* tools/gpg-wks.h (opt): Add field with_colons.
* tools/gpg-wks-client.c (oWithColons): New const.
(opts, parse_arguments): Add option --with-colons.
(main): Change aSupported to take several domains in --with-colons
mode.
(command_send): Factor policy getting code out to ...
(get_policy_and_sa): New function.
(command_supported): Make use of new function.
--
In addition to this the --create command now also supports a
submission address only in the policy file. That means the
submission-address file is not anymore required and can be replaced by
the policy file.
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit e3a1e80d13)
* tools/rfc822parse.c (HEADER_NAME_CHARS): New. Taken from
mime-maker.c.
(rfc822_valid_header_name_p): New. Based on code from mime-maker.c.
(rfc822_capitalize_header_name): New. Copied from mime-maker.c.
(capitalize_header_name): Remove. Replace calls by new func.
(my_toupper, my_strcasecmp): New.
* tools/mime-maker.c: Include rfc822parse.h.
(HEADER_NAME_CHARS, capitalize_header_name): Remove.
(add_header): Replace check and capitalization by new functions.
--
This is a straightforward change with two minor chnages:
- In rfc822parse.c the capitalization handles MIME-Version special.
- The check in mime-maker bow detects a zero-length name as invalid.
my_toupper and my_strcasecmp are introduced to allow standalone use
of that file.
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit f03928b16c)
* tools/gpg-wks-server.c (opts): Add '--directory',
(main): Explain how to set correct permissions.
(command_list_domains): Create an empty policy file and remove the
warning for an empty policy file.
--
Note that a policy file is meanwhile required and thus is is useful to
create it.
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit f248416bc9)
* tools/gpg-connect-agent.c (do_open): dup the fileno and close the
stream.
GnuPG-bug-id: 4220
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 378719f25f)
* tools/gpgconf-comp.c (get_config_filename): Allow UNC paths.
--
The homedir of GnuPG on Windows can be on a network share
e.g. if %APPDATA% is redirected to a network share. The
file API calls work and GnuPG itself works nicely
with such paths so gpgconf should work with them, too.
GnuPG-Bug-Id: T3818
Signed-off-by: Andre Heinecke <aheinecke@intevation.de>
* tools/gpg-wks-client.c (get_key_status_parm_s)
(get_key_status_cb, get_key): Move to ...
* tools/wks-util.c: ...here.
(get_key): Rename to wks_get_key.
* tools/gpg-wks-server.c: Include userids.h.
(command_install_key): Allow use of a fingerprint.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpg-wks.h (policy_flags_s): Add field 'submission_address'.
* tools/wks-util.c (wks_parse_policy): Parse that field.
(wks_free_policy): New.
* tools/gpg-wks-client.c (command_send): Also try to take the
submission-address from the policy file. Free POLICY.
* tools/gpg-wks-server.c (process_new_key): Free POLICYBUF.
(command_list_domains): Free POLICY.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpgconf.c (oStatusFD): New const.
(opts): New option --status-fd.
(statusfp): New var.
(set_status_fd): New.
(gpgconf_write_status): New.
(gpgconf_failure): New.
(main): Set status fd and replace exit by gpgconf_failure.
* tools/gpgconf-comp.c: Repalce exit by gpgconf_failure.
(gc_process_gpgconf_conf): Print a few warning status messages.
Signed-off-by: Werner Koch <wk@gnupg.org>
* sm/gpgsm.c (main): Allow setting of the default compliance.
* tools/gpgconf-comp.c (gc_options_gpgsm): Add "compliance".
--
This is required so that we can use this option in in gpgconf.conf.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpgtar-extract.c: Prefer opt.filename over filename
for the directory prefix.
--
If you would extract from stdin (filename -) and use set-filename
to provide a real filename the "-" would be used for the directory
name. With this change an explicit filename is prefered.
GnuPG-Bug-Id: T3500
Signed-off-by: Andre Heinecke <aheinecke@intevation.de>
* tools/gpgconf-comp.c (retrieve_options_from_program): Add arg
only_installed.
(gc_component_retrieve_options): Use this if we want to process all
components.
--
Note that this also also ignores them in --with-defaults. This is
useful for systems which come without scdaemon.
GnuPG-bug-id: 3313
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/wks-util.c (list_key_status_cb): Rename to key_status_cb.
(wks_filter_uid): New.
(wks_list_key): Allow FPR to be NULL. Return an error if no
fingerprint was found.
* tools/gpg-wks-server.c (process_new_key)
(check_and_publish): Remove now useless extra check for FPR.
* tools/gpg-wks-client.c (command_check): Ditto.
(command_send): Filter out the newest uid.
--
This fixes the case of having several userids with all the the same
mailbox. Now we use the latest user id created. This patch is also a
prerequisite to automatically create a new user id for providers with
the mailbox-only policy.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpg-wks-client.c (command_send): Allow sending in draft-1
mode.
--
Obviously Posteo did not implement the current draft and thus it was
not possible to send a request to them. This hack uses the old method
for posteo.de. Not sending it encrypted is okay here because they use
authenticated sending anyway.
Signed-off-by: Werner Koch <wk@gnupg.org>
* g10/gpg.c (gpgconf_list): Announce "auto-key-retrieve".
(main): Simplify setting of KEYSERVER_AUTO_KEY_RETRIEVE.
* tools/gpgconf-comp.c: Make "no-auto-key-retrieve" invisible. Make
"auto-key-retrieve" an expert option.
--
This basically reverts 9bb13a0e81
because --no-auto-key-retrieve is again the default. Note that we
allow both options for the sake of profiles.
Signed-off-by: Werner Koch <wk@gnupg.org>
* configure.ac (GNUPG_SWDB_TAG): New ac_define. Set it to "gnupg22".
* tools/gpgconf.c (query_swdb): Use it.
* build-aux/speedo.mk: Change tag "gnupg21" to "gnupg22".
* Makefile.am (distcheck-hook): Ditto.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpgconf-comp.c (gc_options_gpg): Add max-cert-depth,
completes-needed, and marginals-needed options.
* g10/gpg.c (gpgconf_list): Likewise.
--
Some tests to come for the PGP trust model will need to manipulate
these parameters.
Signed-off-by: Damien Goutte-Gattat <dgouttegattat@incenp.org>
* doc/gpg.texi: Document new option.
* g10/call-dirmngr.c (create_context): Fail if option is given.
* g10/gpg.c (cmd_and_opt_values): New value.
(opts): New option.
(gpgconf_list): Add new option.
(main): Handle new option.
* g10/options.h (struct opt): New field 'disable_dirmngr'.
* tools/gpgconf-comp.c (gc_options_gpg): New option.
GnuPG-bug-id: 3334
Signed-off-by: Justus Winter <justus@g10code.com>
* tools/gpgconf-comp.c (gc_options_gpg): Re-add "auto-key_retrieve".
--
Although this option is invisible, it might be in use by gpgconf
profiles. We don't want to break them.
Signed-off-by: Werner Koch <wk@gnupg.org>
* g10/gpg.c (gpgconf_list): Print no-auto-key-retrieve instead of
auto-key-retrieve.
* tools/gpgconf-comp.c (gc_options_gpg): Replace auto-key-retrieve by
no-auto-key-retrieve and chnage level from invisible to advanced.
Signed-off-by: Werner Koch <wk@gnupg.org>
* agent/gpg-agent.c (main): Move oSSHFingerprintDigest to ...
(parse_rereadable_options): here.
(opts): Change its description.
(main) <aGPGConfList>: Include this option.
* tools/gpgconf-comp.c (gc_options_gpg_agent): Add option at expert
level.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpg-connect-agent.c (start_agent): Add paren.
--
The intention is comparing the error code depending opt.use_dirmngr.
Considering C Operator Precedence, we should have paren here.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* g10/compress-bz2.c: Include bzlib.h after gcrypt.h.
* tools/gpgsplit.c: Likewise.
--
bzlib.h may include windows.h on Windows. It is better
after gcrypt.h which may include winsock2.h.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* tools/rfc822parse.c (my_stpcpy): Rename from stpcpy.
--
When HAVE_STPCPY is not defined (no definition in libc), still,
compiler may have definition as a built-in function (for some specific
case like second argument is constant). In that case, having stpcpy
implementation with the same name but different signature ("static"
qualifier) is not good.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* tests/openpgp/defs.scm (stop-agent): Swap order of actions. Kill
all daemons using gpgconf.
* tools/gpgconf.c (main) <aRemoveSocketDir>: Try to remove known
socketfails on rmdir failure. Do no fail for ENONET.
--
Killing all daemons is not really required but it does not harm to be
prepared for the future.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/send-mail.c (send_mail_to_file): Call es_set_binary.
--
Without that, output to stdout via --send is mangled: The "\r\n" is
translated to "\r\r\n" which is bad because other
software (e.g. Thunderbird) translates this again to "\n\n" and thus
put all mail header liens after the first into the body.
Signed-off-by: Werner Koch <wk@gnupg.org>
* configure.ac (AC_CHECK_HEADERS): Add util.h libutil.h and termios.h.
* tools/symcryptrun.c: Include those headers.
--
This is for OpenBSD and FreeBSD.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* tools/gpg-wks.h (WKS_DRAFT_VERSION): New.
* tools/wks-receive.c (new_part): Move test wks draft version to ...
(t2body): new callback.
(wks_receive): Register this callback.
* tools/gpg-wks-server.c (send_confirmation_request): Emit draft
version header.
(send_congratulation_message): Ditto.
* tools/gpg-wks-client.c (decrypt_stream_parm_s): New.
(decrypt_stream_status_cb): Check DECRYTPION_KEY status.
(decrypt_stream): Get infor from new callback.
(process_confirmation_request): New arg 'mainfpr'. Check that it
matches the decryption key.
(read_confirmation_request): Check that the decryption key has been
generated by us.
(command_send): Use macro from draft version header.
(send_confirmation_response): Emit draft version header.
--
This patch also adds a check to only send a confirmation when the
decryption has been done by an ultimately trusted (self-generated)
key.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/mime-parser.c (mime_parser_context_s): New field 't2body'.
(parse_message_cb): Call that callback.
(mime_parser_set_t2body): New.
--
This callback allows to process header values even on the outer level.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpgconf-comp.c (retrieve_options_from_program): Check ERRNO
before printing a warning.
--
It is common that a conf files does not exist - thus we should not
print a warning.
GnuPG-bug-id: 2944
BTW: The error messages in gpgconf should be reworked to match those
of the other components.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpg-connect-agent.c (main): Use a gpgrt_stream_t for
'script_fp'. Adapt accordingly.
--
Werner asked me to make gpgconf use the platform abstractions that
were introduced after gpgconf's inception. After doing that, I
realized that 'read_line' is only used in two more places, one of
which this patch takes care of.
Signed-off-by: Justus Winter <justus@g10code.com>
* tools/gpgconf-comp.c (retrieve_options_from_file): Use a
gpgrt_stream_t for 'list_file'. Adapt accordingly.
(copy_file): Likewise for 'src' and 'dst'.
(change_options_file): Likewise for 'src_file' and 'dest_file'.
(change_options_program): Likewise for 'src_file' and 'dest_file'.
(gc_process_gpgconf_conf): Likewise for 'config'.
--
Werner asked me to make gpgconf use the platform abstractions that
were introduced after gpgconf's inception.
Signed-off-by: Justus Winter <justus@g10code.com>
* tools/gpgconf-comp.c (gc_component_change_options): Use
'gnupg_rename_file'. Also, block signals across all renames in an
attempt to make the whole process atomic.
--
Werner asked me to make gpgconf use the platform abstractions that
were introduced after gpgconf's inception.
Signed-off-by: Justus Winter <justus@g10code.com>
* tools/gpgconf-comp.c (change_options_file): Add comments explaining
the functions parameters.
(change_options_program): Likewise.
--
From reading those two functions it is not clear why we write the new
configuration to the source file, and read the current configuration
from the destination file. The identifiers are named for the benefit
of the callee.
Note that identifiers that require that much explanation are poorly
chosen.
Signed-off-by: Justus Winter <justus@g10code.com>
* tools/gpgconf-comp.c (gp_component_change_options): Improve error
handling when reading from stdin.
--
Previously, errors encountered while reading the configuration changes
were ignored.
Signed-off-by: Justus Winter <justus@g10code.com>
* common/logging.c (do_logv): Remove extra parentheses in comparison.
* dirmngr/dns-stuff.c (resolve_addr_libdns): Init RES so that
dns_res_close is given a defined value in the error case.
* dirmngr/http.c (cookie_read, cookie_write) [HTTP_USE_NTBTLS]: Fix
format string char.
* dirmngr/ks-engine-hkp.c (ks_hkp_help): Remove duplicate "const".
* dirmngr/ks-engine-http.c (ks_http_help): Ditto.
* dirmngr/ks-engine-kdns.c (ks_kdns_help): Ditto.
* dirmngr/ks-engine-ldap.c (ks_ldap_help): Ditto.
* scd/app-p15.c (send_keypairinfo, do_getattr): Fix format string
char.
* tools/gpgconf-comp.c (gpg_agent_runtime_change): Init PID for the
error case.
(scdaemon_runtime_change): Ditto.
(dirmngr_runtime_change): Ditto.
* tools/gpgconf.c (query_swdb): Init VALUE_SIZE_UL.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpg-wks-client.c (command_send): If we fail to lookup the
submission address, print a better error message. If it is because
the corresponding file doesn't exist, provide the hint that the server
probably doesn't support WKS.
Signed-off-by: Neal H. Walfield <neal@g10code.com>
* dirmngr/dns-stuff.c (DEFAULT_TIMEOUT): New.
(opt_timeout): New var.
(set_dns_timeout): New.
(libdns_res_open): Set the default timeout.
(libdns_res_wait): Use configurable timeout.
(resolve_name_libdns): Ditto.
* dirmngr/dirmngr.c (oResolverTimeout): New const.
(opts): New option --resolver-timeout.
(parse_rereadable_options): Set that option.
(main) <aGPGConfList>: Add --nameserver and --resolver-timeout.
* tools/gpgconf-comp.c (gc_options_dirmngr): Add --resolver-timeout
and --nameserver.
* dirmngr/http.c (connect_server): Fix yesterday introduced bug in
error diagnostic.
--
This timeout is a pretty crude thing because libdns has a few other
internal timeouts as well.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpgconf.c (aApplyProfile): New.
(opts): New command --apply-profile.
(main): Implement that command.
* tools/gpgconf-comp.c (option_check_validity): Add arg VERBATIM.
(change_options_program): Ditto.
(change_one_value): Ditto.
(gc_component_change_options): Ditto.
(gc_apply_profile): New.
--
Here is an example for a profile
--8<---------------cut here---------------start------------->8---
# foo.prf - Sample profile
[gpg]
compliance de-vs
default-new-key-algo brainpoolP256r1+brainpoolP256r1
[gpgsm]
enable-crl-checks
[gpg-agent]
default-cache-ttl 900
max-cache-ttl [] 3600
no-allow-mark-trusted
no-allow-external-cache
enforce-passphrase-constraints
min-passphrase-len 9
min-passphrase-nonalpha 0
[dirmngr]
keyserver hkp://keys.gnupg.net
allow-ocsp
--8<---------------cut here---------------end--------------->8---
Note that flags inside of brackets are allowed after the option name.
The only defined flag for now is "[default]". In case the value
starts with a bracket, it is possible to insert "[]" as a nop-flag.
Signed-off-by: Werner Koch <wk@gnupg.org>
* common/homedir.c (gnupg_build_directory): New variable.
(gnupg_module_name_called): Likewise.
(gnupg_set_builddir): New function.
(gnupg_set_builddir_from_env): Likewise.
(gnupg_module_name): Support locating components in the build tree.
* common/util.h (gnupg_set_builddir): New prototype.
* tests/openpgp/defs.scm (tools): Drop 'gpg and 'gpg-agent.
(tool): Rename to 'tool-hardcoded.
(gpg-conf): New function, with accessors for the results.
(gpg-components): New variable.
(tool): New function.
* tools/gpgconf.c (enum cmd_and_opt_values): New key.
(opts): New option '--build-prefix'.
(main): Handle new option.
--
This change makes sure that the components from the build tree are
used, and not some older installed version in PATH. It also lets us
make GPGME use components from the build tree, making it possible to
execute GPGME's test suite with them.
Signed-off-by: Justus Winter <justus@g10code.com>
* tools/wks-util.c: Include status.h.
(statusfp): New global var.
(wks_set_status_fd): New func.
(wks_write_status): New func.
* tools/gpg-wks-client.c: Include status.h.
(oStatusFD): New constant.
(opts): New option --status-fd.
(parse_arguments): Handle that option.
(main): Return STATUS_SUCCESS or STATUS_FAILURE.
--
This option is useful in case gpg-wks-client is spawed using a double
fork approach which does not allow to return the exit code.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpg-wks-server.c (list_key_status_cb): Remove.
(list_key): Move to ...
* tools/wks-util.c (wks_list_key): here and rename. Add new args
R_FPR and R_MBOXES and remove the CTX.
(list_key_status_cb): New.
* tools/wks-util.c: Include ccparray.h, exectool.h, and mbox-util.h.
* tools/gpg-wks-server.c (process_new_key): Replace list_key by
wks_list_key.
(check_and_publish): Ditto.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/mime-maker.c (ensure_part): Make sure to set R_PARENT on
error.
(add_missing_headers): Ensure that ERR is set on success.
* tools/wks-util.c (wks_parse_policy): Fix indentation.
Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr/dirmngr.h (struct opt): Add field allow_version_check.
* dirmngr/dirmngr.c (oAllowVersionCheck): New.
(opts): Add --allow-version-check.
(network_activity_seen): New variable.
(parse_rereadable_options): Set opt.allow_version_check.
(main) <aGPGConfList>: Do not anymore set the no change flag for
Windows. Add allow-version-check.
(netactivity_action): Set network_activity_seen.
(housekeeping_thread): Call dirmngr_load_swdb.
* tools/gpgconf-comp.c (gc_options_dirmngr): Add allow-version-check.
Make "use-tor" available at Basic level.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpg-wks-client.c (encrypt_response): Add arg FINGERPRINT.
(send_confirmation_response): Ditto.
(process_confirmation_request): Parse out fingerprint and pass
send_confirmation_response.
--
This is useful for debugging the protocol and to avoid surprises when
the sender tries to open a message from the Sent folder.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpgconf.c (query_swdb): Insert new field with the installed
version. Check that the supplied version does not contain a colon.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpgconf.c (aQuerySWDB): New.
(opts): Add --query-swdb.
(valid_swdb_name_p): New.
(query_swdb): New.
(main): Implement command --query-swdb.
--
Right now this command is not very useful because dimngr has not yet
been changed to create the swdb.lst. For manual tests the swdb.lst
file from the Net can be used with these additional lines:
.filedate 20161102T130337
.verified 20161102T150000
* tools/gpgconf-comp.c (gpg_agent_runtime_change,
scdaemon_runtime_change, dirmngr_runtime_change): Provide the homedir
arguments by --homedir when it's not default.
--
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* tools/gpg-wks-client.c (oFakeSubmissionAddr): New.
(opts): Add option --fake-submission-addr.
(fake_submission_addr): New variable.
(parse_arguments): Set it.
(command_send): Use --fake-submission-addr.
--
This option is useful for testing.
Signed-off-by: Werner Koch <wk@gnupg.org>
* tools/gpgtar-extract.c (extract_directory): Ignore existing
directories now that we have '--directory'.
Signed-off-by: Justus Winter <justus@g10code.com>
* agent/gpg-agent.c (main): Take the socketdir in account for the
default sockets.
* tools/gpgconf.c (list_dirs): Add "agent-extra-socket" and
"agent-browser-socket".
Signed-off-by: Werner Koch <wk@gnupg.org>
