* g10/key-clean.c (clean_key): Rename to clean_all_uids and split
subkey cleaning into ...
(clean_all_subkeys): new. Call that always after the former clean_key
invocations.
--
Note that the clean_all_subkeys function will later be extended.
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 6c3567196f)
* g10/mainproc.c (symkey_decrypt_seskey): Check for a valid algorithm.
(proc_symkey_enc): Clear passpharse on error from above function.
--
This does not work reliable as stated in bug 3795 but we can try to
fix ~95% of all cases. The real fix is to use AEAD which will come
with 2.3
GnuPG-bug-id: 3795, 4050
Signed-off-by: Werner Koch <wk@gnupg.org>
* g10/getkey.c (get_pubkey_for_sig): New.
(get_pubkeyblock_for_sig): New.
* g10/mainproc.c (issuer_fpr_raw): Give global scope.
(check_sig_and_print): Use get_pubkeyblock_for_sig.
* g10/pkclist.c (check_signatures_trust): Use get_pubkey_for_sig.
* g10/sig-check.c (check_signature2): Ditto.
(check_signature_over_key_or_uid): Ditto.
--
GnuPG-bug-id: 4046
The whole getkey stuff is still a mess with way to much duplication
and missing caching of already fetched data.
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit f7526c7bc7)
* po/de.po (decryption forced to fail!): Fix translation.
--
The unmatched %s actually produced a crash on Windows.
GnuPG-Bug-Id: T4053
GnuPG-Bug-Id: T4054
* g10/import.c (read_block): Add special treatment for bad user ids
and comment packets.
--
See
GnuPG-bug-id: 4022
for an example of a bogus user id.
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 01cd66f9fa)
* g10/sig-check.c (check_signature_end_simple): Check sign usage.
--
Without this patch the signature verification fails only due to the
missing back signature. This check better explains what went wrong.
GnuPG-bug-id: 4014
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 214b007726)
* g10/import.c (get_revocation_reason): New.
(list_standalone_revocation): Extend function.
--
Note that this function extends the "rvs" field signature-class (field
11) with the revocation reason. GPGME does not yet parse this but it
can be expected that the comma delimiter does not break other parsers.
A new field is added to the "rvs" (and in future also the "rev")
record to carry a record specific comment. Hopefully all parsers
meanwhile learned the lesson from other new fields and don't bail out
on more fields than they know about.
This is partial solution to
GnuPG-bug-id: 1173
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit b7cd2c2093)
* dirmngr/dns.c (dns_res_exec): If it's DNS_SO_SOCKS_CONN, don't
iterate to other server, but return the error immediately.
--
Cherry picked from master commit:
1aacd12471
In the function libdns_switch_port_p in dns-stuff.c, this patch
allows to fallback using TOR_PORT2 correctly.
Fixes-commit: bcdbf8b8eb
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* dirmngr/dns.c (LEAVE_SELECTION_OF_PORT_TO_KERNEL): New.
(dns_socket): Don't select ephemeral port in user space.
--
Cherry picked from master commit:
861f1da073
There is no good reason to bind local port aggressively. It might be
some reason to do so, then, a user can specify it in /etc/resolv.conf
by the second argument of "interface" directive.
At least, it causes a problem on Windows. Binding a specified port in
user space can trigger the Firewall dialog on Windows. Since it can
be considered valid question, it is better not to bind with an
ephemeral port which is selected in user space, by default.
GnuPG-bug-id: 3610
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* dirmngr/dns.c (dns_so_check): When EINVAL, release the association
by connect with AF_UNSPEC and try again. Also try again for
ECONNREFUSED.
(dns_res_exec): Try next nameserver when ECONNREFUSED.
--
Cherry pick from master commit:
bcdbf8b8eb
GnuPG-bug-id: T3374
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* dirmngr/dns.c (dns_resconf_pton): Clear SS.
(dns_resconf_setiface): Clear ->IFACE.
(dns_hints_root, send_query): Clear SS.
--
Cherry pick from master commit:
1c0b6681e4
POSIX requires clear the structure of struct sockaddr_in6. On macOS,
in some case like bind, it is better to clear even for struct
sockaddr_in.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* dirmngr/dns-stuff.c (libdns_init): Initialize options.recurse.
--
Cherry pick from master commit:
5b40338f12
To reproduce an error, run:
./t-dns-stuff --debug --recursive-resolver www.gnupg.org
Then, it returns "No name" error. That's because there was only setup
for root servers, and no setup for recursive query in fact.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* g10/import.c (import_revoke_cert): Add arg 'options'. Take care of
IMPORT_DRY_RUN.
--
GnuPG-bug-id: 4017
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 6c9e37b2e541e96e7c65e1679982a614b4863fdb)
* g10/import.c (impex_filter_getval): Add new "usage" property for
drop-subkey filter.
--
For example, this permits extraction of only encryption-capable
subkeys like so:
gpg --export-filter 'drop-subkey=usage !~ e' --export $FPR
GnuPG-Bug-id: 4019
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
(cherry picked from commit 2ddfb5bef9)
* g10/gpg.c (main): Set some list options.
--
The new command --show-keys is commonly used to check the content of a
file with keys. In this case it can be expected that all included
subkeys and uids are of interested, even when they are already expired
or have been revoked.
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit d2bc66f241)
* g10/mainproc.c (proc_encrypted): Use constant from logging.h
--
Because the log levels are enums I had to change there names in
libgpg-error to avoid clashes. Master uses the new names but 2.2
needs to stick to the old names.
Fixes-commit: 825909e9cd
Signed-off-by: Werner Koch <wk@gnupg.org>
* g10/mainproc.c (proc_plaintext): Sanitize verbose output.
--
This fixes a forgotten sanitation of user supplied data in a verbose
mode diagnostic. The mention CVE is about using this to inject
status-fd lines into the stderr output. Other harm good as well be
done. Note that GPGME based applications are not affected because
GPGME does not fold status output into stderr.
CVE-id: CVE-2018-12020
GnuPG-bug-id: 4012
(cherry picked from commit 13f135c7a2)
* g10/key-check.c (key_check_all_keysigs): Factor some code out to ...
(remove_duplicate_sigs): new.
(key_check_all_keysigs): Call remove_duplicate_sigs again after
reordering.
--
This is a follupup for commit 26bce2f01d
to cleanup the code and to add a second de-duplicate step when needed.
GnuPG-bug-id: 3994
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 26746fe65d)
* g10/packet.h (PKG_siganture): Add field 'help_counter'.
* g10/key-check.c (sig_comparison): Take care of HELP_COUNTER.
(key_check_all_keysigs): De-duplicate on a per-block base.
--
The key_check_all_keysigs first does a detection of duplicate
signature. This is done over all signatures at once. The problem
here is for example:
key
uid_1
sig_uid_1.1
sig_uid_1.2
subkey_1
sig_sub_1.1
subkey_2
sig_sub_2.1
sig_sub_2.2 (duplicate of sig_sub_1.1)
Now the de-duplication deletes the first signature and keeps the
second. That works in most cases for foreign signature on userids but
in the above constellation the code simply removes sig_sub_1.1 so that
subkey_1 has no binding signature anymore. In a later step during
import the missing binding is detected and subkey_1 is removed because
it is not anymore valid. The sig_sub_2.2 will also be removed later
because it does not check out for subkey_2 (that is as expected).
The fix is to let the de-duplication work only on blocks (ie. within
the signatures of a user id or a subkey). This will not detect all
duplicates but that does not harm because later steps will detect and
remove them.
In the above case (with this patch applied) the second phase of
key_check_all_keysigs will reorder key signatures and move the
duplicate sig_sub_2.2 directly after sig_sub_1.1. This duplicates the
signature and for cleanness we should kick the de-duplication process
again. This will be done with a followup patch.
GnuPG-bug-id: 3994
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 26bce2f01d)
* g10/import.c (chk_self_sigs): Print the subkeyid in addition to the
keyid.
(delete_inv_parts): Ditto.
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 1bc6b51742)
* agent/gpg-agent.c (agent_copy_startup_env): Replace explicit list
with the standard list.
--
Although the function agent_copy_startup_env is newer than
session_env_list_stdenvnames the latter was not used. When
DBUS_SESSION_BUS_ADDRESS was added to the latter it was forgotten to
add it to the former as well. Having all stdnames here seems to be
the Right Thing (tm) to do.
GnuPG-bug-id: 3947
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 7ffc1ac7dd)
* g10/mainproc.c (proc_encrypted): Print warning and later force an
error.
--
Note that when this error is triggered the plaintext from the literal
data packet has already been outputted before the BEGIN_DECRYPTION
status line. We fail only later to get more information. Callers
need to check and act upon the decryption error code anyway.
Thanks to Marcus for pointing out this case.
GnuPG-bug-id: 4000
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 344b548dc7)
* g10/gpg.c (aShowKeys): New const.
(opts): New command --show-keys.
(main): Implement command.
* g10/import.c (import_keys_internal): Don't print stats in show-only
mode.
(import_one): Be silent in show-only mode.
--
Using
--import --import-options show-only
to look at a key is too cumbersome. Provide this shortcut and also
remove some diagnostic cruft in this case.
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 257661d6ae)
* g10/mainproc.c (proc_encrypted): Print a hint for legacy ciphers w/o
MDC. Also print a dedicated status error code
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 874e391665)
* g10/gpg.c: Turn options --force-mdc, --no-force-mdc, --disable-mdc
and --no-disable-mdc into NOPs.
* g10/encrypt.c (use_mdc): Simplify. MDC is now almost always used.
* g10/cipher.c (write_header): Include extra hint and make
translatable.
* g10/options.h (struct opt): Remove fields force_mdc and disable_mdc.
--
The MDC is now always used except with --rfc2440 which will lead to a
a big fat warning.
This is a stripped down version of commit
253e8bdd90 which could not directly be
applied due to the AEAD mechanisms there.
Signed-off-by: Werner Koch <wk@gnupg.org>
* g10/mainproc.c (proc_encrypted): Require an MDC or AEAD
* tests/openpgp/defs.scm (create-gpghome): Use --ignore-mdc-error to
allow testing with the current files.
--
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit d1431901f0)
Resolved Conflicts:
g10/mainproc.c - Remove AEAD stuff.
* g10/gpg.c (oNoMDCWarn): Remove.
(opts): Make --no-mdc-warn a NOP.
(main): Don't set var.
* g10/options.h (struct opt): Remove 'no_mdc_var'.
* g10/cipher-cfb.c (write_header): Assume opt.no_mdc_warn is false.
* g10/mainproc.c (proc_encrypted): Ditto.
--
Users should not be allowed to suppress the warning that they are
shooting into their foot.
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 96350c5d5a)
