1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-23 10:29:58 +01:00

462 Commits

Author SHA1 Message Date
Justus Winter
2e734a3ce1
dirmngr,build: Remove support for ADNS.
* autogen.rc: Remove '--with-adns' argument.
* configure.ac: Remove check for ADNS.
* dirmngr/dns-stuff.c: Remove all code that uses ADNS.
* dirmngr/server.c (cmd_getinfo): Update status line.
* doc/dirmngr.texi: Do not mention ADNS.
--

We used ADNS to support queries over Tor.  However, our patch to ADNS
that adds Tor support was never accepted upstream.  Furthermore, there
are other shortcomings that let us to consider alternatives.

Signed-off-by: Justus Winter <justus@g10code.com>
2016-12-14 15:52:01 +01:00
NIIBE Yutaka
57aa42ce9b dirmngr: Improve ntbtls support.
* dirmngr/http.c [HTTP_USE_NTBTLS] (close_tls_session): Release.
(send_request): Call ntbtls_set_transport.
(cookie_read, cookie_write): Implement.
(cookie_close): Add initial implementation for ntbtls.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2016-12-14 16:17:03 +09:00
Werner Koch
cb4c7abb77
Fix 2 compiler warnings.
* dirmngr/loadswdb.c: Set ERR on malloc failure.
* g10/passphrase.c (passphrase_to_dek): Initialize all fields of
HELP_S2K.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-12-08 19:02:56 +01:00
Werner Koch
304566d332
dirmngr: Add option --standard-resolver.
* dirmngr/dirmngr.c (oStandardResolver): New constant.
(opts): New option --standard-resolver.
(parse_rereadable_options): Set option.
* dirmngr/dns-stuff.c: Refactor all code to support the new option.
(standard_resolver): New var.
(enable_standard_resolver, standard_resolver_p): New func.
* dirmngr/http.c (connect_server): Remove USE_DNS_SRV build
conditional.
* dirmngr/ks-engine-hkp.c (map_host): Ditto.
* dirmngr/server.c (cmd_getinfo) <dnsinfo>: Take care of new option
* configure.ac (HAVE_ADNS_IF_TORMODE): Remove var ADNSLIB.  ac_define
USE_ADNS in the adns checking code.  Remove options --disable-dns-srv
and --disable-dns-cert.  Always look for the system resolver.  Print
warning if no system resolver was found.
(USE_DNS_CERT, USE_DNS_SRV): Remove ac_defines.
(HAVE_SYSTEM_RESOLVER): New ac_define.
(USE_DNS_SRV): Remove am_conditional; not used anyway.
--

This option allows for runtime switching to the system's standard
resolver.  This is mainly useful to work around possible bugs in the
optional resolver libraries (as of now ADNS).  Note that on Windows
there is no code to use systems's resolver and thus for full
functionality dirmngr must be build with a separate resolver.

This patch also does way with configure options to disable the use of
CERT and SRV records.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-12-01 16:40:32 +01:00
Werner Koch
aa6ab9e0bc
agent,dirmngr: Tiny restructuring.
* agent/gpg-agent.c (handle_connections): Add a comment.
* dirmngr/dirmngr.c (main): Move assuan_sock_close of the listening
socket to ...
(handle_connections): here.  Add a comment why we keep the
listening socket open during a shutdown.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-11-29 20:35:23 +01:00
Werner Koch
854adc8ae1
agent,dirmngr: Handle corner case in shutdown mode.
* agent/gpg-agent.c (handle_connections): Keep on selecting on the
inotify fd even when a shutdown is pending.
* dirmngr/dirmngr.c (handle_connections): Ditto.  Also simplifyy the
use of the HAVE_INOTIFY_INIT cpp conditional.
--

Without that patch we won't notice a removed socket when a shutdown is
pending.  This is somewhat related to bug report 2849.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-11-29 20:17:03 +01:00
Daniel Kahn Gillmor
f6728d13e8
dirmngr: Lazily launch ldap reaper thread.
* dirmngr/dirmngr.c (main): Avoid calling ldap_wrapper_launch_thread()
Before we need it.
* dirmngr/ldap-wrapper.c (ldap_wrapper): Call
ldap_wrapper_launch_thread() just in time (before any attempt to use
an ldap subprocess).

--

A dirmngr process that never looks anything up in LDAP has no need for
a reaper thread, but one was started automatically.  This thread wakes
up every two seconds to look for ldap processes that might never have
been running.  We won't start more than one reaper thread for any
given dirmngr due to the static int "done" in
ldap_wrapper_launch_thread(), so it's safe to call this every time
there is a use of ldap_wrapper.

If someone wants to do further dirmngr optimizations for ldap users,
the reaper thread itself could use dynamically-calculated timeouts
(and probably needs to be alerted dynamically when a new ldap
subprocess is available so it can re-calculate those timeouts).

Note: It's not clear to me how to test ldap access effectively; i know
of no public ldap services that i can verify against, and i do not run
my own ldap servers.  If someone has a publicly-available ldap server
that developers can run tests against, i would be happy to hear about
it.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2016-11-29 14:32:31 +01:00
Werner Koch
833eef974a
dirmngr: Use a longer timer tick interval.
* dirmngr/dirmngr.c (TIMERTICK_INTERVAL): Always use 60 seconds like
we did for WindowsCE.
--

Given that the timer tick is only used for housekeeping tasks and
these are done every 10 minutes, it makes no sense to use 2 seconds.
The minor drawback is tha the housekeeping may be delayed by one
minute.

NB: For the purpose of power saving, we already make sure that the
process wakes up at the full second so that it is synchronized to the
wakeup time of other processes.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-11-18 08:30:33 +01:00
Daniel Kahn Gillmor
b3a9172012
dirmngr: More w32 system daemon cleanup
* dirmngr/dirmngr.c (handle_tick): Remove w32 tests for
shutdown_pending; no longer needed.

--

In d83ba4897bf217d1045c58d1b99e52bd31c58812, we removed the
Windows-specific system daemon features, where shutdown_pending was
set from w32_service_control().  shutdown_pending is now never
assigned outside of handle_signal() or within an inotify test, neither
of which are available on w32.

As a result, this stanza in handle_tick() should be dead code, and can
be removed to keep things simple.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

s/win32/w32/ to please RMS ;-)  -wk
2016-11-18 08:30:33 +01:00
Daniel Kahn Gillmor
8fb4822524
dirmngr: Use a default keyserver if none is explicitly set
* configure.ac: Define DIRMNGR_DEFAULT_KEYSERVER.
* dirmngr/server.c (ensure_keyserver): Use it if no keyservers are set.
* doc/dirmngr.texi: Document this behavior.

--

A user who doesn't specify a keyserver, but asks gnupg to fetch a key
currently just gets a simple error messages "No keyserver available".

If the user is asking to contact a keyserver, we should have a
reasonable default, and not require them to fiddle with settings when
they might not know what settings to choose.  This patch makes the
default hkps://hkps.pool.sks-keyservers.net.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2016-11-17 15:29:35 +01:00
Daniel Kahn Gillmor
7c1613d415
dirmngr: Add system CAs if no hkp-cacert is given
* dirmngr/dirmngr.c (http_session_new): If the user isn't talking to
the HKPS pool, and they have not specified any hkp-cacert, then we
should default to the system CAs, rather than nothing.
* doc/dirmngr.texi: Document choice of CAs.

--

Consider three possible classes of dirmngr configuration:

 a) no hkps:// keyserver URLs at all (communication with keyservers is
    entirely in the clear)

 b) hkps:// keyserver URLs, but no hkp-cacert directives

 c) hkps:// keyserver URLs, and at least one hkp-cacert directive

class (a) provides no confidentiality of requests.

class (b) currently will never work because the server certificate
cannot be validated.

class (c) is currently supported as intended.

This patch allows users with configurations in class (b) to work as
most users expect (relying on the system certificate authorities),
without affecting users in classes (a) or (c).

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

o minor indentation fix
  - wk
2016-11-17 15:29:35 +01:00
Daniel Kahn Gillmor
c4e02a3b7a
dirmngr: Register hkp-cacert even if the file doesn't exist yet
* dirmngr/dirmngr.c (parse_readable_options): If we're unable to turn
an argument for hkp-cacert into an absolute filename, terminate
completely.
* dirmngr/http.c (http_register_tls_ca): Show a warning if file is not
immediately accessible, but register it anyway.

--

Without this changeset, the condition of the filesystem when dirmngr
is initialized will have an effect on later activities of dirmngr.

For example, if a file identified by a hkp-cacert directive doesn't
exist when dirmngr starts, dirmngr will behave as though it simply
didn't have the hkp-cacert directive set at all, even if the file
should appear later.

dirmngr currently behaves differently if no hkp-cacert directives have
been set then it does when at least one hkp-cacert directive has been
set.  For example, its choice of CA cert for
hkps://hkps.pool.sks-keyservers.net depends on whether a TLS CA file
has been registered.  That behavior shouldn't additionally depend on
the state of the filesystem at the time of dirmngr launch.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2016-11-17 15:29:35 +01:00
Werner Koch
bd91f92ace
dirmngr: Auto-sownload the swdb.lst
* dirmngr/dirmngr.h (struct opt): Add field allow_version_check.
* dirmngr/dirmngr.c (oAllowVersionCheck): New.
(opts): Add --allow-version-check.
(network_activity_seen): New variable.
(parse_rereadable_options): Set opt.allow_version_check.
(main) <aGPGConfList>: Do not anymore set the no change flag for
Windows.  Add allow-version-check.
(netactivity_action): Set network_activity_seen.
(housekeeping_thread): Call dirmngr_load_swdb.
* tools/gpgconf-comp.c (gc_options_dirmngr): Add allow-version-check.
Make "use-tor" available at Basic level.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-11-17 10:14:14 +01:00
Werner Koch
c45ca316a5
dirmngr: Improve downloading of swdb.lst.
* dirmngr/loadswdb.c (time_of_saved_swdb): Aslo return the "verified"
timestamp.
(dirmngr_load_swdb): Avoid unnecessary disk or network access witout
FORCE.  Do not update swdb.lst if it did not change.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-11-17 10:08:20 +01:00
Werner Koch
52c10a280a
dirmngr: Add command to only load the swdb.
* dirmngr/loadswdb.c: New.
* dirmngr/Makefile.am (dirmngr_SOURCES): Add that file.
* dirmngr/server.c: Remove includes cpparray.h and exectool.h.
(cmd_loadswdb): New.
(parse_version_number,parse_version_string): Remove.
(my_mktmpdir, cmp_version): Remove.
(fetch_into_tmpdir): Remove.
(struct verify_swdb_parm_s): Remove.
(verify_swdb_status_cb): Remove.
(cmd_versioncheck): Remove.
(register_commands): Register LOADSWDB.  Remove VERSIONCHECK.
--

This change is required to to the new design where gpgconf does the
version check w/o network access and only dirmngr is responsible for
getting the swdb.

In the next installment the loading will be triggered as needed.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-11-16 21:22:39 +01:00
Werner Koch
4839e6d002
scd,dirmngr: Keep the standard fds when daemonizing.
* dirmngr/dirmngr.c (main): Before calling setsid do not close the
standard fds but connect them to /dev/null.
* scd/scdaemon.c (main): Ditto.  Noet that the old test for a log
stream was even reverted.

--

Note that this was fixed for gpg-agent 10 years ago on 2006-11-09.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-11-16 21:17:47 +01:00
Werner Koch
7b04a43c05
dirmngr: Prepare to trigger jobs by network activity.
* dirmngr/http.c (netactivity_cb): New.
(http_register_netactivity_cb): New.
(notify_netactivity): New.
(connect_server): Call that function.
* dirmngr/dirmngr.c (main): Call http_register_netactivity_cb.
(netactivity_action): New stub handler.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-11-11 17:30:23 +01:00
Werner Koch
c7ea98cd3d
dirmngr: Improve concurrency in the non-adns case.
* dirmngr/dns-stuff.c (map_adns_status_to_gpg_error): New.
(resolve_name_adns, get_dns_cert, get_dns_cname): Use that function.
(getsrv) [!USE_ADNS]: Call res_query outside of nPth.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-11-10 11:41:53 +01:00
Werner Koch
4d7dc432b5
Change all http://www.gnu.org in license notices to https://
--
2016-11-05 12:02:19 +01:00
Werner Koch
5a1f6a0062
dirmngr: Fix signature checking.
* dirmngr/server.c: Include cpparray.h.
(verify_swdb_parm_s): New.
(verify_swdb_status_cb): New.
(cmd_versioncheck): Use gpgv to correclty verify the signature.
Rename some variable to comply with GNU standards.
--

Relying on the return code of gpg is not a robust way to check
signatures.  We better use our dedicated tool.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-10-27 20:35:28 +02:00
Justus Winter
445f0c13d7 Fix typos.
--
Signed-off-by: Justus Winter <justus@g10code.com>
2016-10-27 14:59:56 +02:00
Werner Koch
cf20b23c14
dirmngr: Do not implement --supervised in Windows.
* dirmngr/dirmngr.c (opts) [W32]: Remove --supervised.
(main) [W32]: Ditto.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-10-27 09:27:37 +02:00
NIIBE Yutaka
45dfc02b47 dirmngr: ADNS error handling fix.
* dirmngr/dns-stuff.c (resolve_name_adns, get_dns_cert, get_dns_cname):
Use gpg_error and gpg_err_code_from_errno to compose the error value.

--
This fixes commits 6f1d8123d61b3efac94b4c61ee75bd947790ba42.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2016-10-27 16:22:26 +09:00
NIIBE Yutaka
6f1d8123d6 dirmngr: More ADNS error fix.
* dirmngr/dns-stuff.c (get_dns_cert, getsrv, get_dns_cname): Fix return
value.

--
GnuPG-bug-id: 2745
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2016-10-27 15:04:34 +09:00
NIIBE Yutaka
8a9341b42c dirmngr: Fix error return for ADNS.
* dirmngr/dns-stuff.c (resolve_name_adns): Use RET for return value.

--
There are cases where libadns returns an error without setting the
variable ERRNO.

GnuPG-bug-id: 2745
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2016-10-27 14:49:17 +09:00
Daniel Kahn Gillmor
75f8aaf5bc dirmngr: Implement --supervised command (for systemd, etc).
* dirmngr/dirmngr.c (main): Add new --supervised command, which is a
mode designed for running under a process supervision system like
systemd or runit.
* doc/dirmngr.texi: document --supervised option.

--

"dirmngr --supervised" is a way to invoke dirmngr such that a system
supervisor like systemd can provide socket-activated startup, log
management, and scheduled shutdown.

When running in this mode, dirmngr:

 * Does not open its own listening socket; rather, it expects to be
   given a listening socket on file descriptor 3.

 * Does not detach from the invoking process, staying in the
   foreground instead.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2016-10-27 10:46:53 +09:00
Daniel Kahn Gillmor
6bb6ac56cc dirmngr: report actual socket name.
* dirmngr/dirmngr.[ch] (dirmngr_get_current_socket_name): new function
to report known socket name.
* dirmngr/server.c (cmd_getinfo): use dirmngr_get_current_socket_name
to report correct socket name.

--

This fixes the output of 'getinfo socket_name' when dirmngr is invoked
with --socket-name.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2016-10-27 10:30:55 +09:00
NIIBE Yutaka
96414baf36 dirmngr: Fix help string and argument.
* dirmngr/server.c (hlp_versioncheck): Add a newline.
(cmd_versioncheck): Fix argument.

--
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2016-10-27 09:18:29 +09:00
Werner Koch
d1ccab5176
dirmngr: Fix hang due to deferred thread initialization.
* dirmngr/dirmngr.c (main): Call ldap_wrapper_launch_thread after
thread_init.
--

Fixes-commit: eda17649f8bd3b8ce7bfc00a3c11cbcae63c845d
Signed-off-by: Werner Koch <wk@gnupg.org>
2016-10-26 10:25:14 +02:00
Werner Koch
b120f358c2
dirmngr: Allow command VERSIONCHECK to handle 3 part version numbers.
* dirmngr/server.c (parse_version_string): Add arg MICRO and set it.
(cmp_version): Extend to handle the MICRO part.
(confucius_mktmpdir): Rename to my_mktmpdir.
(my_mktmpdir): xstrconcat does not fail; use strconcat.
(fetch_into_tmpdir): Improve error checking.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-10-25 09:38:01 +02:00
Kai Michaelis
5e7dfd979d dirmngr: Fix segfault in VERSIONCHECK.
* dirmngr/server.c (cmd_versioncheck): The VERSIONCHECK command crashes
when called without program version.
2016-10-24 12:33:22 +02:00
NIIBE Yutaka
6e85ac77af Fix use cases of snprintf.
* agent/call-pinentry.c, agent/call-scd.c, agent/command.c,
build-aux/speedo/w32/g4wihelp.c, common/get-passphrase.c,
dirmngr/dirmngr.c, g10/call-agent.c, g10/cpr.c, g10/keygen.c,
g10/openfile.c, g10/passphrase.c, scd/app-openpgp.c, scd/scdaemon.c,
sm/call-agent.c, sm/call-dirmngr.c, sm/certreqgen.c: Fix assuming C99.

--
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2016-10-21 12:04:46 +09:00
Kai Michaelis
72a99f582d dirmngr: improve VERSIONCHECK
Replace strtok_r() and code formatting. Use code from libgpg-error for
version comparison.
2016-10-19 16:44:28 +02:00
Kai Michaelis
c318561ef4 dirmngr: use gnupg_mkdtemp instead of mkstemp
MinGW on debian does not support mkstemp.
2016-10-14 18:16:43 +02:00
Kai Michaelis
f99c5fa1c9 dirmngr: add VERSIONCHECK command
Given an application name and version VERSIONCHECK fetches the software
version list from version.gnupg.org, verifies the signature and returns
whenever the given version is older (UPDATE), current (CURRENT) or newer
(ROLLBACK).
2016-10-14 10:35:48 +02:00
NIIBE Yutaka
fc0b392e76 agent, dirmngr, scd: Fix init_common_subsystems.
* common/init.c (_init_common_subsystems): Don't call
gpgrt_set_syscall_clamp in this function.
* agent/gpg-agent.c, dirmngr/dirmngr.c, scd/scdaemon.c: Call
gpgrt_set_syscall_clamp after npth_init.

--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2016-10-07 10:45:22 +09:00
NIIBE Yutaka
eda17649f8 agent, dirmngr, scd: npth_init must be after fork.
* agent/gpg-agent.c (thread_init_once, initialize_modules): New.
(main): Make sure no daemonizing-fork call after npth_init, and no npth
calls before npth_init, with care of npth calls by assuan hooks.
* dirmngr/dirmngr.c (thread_init): New.
(main): Make sure npth_init must not be called before daemonizing fork.
* scd/scdaemon.c (main): Likewise.

--

It is simply the best for nPth not to allow the daemonizing fork after
npth_init, because semantics and implementations of forked child process
in a threaded application is a difficult corner case.

GnuPG-bug-id: 1779
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2016-10-04 09:01:13 +09:00
Justus Winter
8d37018050 w32: Fix STARTTLS on LDAP connections.
* dirmngr/ks-engine-ldap.c (my_ldap_connect): Fix build against
<winldap.h>.

GnuPG-bug-id: 1338
Debian-bug-id: 623526
Fixes-commit: 9e6f8a55
Signed-off-by: Justus Winter <justus@g10code.com>
2016-09-30 11:01:42 +02:00
Justus Winter
9e6f8a55ed dirmngr: Fix STARTTLS on LDAP connections.
* dirmngr/ks-engine-ldap.c (my_ldap_connect): Fix unfortunate typo.
--
Courtesy of pkgsrc contributor fhajny.

Signed-off-by: Justus Winter <justus@g10code.com>
2016-09-29 14:17:24 +02:00
NIIBE Yutaka
836b723631 dirmngr: Removal of no-libgcrypt.o.
* dirmngr/Makefile.am (dirmngr_ldap_LDADD): Remove no-libgcrypt.o.

--

Thanks to Rainer Perske who located the issue.

GnuPG-bug-id: 2698
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>

This is a fix for the commit: 49829c29e541546084950b8a153067db371d101a
2016-09-27 14:21:08 +09:00
Justus Winter
285d193f1e dirmngr: Fix type.
* dirmngr/dns-stuff.c (get_dns_cert): Fix type in fallback code.

Signed-off-by: Justus Winter <justus@g10code.com>
2016-09-20 15:33:57 +02:00
Andre Heinecke
4644c27514 dirmngr: Open file CRL's in binary mode
* dirmngr/crlcache.c (crl_cache_load): Open file in binary mode.

--
This fixes conversion bugs with binary CRL's on Windows.

GnuPG-bug-id: issue2448
Signed-off-by: Andre Heinecke <aheinecke@intevation.de>
2016-09-20 14:01:14 +02:00
Werner Koch
5bf1facc97
dirmngr: Silence diagnostics about starting housekeeping.
* dirmngr/dirmngr.c (housekeeping_thread): Print info only in very
verbose mode.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-09-19 12:49:04 +02:00
Daniel Kahn Gillmor
215180d1ce move some file encodings to UTF-8
* dirmgnr/cdblib.c: comment used unnecesary hyphenation
* dirmngr/crlcache.h: comment was iso-8859-1
* doc/contrib.text: list contributors using UTF-8 (now we can
  acknowledge many more people using their preferred orthography)

At least one other files remains in a non-UTF-8 encoding, which i'm
not sure what to do with:

 - build-aux/speedo/w32/inst.nsi is ISO-8859-1, but maybe Windows needs
   it that way?

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2016-09-17 15:57:31 +09:00
Daniel Kahn Gillmor
167273ee9d spelling: conenction should be connection
* dirmngr/server.c, sm/server.c: s/conenction/connection/

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2016-09-15 10:06:32 +02:00
Ben Kibbey
eddcba0380 Portability build fix.
* kbx/Makefile.am: Add NETLIBS.
* dirmngr/Makefile.am: Ditto for dirmngr_ldap.
--

Fixes OpenIndiana (Solaris) builds.

Signed-off-by: Ben Kibbey <bjk@luxsci.net>
2016-09-10 13:42:09 -04:00
Werner Koch
6308c30019
dirmngr: Terminate on deletion of the socket file (Linux only).
* dirmngr/dirmngr.c [HAVE_INOTIFY_INIT]: Include sys/inotify.h.
(oDisableCheckOwnSocket): New.
(opts): Add --disable-check-own-socket.
(disable_check_own_socket): New var.
(parse_rereadable_options): Set that var.
(my_inotify_is_name) [HAVE_INOTIFY_INIT]: New.
(handle_connections) [HAVE_INOTIFY_INIT]: New.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-09-07 12:36:48 +02:00
Werner Koch
de623474db
dirmngr: Exclude D lines from the IPC debug output.
* dirmngr/dirmngr.h: Include asshelp.h.
* dirmngr/server.c (server_local_s): Add inhibit_dara_logging fields.
(data_line_write): Implement logging inhibit.
(data_line_cookie_close): Print non-logged D lines.
(cmd_wkd_get, cmd_ks_get, cmd_ks_fetch): Do not log D lines.
(dirmngr_assuan_log_monitor): New.
* dirmngr/dirmngr.c (main): Register monitor function.
--

In particular with large keys the D lines clutter the log output and
make it unusable.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-09-05 13:06:24 +02:00
Werner Koch
0ac671f8a2
common: Add an assuan logging monitor.
* common/asshelp.c (my_log_monitor): New var.
(my_libassuan_log_handler): Run that monitor.
(setup_libassuan_logging): Add arg to set a log monitor and change all
callers.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-09-05 11:58:48 +02:00
Werner Koch
505ee45106
dirmngr: Add --policy-flags option to WKD_GET.
* dirmngr/server.c (cmd_wkd_get): Add new option.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-09-02 16:56:04 +02:00
Werner Koch
babeb6f8a9
tests: Run test requiring the network only in maintainer-mode.
* dirmngr/Makefile.am (noinst_PROGRAMS, TESTS): Add module_net_tests.
(module_tests): Move t-dns-test to ...
(module_net_tests): here.
--

Debian-bug-id: 836259
Signed-off-by: Werner Koch <wk@gnupg.org>
2016-09-01 11:18:10 +02:00
Werner Koch
d83ba4897b
dirmngr: Remove all system daemon features.
* dirmngr/dirmngr.h (opts): Remove fields 'system_service' and
'system_daemon'.
* common/homedir.c (dirmngr_sys_socket_name): Remove.
(dirmngr_user_socket_name): Rename to ...
(dirmngr_socket_name): this.  Change call callers.
* common/asshelp.c (start_new_dirmngr): Remove the system socket
feature.
* tools/gpgconf.c (list_dirs): Do not print "dirmngr-sys-socket".
* sm/server.c (gpgsm_server): Adjust for removed system socket feature.
* dirmngr/server.c (cmd_getinfo): Ditto.
(cmd_killdirmngr): Remove check for system daemon.
(cmd_reloaddirmngr): Ditto.
* dirmngr/dirmngr.c (USE_W32_SERVICE): Remove macro.
(aService): Remove.
(opts): Remove --service.
(w32_service_control): Remove.
(real_main, call_real_main) [W32]: Remove wrapper.
(main): Remove Windows system service feature.  Remove system dameon
feature.  Use only the "~/.gnupg/dirmngr_ldapservers.conf" file.
* dirmngr/certcache.c (load_certs_from_dir): Remove warning in the
system dameon case.
* dirmngr/crlcache.c (DBDIR_D): Always use "~/.gnupg/crls.d".
* dirmngr/ocsp.c (validate_responder_cert): Do not call
validate_cert_chain which was used only in system daemon mode.
* dirmngr/validate.c (validate_cert_chain): Always use the code.
--

We are now starting dirmngr as needed as a user daemon.  The
deprecated system daemon mode does not anymore make sense.  In case a
system wide daemon is required, it is better to setup a dedicated
account to run dirmngr and tweak socket permissions accordingly.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-08-18 11:23:40 +02:00
Daniel Kahn Gillmor
61c2a1fa6d
Call log_set_prefix() with human-readable labels.
* agent/preset-passphrase.c, agent/protect-tool.c, dirmngr/dirmngr.c
* dirmngr/t-http.c, g10/gpg.c, g10/gpgv.c, g13/g13-syshelp.c
* g13/g13.c, kbx/kbxutil.c, scd/scdaemon.c, sm/gpgsm.c
* tests/gpgscm/main.c, tools/gpg-check-pattern.c
* tools/gpg-connect-agent.c, tools/gpgconf.c, tools/gpgtar.c
* tools/symcryptrun.c: Invoke log_set_prefix() with
human-readable labels.

--

Some invocations of log_set_prefix() were done with raw numeric values
instead of values that humans can understand.  Use symbolic
representations instead of numeric for better readability.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2016-08-12 12:16:19 +02:00
Werner Koch
0698324cde
common: New function string_to_u64.
* common/stringhelp.c (string_to_u64): New.
* dirmngr/http.c (longcounter_t): Remove.
(struct cookie_s): Change content_length to uint64_t.
(parse_response): Use string_to_u64.
--

Meanwhile we allow some C99 features including stdint.h.  Thus we can
simplify things now.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-08-11 21:32:55 +02:00
Ben Kibbey
49829c29e5 Cleanup initialization of libgcrypt.
* common/init.c (init_common_subsystems): Initialize libgcrypt.
* dirmngr/Makefile.am (dirmngr_ldap): Link with libgcrypt.

--
Most other modules already call gcry_check_version() after
init_common_subsystems() so may as well move initialization of libgcrypt
to here. Also fixes a warning in the system log from gpgconf --homedir.

Signed-off-by: Ben Kibbey <bjk@luxsci.net>
2016-08-09 10:47:46 +02:00
Daniel Kahn Gillmor
dc107b7850 More cleanup of "allow to".
* README, agent/command.c, agent/keyformat.txt, common/i18n.c,
  common/iobuf.c, common/keyserver.h, dirmngr/cdblib.c,
  dirmngr/ldap-wrapper.c, doc/DETAILS, doc/TRANSLATE,
  doc/announce-2.1.txt, doc/gpg.texi, doc/gpgsm.texi,
  doc/scdaemon.texi, doc/tools.texi, doc/whats-new-in-2.1.txt,
  g10/export.c, g10/getkey.c, g10/import.c, g10/keyedit.c, m4/ksba.m4,
  m4/libgcrypt.m4, m4/ntbtls.m4, po/ca.po, po/cs.po, po/da.po,
  po/de.po, po/el.po, po/eo.po, po/es.po, po/et.po, po/fi.po,
  po/fr.po, po/gl.po, po/hu.po, po/id.po, po/it.po, po/ja.po,
  po/nb.po, po/pl.po, po/pt.po, po/ro.po, po/ru.po, po/sk.po,
  po/sv.po, po/tr.po, po/uk.po, po/zh_CN.po, po/zh_TW.po,
  scd/app-p15.c, scd/ccid-driver.c, scd/command.c, sm/gpgsm.c,
  sm/sign.c, tools/gpgconf-comp.c, tools/gpgtar.h: replace "Allow to"
  with clearer text.

In standard English, the normal construction is "${XXX} allows ${YYY}
to" -- that is, the subject (${XXX}) of the sentence is allowing the
object (${YYY}) to do something.  When the object is missing, the
phrasing sounds awkward, even if the object is implied by context.
There's almost always a better construction that isn't as awkward.

These changes should make the language a bit clearer.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2016-08-03 16:55:33 +02:00
Daniel Kahn Gillmor
436b28c231 dirmngr: Emit correct spelling of "superseded".
* dirmngr/crlcache.c (list_one_crl_entry): Spell superseded correctly.
* dirmngr/ocsp.c (ocsp_invalid): Likewise.

This might break some tools which parse the existing output and expect
misspellings, but i'm not sure there are many such tools, and we
should use standardized orthography going forward.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2016-08-03 16:54:41 +02:00
Damien Goutte-Gattat
60428c24fb
dirmngr: fix handling of HTTP redirections
* dirmngr/ks-engine-http.c (ks_http_fetch): Reinitialize HTTP session
when following a HTTP redirection.

Signed-off-by: Damien Goutte-Gattat <dgouttegattat@incenp.org>
2016-07-14 15:44:21 +02:00
Werner Koch
0342369ce0
gpg: Fix regression since 2.1 in --search-key with a fingerprint.
* dirmngr/ks-engine-hkp.c (ks_hkp_search): Prefix fingerprint with 0x.
--

pre-2.1 made sure that the 0x prefix was put before the fingerprint so
that the search command works.  Actually --recv-key should be used
with a fingerprint but some users are using --search-key, probably to
use the interactive mode.

GnuPG-bug-id: 2412
Signed-off-by: Werner Koch <wk@gnupg.org>
2016-07-14 14:00:37 +02:00
Werner Koch
c98995efef
build: Require latest released libraries
* agent/protect.c (OCB_MODE_SUPPORTED): Remove macro.
(do_encryption): Always support OCB.
(do_decryption): Ditto.
(agent_unprotect): Ditto.
* dirmngr/server.c (is_tor_running): Unconditionally build this.
--

Although not technically required, it is easier to require them to
avoid bug reports due to too old library versions.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-07-14 10:48:34 +02:00
Daniel Kahn Gillmor
a346dc2275 dirmngr: Fix typo.
--
Signed-off-by: Justus Winter <justus@g10code.com>
2016-07-12 12:16:22 +02:00
Justus Winter
6bfbc368f9 Fix trivial memory leaks in tests.
* dirmngr/t-ldap-parse-uri.c (check_ldap_escape_filter): Free result.
* g10/t-stutter.c (main): Free file name.

Signed-off-by: Justus Winter <justus@g10code.com>
2016-07-01 09:47:48 +02:00
Werner Koch
b1e8e0d4b9
dirmngr: add option to retrieve extra WKS info.
* dirmngr/server.c (cmd_wkd_get): Add option --submission-address.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-06-28 15:53:59 +02:00
Werner Koch
b7e3dfcf13
ldap: Improve info output for v3 fallback
* dirmngr/dirmngr_ldap.c (fetch_ldap): Do not use log_debug in an
unprotected section.  Replace log_debug by log_info in verbose mode.
--

GnuPG-bug-id: 2376
2016-06-14 20:51:22 +02:00
Andre Heinecke
f989b6ee0d
dirmngr: Try ldap protocol V3 as fallback
* dirmngr/dirmngr_ldap.c (fetch_ldap): Try V3 Protocol in case
default Protocol gives error.

--
Servers may have blocked V2 Protocol, in which case the
bind will result in a Protocol Error. In that case we try
again with v3 Protocol if the ldap libarary used to compile
dirmngr supports V3.

Signed-off-by: Andre Heinecke <aheinecke@intevation.de>
2016-06-14 20:43:27 +02:00
Andre Heinecke
5faddcb292
dirmngr: Print ldap error if bind fails
* dirmngr/dirmngr_ldap.c (fetch_ldap): Use ldap_err2string on bind
return.

--
ldap_simple_bind_s does not set errno.

Signed-off-by: Andre Heinecke <aheinecke@intevation.de>
2016-06-14 20:40:42 +02:00
Werner Koch
5ddccf4fc6
doc: Consistently use 'keyserver'.
--
GnuPG-bug-id: 2383

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-06-14 09:06:44 +02:00
Werner Koch
8127043d54
Explicitly restrict socket permissions.
* agent/gpg-agent.c (create_server_socket): Call chmod before listen.
* scd/scdaemon.c (create_server_socket): Ditto.
* dirmngr/dirmngr.c (main): Ditto.
--

This is just in case of a improperly set umask.  Note that a connect
requires a write permissions.
2016-06-08 16:18:02 +02:00
Werner Koch
173fa97102
Do not use no-libgcrypt dummy for tools
* tools/Makefile.am (gpgconf_SOURCES): Remove no-libgcrypt.c.
(gpgconf_LDADD): Add LIBGCRYPT_LIBS.
(gpg_connect_agent_LDADD): Ditto.
(gpgtar_LDADD): Ditto.
* dirmngr/Makefile.am (dirmngr_client_LDADD): Ditto.
(t_common_ldadd): Ditto.  Remove no-libgcrypt.o.
--

We need this change so that a future code in common/ can use Libgcrypt
functions; in particular hashing.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-06-08 09:17:49 +02:00
Werner Koch
fb88f37c40
common: Remove homedir arg from start_new_{dirmngr,gpg_agent}.
* common/asshelp.c (start_new_gpg_agent): Remove arg 'homedir' in
favor of gnupg_homedir ().  Change all callers.
(start_new_dirmngr): Ditto.
* common/get-passphrase.c (gnupg_prepare_get_passphrase): Remove arg
'homedir'.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-06-07 13:09:00 +02:00
Werner Koch
22a7ef01aa
Replace use of opt.homedir by accessor functions.
* common/homedir.c (the_gnupg_homedir): New var.
(gnupg_set_homedir): New.
(gnupg_homedir): New.
* g10/options.h (struct opt): Remove 'homedir' and replace all users
by the new accessor functions.
* g13/g13-common.h (struct opt): Ditto.
* scd/scdaemon.h (struct opt): Ditto.
* sm/gpgsm.h (struct opt): Ditto.
* dirmngr/dirmngr.h (struct opt): Ditto.
* agent/preset-passphrase.c (opt_homedir): Ditto.
* agent/protect-tool.c (opt_homedir): Ditto.
--

This will make detection of a non-default homedir easier.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-06-07 10:59:46 +02:00
Werner Koch
5d991e333a
common: Extend gnupg_create_inbound_pipe et al.
* common/exechelp-posix.c (gnupg_create_inbound_pipe): Add args 'r_fp'
and 'nonblock'.
(gnupg_create_outbound_pipe): Ditto.
* common/exechelp-w32.c (gnupg_create_inbound_pipe): Add non yet
functional args 'r_fp' and 'nonblock'.
(gnupg_create_outbound_pipe): Ditto.
* common/exechelp-w32ce.c (gnupg_create_inbound_pipe): Ditto.
(gnupg_create_outbound_pipe): Ditto.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-05-27 15:41:55 +02:00
Werner Koch
cf97769906
dirmngr: Adjust the WKD lookup to specs version -01.
* dirmngr/server.c (cmd_wkd_get): Remove second occurrence of the
domain part.
--

This change updates gnupg to comply with
draft-koch-openpgp-webkey-service-01
2016-05-18 09:46:22 +02:00
Werner Koch
c83c6f212e
dirmngr: Add experimental command WKD_GET.
* dirmngr/server.c (cmd_wkd_get): New.
(register_commands): Add command WKD_GET.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-04-27 08:20:25 +02:00
Werner Koch
c3aeda82b8
dirmngr: Use system provided root CAs with KS_FETCH.
* dirmngr/ks-engine-http.c (ks_http_fetch): Use HTTP_FLAG_TRUST_SYS.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-04-27 08:18:37 +02:00
Werner Koch
fd765df6a7
http: Allow to request system defined CAs for TLS.
* dirmngr/http.h (HTTP_FLAG_TRUST_DEF, HTTP_FLAG_TRUST_SYS): New.
* dirmngr/http.c (http_session_new): Add arg "flags".
* dirmngr/ks-engine-hkp.c (send_request): Use new flag
HTTP_FLAG_TRUST_DEF for the new arg of http_session_new.
* dirmngr/ks-engine-http.c (ks_http_fetch): Ditto.
* dirmngr/t-http.c (main): Ditto.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-04-26 21:57:56 +02:00
Andre Heinecke
6272f24312 dirmngr: Fix https never reported in general help
* dirmngr/ks-engine-http.c (ks_hkp_help): Also print https
when supported and no uri provided.

--
Wrong reporting was pointed out by K_F, again.
2016-04-15 17:50:07 +02:00
Andre Heinecke
a0642856b2 dirmngr: Fix https incorrectly reported in help
* dirmngr/ks-engine-http.c (ks_hkp_help): Only print https if tls
is supported.

--
Wrong reporting was pointed out by K_F. Check is the same as
in ks-engine-hkp.c
2016-04-15 17:30:05 +02:00
Justus Winter
9354293b8c dirmngr: Autodetect PEM format in dirmngr-client.
* dirmngr/dirmngr-client.c (init_asctobin): New function.
(main): Move the initialization code to the new function.
(read_pem_certificate): Initialize base64 table.
(read_certificate): Try to decode certificates given in files as PEM
first.

GnuPG-bug-id: 1844
Signed-off-by: Justus Winter <justus@g10code.com>
2016-04-05 16:11:37 +02:00
Justus Winter
9f0ba5089e dirmngr: Add more missing CFLAGS.
* dirmngr/Makefile.am (t_ldap_parse_uri_CFLAGS): Add
'GCRYPT_CFLAGS'.
(t_dns_stuff_CFLAGS): Likewise.

GnuPG-bug-id: 2235
Signed-off-by: Justus Winter <justus@g10code.com>
2016-03-03 13:47:42 +01:00
Justus Winter
e77c85577d common: Consolidate Assuan server argument handling.
* common/Makefile.am (common_sources): Add new files.
* common/server-help.c: New file.
* common/server-help.h: Likewise.
* agent/command.c: Drop argument handling primitives in favor of using
the consolidated ones.
* dirmngr/server.c: Likewise.
* g10/server.c: Likewise.
* g13/server.c: Likewise.
* scd/command.c: Likewise.
* sm/server.c: Likewise.

Signed-off-by: Justus Winter <justus@g10code.com>
2016-03-02 14:14:33 +01:00
Justus Winter
9a1778abca dirmngr: Add missing CFLAGS.
* dirmngr/Makefile.am (t_ldap_parse_uri_CFLAGS): Add
'GPG_ERROR_CFLAGS'.
(t_dns_stuff_CFLAGS): Likewise.

Signed-off-by: Justus Winter <justus@g10code.com>
2016-03-01 15:08:47 +01:00
NIIBE Yutaka
6fbe12a51e dirmngr: fix for memory alignment.
* dirmngr/dns-stuff.c (get_dns_cert): Cast through void *.
(getsrv, get_dns_cname): Make sure it's aligned for HEADER.

--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2016-02-15 10:55:34 +09:00
Werner Koch
4d67144142
dirmngr: Build fix for FreeBSD (EAI macros)
* dirmngr/dns-stuff.c (map_eai_to_gpg_error): Map EAI_NODATA and
EAI_ADDRFAMILY only if defined.
--

Reported-by: Christoph Moench-Tegeder <cmt@burggraben.net>
Signed-off-by: Werner Koch <wk@gnupg.org>
2016-01-27 14:00:15 +01:00
Werner Koch
12c665b36c
dirmngr: Indicate that serial numbers are hexadecimal.
* dirmngr/misc.c (hexify_data): Add arg with_prefix.  Adjust all
callers.
* dirmngr/crlcache.c (cache_isvalid): Print "0x" in front of the S/N.
--

GnuPG-bug-id: 1147
Signed-off-by: Werner Koch <wk@gnupg.org>
2016-01-22 12:54:02 +01:00
Werner Koch
77bceb2902
dirmngr: Provide the keyserver pool name even if there is no CNAME.
* dirmngr/ks-engine-hkp.c (map_host): Fix setting of r_poolname.
--

map_host is intended to return the name of the pool as an additional
information.  However this broke some time ago and a pool name was
only retrained if the pool name was retrieved from a DNS CNAME.

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-01-22 12:34:50 +01:00
Daniel Kahn Gillmor
afb8696126
dirmngr: Use sks-keyservers CA by default for the hkps pool.
* dirmngr/Makefile.am (dist_pkgdata_DATA): Add sks-keyservers.netCA.pem.
* dirmngr/http.c (http_session_new): Add optional arg
intended_hostname and set a default cert.
* dirmngr/ks-engine-hkp.c (send_request): Pass httphost to
http_session_new.
--

Ship the certificate for the sks-keyservers hkps pool.  If the user
has specified that they want to use
hkps://hkps.pool.sks-keyservers.net, and they have not specified any
hkp-cacert explicitly, then initialize the trust path with this
specific trust anchor.

Co-authored-by: wk@gnupg.org
Signed-off-by: Werner Koch <wk@gnupg.org>
2016-01-22 11:53:49 +01:00
Werner Koch
6deafb92ab
dirmngr: Silence one regression test.
* dirmngr/t-dns-stuff.c (main): Do not print info during standard
"make check".

Signed-off-by: Werner Koch <wk@gnupg.org>
2016-01-06 08:37:03 +01:00
Neal H. Walfield
1cceba163b gpg: Suppress a warning.
* dirmngr/dns-stuff.c (enable_dns_tormode): Reference new_circuit to
avoid a warning when ADNS is not available.

--
Signed-off-by: Neal H. Walfield <neal@g10code.com>
2015-12-22 15:03:49 +01:00
Justus Winter
71726b627d dirmngr: Initialize http status code.
* dirmngr/ks-action.c (ks_action_search): Initialize 'http_status' as
it is unused if LDAP is used to search for keys.
--
This amends 6ac57a48.

Signed-off-by: Justus Winter <justus@g10code.com>
2015-12-07 11:21:47 +01:00
Justus Winter
6d64ef869d dirmngr: Stricter handling of http error codes.
* dirmngr/ks-action.c (ks_action_search): Only retry if the keyserver
responded with a '404 Not Found'.
* dirmngr/ks-engine-hkp.c (send_request): Return http status code.
(ks_hkp_search): Likewise.
(ks_hkp_{get,put}): Adapt call to 'send_request'.
* dirmngr/ks-engine.h (ks_hkp_search): Update prototype.

Signed-off-by: Justus Winter <justus@g10code.com>
2015-12-04 13:02:56 +01:00
Justus Winter
6ac57a482f dirmngr: Really search all keyservers for patterns.
* dirmngr/ks-action.c (ks_action_search): Search all configured
keyservers for the given patterns.

Signed-off-by: Justus Winter <justus@g10code.com>
GnuPG-bug-id: 1038
2015-12-04 13:02:56 +01:00
Justus Winter
a8308ba523 dirmngr: Handle http status '501 Not Implemented'.
* dirmngr/ks-engine-hkp.c (send_request): Handle status 501 and return
GPG_ERR_NOT_IMPLEMENTED.

Signed-off-by: Justus Winter <justus@g10code.com>
GnuPG-bug-id: 1221
2015-12-04 12:58:33 +01:00
Werner Koch
4ff2cae7de
dirmngr: Add command to print the resolver version.
* dirmngr/server.c (cmd_getinfo): Add sub-command "dnsinfo".
2015-12-04 07:36:16 +01:00
Werner Koch
69db3285e4
build: Require at least Libassuan 2.4.1.
* configure.ac (NEED_LIBASSUAN_VERSION): Set to 2.4.1.
* agent/gpg-agent.c (create_server_socket): Remove check for
libassuan >= 2.3.0 and >= 2.1.4.
(main): Remove check for libassuan >= 2.1.4.
* scd/scdaemon.c (create_server_socket): Remove check for
libassuan >= 2.1.4.
* dirmngr/dirmngr.c (set_tor_mode): Remove check for
libassuan >= 2.3.0.
* dirmngr/http.c (http_raw_connect, send_request): Remove checks for
libassuan >= 2.3.0.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-12-02 18:57:49 +01:00
Werner Koch
28e2513721
dirmngr: Switch to an onion address if Tor is running.
* dirmngr/dirmngr.h (opt): Turn field 'keyserver' into an strlist.
* dirmngr/dirmngr.c (parse_rereadable_options): Allow multiple
--keyserver options.
* dirmngr/server.c (server_local_s): Add field 'tor_state'.
(release_uri_item_list): New.
(release_ctrl_keyservers): Use it.
(start_command_handler): Release list of keyservers.
(is_tor_running): New.
(cmd_getinfo): Re-implement "tor" subcommand using new fucntion.
(ensure_keyserver): Rewrite.
* g10/dirmngr-conf.skel: Add two keyserver options.
--

This feature is independent of --use-tor and automagically uses Tor if
available.  The dirmngr.conf file needs to specify two keyservers to
make this work.  For new installations this is done using the skeleton
file.  This feature requires the Libassuan 2.4.2 to work.

This patch also fixes a memory leak of opt.keyserver en passant.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-12-02 12:27:35 +01:00
Werner Koch
17ac843871
http: Enhance parser to detect .onion addresses.
* dirmngr/http.h (parsed_uri_s): Add flag 'onion'.
* dirmngr/http.c (do_parse_uri): Set that flag.
* dirmngr/t-http.c (main): Print flags.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-12-02 12:27:35 +01:00
Justus Winter
9c34711539 dirmngr: Improve error handling.
* dirmngr/dns-stuff.c (getsrv): Avoid looking at 'header' before
checking for errors, but silently ignore errors when looking up SRV
records.
--
This is a follow-up to 946faaff.

Signed-off-by: Justus Winter <justus@g10code.com>
2015-12-01 13:24:38 +01:00
Werner Koch
501436ab0f
Silence compiler warnings related to not using assuan_fd_t.
* common/call-gpg.c (start_gpg): Use assuan_fd_t.  Note that the
declaration was already fixed by a previous change.
* dirmngr/server.c (cmd_getinfo): Use assuan_fd_t.
--

Note that this matters only for Windows and it does not harm as long
as we can only build for 32 bit Windows withsizeof(int)==sizeof(void*).

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-11-27 18:32:26 +01:00
Werner Koch
64e8708339
Avoid incompatible pointer assignment warnings on Windows.
* common/logging.c (fun_writer): Use gpgrt_ssize_t instead of ssize_t.
* dirmngr/server.c (data_line_cookie_write): Ditto.
* sm/certdump.c (format_name_writer): Ditto.
* sm/server.c (data_line_cookie_write): Ditto.
* dirmngr/http.c (cookie_read, cookie_write): Ditto.
--

See the release notes of libgpg-error 1.15 for background info on
gpgrt_ssize_t.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-11-27 18:32:17 +01:00
Werner Koch
6501741d2c
dirmngr: Avoid casting away a const from an char**.
* dirmngr/ldap.c (start_cert_fetch_ldap): Do not use pointers from
global variables.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-11-27 17:10:59 +01:00
Werner Koch
da5a232199
dirmngr: Allow testing for a running Tor via "getinfo tor".
* dirmngr/server.c (cmd_getinfo): Print an S line if Tor is not
running.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-11-27 12:21:45 +01:00
Werner Koch
d226e67856
dirmngr: Improve output of "getinfo tor".
* dirmngr/server.c (cmd_getinfo): Print a message along with OK.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-11-26 18:05:27 +01:00
Werner Koch
f95cff1cc9
dirmngr: Let Libassuan employ nPth wrappers for connect.
* dirmngr/http.c (my_unprotect, my_protect): Remove.
(connect_server): Do not use these wrappers.
--

Since Libassuan version 2.4.2 the macro ASSUAN_SYSTEM_NPTH_IMPL
protects the low-level connect calls with npth_unprotect and
npth_protect.  This is better than the high-level kludge we used here.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-11-26 18:05:26 +01:00
Justus Winter
b75e1b3d8b dirmngr: Fix http lookups when libadns is used.
* dirmngr/dns-stuff.c (resolve_name_adns): Fill in the port.
--
Previously, sin_port was set to zero, making connect fail.

Signed-off-by: Justus Winter <justus@g10code.com>
2015-11-23 15:53:41 +01:00
Justus Winter
946faaff04 dirmngr: Fix SRV record lookups when using the system resolver.
* dirmngr/dns-stuff.c (getsrv): Fix error handling.
--
This fixes hkp server pools not using SRV records.

Signed-off-by: Justus Winter <justus@g10code.com>
2015-11-23 15:52:50 +01:00
Justus Winter
73c1a86ad9 dirmngr: Honor ports specified in SRV records.
* dirmngr/ks-engine-hkp.c (struct hostinfo_s): New field 'port'.
(create_new_hostinfo): Initialize 'port'.
(add_host): Add host parameter and update the hosttable entry.
(map_host): Return port if known, adjust calls to 'add_host'.
(make_host_part): Let 'map_host' specify the port if known.

Signed-off-by: Justus Winter <justus@g10code.com>
2015-11-23 14:00:48 +01:00
Justus Winter
c9f5aa1579 dirmngr: Support hkp server pools using SRV records.
* dirmngr/ks-engine-hkp.c (map_host): Handle SRV records.
--
Signed-off-by: Justus Winter <justus@g10code.com>
GnuPG-bug-id: 1788
2015-11-23 14:00:48 +01:00
Justus Winter
3f52f6bcac dirmngr: Refactor 'map_host'.
* dirmngr/ks-engine-hkp.c (add_host): New function.
(map_host): Use the new function.

Signed-off-by: Justus Winter <justus@g10code.com>
2015-11-23 14:00:47 +01:00
Justus Winter
23ea641ba2 dirmngr: Fix pool detection.
* dirmngr/ks-engine-hkp (arecords_is_pool): Fix counting IP addresses.

Signed-off-by: Justus Winter <justus@g10code.com>
2015-11-23 14:00:47 +01:00
Justus Winter
2b43a05158 dirmngr: Refactor 'map_host'.
* dirmngr/ks-engine-hkp.c (arecords_is_pool): New function.
(map_host): Use the new function.

Signed-off-by: Justus Winter <justus@g10code.com>
2015-11-23 13:47:47 +01:00
Justus Winter
a9e0b1dd6c dirmngr: Start dirmngr on demand.
* common/asshelp.h: Include 'util.h'.
* dirmngr/dirmngr-client.c (main): Use 'start_new_dirmngr' to connect
to the dirmngr.
(start_dirmngr): Drop now unused declaration and function.
--
Signed-off-by: Justus Winter <justus@g10code.com>
GnuPG-bug-id: 1843
2015-11-23 13:41:15 +01:00
Justus Winter
6b14df5525 dirmngr: Improve error handling.
* dirmngr/crlcache.c (crl_cache_cert_isvalid): Add missing break.
--
Found using the Clang Static Analyzer.

Signed-off-by: Justus Winter <justus@g10code.com>
2015-11-19 17:53:18 +01:00
Justus Winter
b223cde311 dirmngr: Fix memory leak.
* dirmngr/ldap.c (start_cert_fetch_ldap): Avoid leaking all malloc'ed
arguments.
--
Found using the Clang Static Analyzer.

Signed-off-by: Justus Winter <justus@g10code.com>
2015-11-19 17:53:18 +01:00
Justus Winter
f596f8defa dirmngr: Fix typo.
--
Signed-off-by: Justus Winter <justus@g10code.com>
2015-11-19 15:08:42 +01:00
Justus Winter
eb54fca4bf dirmngr: Gracefully handle premature termination of TLS streams.
* dirmngr/http.c (close_tls_session): New function.
(session_unref): Use the new function to close the TLS stream.
(cookie_read): If the stream terminated prematurely, close it and
return a short read.
--
With this patch, I was able to update all the keys in the Debian
keyring over hkps.

Signed-off-by: Justus Winter <justus@g10code.com>
GnuPG-bug-id: 1950
2015-11-18 15:06:48 +01:00
Justus Winter
1e3dbb15af dirmngr: Fix specifying keyservers by IP address.
* dirmngr/ks-engine-hkp.c (map_host): Update the original 'hosttable'
entry instead of creating another one.
--
Previously, if a keyserver was given using its IP address
(e.g. 'hkp://127.0.0.1'), 'map_host' would create two entries in the
'hosttable', one with the name '127.0.0.1', and the second one with
the name 'localhost' and 'v4addr' being set to '127.0.0.1'.  But the
first entry is the one being used for lookups, and since the 'v4' flag
is not set, the 'HTTP_FLAG_IGNORE_IPv4' is used when doing the http
request, making it fail.

Signed-off-by: Justus Winter <justus@g10code.com>
GnuPG-bug-id: 2012
2015-11-17 16:09:45 +01:00
Justus Winter
a9e0905342 Fix typos found using codespell.
* agent/cache.c: Fix typos.
* agent/call-pinentry.c: Likewise.
* agent/call-scd.c: Likewise.
* agent/command-ssh.c: Likewise.
* agent/command.c: Likewise.
* agent/divert-scd.c: Likewise.
* agent/findkey.c: Likewise.
* agent/gpg-agent.c: Likewise.
* agent/w32main.c: Likewise.
* common/argparse.c: Likewise.
* common/audit.c: Likewise.
* common/audit.h: Likewise.
* common/convert.c: Likewise.
* common/dotlock.c: Likewise.
* common/exechelp-posix.c: Likewise.
* common/exechelp-w32.c: Likewise.
* common/exechelp-w32ce.c: Likewise.
* common/exechelp.h: Likewise.
* common/helpfile.c: Likewise.
* common/i18n.h: Likewise.
* common/iobuf.c: Likewise.
* common/iobuf.h: Likewise.
* common/localename.c: Likewise.
* common/logging.c: Likewise.
* common/openpgp-oid.c: Likewise.
* common/session-env.c: Likewise.
* common/sexputil.c: Likewise.
* common/sysutils.c: Likewise.
* common/t-sexputil.c: Likewise.
* common/ttyio.c: Likewise.
* common/util.h: Likewise.
* dirmngr/cdblib.c: Likewise.
* dirmngr/certcache.c: Likewise.
* dirmngr/crlcache.c: Likewise.
* dirmngr/dirmngr-client.c: Likewise.
* dirmngr/dirmngr.c: Likewise.
* dirmngr/dirmngr_ldap.c: Likewise.
* dirmngr/dns-stuff.c: Likewise.
* dirmngr/http.c: Likewise.
* dirmngr/ks-engine-hkp.c: Likewise.
* dirmngr/ks-engine-ldap.c: Likewise.
* dirmngr/ldap-wrapper.c: Likewise.
* dirmngr/ldap.c: Likewise.
* dirmngr/misc.c: Likewise.
* dirmngr/ocsp.c: Likewise.
* dirmngr/validate.c: Likewise.
* g10/encrypt.c: Likewise.
* g10/getkey.c: Likewise.
* g10/gpg.c: Likewise.
* g10/gpgv.c: Likewise.
* g10/import.c: Likewise.
* g10/keydb.c: Likewise.
* g10/keydb.h: Likewise.
* g10/keygen.c: Likewise.
* g10/keyid.c: Likewise.
* g10/keylist.c: Likewise.
* g10/keyring.c: Likewise.
* g10/mainproc.c: Likewise.
* g10/misc.c: Likewise.
* g10/options.h: Likewise.
* g10/packet.h: Likewise.
* g10/parse-packet.c: Likewise.
* g10/pkclist.c: Likewise.
* g10/pkglue.c: Likewise.
* g10/plaintext.c: Likewise.
* g10/server.c: Likewise.
* g10/sig-check.c: Likewise.
* g10/sqlite.c: Likewise.
* g10/tdbio.c: Likewise.
* g10/test-stubs.c: Likewise.
* g10/tofu.c: Likewise.
* g10/trust.c: Likewise.
* g10/trustdb.c: Likewise.
* g13/create.c: Likewise.
* g13/mountinfo.c: Likewise.
* kbx/keybox-blob.c: Likewise.
* kbx/keybox-file.c: Likewise.
* kbx/keybox-init.c: Likewise.
* kbx/keybox-search-desc.h: Likewise.
* kbx/keybox-search.c: Likewise.
* kbx/keybox-update.c: Likewise.
* scd/apdu.c: Likewise.
* scd/app-openpgp.c: Likewise.
* scd/app-p15.c: Likewise.
* scd/app.c: Likewise.
* scd/ccid-driver.c: Likewise.
* scd/command.c: Likewise.
* scd/iso7816.c: Likewise.
* sm/base64.c: Likewise.
* sm/call-agent.c: Likewise.
* sm/call-dirmngr.c: Likewise.
* sm/certchain.c: Likewise.
* sm/gpgsm.c: Likewise.
* sm/import.c: Likewise.
* sm/keydb.c: Likewise.
* sm/minip12.c: Likewise.
* sm/qualified.c: Likewise.
* sm/server.c: Likewise.
* tools/gpg-check-pattern.c: Likewise.
* tools/gpgconf-comp.c: Likewise.
* tools/gpgkey2ssh.c: Likewise.
* tools/gpgparsemail.c: Likewise.
* tools/gpgtar.c: Likewise.
* tools/rfc822parse.c: Likewise.
* tools/symcryptrun.c: Likewise.

Signed-off-by: Justus Winter <justus@g10code.com>
2015-11-17 12:50:22 +01:00
Werner Koch
a3b26d6c08
dirmngr: Do not block during ADNS calls.
* dirmngr/dns-stuff.c: Include npth.h
(my_unprotect, my_protect): New wrapper.
(resolve_name_adns): Put unprotect/protect around adns calls.
(get_dns_cert): Ditto.
(getsrv): Ditto.
(get_dns_cname): Ditto.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-11-12 13:31:59 +01:00
Werner Koch
a2cc1d5755
dirmngr: New option --nameserver.
* dirmngr/dirmngr.c (oNameServer): New.
(opts): Add --nameserver.
(parse_rereadable_options): Act upon oNameServer.
* dirmngr/dns-stuff.c (DEFAULT_NAMESERVER): New.
(tor_nameserver): New.
(set_dns_nameserver): New.
(my_adns_init): Make name server configurable.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-11-12 13:20:18 +01:00
Werner Koch
288c9919dc
dirmngr: Change to new ADNS Tor mode init scheme.
* dirmngr/dns-stuff.c (tor_credentials): New.
(enable_dns_tormode): Add arg new_circuit and update tor_credentials.
(my_adns_init): Rework to set Tor mode using a config file options and
always use credentials.
* dirmngr/server.c (cmd_dns_cert): Improve error message.
* dirmngr/t-dns-stuff.c (main): Add option --new-circuit.
--

Note that the option --new-circuit in t-dns-stuff is not really useful
because a new circuit is also used for the first call to the function.

Todo: We need to find a policy when to requrest a new curcuit and we
      also need to add credentials to the assuan_sock_connect calls.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-11-09 20:44:13 +01:00
Werner Koch
f92e95175e
dirmngr: Improve detection of ADNS.
* configure.ac (HAVE_ADNS_FREE): New ac_define.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-11-09 20:34:42 +01:00
Werner Koch
5aadb4b62d
common: Add separate header for zb32.c.
* common/util.h (zb32_encode): Move prototype to ...
* common/zb32.h: new.  Include this for all callers of zb32_encode.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-30 12:33:40 +01:00
Werner Koch
fa15a71daf
dirmngr: Fix NULL-deref while loading a CRL.
* dirmngr/crlcache.c (crl_parse_insert): Set error before leaping to
failure.
--

GnuPG-bug-id: 2082
Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-28 11:57:00 +01:00
Werner Koch
949a5cfdab
dirmngr: Minor cleanup of the SRV RR code.
* dirmngr/dns-stuff.c: Include unistd.h.
(getsrv): Run srand only once.
* dirmngr/t-dns-stuff.c (main): Allow passing another name for --srv
and change output format.
2015-10-28 10:14:30 +01:00
Werner Koch
e026efb436
dirmngr: Add a getaddrinfo wrapper backend using ADNS.
* dirmngr/dns-stuff.c: Replace all use of default_errsource.
(my_adns_init): Move to top.
(resolve_name_adns): New.
(resolve_dns_name) [USE_ADNS]: Divert to new func.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-28 08:55:01 +01:00
Werner Koch
4524a2a371
dirmngr: Support Tor hidden services.
* dirmngr/dns-stuff.c (is_onion_address): New.
* dirmngr/ks-engine-hkp.c (hostinfo_s): Add field "onion".
(map_host): Special case onion addresses.
(ks_hkp_print_hosttable): Print an 'O' for an onion address.
* dirmngr/http.c (connect_server): Special case onion addresses.
--

Note that this requires the latest libassuan from git.  Onion addresses
are always support regardless of the --use-tor flag.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-26 16:34:19 +01:00
Werner Koch
7735bbe539
dirmngr,w32: Remove gethostbyname hack and make it build again.
* dirmngr/http.c (connect_server) [W32]: Remove gethostbyname hack;
we require getaddrinfo anyway.
* dirmngr/dns-stuff.c (AI_ADDRCONFIG): Add replacement if not defined.
(map_eai_to_gpg_error) [W32]: Take care of unsupported codes.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-26 16:34:19 +01:00
Werner Koch
5e7ac031f5
dirmngr: Add workaround for broken getaddrinfo.
* dirmngr/dns-stuff.c (resolve_name_standard): On failure retry by
first resolving the CNAME.
(get_dns_cname): New.

* dirmngr/t-dns-stuff.c (main): Add option --cname.
--

At least the getaddrinfo implementation in glibc 2.19-13 from Debian
returns EAI_NONAME if the CNAME points to a too long list of A/AAAA
addresses.  Looking at the wire the data is correctly returned from
the server but getaddrinfo seems to get confused by truncation and
retry.  To fix this we resolve the CNAME again and call getaddrinfo
again with the canonical name.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-25 16:47:12 +01:00
Werner Koch
0e3c9f184a
dirmngr: Better handle systems without IPv6 or IPv4.
* dirmngr/dns-stuff.c (resolve_name_standard): Use AI_ADDRCONFIG.
2015-10-25 16:47:12 +01:00
Werner Koch
927f34603d
dirmngr: Replace use of getnameinfo by resolve_dns_addr.
* dirmngr/ks-engine-hkp.c (my_getnameinfo): Remove.
(map_host): Use resolve_dns_addr.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-25 16:47:12 +01:00
Werner Koch
816505958a
dirmngr: Implement a getnameinfo wrapper.
* dirmngr/dns-stuff.h (DNS_NUMERICHOST): New.
(DNS_WITHBRACKET): New.
* dirmngr/dns-stuff.c (resolve_name_standard): Factor code out to...
(map_eai_to_gpg_error): new.
(resolve_addr_standard): New.
(resolve_dns_addr): New.

* dirmngr/ks-engine-hkp.c (is_ip_address): Move to ...
* dirmngr/dns-stuff.c (is_ip_address): here.  Add support for non
bracketed v6 addresses.

* dirmngr/t-dns-stuff.c: Remove header netdb.h.
(main): Add option --bracket.  Use resolve_dns_name instead of
getnameinfo.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-25 16:47:11 +01:00
Werner Koch
8b06d7f41a
dirmngr: Implement Tor mode for SRV RRs.
* dirmngr/dns-stuff.c (get_dns_cert): Factor adns init out to...
(my_adns_init): new.
(getsrv)[USE_ADNS]: Use my_adns_init.
(getsrv)[!USE_ADNS]: Return an error if Tor mode is active.

* dirmngr/t-dns-stuff.c: Add option --use-tor.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-22 10:15:25 +02:00
Werner Koch
e03a4a94bb
dirmngr: Do not use MAXDNAME.
* dirmngr/dns-stuff.c (getsrv): Replace MAXDNAME.
* dirmngr/dns-stuff.h (MAXDNAME): Remove.
(struct srventry): Use a fixed value instead of MAXDNAME.
* dirmngr/http.c (connect_server): Use DIMof instead of MAXDNAME.
Malloc a helper array.

--

Depending on the order of included headers it might be that we allocate
the array with a different size than what we test against in another
module.  To make it more robust we use the actual known size of
checking.

A better would be to use a linked list and avoid these large arrays.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-22 09:52:51 +02:00
Werner Koch
41bb01ae79
Move SRV RR code from common/ to dirmngr/.
* common/srv.c: Merge into dirmngr/dns-stuff.c.  Delete file.
* common/srv.h: Merge into dirmngr/dns-stuff.h.  Delete file.
* common/Makefile.am (common_sources): Remove srv.c and srv.h.
* g10/keyserver.c: Do not include srv.h.  The code using it is anyway
disabled.
* dirmngr/http.c: Remove header srv.h and stubs.
* dirmngr/t-dns-stuff.c: Add option --srv.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-22 09:22:41 +02:00
Werner Koch
1e34007c97
dirmngr: Use the new DNS wrapper for the HTTP module.
* dirmngr/t-http.c (main): Init assuan sockets.
* dirmngr/http.c: Include dns-stuff.h.
(connect_server)[!HAVE_GETADDRINFO]: Remove all code.
(connect_server): Change to use resolve_dns_name.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-21 22:41:12 +02:00
Werner Koch
b6af3377e1
dirmngr: Allow use of http.c if USE_NPTH is not defined.
* dirmngr/http.c (send_request): Always set the gnutls pull/push
functions.
(my_npth_read): Rename to ...
(my_gnutls_read) .. this.  Use system read if !USE_NPTH.
(my_npth_write): Rename to ...
(my_gnutls_write) .. this.  Use system write if !USE_NPTH.
--

This is necessary to run t-http because we once switched to a ref
counted object with the socket descriptor.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-21 22:38:37 +02:00
Werner Koch
6fafda979d
dirmngr: Check that getaddrinfo is available.
* dirmngr/Makefile.am (t_http_SOURCES): Add dns-stuff.c.
(t_ldap_parse_uri_SOURCES): Ditto.
* dirmngr/dns-stuff.c: Bail out if neither ADNS nor getaddrinfo is
available.
--

We used to have replacement code for getaddrinfo and thus check for it
in configure.  However, this was for the old http and dns-cert code
from common/.  For dirmngr I made liberal use of getaddrinfo w/o
without checking.  Just in case someone tries to build on an old
platform we now error our with a suitable #error.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-21 22:11:59 +02:00
Werner Koch
9ffcb77e25
Change capitalization of TOR to Tor.
--
2015-10-21 18:14:24 +02:00
Werner Koch
afbe87fa2d
dirmngr: Use the new DNS wrapper for the HKP engine.
* dirmngr/ks-engine-hkp.c (my_getnameinfo): Change arg type to
dns_addrinfo_t.
(map_host): Replace getaddrinfo by resolve_dns_name.
--

Note that we still need to replace getnameinfo so that the PTR lookup
is either suppressed or also done via ADNS.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-21 17:57:03 +02:00
Werner Koch
8bccbf4778
dirmngr: Implement a getaddrinfo wrapper.
* dirmngr/dns-stuff.h: Include some header files.
(dns_addinfo_t, dns_addrinfo_s): New.
* dirmngr/dns-stuff.c: Always include DNS related headers.
(free_dns_addrinfo): New.
(resolve_name_standard): New.
(resolve_dns_name): New.

* dirmngr/t-dns-stuff.c: Include netdb.h.
(main): Keep old default mode with no args but else print outout of
resolve_dns_name.  Revamp option parser.
--

This wrapper allows us to switch to ADNS and thus Tor for standard
name resultion.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-21 17:56:56 +02:00
Neal H. Walfield
a79045e38d dirmngr: Allow building with libassuan < 2.3.
* dirmngr/http.c (send_request): Use newer assuan function only if
available.

--
Signed-off-by: Neal H. Walfield <neal@g10code.com>
Regression-due-to: 4e42ad30
2015-10-21 13:45:46 +02:00
Werner Koch
5055b617a9
dirmngr: Rename file dns-cert.c.
* dirmngr/dns-cert.c: Rename to dirmngr/dns-stuff.c.
* dirmngr/dns-cert.h: Rename to dirmngr/dns-stuff.h and change
includers.
* dirmngr/t-dns-cert.c: Rename to dirmngr/t-dns-stuff.c.
* dirmngr/Makefile.am: Adjust.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-21 10:29:02 +02:00
Werner Koch
58ebe50bdf
dirmngr: Prefer ADNS over system resolver.
* configure.ac (HAVE_ADNS_IF_TORMODE): New ac_define.
(USE_DNS_CERT): Prefer ADNS over the system resolver.
* dirmngr/dns-cert.c (tor_mode): New global var.
(enable_dns_tormode): New func.
(get_dns_cert): Use DNS resolver at 8.8.8.8 in tor-mode.
* dirmngr/server.c (cmd_dns_cert): If supported allow DNS requests.
2015-10-20 19:03:26 +02:00
Werner Koch
c83b627174
w32: Allow building again.
* dirmngr/http.c (connect_server): Fix called function name.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-20 17:33:18 +02:00
Werner Koch
4e42ad300b
dirmngr: Allow building with libassuan < 2.3.
* dirmngr/dirmngr.c (set_tor_mode): Use newer assuan function only if
available.
* dirmngr/http.c (http_raw_connect): Ditto.
--

Frankly we should require that but we can also wait for 2.4.0 and
switch then.
2015-10-19 20:52:19 +02:00
Werner Koch
6983fd131f
dirmngr: Make --use-tor work - still leaks DNS.
* dirmngr/dirmngr.c (set_tor_mode): New.
(main, reread_configuration): Call it.
* dirmngr/http.c (http_raw_connect, send_request): Check whether TOR
mode is enabled if the FORCE_TOR flag is given.
--

The patch for http.c is a sanity check because tor mode is anyway
global as long as the Assuan socket wrappers are used.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-19 13:17:58 +02:00
Werner Koch
8c609eaf35
dirmngr: Use Assuan socket wrappers for http.c
* dirmngr/http.c: Include assuan.h.  Changed all code taking a socket
descriptor from int to assuan_fd_t.
(my_unprotect, my_protect): New.
(my_connect): Remove.
(_my_socket_new, _my_socket_unref): use assuan_sock_close.
(connect_server): Use assuan_sock_connect, assuan_sock_new, and
assuan_sock_close.
* dirmngr/Makefile.am (t_common_ldadd): Add LIBASSUAN_LIBS.
--

This change prepares for the use of SOCKS5 with http.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-19 13:17:58 +02:00
Werner Koch
5aa1b392b1
Move http module from common/ to dirmngr/.
* common/http.c: Move to ../dirmngr/.
* common/http.h: Move to ../dirmngr/.
* common/t-http.c: Move to ../dirmngr/.
* common/tls-ca.pem: Move to ../dirmngr/.
* common/Makefile.am: Do not build libcommontls.a libcommontlsnpth.a.
Remove http.c related stuff.
* po/POTFILES.in: Move http.c to dirmngr/.
* dirmngr/Makefile.am (EXTRA_DIST): Add tls-ca.pem.
(module_maint_tests): New.
(noinst_PROGRAMS): Add module_maint_tests.
(dirmngr_SOURCES): Add http.c and http.h.
(dirmngr_LDADD): Remove libcommontlsnpth.
(t_common_ldadd): Ditto.
(t_http_SOURCES, t_http_CFLAGS, t_http_LDADD): New.
(t_ldap_parse_uri_SOURCES): Add http.c.
(t_ldap_parse_uri_CFLAGS): Build without npth.
($(PROGRAMS)): Do not require libcommontls.a libcommontlsnpth.a.
* dirmngr/dirmngr.h, dirmngr/ks-engine.h: Fix include of http.h.
--

All network access is done via dirmngr and thus http.c should be
there.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-18 20:08:26 +02:00
NIIBE Yutaka
3de5ef7598 cleanup: Fix confusion between gpg_error_t and gpg_err_code_t.
* dirmngr/crlcache.c (hash_dbfile): Use gpg_error_t for ERR.
* kbx/keybox-update.c (keybox_set_flags): Call
gpg_err_code_from_syserror.
2015-10-14 18:57:26 +09:00
Werner Koch
264a81d827
dirmngr: Addlow fetching keys using OpenPGP DANE
* dirmngr/server.c (cmd_dns_cert): Add option --dane.
--

This implements draft-ietf-dane-openpgpkey-05.txt
To test this use

  $ gpg-connect-agent --dirmngr
  > /hex
  > dns_cert --dane wk@gnupg.org

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-06 19:59:56 +02:00
Werner Koch
211b8084ee
dirmngr: Improve DNS code to retrieve arbitrary records.
* dirmngr/dns-cert.c (get_dns_cert): Add hack to retrieve arbitrary
resource records.
* dirmngr/dns-cert.h (DNS_CERTTYPE_RRBASE): New.
(DNS_CERTTYPE_RR61): New.
--

This has been tested with ADNS on Unix and with the standard
resolver.  Because ADNS works it should also work on Windows.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-06 19:57:00 +02:00
Werner Koch
6cf80dc77e
dirmngr: Change DNS code to make additions easier.
* dirmngr/dns-cert.c (get_dns_cert) [!USE_ADNS]: Change loop to allow
adding more resource types.
2015-10-06 17:34:13 +02:00
Werner Koch
7faf45effc
dirmngr: Make commands RELOADDIRMNGR and KILLDIRMNGR work properly.
* dirmngr/server.c (cmd_killdirmngr): Set assuan close flag.
(cmd_reloaddirmngr): Use check_owner_permission.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-06 13:55:38 +02:00
Werner Koch
9db6547a00
dirmngr: Do tilde expansion for --hkp-cacert.
* dirmngr/dirmngr.c (parse_rereadable_options): Do tilde expansion and
check for cert file existance in option --hkp-cacert.
--

GnuPG-bug-id: 2120
Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-06 13:10:26 +02:00
Werner Koch
a48e6de603
dirmngr: Add option --keyserver.
* dirmngr/dirmngr.c (oKeyServer): New.
(opts): Add "keyserver".
(parse_rereadable_options): Parse that options
(main): Add option to the gpgconf list.
* dirmngr/dirmngr.h (opt): Add field "keyserver".
* dirmngr/server.c (ensure_keyserver): New.
(make_keyserver_item): New.  Factored out from
(cmd_keyserver): here.  Call ensure_keyserver.
(cmd_ks_search): Call ensure_keyserver.
(cmd_ks_get): Ditto.
(cmd_ks_fetch): Ditto.
(cmd_ks_put): Ditto.
--

This option specifies the keyserver to be used if the client does not
set another keyserver.  We want to fade out the use of --keyserver in
gpg.conf in favor of specifying it here.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-05 17:44:20 +02:00
Werner Koch
438730323a
dirmngr: Make clear that --use-tor is not yet ready for use.
* dirmngr/dirmngr.c (main): Print a warning if --use-tor has been
given.
* tools/gpgconf-comp.c (gc_options_dirmngr): Make --use-tor invisible.
2015-10-05 11:31:31 +02:00
Werner Koch
75c64c2b6d
dirmngr: Fix use-after-free due to a realloc shrinking.
* dirmngr/ks-engine-hkp.c (map_host): Do not use original pointer
after realloc.
--

vex01 reported and debugged the problem.

GnuPG-bug-id: 2107
Signed-off-by: Werner Koch <wk@gnupg.org>
2015-10-02 11:31:45 +02:00
Werner Koch
c091816b4a
dirmngr: Add option --use-tor as a stub.
* dirmngr/dirmngr.h (opt): Add field "use_tor".
* dirmngr/dirmngr.c (oUseTor): New.
(opts): Add --use-tor.
(parse_rereadable_options): Set option.
(main): Tell gpgconf about that option.

* dirmngr/crlfetch.c (crl_fetch): Pass TOR flag to the http module and
return an error if LDAP is used in TOR mode.
(ca_cert_fetch): Return an error in TOR mode.
(start_cert_fetch): Ditto.
* dirmngr/ks-engine-finger.c (ks_finger_fetch): Pass TOR flag to the
http module.
* dirmngr/ks-engine-hkp.c (send_request): Ditto.
* dirmngr/ks-engine-http.c (ks_http_fetch): Ditto.
* dirmngr/ks-engine-ldap.c (ks_ldap_get): Return an error in TOR mode.
(ks_ldap_search): Ditto.
(ks_ldap_put): Ditto.
* dirmngr/ocsp.c (do_ocsp_request): Ditto.  Also pass TOR flag to the
http module.

* dirmngr/server.c (option_handler): Add "honor-keyserver-url-used".
(cmd_dns_cert): Return an error in TOR mode.
(cmd_getinfo): Add subcommand "tor"
* tools/gpgconf-comp.c (gc_options_dirmngr): Add TOR group.
--

More work is required to actually make --use-tor useful.  For now it
returns an error for almost all network access but as soon as we have
added the TOR feature to the http module some parts will start to
work.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-09-18 16:21:31 +02:00
Werner Koch
19545e3a2d
dirmngr: Allow sending much larger keyblocks.
* dirmngr/server.c (MAX_CERT_LENGTH): Increase to 16k.
(MAX_KEYBLOCK_LENGTH): Increase to 20M.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-09-09 15:41:25 +02:00
Werner Koch
84f4c8811f
dirmngr: Allow sending of Zack's key.
* dirmngr/server.c (MAX_KEYBLOCK_LENGTH): Increase to 1 MiB.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-08-23 21:16:39 +02:00
Werner Koch
d382242fb6
Replace GNUPG_GCC_A_ macros by GPGRT_ATTR_ macros.
* common/util.h: Provide replacement for GPGRT_ATTR_ macros when using
libgpg-error < 1.20.
* common/mischelp.h: Ditto.
* common/types.h: Ditto.
--

Given that libgpg-error is a dependency of all GnuPG related libraries
it is better to define such macros at only one place instead of having
similar macros at a lot of places.  For now we need repalcement
macros, though.
2015-07-26 12:50:24 +02:00
Werner Koch
54a0ed3d9b
Allow use of debug flag names for all tools.
* g13/g13.c: Make use of debug_parse_flag.
* scd/scdaemon.c: Ditto.
* sm/gpgsm.c: Ditto
* agent/gpg-agent.c: Ditto.  But do not terminate on "help"
* dirmngr/dirmngr.c: Ditto.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-06-23 09:13:45 +02:00
Werner Koch
c97198371b
dirmngr: Fix the cleanup zombies fix (685b782).
* dirmngr/ldap-wrapper.c (ldap_wrapper_thread): Do not close the
stdout reader after EOF from read_log_data.
* dirmngr/crlcache.c (crl_cache_reload_crl): Close the reader before
the next iteration.
--

I assumed that the log_fd also has a reader object but that reader
object is used for stdout and needs to be closed by the consumer.

The real bug with the non-released ldap_wrapper control objects was
that when looping over distribution points we did not closed the used
reader object before the next iteration.  Now, the test case had more
than one DP and thus we lost one reader object.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-06-18 13:34:48 +02:00
Werner Koch
685b782a18
dirmngr: Cleanup zombies and fix hang on shutdown.
* dirmngr/ldap-wrapper.c (ldap_wrapper_thread): Move nfds computation
into the loop.  Check the queue also on timeout.  Close log_fd and
reader context on EOF or error.
--

The major bug here was that on an EOF of the log fd the log fd was not
closed and thus the final queue item removal could not work.  Checking
the queue on a timeout is not really necessary but it help in case
there is a race condition lingering.

GnuPG-bug-id: 1838, 1978
Signed-off-by: Werner Koch <wk@gnupg.org>
2015-06-16 18:11:32 +02:00
Werner Koch
eb4d33cba9
dirmngr: Add missing cast for use of pid_t in printf.
--
2015-06-16 18:11:31 +02:00
Werner Koch
82c72e2db7
dirmngr: Avoid accessing uninitialized memory in log callback.
* dirmngr/dirmngr.c (pid_suffix_callback): Clear int_and_ptr_u before
use.
(start_connection_thread): Ditto.
(handle_connections): Ditto.
--

Example valgrind output:

==2921== Conditional jump or move depends on uninitialised value(s)
==2921==    at 0x5BBDEF4: pthread_getspecific (pthread_getspecific.c:57)
==2921==    by 0x40AAEE: pid_suffix_callback (dirmngr.c:614)
==2921==    by 0x433F5A: do_logv (logging.c:684)

This is because on 64 bit systems "sizeof aptr > sizeof aint" and thus
Valgrind complains about this.  It is no a real problem because we
don't use the unitialized bits.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-06-16 18:11:31 +02:00
Werner Koch
255dadd76d
dirmngr: Avoid crash due to an empty crls.d/DIR.txt.
* dirmngr/crlcache.c (check_dir_version): Avoid segv.
--

GnuPG-bug-id: 1842
Debian-bug-id: 776611
2015-06-09 11:31:06 +02:00
Kristian Fiskerstrand
d0d4984cfe dirmngr: Fix segfault in ldap engine
(ks-engine-ldap.c) Fix segfault caused by missing check whether uri is
initialized
2015-05-07 15:03:28 +02:00
Werner Koch
26d7e0d7ac
common: Rename log and gcc attribute macros (jnlib merge).
* common/logging.h: Rename JNLIB_LOG_* to GPGRT_LOG_*.
* common/mischelp.h: Rename JNLIB_GCC_* to GPGRT_GCC_*.
--

JNLIB has no more meaning.  Thus we switch to a GPGRT_ prefix in
anticipation that some code may eventually be moved to libgpg-error.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-04-24 16:10:47 +02:00
Werner Koch
575230d91b
common: Remove two JNLIB_ macros (jnlib merge).
* configure.ac: Merge seperate jnlib checks.
(HAVE_JNLIB_LOGGING): Remove.
* common/logging.c, common/simple-pwquery.c (JNLIB_NEED_AFLOCAL):
Rename to GNUPG_COMMON_NEED_AFLOCAL.  Change all tests.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-04-24 16:10:15 +02:00
Werner Koch
154f3ed2bf
gpg: Move all DNS access to Dirmngr.
* common/dns-cert.h: Move to ../dirmngr/.
* common/dns-cert.c: Move to ../dirmngr/.  Change args to return the
key as a buffer.
* common/t-dns-cert.c: Move to ../dirmngr/.
* common/pka.c, common/pka.h, common/t-pka.c: Remove.

* dirmngr/server.c (data_line_cookie_write): Factor code out to
data_line_write and make it a wrapper for that.
(data_line_write): New.
(cmd_dns_cert): New.
(register_commands): Register new command.

* g10/Makefile.am (LDADD): Remove DNSLIBS.
* g10/call-dirmngr.c (dns_cert_parm_s): New.
(dns_cert_data_cb, dns_cert_status_cb): New.
(gpg_dirmngr_dns_cert): New.
(gpg_dirmngr_get_pka): New.
* g10/gpgv.c (gpg_dirmngr_get_pka): New dummy function.
* g10/keyserver.c (keyserver_import_cert): Replace get_dns_cert by
gpg_dirmngr_dns_cert.
(keyserver_import_pka): Replace get_pka_info by gpg_dirmngr_get_pka.
* g10/mainproc.c: Include call-dirmngr.h.
(pka_uri_from_sig): Add CTX arg. Replace get_pka_info by
gpg_dirmngr_get_pka.
--

With this patch gpg does not do any network access itself but uses
dirmngr for that.  Note that we need to keep linking to NETLIBS due to
the logging code and because we need TCP for our socket emulation
under Windows.  Probably also required for Solaris etc.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-04-23 15:52:39 +02:00
Werner Koch
a0dead5edc
dirmngr: Add http proxy support for keyservers.
* dirmngr/dirmngr.h (server_control_s): Add field http_proxy.
* dirmngr/dirmngr.c (dirmngr_init_default_ctrl): Copy http_proxy value
from OPT.
(dirmngr_deinit_default_ctrl): New.
(main): Call dirmngr_deinit_default_ctrl.
* dirmngr/server.c (start_command_handler): Ditto.
(option_handler): Add option "http-proxy".
* dirmngr/crlfetch.c (crl_fetch): Take http_proxy from CTRL.
* dirmngr/ocsp.c (do_ocsp_request): Ditto.
* dirmngr/ks-engine-hkp.c (send_request): Add proxy support.
* dirmngr/ks-engine-http.c (ks_http_fetch): Ditto.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-04-21 17:15:34 +02:00
Werner Koch
62b2cee85f
Remove the obsolete keyserver directory from the repo.
--

We also merge dirmngr/ChangeLog.1 into dirmngr/ChangeLog-2011
and rename keyserver/ChangeLog-2011 to dirmngr/ChangeLog-2011-ks.
2015-04-20 18:20:45 +02:00
Neal H. Walfield
5cde5bf373 dirmngr: If LDAP is not enable, don't build the LDAP bits.
* dirmngr/Makefile.am (dirmngr_SOURCES): Only include
ks-engine-ldap.c, ldap-parse-uri.c and ldap-parse-uri.h if USE_LDAP
is TRUE.
(module_tests): Only add t-ldap-parse-uri if USE_LDAP is TRUE.
* dirmngr/ks-action.c: Only include "ldap-parse-uri.h" if USE_LDAP is
TRUE.
(ks_action_help): Don't invoke LDAP functionality if USE_LDAP is not
TRUE.
(ks_action_search): Likewise.
(ks_action_get): Likewise.
(ks_action_put): Likewise.
* dirmngr/server.c: Only include "ldap-parse-uri.h" if USE_LDAP is
TRUE.
(cmd_keyserver): Don't invoke LDAP functionality if USE_LDAP is not
TRUE.

--
Signed-off-by: Neal H. Walfield <neal@g10code.com>
GnuPG-bug-id: 1949
2015-04-13 12:02:40 +02:00
Werner Koch
c8bb5000d4
dirmngr,w32: Make it build for Windows.
* dirmngr/Makefile.am (t_common_ldadd): Add missing libs.
2015-04-10 15:08:50 +02:00
Werner Koch
67158ff155
Remove obsolete directories from AM_CPPFLAGS. 2015-04-10 13:11:59 +02:00
Werner Koch
0fb224c2c5
dirmngr,w32: Replace functions not available under Windows.
* dirmngr/ks-engine-ldap.c (extract_attributes): Replace isoptime and
gmtime_r.
2015-04-10 13:09:58 +02:00
Werner Koch
6ad95fe6f1
dirmngr,w32: Avoid name clash with existing function
* dirmngr/ks-engine-ldap.c (ldap_connect): Rename to my_ldap_connect.
2015-04-10 13:09:35 +02:00
Werner Koch
24a75201da
Rename DBG_ASSUAN to DBG_IPC and add separate DBG_EXTPROG.
* g10/options.h (DBG_EXTPROG_VALUE): Separate from DBG_IPC_VALUE.
2015-04-06 13:42:17 +02:00
Werner Koch
2f099eb62a
Fix use of DBG_CACHE and DBG_LOOKUP
* dirmngr/dirmngr.h (DBG_LOOKUP_VALUE): Change to 8192.
* g10/options.h (DBG_LOOKUP_VALUE, DBG_LOOKUP): New.
* g10/getkey.c: Use DBG_LOOKUP instead of DBG_CACHE at most places.
2015-04-06 13:27:26 +02:00
Neal H. Walfield
d0ff2ee041 dirmngr: Don't use alloca.
* dirmngr/ks-engine-ldap.c (ks_ldap_put): Replace use of alloca with
xmalloc and xfree.

--
Signed-off-by: Neal H. Walfield <neal@g10code.com>
2015-03-31 14:48:31 +02:00
Neal H. Walfield
802eec0ca4 dirmngr: Simplify truncation of long strings in debug code.
* dirmngr/ks-engine-ldap.c (modlist_dump): Simplify truncation of long
strings.

--
Signed-off-by: Neal H. Walfield <neal@g10code.com>
2015-03-31 14:23:13 +02:00
Neal H. Walfield
6d5aee23c3 dirmngr: Correct indentation.
--
Signed-off-by: Neal H. Walfield <neal@g10code.com>
2015-03-31 12:26:59 +02:00
Neal H. Walfield
7f6d7948c1 dirmngr: Use a better error code.
* dirmngr/ldap-parse-uri.c (ldap_parse_uri): On error, return
GPG_ERR_GENERAL, not GPG_ERR_ASS_GENERAL.

--
Signed-off-by: Neal H. Walfield <neal@g10code.com>
2015-03-31 12:07:39 +02:00
Neal H. Walfield
348c520040 dirmngr: Better encapsulate the keyservers variable.
* dirmngr/dirmngr.h (struct server_control_s): Move field keyservers
from here...
* dirmngr/server.c (struct server_local_s): ... to here.  Update
users.
* dirmngr/ks-action.h (ks_action_resolve): Add argument keyservers.
(ks_action_search): Likewise.
(ks_action_get): Likewise.
(ks_action_put): Likewise.
* dirmngr/ks-action.c (ks_action_resolve): Add argument keyservers.
Use it instead of ctrl->keyservers.
(ks_action_search): Likewise.
(ks_action_get): Likewise.
(ks_action_put): Likewise.

--

Signed-off-by: Neal H. Walfield <neal@g10code.com>
2015-03-31 11:58:41 +02:00
Werner Koch
bec10ae4b5
dirmngr: Fix resource leaks and check rare errors.
* dirmngr/ks-engine-ldap.c (keyspec_to_ldap_filter): Fix resource
leak.
(ks_ldap_search): Check error from es_fopenmem.  Use LDAP_ERR where
required.
(modlist_dump): Check error from es_fopenmem.
(uncescape): s/int/size_t/.  Use existing macros.
(extract_attributes): Use existing trim function.
(ks_ldap_put): Do not segv on error from modlist_dump.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-03-25 19:39:27 +01:00
Werner Koch
6c701af121
dirmngr: Minor cleanups.
* dirmngr/ks-engine-ldap.c [__riscos__]: Remove doubled util.h.
(ldap_to_gpg_err): s/GPG_ERR_GENERAL/GPG_ERR_INTERNAL/.
(tm2ldaptime): Use snprintf.
(ldap_connect): Get error code prior to log_error and and use modern
function.   Use xfree, xtrustrdup etc.
(modlist_lookup): Use GNUPG_GCC_A_USED.
(modlist_free): Use xfree.
--

sprintf has been replaced by snprintf to avoid warnings on some
platforms.

xfree et al. is required so that replacement functions are
used if defined.  For example the Libgcrypt functions which may not be
fully compatible with standard free.

Impossible conditions should use GPG_ERR_INTERNAL.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-03-25 19:33:59 +01:00
Neal H. Walfield
7a56b6b3aa Improve documentation for ks_hkp_get.
* dirmngr/ks-engine-hkp.c (ks_hkp_get): Improvement documentation.

--
Signed-off-by: Neal H. Walfield <neal@g10code.de>
2015-03-23 19:58:31 +01:00
Neal H. Walfield
096f4186c8 Improve spelling and grammar of some comments.
--
Signed-off-by: Neal H. Walfield <neal@g10code.de>
2015-03-23 19:58:30 +01:00
Neal H. Walfield
51341badb6 Add support to talking to LDAP key servers.
* g10/call-dirmngr.c (record_output): New function.
(ks_put_inq_cb): Use it here to generate a --with-colons like output
instead of a custom format.
* dirmngr/ks-action.c: Include "ldap-parse-uri.h".
(ks_action_help): If the provided URI is an LDAP URI, then use
ldap_parse_uri to parse.  Call ks_ldap_help.
(ks_action_search): If passed an LDAP URI, then call ks_ldap_search.
(ks_action_get): Likewise.
(ks_action_put): Likewise.  Also, change data from a 'const void *' to
a 'void *' and add info and infolen parameters.  Add note that
function may modify DATA.
* dirmngr/ks-action.h (ks_action_put): Update declaration accordingly.
* dirmngr/server.c: Include "ldap-parse-uri.h".
(cmd_keyserver): If ITEM->URI is an LDAP URI, parse it using
ldap_parse_uri.
(hlp_ks_put): Improve documentation.
(cmd_ks_put): Also pass info and infolen to ks_action_put.  Improve
documentation.
* dirmngr/ks-engine.h (ks_ldap_help): New declaration.
(ks_ldap_search): Likewise.
(ks_ldap_get): Likewise.
(ks_ldap_put): Likewise.
* dirmngr/ks-engine-ldap.c: New file.
* dirmngr/Makefile.am (dirmngr_SOURCES): Add ks-engine-ldap.c,
ldap-parse-uri.c and ldap-parse-uri.h.
(dirmngr_LDADD) [USE_LDAP]: Add $(ldaplibs).

--
Signed-off-by: Neal H. Walfield <neal@g10code.de>
2015-03-23 19:58:29 +01:00
Neal H. Walfield
9e79a15f74 Move copy_stream function to misc.c.
* dirmngr/ks-action.c (copy_stream): Move function from here...
* dirmngr/misc.c (copy_stream): ... to here and drop the static
qualifier.
* dirmngr/misc.h (copy_stream): Add declaration.

--
Signed-off-by: Neal H. Walfield <neal@g10code.de>
2015-03-23 19:58:27 +01:00
Neal H. Walfield
63552852bf Move armor_data to misc.c.
* dirmngr/ks-engine-hkp.c (armor_data): Move function from here...
* dirmngr/misc.c (armor_data): ... to here and drop static qualifier.
* dirmngr/misc.h: New declaration.

--
Signed-off-by: Neal H. Walfield <neal@g10code.de>
2015-03-23 19:58:27 +01:00
Neal H. Walfield
1a75b7c39f Add new LDAP utility functions.
* dirmngr/Makefile.am (module_tests): New variable.
(noinst_PROGRAMS): New primary.  Set it to $(module_tests).
(TESTS): New variable.  Set it to $(module_tests).
(t_common_src): New variable.
(t_common_ldadd): Likewise.
(t_ldap_parse_uri_SOURCES): New primary.
(t_ldap_parse_uri_LDADD): Likewise.
* dirmngr/ldap-parse-uri.c: New file.
* dirmngr/ldap-parse-uri.h: Likewise.
* dirmngr/t-ldap-parse-uri.c: Likewise.
* dirmngr/t-support.h: Likewise.

--
Signed-off-by: Neal H. Walfield <neal@g10code.de>
2015-03-23 19:58:26 +01:00
Werner Koch
dc10d466bf
hkps: Fix host name verification when using pools.
* common/http.c (send_request): Set the requested for SNI.
* dirmngr/ks-engine-hkp.c (map_host): Return the poolname and not
the selecting a host.
--

GnuPG-bug-id: 1792

Thanks to davidw for figuring out the problem.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-03-19 15:37:05 +01:00
Andre Heinecke
070d7bf940 dirmngr: Initialize cache from sysconfig dir
* dirmngr/certcache.c (cert_cache_init): Load certificates
from sysconfig dir instead of the homeidr.
* dirmngr/dirmngr.c (main): Removed parsing of obsolete
homedir_data option.
* dirmngr/dirmngr.h (opt): Removed homedir_data.
* doc/dirmngr.texi: Update and clarify certs directory doc.

--

Using the homedir for extra-certs and trusted-certs makes
little sense when dirmngr is used with a caller that
manages it's own store of certificates and can
provide those through the SENDCERT command.
You can use trusted-certs and extra-certs to provide
users with a base of locally available certificates that are
not already in store of the applications.
2015-02-12 13:02:53 +01:00
Werner Koch
8219c87c30 dirmngr: Avoid warning about unused function.
* dirmngr/dirmngr.c (my_gnutls_log): Build only if gnutls is used.
2015-02-11 19:01:11 +01:00
Werner Koch
2183683bd6 Use inline functions to convert buffer data to scalars.
* common/host2net.h (buf16_to_ulong, buf16_to_uint): New.
(buf16_to_ushort, buf16_to_u16): New.
(buf32_to_size_t, buf32_to_ulong, buf32_to_uint, buf32_to_u32): New.
--

Commit 91b826a38880fd8a989318585eb502582636ddd8 was not enough to
avoid all sign extension on shift problems.  Hanno Böck found a case
with an invalid read due to this problem.  To fix that once and for
all almost all uses of "<< 24" and "<< 8" are changed by this patch to
use an inline function from host2net.h.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-02-11 10:28:25 +01:00
Werner Koch
0c2bfd9d5a Add a hook to be called right after main.
* common/init.c (early_system_init): New stub function.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-01-28 19:57:22 +01:00
Werner Koch
091c35ec72 dirmngr: Fix TLS build problems.
* dirmngr/Makefile.am (AM_CFLAGS): Add flags for TLS libs.
--

This should fix
GnuPG-bug-id: 1813.
2015-01-21 15:54:06 +01:00