1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-22 10:19:57 +01:00

4133 Commits

Author SHA1 Message Date
NIIBE Yutaka
ca89277cb4 SCD: Clean up. Remove PADLEN for keypad input.
* scd/apdu.c (struct pininfo_s): Use iso7816_pininfo_s.
(struct reader_table_s): Remove last arg from check_keypad method.
(check_pcsc_keypad, check_pcsc_keypad): Remove PIN_PADLEN.
(pcsc_keypad_verify, pcsc_keypad_modify): Don't check PIN_PADLEN.
(send_apdu_ccid, ccid_keypad_operation): Remove PIN_PADLEN.
(apdu_check_keypad, apdu_keypad_verify, apdu_keypad_modify):
Likewise.

* scd/apdu.h (apdu_check_keypad, apdu_keypad_verify)
(apdu_keypad_modify): Remove PIN_PADLEN.

* scd/ccid-driver.c (ccid_transceive_secure): Remove PIN_PADLEN.

* scd/ccid-driver.h (ccid_transceive_secure): Remove PIN_PADLEN.

* scd/iso7816.c (iso7816_check_keypad, iso7816_verify_kp)
(iso7816_change_reference_data_kp): Remove PADLEN.

* scd/iso7816.h (struct iso7816_pininfo_s): Remove PADLEN, PADCHAR.
--
In the OpenPGPcard specification, password comes with no padding.  In
GnuPG, we support keypad input for OpenPGPcard only.  Thus, it is
useless to try to support padding for keypad input.
2013-02-05 13:35:44 +09:00
NIIBE Yutaka
d9f6cc7502 SCD: Add option enable-keypad-varlen and support for GEMPC_PINPAD.
* scd/scdaemon.h (opt): Add enable_keypad_varlen.
* scd/scdaemon.c (cmd_and_opt_values): Add oEnableKeypadVarlen.
(opts, main): Add oEnableKeypadVarlen.
* scd/ccid-driver.c (GEMPC_PINPAD): New.
(ccid_transceive_secure): Add enable_varlen handling.
Enable GEMPC_PINPAD.
--
Note that GEMPC_PINPAD doesn't support variable length keypad input.
The feature of fixed length keypad input will be added soon.
2013-02-05 13:33:44 +09:00
Werner Koch
65eb98966a Convert doc/DETAILS to org-mode
--
Also restructure the file and fix some obviously wrong things.
2013-01-30 18:54:23 +01:00
Werner Koch
50a7badbda Remove unused status codes
* common/status.h (STATUS_BEGIN_STREAM, STATUS_END_STREAM)
(STATUS_SIEXPIRED): Remove unused codes.
2013-01-30 18:51:56 +01:00
Werner Koch
1cd6445eec gpg: Add status line PINENTRY_LAUNCHED.
* common/status.h (STATUS_PINENTRY_LAUNCHED): New.
* g10/server.c (server_local_s): Add field allow_pinentry_notify.
(option_handler): Add option "allow-pinentry-notify".
(gpg_proxy_pinentry_notify): New.
* g10/call-agent.c (default_inq_cb): Factor code out to the new
function.
2013-01-30 12:00:29 +01:00
NIIBE Yutaka
1999446644 agent: Fix a bug of handling return code from npth_join.
* agent/call-pinentry.c (agent_popup_message_stop): Fix npth_join
return code.
--
pth_join returns TRUE (1) on success.  But npth_join (and pthread_join)
returns 0 on success, returns error number on error.
2013-01-25 23:20:46 +09:00
Christian Aistleitner
60c58766ae gpg: Fix honoring --cert-digest-algo when recreating a cert
* g10/sign.c (update_keysig_packet): Override original signature's
digest algo in hashed data and for hash computation.
2013-01-11 13:48:59 +01:00
Werner Koch
7a638c094f Fix spurious cruft from configure summary output.
* configure.ac (build_scdaemon_extra): Remove $tmp cruft.
2013-01-11 13:48:59 +01:00
NIIBE Yutaka
4dddf32c83 SCD: Hold lock for pinpad input.
* scd/apdu.c (apdu_check_keypad, apdu_keypad_verify)
(apdu_keypad_modify): Hold lock to serialize communication.
2013-01-11 11:18:39 +09:00
NIIBE Yutaka
a776f66036 SCD: Support not-so-smart card readers.
* scd/ccid-driver.c (struct ccid_driver_s): Add auto_voltage,
auto_param, and auto_pps.
(parse_ccid_descriptor): Set auto_voltage, auto_param, and auto_pps.
Support non-autoconf readers.
(update_param_by_atr): New.
(ccid_get_atr): Use 5V for PowerOn when auto_voltage is not supported.
Use 0x10 when nonnull_nad for SetParameters.
Call update_param_by_atr for parsing ATR, and use param for
SetParameters.
Send PPS if reader requires it and card is negotiable.
When bNadValue in the return values of SetParameters == 0,
clear handle->nonnull_nad flag.
--
This change is to support more card readers by the internal driver.
Tested with 08e6:3478 Gemplus PinPad Smart Card Reader.
2013-01-08 15:22:31 +09:00
NIIBE Yutaka
bb51edc31e Update Japanese Translation.
* po/ja.po: Fix wrong translations for designated revocation.
Reported by Hideki Saito.

Conflicts:
	po/ja.po
2013-01-07 10:51:26 +09:00
NIIBE Yutaka
05a4458e57 Update Japanese Translation.
* po/ja.po: Fix fuzzy translations.
2013-01-05 16:38:11 +09:00
NIIBE Yutaka
709a8f8125 Update Japanese Translation.
* po/ja.po: Update with POT.
2013-01-03 12:03:19 +09:00
NIIBE Yutaka
0fae789c41 Update Japanese Translation.
* po/ja.po: Start from the new one of 2.0.
2013-01-03 12:02:07 +09:00
Werner Koch
f0b33b6fb8 gpg: Import only packets which are allowed in a keyblock.
* g10/import.c (valid_keyblock_packet): New.
(read_block): Store only valid packets.
--

A corrupted key, which for example included a mangled public key
encrypted packet, used to corrupt the keyring.  This change skips all
packets which are not allowed in a keyblock.

GnuPG-bug-id: 1455

(cherry-picked from commit f795a0d59e197455f8723c300eebf59e09853efa)
2012-12-20 12:37:01 +01:00
Werner Koch
d61f7402f2 gpg: Make commit 2b3cb2ee actually work
* g10/sign.c (update_keysig_packet): Use digest_algo.

(cherry-picked from commit d23ec86095714d388acac14b515445fe69f019e9)
2012-12-19 12:40:21 +01:00
Werner Koch
8325d61659 gpg: Suppress "public key already present" in quiet mode.
* g10/pkclist.c (find_and_check_key, build_pk_list): Print a
diagnostic only in non-quiet mode.
2012-12-19 11:21:26 +01:00
Werner Koch
5a66316ea4 faq: Add a section on copyright assignments
--
2012-12-19 11:05:05 +01:00
Werner Koch
0e64e1abd3 State that disclaimers are not anymore needed for translations.
--
2012-12-18 19:56:24 +01:00
Werner Koch
41d564333d common: Add meta option ignore-invalid-option.
* common/argparse.c (iio_item_def_s, IIO_ITEM_DEF): New.
(initialize): Init field IIO_LIST.
(ignore_invalid_option_p): New.
(ignore_invalid_option_add): New.
(ignore_invalid_option_clear): New.
(optfile_parse): Implement meta option.
--

This option is currently of no use.  However, as soon as it has been
deployed in all stable versions of GnuPG, it will allow the use of the
same configuration file with an old and a new version of GnuPG.  For
example: If a new version implements the option "foobar", and a user
uses it in gpg.conf, an old version of gpg would bail out with the
error "invalid option".  To avoid that the following line can be put
above that option in gpg.conf

  ignore-invalid-option foobar

This meta option may be given several times or several option names
may be given as arguments (space delimited).  Note that this option is
not available on the command line.
2012-12-18 18:06:41 +01:00
Werner Koch
6177fb3c87 utf8conv.c: Add hacks for Android.
* common/utf8conv.c [HAVE_ANDROID_SYSTEM]: Do not include iconv.h.
(iconv_open, iconv_close, load_libiconv) [HAVE_ANDROID_SYSTEM]: New
dummy functions.
(set_native_charset) [HAVE_ANDROID_SYSTEM]: Force use of "utf-8".
(jnlib_iconv_open) [HAVE_ANDROID_SYSTEM]: Act the same as under W32.
(jnlib_iconv) [HAVE_ANDROID_SYSTEM]: Ditto.
(jnlib_iconv_close) [HAVE_ANDROID_SYSTEM]: Ditto.
--

Co-authored-by: Hans of Guardian <hans@guardianproject.info>
2012-12-13 16:11:21 +01:00
NIIBE Yutaka
e7dca3e83e SCD: Fix the process of writing key or generating key.
* scd/app-openpgp.c (store_fpr): Flush KEY-FPR and KEY-TIME.
2012-12-13 13:44:43 +09:00
Werner Koch
649b31c663 ssh: Support ECDSA keys.
* agent/command-ssh.c (SPEC_FLAG_IS_ECDSA): New.
(struct ssh_key_type_spec): Add fields CURVE_NAME and HASH_ALGO.
(ssh_key_types): Add types ecdsa-sha2-nistp{256,384,521}.
(ssh_signature_encoder_t): Add arg spec and adjust all callers.
(ssh_signature_encoder_ecdsa): New.
(sexp_key_construct, sexp_key_extract, ssh_receive_key)
(ssh_convert_key_to_blob): Support ecdsa.
(ssh_identifier_from_curve_name): New.
(ssh_send_key_public): Retrieve and pass the curve_name.
(key_secret_to_public): Ditto.
(data_sign): Add arg SPEC and change callers to pass it.
(ssh_handler_sign_request): Get the hash algo from SPEC.
* common/ssh-utils.c (get_fingerprint): Support ecdsa.

* agent/protect.c (protect_info): Add flag ECC_HACK.
(agent_protect): Allow the use of the "curve" parameter.
* agent/t-protect.c (test_agent_protect): Add a test case for ecdsa.

* agent/command-ssh.c (ssh_key_grip): Print a better error code.
--

The 3 standard curves are now supported in gpg-agent's ssh-agent
protocol implementation.  I tested this with all 3 curves and keys
generated by OpenSSH 5.9p1.

Using existing non-ssh generated keys will likely fail for now. To fix
this, the code should first undergo some more cleanup; then the fixes
are pretty straightforward.  And yes, the data structures are way too
complicated.
2012-12-12 18:47:21 +01:00
Werner Koch
f76a0312c3 ssh: Rewrite a function for better maintainability
* agent/command-ssh.c (ssh_signature_encoder_dsa): Rewrite.
--

Using es_fopenmem instead of a preallocated buffer is safer and easier
to read.
2012-12-11 14:50:34 +01:00
Werner Koch
d2777f84be ssh: Improve key lookup for many keys.
* agent/command-ssh.c: Remove dirent.h.
(control_file_s): Add struct item.
(rewind_control_file): New.
(search_control_file): Factor code out to ...
(read_control_file_item): New.
(ssh_handler_request_identities): Change to iterate over entries in
sshcontrol.
--

Formerly we scanned the private key directory for matches of entries
in sshcontrol.  This patch changes it to scan the sshcontrol file and
thus considers only keys configured there.  The rationale for this is
that it is common to have only a few ssh keys but many private keys.
Even if that assumption does not hold true, the scanning of the
sshcontrol file is faster than reading the directory and only then
scanning the ssh control for each directory entry.
2012-12-10 18:27:23 +01:00
Werner Koch
25fb53ab4a ssh: Cleanup sshcontrol file access code.
* agent/command-ssh.c (SSH_CONTROL_FILE_NAME): New macro to replace
the direct use of the string.
(struct control_file_s, control_file_t): New.
(open_control_file, close_control_file): New.  Use them instead of
using fopen/fclose directly.
2012-12-10 16:39:12 +01:00
Werner Koch
36ba784599 agent: Add envvar "gnupg_SSH_AUTH_SOCK_by"
* agent/gpg-agent.c (main): Pass new envar gnupg_SSH_AUTH_SOCK_by to
an invoked process.
--

This environment variable is useful for debugging if
--use-standard-socket is used (which is the default since 2.1).
Commonly you should have this in your init script (e.g. ~/.bashrc):

    unset GPG_AGENT_INFO
    unset SSH_AGENT_PID
    SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh"
    export SSH_AUTH_SOCK

The problem is that gpg-agent won't be able to override the
SSH_AUTH_SOCK envvar if gpg-agent has been invoked as

  gpg-agent --enable-ssh-support --daemon /bin/bash

To fix this you should instead use this code in the init script:

  unset GPG_AGENT_INFO
  unset SSH_AGENT_PID
  if [ ${gnupg_SSH_AUTH_SOCK_by:-0} -ne $$ ]; then
    export SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh"
  fi

This will work in all cases and thus allows to start gpg-agent for
testing purposes with a different homedir and use this gpg-agent as an
ssh-agent.  Example:

  GNUPGHOME=$(pwd) gpg-agent --enable-ssh-support --daemon /bin/bash

gnupg_SSH_AUTH_SOCK_by is set to the PID of the exec-ed process and
thus will work safely if called recursively.
2012-12-10 14:45:26 +01:00
Werner Koch
ceab60b59d config: Update npth.m4.
* m4/npth.m4: Take from current npth master.
2012-12-10 09:40:40 +01:00
NIIBE Yutaka
1e1326aeb8 Revert SCD changes of 2010-05-03.
* scd/apdu.c (pcsc_no_service): Remove.
(open_pcsc_reader_direct, open_pcsc_reader_wrapped): Remove
pcsc_no_service support.
(apdu_open_reader): Remove R_NO_SERVICE.
* scd/apdu.h (apdu_open_reader): Remove R_NO_SERVICE.
* scd/command.c (reader_disabled): Remove.
(get_current_reader): Follow the change of R_NO_SERVICE.
(open_card, cmd_serialno, scd_command_handler): Remove reader_disabled
support.
* scd/sc-copykeys.c (main): Follow the change of R_NO_SERVICE.
--
Daemon should handle all possible cases.  Even if such a difficult
case like reader_disabled, it should not exit.
2012-12-04 10:48:20 +01:00
NIIBE Yutaka
baf7b09e12 Don't keep opening unavailable card reader.
* scd/command.c (update_reader_status_file): Don't call
get_current_reader.

--
This fix has a impact that the insertion of a card reader will not be
detected upon the insertion, but will be deferred until user tries to
access his card.
2012-12-04 10:48:20 +01:00
David Shaw
b8eb2ab569 Refresh sample keys 2012-11-30 12:47:49 -05:00
David Shaw
3f8ad56467 Adjust awk to not add trailing whitespace.
* mksamplekeys: Tweak awk script to not add trailing whitespace to
  blank lines (makes git pre-commit hook unhappy)
2012-11-30 12:43:34 -05:00
David Shaw
7602d9e3ed The keyserver search menu should honor --keyid-format
* keyserver.c (print_keyrec): Honor --keyid-format when getting back
  full fingerprints from the keyserver (the comment in the code was
  correct, the code was not).
2012-11-29 13:09:46 -05:00
Werner Koch
3d2da6c821 Fix printing of ECC algo names in hkp keyserver listings.
* g10/keyserver.c (print_keyrec): Map OpenPGP algorithm ids.
2012-11-27 16:51:09 +01:00
Ben Kibbey
66331e138e Check for inet_addr() in -lnsl.
* configure.ac: Check for inet_addr() in libnsl.

--
OpenSolaris/OpenIndiana requires this.
2012-11-26 14:34:11 +01:00
Werner Koch
835698b72b Do not use a broken ttyname.
* configure.ac (HAVE_BROKEN_TTYNAME): New ac_define set for Android
systems.
* common/util.h (gnupg_ttyname): New macro.  Change all callers of
ttyname to use this macro instead.
(ttyname) [W32]: Rename to _gnupg_ttyname and use also if
HAVE_BROKEN_TTYNAME is defined.
* common/simple-pwquery.c (agent_send_all_options): Keep on using
ttyname unless HAVE_BROKEN_TTYNAME is set.  This is because this file
may be used standalone.
2012-11-20 19:03:49 +01:00
Werner Koch
e7bc5012c5 Fix non-portable use of chmod in autogen.sh.
* autogen.sh: Remove option -c from chmod.
2012-11-16 10:41:22 +01:00
Werner Koch
011faa0c68 Improve parsing of the GIT revision number.
* configure.ac (mmm4_revision): Use git rev-parse.
2012-11-16 10:41:22 +01:00
Werner Koch
ac775780fe Add an OpenPGP card vendor.
* g10/card-util.c (get_manufacturer): Add Yubico.
2012-11-16 10:41:22 +01:00
Werner Koch
6505a995f9 Fix description of validity flag 'n'.
--
Thanks to Hauke Laging for spotting this.
2012-11-12 15:31:45 +01:00
Werner Koch
9f0e9ea80c agent: Use wipememory instead of memset in one place.
* agent/command.c (clear_outbuf): Use wipememory.  Suggested by Ben
Kibbey.
2012-11-06 18:51:47 +01:00
Werner Koch
905b6a36d3 Allow decryption with card keys > 3072 bits
* scd/command.c (MAXLEN_SETDATA): New.
(cmd_setdata): Add option --append.
* agent/call-scd.c (agent_card_pkdecrypt): Use new option for long
data.

* scd/app-openpgp.c (struct app_local_s): Add field manufacturer.
(app_select_openpgp): Store manufacturer.
(do_decipher): Print a note for broken cards.

--

Please note that I was not able to run a full test because I only have
broken cards (S/N < 346) available.
2012-11-06 14:48:06 +01:00
NIIBE Yutaka
8f8c29d24c agent: Fix wrong use of gcry_sexp_build_array
* findkey.c (agent_public_key_from_file): Fix use of
gcry_sexp_build_array.

--
A test case leading to a segv in Libgcrypt is

  gpg-connect-agent \
    "READKEY 9277C5875C8AFFCB727661C18BE4E0A0DEED9260" /bye

The keygrip was created by "monkeysphere s", which has a comment.

gcry_sexp_build_array expects pointers to the arguments which is quite
surprising.  Probably ARG_NEXT was accidentally implemented wrongly.
Anyway, we can't do anything about it and thus need to fix the check
the users of this function.

Some-comments-by: Werner Koch <wk@gnupg.org>
2012-11-02 16:22:26 +01:00
NIIBE Yutaka
8df89f3e9c SCD: Upon error, open_pcsc_reader_wrapped does same as _direct.
* scd/apdu.c (PCSC_E_NO_SERVICE): New.
(open_pcsc_reader_direct): Use PCSC_E_NO_SERVICE.
(open_pcsc_reader_wrapped): Set pcsc_no_service.
2012-10-31 11:05:55 +09:00
Werner Koch
76055d49d1 Update and enable French translation
* po/fr.po: Update.
* po/LINGUAS: Enable fr.
2012-08-24 17:42:36 +02:00
Werner Koch
7ccc3eafe0 Add POT file to .gitignore
--
2012-08-24 17:41:21 +02:00
Werner Koch
6b5f59c87f Update German translation
--
Actually only updates due to typo fixes in the English source.
2012-08-24 10:20:16 +02:00
David Prévot
ba591e2f14 Fix typos spotted during translations
* agent/genkey.c: s/to to/to/
* sm/*.c: s/failed to allocated/failed to allocate/
* sm/certlist.c, ./dirmngr/validate.c: s/should have not/should not have/
* g10/seskey.c: missing closing parenthesis
* dirmngr/crlcache.c: s/may has/may have/

Consistency fix:

* g10/gpg.c, kbx/kbxutil.c, sm/gpgsm.c: uppercase after Syntax
* dirmngr/dirmngr_ldap: no period in Syntax
* dirmngr/dirmngr-client.c: infinitive for option description:
	s/certificates are expected/expect certificates/
2012-08-24 09:44:33 +02:00
David Prévot
94e663885b Actually show translators comments in PO files
--
2012-08-24 09:42:31 +02:00
David Prévot
bf95408fc3 Keep previous msgids of translated messages
* po/Makefile.in.in: Use --previous with msgmerge.
2012-08-24 09:41:39 +02:00