* sm/verify.c (gpgsm_verify): use gpg_err_code instead of 'rc == -1'
comparison.
--
In ed6ebb696e (sm: Implement initial support for keyboxd., 2020-09-10),
the return of keydb_search() was changed to use gpg_err_code(). Adjust
gpgsm_verify() to use it. This provides a nicer error message to users
when a certificate is not found -- the same error that is seen from 2.2.
Prior to this change, when a cert was not found, gpgsm output:
gpgsm: failed to find the certificate: Not found
as opposed to the more human-readable message from 2.2:
gpgsm: certificate not found
They now return the same message.
Signed-off-by: Todd Zullinger <tmz@pobox.com>
* agent/gpg-agent.c (main): Mark --supervised as deprecated.
* dirmngr/dirmngr.c (main): Ditto.
--
The supervised thing causes more trouble than it pretends to solve.
* g10/mainproc.c (proc_symkey_enc): Issue new error code.
(proc_encrypted): Ditto.
--
This allows GPGME to return a better error message than "bad session
key" to the user. Technically we could get run into these errors also
in other cases but this more unlikley. For the command line use we
don't do anything to not change the expected output of the command
line interface.
GnuPG-bug-id: 5943
* common/iobuf.c (iobuf_read): Handle a case with IOBUF_INPUT_TEMP.
(iobuf_write): Handle a case with IOBUF_OUTPUT_TEMP.
--
GnuPG-bug-id: 5941
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* scd/app-openpgp.c (do_auth): Allow larger data for RSA-4096.
--
OpenPGPcard specification says that it will be rejected by the card
when it's larger. We have been the check on host side too, but it was
written when it only had a support for RSA-2048.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* g10/keyedit.c (menu_adduid): Move linefeed character to the format
string.
--
This fixes a literal '\n' in the error message and a missing line feed
after the error message.
* g10/gpg.c (main): Set LOG_NO_REGISTRY.
* sm/gpgsm.c (main): Ditto.
* tools/gpg-connect-agent.c (main): Ditto.
* tools/gpgconf.c (main): Ditto.
(show_other_registry_entries): Print "DefaultLogFile".
--
The intention of this mostly forgotten registry entry was to allow for
easy debugging of the tools. However, with the global config file
common.conf things are anyway better. We disable the use for the
commonly used tools so that it does not look like calling gpg on the
command line seems to block with no output if the log
server (e.g. tcp://1.2.3.4:11111) is not reachable.
* agent/command-ssh.c (SSH_OPT_CONSTRAIN_MAXSIGN): New.
(SSH_OPT_CONSTRAIN_EXTENSION): New.
(ssh_handler_add_identity): Ignore them.
(ssh_handler_extension): Take success for session-bind.
--
OpenSSH 8.9 does not gracefully allow communication with older agent
implementations. Until this new OpenSSH feature has been settled we
return a faked response.
Code has not yet been tested.
GnuPG-bug-id: 5931
* scd/ccid-driver.c (ccid_dev_scan): Use loop var and not the count.
--
Due to an assignment out of bounds this might lead to a crash if there
are more than 15 readers. In any case it fixes a memory leak.
Kudos to the friendly auditor who found that bug.
Fixes-commit: 8a41e73c31
* common/t-ssh-utils.c (FLAGS_NOFIPS): New.
(sample_keys): Add flags member.
(main): Detect if libgcrypt is in FIPS mode, try SHA256 fingerprints
first and expect the MD5 ones will fail.
--
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
* scd/app-p15.c (CARD_PRODUCT_GENUA): New.
(cardproduct2str): Add it.
(read_p15_info): Detect and set GENUA
(make_pin_prompt): Take holder string from the AODF.
* g10/keygen.c (ask_user_id): Allow for the name to start with a
digit. Allow names shorter than 5.
--
The reason for this change is that we don't enforce these constraints
in the --quick-gen-key interface. I added the constraints right in the
beginning of gnupg to make sure that we have a uniform style for
user-ids. However, this is all problematic with non-Latin names
and we prefer to use mail addresses anyway.
* agent/command-ssh.c (start_command_handler_ssh): Use es_sysopen.
--
With new (not-yet-released) libgpg-error, gpg-agent should be able to
handle connection from Cygwin version of OpenSSH.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* agent/command-ssh.c (get_client_info): Use type gnupg_fd_t for
socket, until call of socket API.
(start_command_handler_ssh): Don't convert here.
--
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* scd/command.c (scd_command_handler): Use gnupg_fd_t for the argument
but no INT2FD to listen. Use GNUPG_INVALID_FD.
* tpm2d/command.c (tpm2d_command_handler): Likewise.
* scd/scdaemon.c (start_connection_thread): Follow the change.
* tpm2d/tpm2daemon.c (start_connection_thread): Likewise.
* scd/scdaemon.h (scd_command_handler): Use gnupg_fd_t.
* tpm2d/tpm2daemon.h (tpm2d_command_handler): Likewise.
--
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* tpm2d/tpm2daemon.c (main): Use gnupg_fd_t for socket, and use
assuan_sock_close for the socket allocated by assuan_sock_new.
(handle_connections): Use gnupg_fd_t for listen_fd.
Use assuan_sock_close for the socket by npth_accept.
--
Apply the same change of scdaemon to tpm2daemon.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* common/exechelp-w32.c (handle_to_fd): Use intptr_t.
(gnupg_wait_processes): Fix to use pid_to_handle.
--
Both of original MinGW and MinGW-W64 use intptr_t for the first
argument of _open_osfhandle. So, intptr_t is better here.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* scd/scdaemon.c (main): Use gnupg_fd_t for socket, and use
assuan_sock_close for the socket allocated by assuan_sock_new.
(handle_connections): Use gnupg_fd_t for listen_fd.
Use assuan_sock_close for the socket by npth_accept.
--
GnuPG-bug-id: 5029
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* g10/gpg.c (main): Remove note about rfc4880bis.
* g10/keygen.c (keygen_set_std_prefs): Use only OCB in the AEAD
preference list.
--
It is more than unlikely that EAX will ever be used in practice and
thus we remove it from the preference list.
* agent/command.c (cmd_keytocard): Timestamp at "Created:" field is
only used when time is not specified.
--
Fixes-commit: c795be79c1
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* dirmngr/ldap.c (url_fetch_ldap): Detect and replace.
--
The actual URL causing this is
ldap://ldap.dgnservice.de:389/CN=CRL-1,O=DGN%20Service%20GmbH,\
C=DE?certificateRevocationList?base?objectClass=cRLDistributionPoint
It is actually not very helpful because I had problems finding the
issuer cert:
CN=dgnservice CRL2101 13:PN,O=DGN Deutsches Gesundheitsnetz \
Service GmbH,C=DE
