in sshcontrol. This patch changes it to scan the sshcontrol file and
thus considers only keys configured there. The rationale for this is
that it is common to have only a few ssh keys but many private keys.
Even if that assumption does not hold true, the scanning of the
sshcontrol file is faster than reading the directory and only then
scanning the ssh control for each directory entry.
(cherry picked from commit d2777f84be)
* agent/command-ssh.c (SSH_CONTROL_FILE_NAME): New macro to replace
the direct use of the string.
(struct control_file_s, control_file_t): New.
(open_control_file, close_control_file): New. Use them instead of
using fopen/fclose directly.
--
(cherry picked from commit 25fb53ab4a)
Fixed conflicts in some variabale names.
* agent/command-ssh.c (ssh_handler_request_identities): Do not call
card_key_available if the scdaemon is disabled.
--
(back ported from commit id 781e9746df)
* agent/command-ssh.c (open_control_file): Use_es_fopen to support
the "wx" mode flag.
--
This also patch also specifies a file mode parameter. However, this
will only be used with an updated version of es_stream which we have
not yet done.
* scd/pcsc-wrapper.c [__APPLE__]: Fix syntax error.
--
For W32 and probably for Cygwin we don't need the wrapper, thus the
problems does not exhibit itself.
* doc/gpg.texi: Fix syntax and add missing menu entries.
* doc/gpgsm.texi: Fix subsectioning.
--
These five patches fix some warnings from Texinfo 5 by adding some
missing nodes and changing some sections to subsections, and moving an
'@end ifset' to the start of a line. I also noticed the 'Deprecated
options' subsection didn't appear in the GPG options menu, so I added
it. (Texinfo never warned about it because it was after the last node
in the menu.)
1) doc/gpg.texi: move '@end ifset' to start of line
2) doc/gpg.texi: Add missing node for 'Compliance options' section.
3) doc/gpg.texi: add node for 'Deprecated options' subsection.
4) doc/gpg.texi: make 'Unattended key generation' a subsection
5) doc/gpgsm.texi: fix subsectioning for Unattended Usage
(all 5 merged into one patch by wk)
* scd/ccid-driver.c (VENDOR_REINER, CYBERJACK_GO): New.
(ccid_transceive_secure): Handle the case for VENDOR_REINER.
Original work was by Alina Friedrichsen (tiny change).
--
This is revised version which adapts changes of ccid-driver.
--
This is required by newer mingw toolchain versions which demand that
winsock2.h is included before windows.h. Now, due to the use of
socket definitions in pth.h we need to include winsock2.h also in
pth.h, now pth.h is often included after an include of windows.h and
thus the compiler spits out a warning. To avoid that we include
winsock2.h at all places the compiler complains about.
* keyserver/gpgkeys_ldap.c (my_ldap_start_tls_s): Define macro
depending on compiler version.
(main): Use new macro.
--
It seems that the LDAP keyserver helper if build with the old mingw32
toolchain never worked correctly for LDAPS. The prototype there for
ldap_start_tls_s is plainly wrong for Windows. However, the fix here
has special support so not to break building with the old compiler.
* g10/gpg.c (build_list): Rewrite to cope with buffer overflow in
certain locales.
--
This fixes an obvious bug in locales where the translated string is
longer than the original. The bug could be exhibited by using
LANG=ru_RU.utf8 gpg -v --version.
En passant we also removed the trailing white space on continued
lines.
Reported-by: Dmitry V. Levin" <ldv at altlinux.org>
(cherry picked from commit e33e74e3a4)
Note that this version uses utf8_charcount to get the indentation
mostly right.
Signed-off-by: Werner Koch <wk@gnupg.org>
Werner Koch