1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-23 10:29:58 +01:00

7966 Commits

Author SHA1 Message Date
NIIBE Yutaka
60c880bda5 g10: Fix another memory leak.
* g10/skclist.c (enum_secret_keys): Use SK_LIST instead of pubkey_t.

--

The use of pubkey_t was wrong.  The use is just a list of keys, not
with keyblock.  With SK_LIST, release_sk_list releases memory by
free_public_key.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-09-14 08:11:45 +09:00
NIIBE Yutaka
2eb481e8cc g10: Fix memory leak (more).
* g10/skclist.c (enum_secret_keys): Free SERIALNO on update.

--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-09-14 08:02:16 +09:00
NIIBE Yutaka
64c5c45e2a g10: Fix memory leak in enum_secret_keys.
* g10/skclist.c (enum_secret_keys): Don't forget to call
free_public_key in the error return paths.

--

Reported-by: Philippe Antoine
GnuPG-bug-id: 4140
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-09-14 07:55:20 +09:00
NIIBE Yutaka
69bab1cba0 Revert "dirmngr: hkp: Avoid potential race condition when some hosts die."
This reverts commit 04b56eff118ec34432c368b87e724bce1ac683f9.

--

Now the access to hosttable is serialized correctly.
2018-09-11 14:04:37 +09:00
NIIBE Yutaka
995aded587 dirmngr: Serialize access to hosttable.
* dirmngr/dirmngr.h (ks_hkp_init): New.
* dirmngr/dirmngr.c (main): Call ks_hkp_init.
* dirmngr/ks-engine-hkp.c (ks_hkp_init): New.
(ks_hkp_mark_host): Serialize access to hosttable.
(ks_hkp_print_hosttable, make_host_part): Likewise.
(ks_hkp_housekeeping, ks_hkp_reload): Likewise.

--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-09-11 14:02:53 +09:00
NIIBE Yutaka
f80346f42d common: Use iobuf_get_noeof to avoid undefined behaviors.
* common/iobuf.c (block_filter): Use iobuf_get_noeof.

--

When singed integer has negative value, left shift computation is
undefined in C.

GnuPG-bug-id: 4093
Reported-by: Philippe Antoine
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-09-10 13:44:47 +09:00
NIIBE Yutaka
adce73b86f agent: Fix error code check from npth_mutex_init.
* agent/call-pinentry.c (initialize_module_call_pinentry): It's an
error when npth_mutex_init returns non-zero.

--

Actually, initialize_module_call_pinentry is only called once from
main.  So, this bug had no harm and having the static variable
INITIALIZED is not needed.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-09-10 09:16:50 +09:00
Werner Koch
bee65edfbc
dirmngr: Emit SOURCE status also on NO_DATA.
* dirmngr/ks-engine-hkp.c (ks_hkp_search): Send SOURCE status also on
NO DATA error.
(ks_hkp_get): Ditto.
* g10/call-dirmngr.c (gpg_dirmngr_ks_search): Print "data source" info
also on error.
(gpg_dirmngr_ks_get): Ditto.
--

If a keyserver does not return any data it can be useful to know which
keyserver out of the pool answered.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-09-07 11:48:18 +02:00
Daniel Kahn Gillmor
04b56eff11 dirmngr: hkp: Avoid potential race condition when some hosts die.
* dirmngr/ks-engine-hkp.c (select_random_host): Use atomic pass
through the host table instead of risking out-of-bounds write.

--

Multiple threads may write to hosttable[x]->dead while
select_random_host() is running.  For example, a housekeeping thread
might clear the ->dead bit on some entries, or another connection to
dirmngr might manually mark a host as alive.

If one or more hosts are resurrected between the two loops over a
given table in select_random_host(), then the allocation of tbl might
not be large enough, resulting in a write past the end of tbl on the
second loop.

This change collapses the two loops into a single loop to avoid this
discrepancy: each host's "dead" bit is now only checked once.

As Werner points out, this isn't currently strictly necessary, since
npth will not switch threads unless a blocking system call is made,
and no blocking system call is made in these two loops.

However, in a subsequent change in this series, we will call a
function in this loop, and that function may sometimes write(2), or
call other functions, which may themselves block.  Keeping this as a
single-pass loop avoids the need to keep track of what might block and
what might not.

GnuPG-bug-id: 2836
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2018-09-07 14:28:11 +09:00
NIIBE Yutaka
7c96cc67e1 g10: Fix memory leak.
* g10/import.c (read_block): Call free_packet to skip the packet.

--

Reported-by: Philippe Antoine
GnuPG-bug-id: 3916
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-09-07 13:01:52 +09:00
NIIBE Yutaka
99c17b970b gpgscm: Suppress warnings for GCC > 6.
* tests/gpgscm/scheme.c (CASE): Use unused attribute for GCC > 6.
(FALLTHROUGH): New for fallthrough.
(Eval_Cycle): Use FALLTHROUGH.  Remove not-needed comment of
fallthrough.

--

Since GCC combines C preprocessor macro expansion, the fallthrough
comment doesn't work well to suppress warnings for
-Wimplicit-fallthrough, near the macro CASE.  To handle this
problem, we use GCC's extension of unused label and fallthrough
attributes.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-09-06 14:53:35 +09:00
NIIBE Yutaka
625ced6e67 Fix use of strncpy, which is actually good to use memcpy.
* common/ssh-utils.c (get_fingerprint): Use memcpy.
* g10/build-packet.c (string_to_notation): Use memcpy.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-09-06 11:41:13 +09:00
Werner Koch
23738c9530
artwork: State license of the logo
--
2018-08-30 10:33:28 +02:00
Werner Koch
1bfe766bcf
gpg: Explain error message in key generation with --batch
* g10/keygen.c (generate_keypair): Show more info.
--

GnuPG-bug-id: 3912
Signed-off-by: Werner Koch <wk@gnupg.org>
2018-08-29 15:14:29 +02:00
Werner Koch
420dc2b49a
doc: Minor additions to the gpg man page
--

Includes a fix for
GnuPG-bug-id: 3906

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-08-29 15:04:44 +02:00
Werner Koch
ed8fe21e66
gpg: Remove unused function get_pubkeys.
* g10/getkey.c (get_pubkeys): Remove.
(pubkey_free): Remove and use code directly ...
(pubkeys_free): ... here.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-08-29 11:53:59 +02:00
Werner Koch
53bbac0865
doc: Show how to list envvars send to gpg-agent.
--

GnuPG-bug: 3353
Signed-off-by: Werner Koch <wk@gnupg.org>
2018-08-29 09:53:06 +02:00
Werner Koch
3da835713f
gpg: New option --known-notation.
* g10/gpg.c (oKnownNotation): New const.
(opts): Add option --known-notation.
(main): Set option.
* g10/parse-packet.c (known_notations_list): New local var.
(register_known_notation): New.
(can_handle_critical_notation): Rewrite to handle the new feature.
Also print the name of unknown notations in verbose mode.
--

GnuPG-bug-id: 4060
Signed-off-by: Werner Koch <wk@gnupg.org>
2018-08-29 09:36:09 +02:00
Werner Koch
7f172404bf
gpg: Refresh expired keys originating from the WKD.
* g10/getkey.c (getkey_ctx_s): New field found_via_akl.
(get_pubkey_byname): Set it.
(only_expired_enc_subkeys): New.
(get_best_pubkey_byname): Add support to refresh expired keys from the
WKD.
--

A little drawback of that code is that if the WKD has no update for an
expired key each access of the key will trigger a WKD lookup (unless
cached by the dirmngr).  To avoid this we need to record the last time
we have checked for an update but that would in turn require that we
update the keyring for each check.  We defer this until we have a
better key database which allows for fast updates of meta data.

Testing the code is currently a bit cumbersome because it requires to
update a key in the WKD several times.  Eventually we we need a
network emulation layer to provide sample data for the regression
tests.

GnuPG-bug-id: 2917
Signed-off-by: Werner Koch <wk@gnupg.org>
2018-08-28 15:22:35 +02:00
Werner Koch
db67ccb759
gpg: Remove unused arg from a function.
* g10/getkey.c (get_best_pubkey_byname): Remove unused arg 'no_akl'.
Change both callers.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-08-28 15:16:19 +02:00
Werner Koch
108702ccae
gpg: Prepare for longer card fingerprints.
* g10/call-agent.h (agent_card_info_s): Rename the "*valid" fields to
"*len".
* g10/call-agent.c (unhexify_fpr): Change to take a FPRLEN and to
return the actual length.
(agent_release_card_info): Adjust for these changes.
* g10/card-util.c (print_sha1_fpr): Rename to print_shax_fpr and add
arg FPRLEN.  Change all callers to pass the length.
(print_sha1_fpr_colon): Rename to print_shax_fpr_colon and add arg
FPRLEN.  Change all callers to pass the length.
(fpr_is_zero): Add arg FPRLEN.
(fpr_is_ff): Ditto.
(show_card_key_info): Use the new functions.
* g10/skclist.c (enum_secret_keys): Use MAX_FINGERPRINT_LEN.
--

This is not needed right now but we should get rid of all hard coded
fingerprint lengths.  Thus this change.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-08-27 16:57:04 +02:00
NIIBE Yutaka
b823788d20 g10: Fix enum_secret_keys for card keys.
* g10/skclist.c (enum_secret_keys): Since "KEY-FPR" returns
fingerprint in binary, change it to hex string.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-08-27 16:25:05 +09:00
NIIBE Yutaka
84cc55880a g10: Prefer to available card keys for decryption.
* g10/skclist.c (enum_secret_keys): Add logic to prefer
decryption keys on cards.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-08-27 16:24:45 +09:00
NIIBE Yutaka
03a8de7def g10: Move enum_secret_keys to skclist.c.
* g10/getkey.c (enum_secret_keys): Move to...
* g10/skclist.c (enum_secret_keys): ... here.

--

The function enum_secret_keys is not used by gpgv.c, but it is in
getkey.c.  Extending enum_secret_keys will require change of gpgv.c,
so moving the function to the file for gpg is better.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-08-27 16:24:27 +09:00
NIIBE Yutaka
6bb93fc295 g10: Fix comment of enum_secret_keys.
* g10/getkey.c (enum_secret_keys): Fix comment for usage of
enum_secret_keys, following the previous change.

--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-08-27 16:24:11 +09:00
NIIBE Yutaka
30153c65f0 g10: Enumerated keys for decryption should be unique.
* g10/getkey.c (enum_secret_keys): Collecting keys in the context,
check duplicate to make sure returning only unique keys.
* g10/pubkey-enc.c (get_session_key): Now, it's the responsibility of
enum_secret_keys to free keys.

--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-08-27 16:24:00 +09:00
NIIBE Yutaka
ce2f717601 g10: Change decryption key selection for public key encryption.
* g10/mainproc.c (struct mainproc_context): It's now pubkey_enc_list.
(do_proc_packets): Remove the first arg CTRL.  Fix call of
proc_pubkey_enc.
(release_list): Handle pubkey_enc_list.
(proc_pubkey_enc): Remove the first arg CTRL.  Simply put the packet
to pubkey_enc_list.
(print_pkenc_list): Remove the last arg FAILED.
(proc_encrypted): Only call print_pkenc_list once.
Handle DEK here.
(proc_packets, proc_signature_packets, proc_signature_packets_by_fd)
(proc_encryption_packets): Fix call of do_proc_packets.
* g10/packet.h (struct pubkey_enc_list): Define.
* g10/pubkey-enc.c (get_it): Change the second argument K.
(get_session_key): Select session key by LIST, using enum_secret_keys.
* g10/gpgv.c (get_session_key): Change the second argument K.
* g10/test-stubs.c (get_session_key): Likewise.

--

Collect all PKT_PUBKEY_ENC packets, and then, process the
PKT_ENCRYPTED* packet.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-08-27 13:12:31 +09:00
NIIBE Yutaka
1b309d9f61 g10: Fix undefined behavior when EOF in parsing packet for S2K.
* g10/parse-packet.c (parse_symkeyenc): Use iobuf_get_noeof.
(parse_key): Likewise.

--

When EOF comes at parsing s2k.count, it is possible the value will
be (unsigned long)-1.  Then, the result of S2K_DECODE_COUNT will be
undefined.  This patch fixes undefined behavior.

Reported-by: Philippe Antoine
GnuPG-bug-id: 4093
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-08-10 15:29:06 +09:00
Werner Koch
e88f56f193
gpg: Set a limit for a WKD import of 256 KiB.
* g10/call-dirmngr.c (MAX_WKD_RESULT_LENGTH): New.
(gpg_dirmngr_wkd_get): Use it.
--

WKD should return only a single key with just one UID.  For key
rollover 2 keys may be send.  A total of 256 KiB seems to be a
generous limit here.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-27 17:48:18 +02:00
Werner Koch
ebe727ef59
dirmngr: Validate SRV records in WKD queries.
* dirmngr/server.c (proc_wkd_get): Check the returned SRV record names
to mitigate rogue DNS servers.
--

I am not sure wether this really is very useful because the security
relies on a trustworthy DNS system anyway.  However, that check is
easy enough to do.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-27 12:24:23 +02:00
Werner Koch
ddee9f9409
common: New function to validate domain names.
* common/mbox-util.c (is_valid_domain_name): New.
* common/t-mbox-util.c (run_dns_test): New test.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-27 12:24:23 +02:00
Jiří Keresteš
967d3649d2 scd: Add support for Trustica Cryptoucan. 2018-07-26 11:44:50 +09:00
NIIBE Yutaka
1111251945 Register DCO for Jiri Kerestes.
--
2018-07-26 11:44:10 +09:00
Werner Koch
bd4048c533
dirmngr: Print a WARNING status for DNS config problems.
* dirmngr/dirmngr-status.h: New.
* dirmngr/dirmngr.h: Include dirmngr-status.h and move some prototypes
to that file.
* dirmngr/t-support.c: New.
* dirmngr/Makefile.am (dirmngr_SOURCES): Add dirmngr-status.h.
(t_common_src): Add t-support.c.
* dirmngr/server.c (dirmngr_status_printf): Bypass if CTRL is NULL.
* dirmngr/dns-stuff.c: Include dirmngr-status.h.
(libdns_init): Print WARNING status line.  Change call callers to take
and pass a CTRL argument.
* g10/call-dirmngr.c (ks_status_cb): Print info for new WARNING
status.
--

To test this you can change RESOLV_CONF_NAME in dns-stuff.c and run
gpg --recv-key -v SOMETHING.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-25 14:35:04 +02:00
Werner Koch
9aa1b368ef
gpg: Use 128 MiB as default AEAD chunk size.
* g10/gpg.c (oDebugAllowLargeChunks): New.
(opts): New option --debug-allow-large-chunks.
(main): Implement that option.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-24 09:58:02 +02:00
NIIBE Yutaka
1c9584dabb Register DCO fo Michael Haubenwallner.
--
2018-07-17 14:14:39 +09:00
Werner Koch
011ab7ec66
doc: Add NEWS about the 2.2.9 release
--
2018-07-12 20:51:02 +02:00
Werner Koch
76989d5bd8
gpg: Remove multiple subkey bindings during export-clean.
* g10/key-clean.c (clean_one_subkey_dupsigs): New.
(clean_all_subkeys): Call it.
--

GnuPG-bug-id: 3804
Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-09 12:01:02 +02:00
Werner Koch
c2fd65ec84
gpg: Let export-clean remove expired subkeys.
* g10/key-clean.h (KEY_CLEAN_NONE, KEY_CLEAN_INVALID)
(KEY_CLEAN_ENCR, KEY_CLEAN_AUTHENCR, KEY_CLEAN_ALL): New.
* g10/key-clean.c (clean_one_subkey): New.
(clean_all_subkeys): Add arg CLEAN_LEVEL.
* g10/import.c (import_one): Call clean_all_subkeys with
KEY_CLEAN_NONE.
* g10/export.c (do_export_stream): Call clean_all_subkeys depedning on
the export clean options.
--

GnuPG-bug-id: 3622
Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-09 09:49:21 +02:00
Werner Koch
6c3567196f
gpg: Split key cleaning function for clarity.
* g10/key-clean.c (clean_key): Rename to clean_all_uids and split
subkey cleaning into ...
(clean_all_subkeys): new.  Call that always after the former clean_key
invocations.
--

Note that the clean_all_subkeys function will later be extended.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-09 08:15:50 +02:00
Werner Koch
135e46ea48
gpg: Move key cleaning functions to a separate file.
* g10/trust.c (mark_usable_uid_certs, clean_sigs_from_uid)
(clean_uid_from_key, clean_one_uid, clean_key): Move to ...
* g10/key-clean.c: new file.
* g10/key-clean.h: New.
* g10/Makefile.am (gpg_sources): Add new files.
* g10/export.c, g10/import.c, g10/keyedit.c, g10/trustdb.c: Include
new header.
* g10/trustdb.h (struct key_item, is_in_klist): Move to ...
* g10/keydb.h: here.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-06 11:40:16 +02:00
Werner Koch
cb71573f37
po: Add flag options for xgettext.
* po/Makevars (XGETTEXT_OPTIONS): Add --flag options.
--

GnuPG-bug-id: 4053, 4054
Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-05 21:39:53 +02:00
Werner Koch
f7526c7bc7
gpg: Prepare for signatures with ISSUER_FPR but without ISSUER.
* g10/getkey.c (get_pubkey_for_sig): New.
(get_pubkeyblock_for_sig): New.
* g10/mainproc.c (issuer_fpr_raw): Give global scope.
(check_sig_and_print): Use get_pubkeyblock_for_sig.
* g10/pkclist.c (check_signatures_trust): Use get_pubkey_for_sig.
* g10/sig-check.c (check_signature2): Ditto.
(check_signature_over_key_or_uid): Ditto.
--

GnuPG-bug-id: 4046

The whole getkey stuff is still a mess with way to much duplication
and missing caching of already fetched data.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-05 20:55:32 +02:00
Werner Koch
9ea9b9db7e
doc: Typo fix in a comment.
--
2018-07-05 09:42:06 +02:00
Werner Koch
01cd66f9fa
gpg: Ignore too large user ids during import.
* g10/import.c (read_block): Add special treatment for bad user ids
and comment packets.
--

See
GnuPG-bug-id: 4022
for an example of a bogus user id.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-04 09:58:05 +02:00
Werner Koch
60e7e102a1
indent: Fix indentation of read_block in g10/import.c
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-04 09:45:52 +02:00
Werner Koch
214b007726
gpg: Extra check for sign usage when verifying a data signature.
* g10/sig-check.c (check_signature_end_simple): Check sign usage.
--

Without this patch the signature verification fails only due to the
missing back signature.  This check better explains what went wrong.

GnuPG-bug-id: 4014
Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-04 09:01:10 +02:00
NIIBE Yutaka
996febbab2 g10: Fix memory leak for PKT_signature.
* g10/getkey.c (buf_to_sig): Free by free_seckey_enc.
* g10/gpgcompose.c (signature): Likewise.
* g10/sign.c (write_signature_packets): Likewise.

--

Reported-by: Philippe Antoine
GnuPG-bug-id: 4047
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2018-07-03 09:07:03 +09:00
Werner Koch
8a915cd9fa
agent: New commands PUT_SECRET and GET_SECRET.
* agent/agent.h (CACHE_MODE_DATA): New const.
* agent/cache.c (DEF_CACHE_TTL_DATA): new.
(housekeeping): Tweak for CACHE_MODE_DATA.
(cache_mode_equal): Ditto.
(agent_get_cache): Ditto.
(agent_put_cache): Implement CACHE_MODE_DATA.
* agent/command.c (MAXLEN_PUT_SECRET): New.
(parse_ttl): New.
(cmd_get_secret): New.
(cmd_put_secret): New.
(register_commands): Register new commands.
--

These commands allow to store secrets in memory for the lifetime of
the gpg-agent process.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-02 21:36:19 +02:00
Werner Koch
58baf40af6
common: New function percent_data_escape.
* common/percent.c (percent_data_escape): New.
* common/t-percent.c (test_percent_data_escape): New.

Signed-off-by: Werner Koch <wk@gnupg.org>
2018-07-02 20:25:30 +02:00