1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-24 10:39:57 +01:00

8680 Commits

Author SHA1 Message Date
Werner Koch
9b886adba4
dirmngr: Fix backport of the new option parser from 2.3
* dirmngr/dirmngr.c (main) <aGPGConfList>: Re-introduce
gpgconf-dirmngr.conf.
--

Fixes-commit: a028f24136a062f55408a5fec84c6d31201b2143
2020-12-18 11:21:18 +01:00
Werner Koch
559efd23e9
gpg: New AKL method "ntds"
* dirmngr/ks-engine-ldap.c (keyspec_to_ldap_filter): Change the new
support for KEYDB_SEARCH_MODE_MAIL.
(ks_ldap_get): Add a debug.
* g10/options.h (AKL_NTDS): New.
* g10/keyserver.c (keyserver_import_ntds): New.
(keyserver_get_chunk): Allow KEYDB_SEARCH_MODE_MAIL.
* g10/getkey.c (parse_auto_key_locate): Support "ntds".
(get_pubkey_byname): Ditto.
2020-12-17 18:19:01 +01:00
Werner Koch
776bef74c7
dirmngr: Support "ldap:///" for the current AD user.
* dirmngr/http.h (struct parsed_uri_s): Add field ad_current.
* dirmngr/ldap-parse-uri.c (ldap_parse_uri): Set it.
* dirmngr/ks-engine-ldap.c (my_ldap_connect): Take care of ad_current.
2020-12-17 16:09:31 +01:00
Werner Koch
c75fd75532
dirmngr: Allow LDAP searches via fingerprint.
* dirmngr/ks-engine-ldap.c (keyspec_to_ldap_filter): Add arg
serverinfo and allow searching by fingerprint.
(ks_ldap_get, ks_ldap_search): First connect then create teh filter.
--

With the new schema we can finally search by fingerprint.
2020-12-17 11:19:22 +01:00
Werner Koch
c28cb5282b
dirmngr: Store all version 2 schema attributes.
* g10/call-dirmngr.c (ks_put_inq_cb): Emit "fpr" records.
* dirmngr/ks-engine-ldap.c (extract_attributes): Add args
extract-state and schemav2.  Add data for the new schema version.
remove the legacy code to handle UIDs in the "pub" line.
(ks_ldap_put): Set new attributes for NTDS use the fingerprint as CN.

Signed-off-by: Werner Koch <wk@gnupg.org>

This is a backport from 2.3
2020-12-17 11:08:31 +01:00
Werner Koch
ac8ece9266
dirmngr: Support the new Active Directory schema
* dirmngr/ks-engine-ldap.c (SERVERINFO_): New constants.
(my_ldap_connect): Relace args pgpkeyattrp and real_ldapp by a new
serverinfo arg.  Set the new info flags.
(ks_ldap_get): Adjust for change.
(ks_ldap_search): Ditto.
(ks_ldap_put): Ditto.  Replace xmalloc by xtrymalloc.  Change the DN
for use with NTDS (aka Active Directory).
--

This is a first take on better Active Directory support.  The main
change for NTDS in the code is that the an top-RDN of CN is used
instead of the old pgpCertID.  More changes to come; for example using
and storing the fingerprint.

Signed-off-by: Werner Koch <wk@gnupg.org>

This is a backport from 2.3 without the new schema samples - they can
be found in the repo.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-12-17 11:05:46 +01:00
Werner Koch
0e88c73bc9
dirmngr: Do not store the useless pgpSignerID in the LDAP.
* dirmngr/ks-engine-ldap.c (extract_attributes): Do not store the
pgpSignerID.
* g10/call-dirmngr.c (ks_put_inq_cb): Do not emit sig records.
--

The pgpSignerID has no use in the LDAP and thus don't store it.
David's idea back in 2004 was
              /* This bit is really for the benefit of people who
                 store their keys in LDAP servers.  It makes it easy
                 to do queries for things like "all keys signed by
                 Isabella".  */
See-commit: 3ddd4410aef928827e1c8d4fb02c1ccd3f8eaea5

I consider this dangerous because such a query is not able to validate
the signature, does not get revocation signatures, and also has no
information about the validity of the signatures.  Further many keys
are spammed tehse days with faked signatures and it does not make
sense to blow up the LDAP with such garbage.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-12-17 11:02:49 +01:00
Werner Koch
e47de85382
dirmngr: Fix adding keys to an LDAP server.
* dirmngr/ks-engine-ldap.c (ks_ldap_put): Extract attribites into
addlist.
--

The code used the wrong list which resulting in adding attributes
marked for deletion.  In particular Active Directory does not accept
such an data and rejects them.  The bug was introduced into 2.1 while
porting the code from the old keyserver helpers to dirmngr.

Fixes-commit: 51341badb623927f2a358588c725a356fc77dbe7
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-12-17 10:23:46 +01:00
NIIBE Yutaka
3c55e15cee scd:ccid: Call libusb_clear_halt in ccid_vendor_specific_setup.
* scd/ccid-driver.c (ccid_vendor_specific_setup): Only for SPR532,
call libusb_clear_halt.

--

Backport master commit of:
	f50373027222f28ab9d37843178a5d44cc1e3cc0

GnuPG-bug-id: 5167
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-12-16 10:15:43 +09:00
NIIBE Yutaka
585cfca0a6 scd:ccid: Revert the addition of libusb_clear_halt for EP_INTR.
* scd/ccid-driver.c (ccid_setup_intr): Don't call libusb_clear_halt.

--

Backport master commit of:

	ffabc29d5eadfe81b9f62b7d4fe6e858b191354d

GnuPG-bug-id: 5167
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-12-16 10:15:11 +09:00
NIIBE Yutaka
5a03bf6130 scd:openpgp: Fix writing ECC key to card.
* scd/app-openpgp.c (build_privkey_template): Adding another argument
of ecc_d_fixed_len to handle variable-size MPI.

--

Backport from master commit of:
	a25c99b156ca9acaa7712e9c09a6df0a7a23c833

GnuPG-bug-id: 5163
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-12-07 10:06:52 +09:00
Werner Koch
a028f24136
Backport of the new option parser from 2.3
* configure.ac (GPGRT_ENABLE_ARGPARSE_MACROS): Define.
* common/argparse.c, common/argparse.h: Rewrite.
* tests/gpgscm/main.c: Switch to the new option parser.

* g10/gpg.c: Switch to the new option parser and enable a global conf
file.
* g10/gpgv.c: Ditto.
* agent/gpg-agent.c: Ditto.
* agent/preset-passphrase.c: Ditto.
* agent/protect-tool.c: Ditto.
* scd/scdaemon.c: Ditto.
* dirmngr/dirmngr.c: Ditto.
* dirmngr/dirmngr_ldap.c: Ditto
* dirmngr/dirmngr-client.c: Ditto.
* kbx/kbxutil.c: Ditto.
* tools/gpg-card.c: Ditto.
* tools/gpg-check-pattern.c: Ditto.
* tools/gpg-connect-agent.c: Ditto.
* tools/gpg-pair-tool.c: Ditto.
* tools/gpg-wks-client.c: Ditto.
* tools/gpg-wks-server.c: Ditto.
* tools/gpgconf.c: Ditto.
* tools/gpgsplit.c: Ditto.
* tools/gpgtar.c: Ditto.
* g13/g13.c: Ditto.
* g13/g13-syshelp.c: Ditto.  Do not force verbose mode.
* sm/gpgsm.c: Ditto. Add option --no-options.
--

This is backport from master

commit cdbe10b762f38449b86da69076209324b0c99982
commit ba463128ce65a0f347643f7246a8e097c5be19f1
commit 3bc004decd289810bc1b6ad6fb8f47e45c770ce6
commit 2c823bd878fcdbcc4f6c34993e1d0539d9a6b237
commit 0e8f6e2aa98c212442001036fb5178cd6cd8af59

but without changing all functions names to gpgrt.  Instead we use
wrapper functions which, when building against old Libgpg-error
versions, are implemented in argparse.c using code from the current
libgpg-error.  This allows to keep the dependency requirement at
libgpg-error 1.27 to support older distributions.  Tested builds
against 1.27 and 1.40-beta.

Note that g13-syshelp does not anymore default to --verbose because
that can now be enabled in /etc/gnupg/g13-syshelp.conf.

GnuPG-bug-id: 4788
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-12-04 12:12:20 +01:00
Werner Koch
acafa695e1
kbx: Better error message in case of a crippled Libgcrypt.
* kbx/keybox-openpgp.c (keygrip_from_keyparm): Detect missing curve.
2020-12-02 11:11:47 +01:00
Jens Meißner
a3f95a29b9
doc: Add parameters for batch generation of ECC keys.
* doc/gpg.texi: Add parameters for batch generation of ECC keys.

--

There are parameters required for batch generation of ECC keys which
weren't mentioned in the documentation.

Signed-off-by: Jens Meißner <meissner@b1-systems.de>
2020-12-01 09:58:32 +01:00
NIIBE Yutaka
7d7a50ba72
common: Fix fallback handling to utf-8.
* common/utf8conv.c (handle_iconv_error): Set NO_TRANSLATION.

--

GnuPG-bug-id: 5038
Fixes-commit: 99c9bf7defd6c1ac9cc49c84e6c78eeb886a6952
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
(cherry picked from commit 393dcdd61c3b2da00a97176c647d9bd1c908ceba)
2020-11-27 17:46:29 +01:00
Werner Koch
abd9aeecfb
Post release updates
--
2020-11-23 18:40:55 +01:00
Werner Koch
40f75823d2
Release 2.2.25 gnupg-2.2.25 2020-11-23 14:08:11 +01:00
Gavin L. Rebeiro
563db31467
doc: Fix typos
--
GnuPG-bug-id: 5071

Also fixed one in keyformat.txt [wk].

(cherry picked from commit 572bcacc287d24d0a2cc56442f9fb6a9ac49e12d)
2020-11-23 12:13:52 +01:00
Werner Koch
6594dc31f5
gpgconf: Also print revision of libksba.
* dirmngr/dirmngr.c (get_revision_from_blurb): Fix detection of empty
string.
(gpgconf_versions): Print ksba revision.
--

The latest Libksba version support retrieving of the revision (commit)
id.  We now use that or print a question mark.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 4070f302e4decc8d54d1305cbd30f6dab052ef7e)
2020-11-19 09:12:04 +01:00
Jakub Bogusz
f7cbf68fdd
po: Update Polish translation 2020-11-19 08:34:28 +01:00
NIIBE Yutaka
84020385be scd:openpgp: Public keys should be available for check_keyidstr.
* scd/app-openpgp.c (check_keyidstr): Call get_public_key.

--

GnuPG-bug-id: 5065
Fixes-commit: 1049f06c6d2e1a833af4c73ea67a05417bbd0967
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-11-19 13:49:08 +09:00
Werner Koch
126fa09f8b
Post release updates
--
2020-11-17 10:51:01 +01:00
Werner Koch
5751c48035
Release 2.2.24 gnupg-2.2.24 2020-11-17 09:17:18 +01:00
Werner Koch
46f373e1a0
po: Auto update
--
2020-11-16 17:09:41 +01:00
Werner Koch
3274eb4637
scd:openpgp: Drop support for GnuPG 1.
--

It does not make sense to keep support form GnuPG 1 here given that we
don't intend to ever backport any of the current stuff to the legacy
version.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-16 17:09:39 +01:00
Werner Koch
1049f06c6d
scd:openpgp: Allow keygrip to be used to reference a key
* scd/app-openpgp.c (struct app_local_s): Add keygrip_str.
(store_keygrip): New.
(read_public_key): Store the keygrip.
(get_public_key): Sitto.
(send_keypair_info): USe the stored keygrip.
(check_keyidstr): New.  Factored out from other functions and
extended.
(do_sign): Use check_keyidstr.
(do_auth): Ditto.
(do_decipher): Ditto.
(do_check_pin): Ditto.
--

This code is a backport of commits:

b0f0791e4ade845b2a0e2a94dbda4f3bf1ceb039
cd: Factor out a function to check keyidstr.

4c4999b8185ace55eb5f3a6fa7d3dc0a77267b63
scd:openpgp: Allow PKSIGN with keygrip also for OPENPGP.3.

e769609cd3c12d2e26955538399172016f78d2d4
scd: Allow KEYGRIP as KEYIDSTR.

Co-authored-by: NIIBE Yutaka <gniibe@fsij.org>
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-16 17:09:37 +01:00
Werner Koch
5d98f95aa9
gpg: Provide better diagnostic for replaced card keys.
* agent/divert-scd.c (divert_pksign): Add arg 'grip'.  Replace OPENPGP
key reference to keygrips.
(divert_pkdecrypt): Ditto.
* agent/protect.c (parse_shadow_info): Trim spaces.
* agent/pkdecrypt.c (agent_pkdecrypt): Pass the keygrip.
* agent/pksign.c (agent_pksign_do): Ditto.

* g10/mainproc.c (print_pkenc_list): Print extra info for an invalid
id error.
* g10/sign.c (do_sign): Ditto.
--

Using the keygrip instead of the identifier works on OpenPGP cards and
thus we use that to make sure that we are working on the right card.
For other cards we better don't do that to avoid regressions.  Those
other cards are also usually provided and do not allow to
self-generate the keys.

Note that old versions of the code (gpg 1.4) used the fingerprint as
additional check but that was eventually removed and now that we use
the keygrip all over the place, it is best to use this to identify a
key.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-13 16:06:59 +01:00
Werner Koch
aeed0b93ff
gpg: Fix the encrypt+sign hash algo preference selection for ECDSA.
* g10/keydb.h (pref_hint): Change from union to struct and add field
'exact'.  Adjust callers.
* g10/pkclist.c (algo_available): Take care of the exact hint.
* g10/sign.c (sign_file): Fix indentation.  Rework the hash from
recipient prefs.
--

This fixes a encrypt+sign case like: One recipient key has SHA512 as
highest ranked hash preference but the the signing key is a 256 bit
curve.  Because we don't want to use a truncated hash with ECDSA, we
need to have an exact match - this is in particular important for
smartcard which check that the hash matches the curves.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-13 16:02:00 +01:00
Werner Koch
f400ff4e7d
gpgconf: Yet another fix for --apply-profile.
* tools/gpgconf.c (main): Use gnupg_homedir instead of
default_homedir.  Check for existance of the directory.
--

Fixes-commit: 1fbf085bc8b4a92772d1da8bfea507f4f97434b1
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-12 13:11:03 +01:00
Werner Koch
7076f6cafb
scd: Skip unknown options in command SERIALNO
* scd/command.c (cmd_serialno): Skip options.
--

SERIALNO --all
works only in 2.3 and thus naive use with 2.2 vesions would conserer
"--all" as the reqyested applications.  Fix is easy and should be done
anyway.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-12 12:44:57 +01:00
NIIBE Yutaka
2b2f21445c po: Update Japanese Translations.
--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-11-12 12:59:57 +09:00
Werner Koch
c4603bcd1f
po: Update the German translation
--
2020-11-11 14:58:21 +01:00
Werner Koch
966fe1e9d9
gpg: Support brainpool keygen with "key from card".
* g10/keygen.c (ask_algo): Add brainpool hack in the same as for Nist
curves.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-11 14:52:32 +01:00
Werner Koch
bd3b698d8e
scd: Do not print reader status change with --debug cardio.
--

... but use --debug reader for this.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-11 14:50:49 +01:00
Werner Koch
e2dfaf1b2b
w32: Revert use of one gnupg_fopen in a test tool
--
2020-11-10 12:11:33 +01:00
Werner Koch
163e4ff195
w32: Support Unicode also for config files etc.
* common/sysutils.c (gnupg_fopen) [W32]: Use _wfopen if needed.   Use
new function in most places where fopen is used.
--

The config files in 2.2 are still read using fopen - we need to change
this to allow Unicode directory names.  There is also one case where
files are written using the old fopen.  The new option parser in 2.3
does not have this problem but at some places fopen is also still used.

GnuPG-bug-id: 5098
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-10 12:09:11 +01:00
Werner Koch
9188a3c6b7
w32: Support utf8 for getcwd even if build with gpgrt < 1.40.
* common/sysutils.c (gnupg_getcwd) [W32]: Use Unicode version.
--

gpgrt 1.40 has not yet been released, so to make getcwd work properly
on Windows we need to have the code here as well.

GnuPG-bug-id: 5098
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-10 10:11:11 +01:00
Werner Koch
0ca0a30bd6
Prepare NEWS for the next release.
--
2020-11-09 13:37:23 +01:00
NIIBE Yutaka
8e206c1721
scd: Internal CCID driver: Fix a race condition on close.
* scd/ccid-driver.c (ccid_require_get_status): For VENDOR_SCM reader,
return 0 only at the initial call.
(bulk_in): Don't detect an error for VENDOR_SCM reader, just kicking
the loop, to invoke scd_update_reader_status_file, which calls
ccid_slot_status again.
(ccid_slot_status): Move the call of ccid_vendor_specific_setup to...
(ccid_get_atr): ... here.

--

For readers with interrupt transfer support, it is only intr_cb which
sets handle->powered_off to 1.  Keeping this condition makes no race.
The function ccid_slot_status can also detect a communication error,
which causes apdu_close_reader (but not setting ->powered_off).

GnuPG-bug-id: 5121
Fixes-commit: 920f258eb6018ecec1d63bad6a0fb0772f72affa
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
(cherry picked from commit 484bafda4dbf5ffe9e7c41ef24fbc5bd791a3b32)
2020-11-09 13:26:40 +01:00
Werner Koch
7f765a98fd
card: Run factory-reset in locked stated.
* scd/command.c (reset_notify): Add option --keep-lock.
(do_reset): Add arg keep_lock.
(cmd_lock): Send progress status.
* g10/call-agent.c (agent_scd_apdu): Add more pseudo APDUs.
* g10/card-util.c (send_apdu): Ditto.
(factory_reset): Use lock commands.
--

This is required so that for example Kleopatra does not detect the
RESET and issues a SERIALNO of its own, thus conflicting with our
SERIALNO undefined.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-09 13:04:38 +01:00
Werner Koch
21d5323f5d
gpg: Fix recent commit for weak digest algos and smartcards.
* g10/sign.c (sign_file): Fix condition.
--

Fixes-commit: 4c181d51a6f1fd05b7f190a18769ba5e9f892f6a
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-09 12:21:27 +01:00
Werner Koch
549dc8cfe9
Require libksba 1.3.5
* configure.ac (NEED_KSBA_VERSION): Set to 1.3.5.
--

Minor update to make sure that important fixes are used.  That version
was release in 2016 and thus before the new requirement for Libgcrypt
1.8.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-09 12:16:42 +01:00
Werner Koch
fc01ae5071
Require Libgpg-error 1.27
* configure.ac (NEED_GPG_ERROR_VERSION): Require 1.27
* common/util.h: Remove compatibility macros.
--

This is just a minor change to align with the need for Libgcrypt 1.8.
The latter was first released in summer 2017 while Libgpg-error 1.27
was released earlier in spring that year.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-09 12:10:48 +01:00
Werner Koch
99ab3aed15
Require Libgcrypt 1.8
* configure.ac (NEED_LIBGCRYPT_VERSION): Require 1.8.
* tools/gpgconf.c (show_version_libgcrypt): Remove conditional case
for Libgcrypt < 1.8.
* common/compliance.c (gnupg_rng_is_compliant): Ditto.
* agent/pksign.c: Ditto.
* agent/gpg-agent.c (thread_init_once): Ditto.
(agent_libgcrypt_progress_cb): Ditto.
* agent/command.c (cmd_getinfo): Ditto.
--

Libgcrypt 1.7 reached end-of-life more than a year ago.  Thus there is
no reason to keep backward support for it.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-09 12:03:19 +01:00
Ben Kibbey
f05d1772c4
gpg: Add canceled status message.
* common/status.h (STATUS_CANCELED_BY_USER): New.
* g10/passphrase.c (passphrase_to_dek): Send STATUS_CANCELED_BY_USER
instead of STATUS_MISSING_PASSPHRASE when canceled is set.
--

This is to prevent further pinentry tries when the pinentry is canceled
by the user during symmetric decryption.

Signed-off-by: Ben Kibbey <bjk@luxsci.net>
(cherry picked from commit 31e47dfad0f40e31e8b3113b933696e8e4105136)
2020-11-09 11:53:33 +01:00
Werner Koch
c373735e79
gpg: Do not print rejected digest algo notes with --quiet.
* g10/misc.c (print_digest_rejected_note): Do not print in quiet mode.
(print_sha1_keysig_rejected_note): Ditto.
--

GnuPG-bug-id: 4893
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit e08e1d62d089a154ec5d7c80cd58e8e3b18d2d6b)
2020-11-09 08:34:24 +01:00
Werner Koch
a4fa4b5d4b
speedo,w32: Install gpg-check-pattern and example profiles.
* doc/examples/vsnfd.prf: Rename to VS-NfD.prf.
* doc/examples/Automatic.prf: New.
* doc/Makefile.am (examples): Adjust.
* build-aux/speedo/w32/inst.nsi: Install gpg-check-pattern.exe and 3
example files.
* build-aux/speedo/w32/wixlib.wxs: Add new files.
--

Note that we renamed the existing example profile so that kleopatra
shows a nicer name.  In fact the gpg4win installer just copies of
theses file but it is better to maintain them here.

gpg-check-pattern.exe can no be installed because we meanwhile have a
regex lib which works also on Windows.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-04 18:15:37 +01:00
Werner Koch
d4089b04a5
g13: Include a now missing header file.
* g13/create.c: Include sysutuls.h
* g13/sh-dmcrypt.c: Ditto.
--

This is needed due to the recent switch from stat to gnupg_stat.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-04 16:32:16 +01:00
Werner Koch
1fbf085bc8
gpgconf: Make sure the homedir exists for --apply-profile.
* tools/gpgconf.c (main) <aApplyDefaults, aApplyProfile>: Create the
standard home directory.
--

This fixes a regression due to the fix for
GnuPG-bug-id: 4867
Before that change gpgsm implictly created the homedir while options
were collected.  It is important to have this so that a login script
can create config files for new users.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-04 16:26:27 +01:00
Werner Koch
6fe5c8c06e
common: Fix duplicate implementation of try_make_homedir.
* g10/openfile.c (try_make_homedir): Move core of the code to ...
* common/homedir.c (gnupg_maybe_make_homedir): new.
* sm/keydb.c (try_make_homedir): Implement using new function.

* common/homedir.c: Include i18n.h.
* po/POTFILES.in: Add common/homedir.c.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-04 16:25:57 +01:00