1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-22 10:19:57 +01:00

8565 Commits

Author SHA1 Message Date
Werner Koch
fb6ff7ead7
scd:openpgp: Let the genkey function also accept a full keyref.
* scd/app-openpgp.c (send_key_attr): Use log_assert.
(do_genkey): Allow prefix.
--

It is more uniform to always use full keyref (e.g. "OPENPGP.1")
instead of just the key number.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-10 00:33:51 +01:00
Werner Koch
332a72f734
common: Extend the new get_keyalgo_string function
* common/openpgp-oid.c (openpgp_oid_or_name_to_curve): New.
(get_keyalgo_string): Use it.
--

We do not always have an OID, so except the name or the alias of the
curve as well.  This creates a second entry mapping to the same name
but that does not matter.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-10 00:31:07 +01:00
Werner Koch
d1c518cdc9
common: Remove duplicated call to a function.
* common/openpgp-oid.c (openpgp_oid_to_str): Remove duplicated call.
--

The removed function was already called.  No memleak etc, though.

Fixes-commit: 4a1558d0c7190cf13d35385e47291a7aa121be3e
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-09 23:22:20 +01:00
Werner Koch
3a1fa13eed
common: New function get_keyalgo_string.
* common/openpgp-oid.c (struct keyalgo_string_s): New.
(keyalgo_strings): New.
(keyalgo_strings_size, keyalgo_strings_used): New.
(get_keyalgo_string): New.
--

This function is intended as a more general version of gpg's
pubkey_string function.  It has the advantage to avoid mallocs and
uses static table of algorithm strings instead.  There should be only
a few dozen of such strings (if at all) and thus all those allocations
we do internally in gpg's pubkey_string and the static buffers all
over the place are not too nice.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-09 21:26:35 +01:00
Werner Koch
49c891a9bf
common: Add OpenPGP<->Gcrypt pubkey id mapping functions.
* g10/misc.c (map_pk_gcry_to_openpgp): Move to ...
* common/openpgp-oid.c (map_gcry_pk_to_openpgp): here and rename.
Change all 4 callers.
(map_openpgp_pk_to_gcry): New.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-09 14:04:18 +01:00
Werner Koch
9df9996b41
card: Support brainpool curves in the generate command.
* tools/gpg-card.c (cmd_generate): Add brainpool curves and dummy name
"help".

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-09 14:02:59 +01:00
Werner Koch
2e5ab34496
sm: New option --issuer-der for the listkey commands.
* sm/server.c (do_listkeys): Implement new option.
--

This option can be used by clients who can only provide a DER encoded
form of the issuer.  For example in PKCS#11 providers.

Testing:

Put the DER encoded issuer DN into a file, say issuer.der.
The run
   gpg-connect-agent -E -- gpgsm --server
   > /definqfile ISSUER_DER issuer.der
   > list-keys --issuer-der 01020304

and if the local keyring has a certifictate with that issuer and a s/n
of 0x01020304 that certificate will be listed.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-03 14:54:23 +01:00
Werner Koch
8bbc4f0d2c
card: Add new OpenPGP card vendor.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-28 15:49:18 +01:00
Werner Koch
d8973975e7
dirmngr: Fix building w/o LDAP support
* dirmngr/Makefile.am: Conditionally build dirmngr_ldap.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-21 11:18:50 +01:00
Werner Koch
bf931299e8
gpg: Fix printing of keyring name (regression in master)
* g10/keydb.c (keydb_get_resource_name):
--

Fixes-commit: aba82684fe14289cf62b4694bc398f3a274b4762
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-21 11:17:18 +01:00
Werner Koch
da2ccfdbeb
card: Add new OpenPGP card vendor
--
2020-01-21 11:15:47 +01:00
Werner Koch
cff5facc7f
build: Require libgpg-error 1.37
--
2020-01-21 08:56:34 +01:00
Werner Koch
e0d9181ad1
tools: Let watchgnupg determine the socket name via gpgconf.
* tools/watchgnupg.c: Include sys/wait.h.
(GNUPG_DEF_COPYRIGHT_LINE): Add a default value for standalone
building.
(get_logname): New.
(main): Use a default socket name and add option --homedir.
--

This is quite convenient and saves a lot of typing or shell alias
definitions.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-20 16:50:56 +01:00
Werner Koch
7f12fb55f9
gpgconf,w32: Print a warning for a suspicious homedir.
* tools/gpgconf.c (list_dirs): Check whether the homedir has been
taken from the registry.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-17 14:24:24 +01:00
NIIBE Yutaka
8748c50bfa gpg: Prefer card key on use in multiple subkeys situation.
* g10/call-agent.c (keyinfo_status_cb): Parse more fields.
(agent_probe_secret_key): Use KEYINFO and returns bigger value
representing the preference.
* g10/getkey.c (finish_lookup): For subkeys, select one
by using value of agent_probe_secret_key.

--

GnuPG-bug-id: 3416
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-01-17 16:09:01 +09:00
NIIBE Yutaka
853d5b7677 gpg: Prepare enhancement of agent_probe_secret_key.
* g10/call-agent.c (agent_probe_secret_key): Change semantics of
return value.
* g10/call-agent.h (agent_probe_secret_key): Change comment.
* g10/delkey.c (do_delete_key): Follow the change.
* g10/getkey.c (get_seckey, parse_def_secret_key): Likewise.
(finish_lookup, have_secret_key_with_kid): Likewise.
* g10/gpgv.c (agent_probe_secret_key): Likewise.
* g10/keyedit.c (keyedit_menu, quick_find_keyblock): Likewise.
(show_key_with_all_names_colon): Likewise.
* g10/revoke.c (gen_desig_revoke, gen_revoke): Likewise
* g10/test-stubs.c (agent_probe_secret_key): Likewise.

--

GnuPG-bug-id: 3416
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-01-17 16:09:01 +09:00
Werner Koch
bd85f9232a
card: Allow switching of cards and applications.
* tools/card-call-scd.c (struct card_cardlist_parm_s): Add field
with_apps.
(card_cardlist_cb): Handle the new with_apps flag.
(scd_switchcard): New.
(scd_switchapp): New.
(scd_applist): New.
(scd_serialno): Pass --all also in --demand mode.

* tools/gpg-card.c (cmd_list): Simplify switching of cards.  Add
switching of alls.  Print a list of apps per card.
--

Note that the output format of "list --card" slightly changes: The
current card is indicated with an asterisk.  That should not harm any
robust parsers which might already be in use.  It is anyway a
development version.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-16 21:28:45 +01:00
Werner Koch
718555874e
scd: New commands SWITCHCARD and SWITCHAPP.
* scd/app.c: Include membuf.h.
(app_switch_current_card): New.
(send_card_and_app_list): Factor code out to ...
(send_serialno_and_app_status): new.
(app_send_card_list): New.
(app_send_active_apps): New.
(app_switch_active_app): New.
* scd/command.c (cmd_switchcard): New.
(cmd_switchapp): New.
(register_commands): Register new commands.
(cmd_getinfo): New sub-commands "active_apps" and "all_active_apps".
--

These new commands allow to switch between known cards and are in
particular useful for the gpg-card tool.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-16 19:42:16 +01:00
Werner Koch
dd61164410
scd:piv: Remove debug code from a recent commit.
* scd/app-piv.c (ask_and_prepare_chv): here.
--

The test code from the last PIV change was accidently kept enabled.
Fixes-commit: 2dd6b4b998dd6e156e2e75ede0f40fb768c69f40

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-16 19:38:54 +01:00
Werner Koch
3ccad75d76
gpg: Print better debug info in case of broken sig subpackets.
* g10/parse-packet.c (enum_sig_subpkt): Print a hexdump.
--

A test key for this is 02DF08F5FD356BF27F5F7B838921B5DCCD15A883 .
A key listing in verbose mode will now yield

  gpg: DBG: buffer shorter than subpacket (10/9/25);\
       dump: 19100d87e54973647cff

The error here is that the packet length is 0x19 but what follows is a
long keyid (subpacket 16) which is shorter.  The debug output might be
helpful to better analyze broken signatures.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-16 14:44:28 +01:00
NIIBE Yutaka
8edd4b8b8c gpg: Use "SCD KEYINFO" to get available card keys.
* g10/skclist.c (enum_secret_keys): Don't use agent_scd_cardlist and
agent_scd_serialno, but agent_scd_keyinfo.

--

When there are multiple cards/tokens, this change can avoid switching
card of foreground access.

GnuPG-bug-id: 4784
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-01-16 13:05:27 +09:00
NIIBE Yutaka
8240a70c31 gpg: Add agent_scd_keyinfo to retrieve available card keys.
* g10/call-agent.c (card_keyinfo_cb, agent_scd_free_keyinfo)
(agent_scd_keyinfo): New.
* g10/call-agent.h: Define new functions.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-01-16 13:01:46 +09:00
NIIBE Yutaka
1aa2a0a46d gpg: default-key: Simply don't limit by capability.
* g10/getkey.c (parse_def_secret_key): Remove the check.

--

GnuPG-bug-id: 4810
Fixes-commit: e573e6188dada4d70f6897aa2fda3c3af8c50441
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-01-16 10:28:15 +09:00
NIIBE Yutaka
9287f9e87b gpg: Cert only key should be usable with --default-key.
* g10/getkey.c (parse_def_secret_key): Allow cert-only key.

--

GnuPG-bug-id: 4810
Fixes-commit: e573e6188dada4d70f6897aa2fda3c3af8c50441
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-01-15 14:27:36 +09:00
Werner Koch
2dd6b4b998
scd: Make the PIN cache robust against wrongdoing of gpg-agent.
* scd/app-openpgp.c (struct app_local_s): New field pincache.
(cache_pin): Set it.
(pin_from_cache): Consult it.
* scd/app-piv.c (struct app_local_s): New field pincache.
(cache_pin): Set it.
(pin_from_cache): Consult it.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-13 18:24:01 +01:00
Werner Koch
60502c3606
scd:piv: Implement PIN cache.
* scd/command.c (pincache_put): Add arg pinlen and change all callers
to provide it.
* scd/app-piv.c (cache_pin): New.
(pin_from_cache): New.
(ask_and_prepare_chv): Add args no_cache and r_unpaddedpinlen.  Take
PIN from the cache.  Return the unpadded length.
(verify_chv): Add arg ctrl.  Cache the PIN.
(do_change_chv): Clear PIN cache.
--

The PIV pins are padded but we want to store the unpadded PIN.  Thus
the changes to the function.

Code has has been tested by commenting the no_cache parameter because
we the current test certificate was created for PIV.9C which requires
a verification for each use.  More testing is required.

GnuPG-bug-id: 4791
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-13 17:53:49 +01:00
Werner Koch
2e86cca7f4
agent: Avoid multiple calls to scd for KEYINFO.
* agent/command.c (struct server_local_s): Add last_card_keyinfo.
(eventcounter): Add maybe_key_change.
(cmd_genkey, cmd_scd, cmd_import_key, cmd_delete_key): Bump new
counter.
(cmd_keyinfo): Cache the keyinfo from the card.
(start_command_handler): Release the cache.
--

This cache speeds up processing of commands like "gpg -K" because
scdaemon does not need to be asked for each key as long as nothing
changed with the card.

We should have a better notification service from scdaemon to make
sure that we get only the relevant events.  What we do right now is a
bit course but sufficient.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-13 16:27:12 +01:00
Werner Koch
aaef0fc3a7
agent: Replace free by xfree in recently added code.
* agent/call-scd.c (agent_card_free_keyinfo): Use xfree.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-13 15:22:50 +01:00
Werner Koch
14aa797bb8
gpg,sm: Avoid useless ASFW diagnostic in loopback mode.
* common/sysutils.c (inhibit_set_foregound_window): New var.
(gnupg_inhibit_set_foregound_window): New func.
(gnupg_allow_set_foregound_window): Use var.
* g10/gpg.c (main): Inhibit in loopback mode.
* sm/gpgsm.c (main): Ditto.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-13 15:20:49 +01:00
Werner Koch
2b843be5ac
scd: Fix memory leak in command READKEY.
* scd/command.c (cmd_readcert): Replace xstrdup by xtrystrdup.
(cmd_readkey): Ditto.  Fix memory leak.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-13 12:18:53 +01:00
Werner Koch
0e48aa0849
scd: Make SERIALNO --all work correctly and use it.
* scd/app.c (maybe_switch_app): Factor reselect code out to ...
(run_reselect): new.
(app_write_learn_status): Tweak diagnostics.
(app_do_with_keygrip): Run reselect if a card has more than one
switchable application.

* agent/call-scd.c (agent_card_serialno): Ditto.
* tools/card-call-scd.c (start_agent): Use option --all with SERIALNO.
(scd_serialno): Ditto.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-13 12:12:57 +01:00
NIIBE Yutaka
15028627a1 agent: handle SSH operation by KEYGRIP.
* agent/command-ssh.c (card_key_available): Supply KEYINFO argument.
Call agent_card_readkey by KEYGRIP of KEYINFO.
Don't use $AUTHKEYID, but IDSTR of KEYINFO.
(ssh_handler_request_identities): Follow the change of
card_key_available.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-01-13 16:47:23 +09:00
NIIBE Yutaka
c31266716d agent: Extend agent_card_getattr with KEYGRIP.
* agent/agent.h (struct card_key_info_s): KEYGRIP null terminated.
(agent_card_getattr): Add KEYGRIP argument.
* agent/call-scd.c (agent_card_getattr): Handle KEYGRIP argument.
(card_keyinfo_cb): Make KEYGRIP null terminated.
* agent/command.c (cmd_readkey): Follow the change.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-01-13 16:43:53 +09:00
NIIBE Yutaka
0cfded4bb1 scd: Implement direct access by KEYGRIP for GETATTR and READKEY.
* scd/app-openpgp.c (do_readkey): Handle KEYGRIP access.
* scd/command.c (do_readkey): New.
(cmd_readkey): Use do_readkey supporting KEYGRIP access.
(cmd_getattr): Supporting KEYGRIP access.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-01-10 15:58:49 +09:00
Werner Koch
63bda3aad8
scd:openpgp: Implement PIN cache.
* scd/app-openpgp.c (wipe_and_free, wipe_and_free_string): Use them
everywere where we do a wipememory followed by a free.
(pin2hash_if_kdf): Change interface.  The input PIN is not anymore
changed.  Further there are no more assumptions about the length of
the provided buffer.
(cache_pin): Restructure.
(chvno_to_keyref): New.
(pin_from_cache): New.
(verify_a_chv): Add arg CTRL.  Adjust for changed pin2hash_if_kdf.
Chache and retrieve the PIN here.
(verify_chv2): Do not cache the PIN here.
(build_enter_admin_pin_prompt): Add arg 'r_remaining'.
(verify_chv3): Adjust for changed pin2hash_if_kdf.  Implement the PIN
cache.
(do_change_pin): Clear the PIN cache.  Do not change the PIN here.
Lots of adjustments to cope with the chnaged pin2hash_if_kdf.
(do_sign): Do not cache the PIN here.
--

Note that some of the changes are required because we can't rely that
the PIN is always cached in secure memory.  Thus it is better to do an
explicit wipe.

Testing the PIN cache can currently only be done my modifying the
code to do a verification for each operation.  Only some basic testing
has been done.  Clearing the PIN cache is also not fully
implemented.  With the forthcoming changes to app-piv we should be
enter able to test the PIN cache.

Missing stuff:
 - The agent should be able to selectively clear the cache on a per
   slot base.
 - We should replace AESWRAP by OCB.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-09 12:14:05 +01:00
Werner Koch
ce5a7fb72b
scd: Use a scdaemon internal key to protect the PIN cache IPC.
* agent/call-scd.c (handle_pincache_put): Do not decrypt.
(handle_pincache_get): New.
(inq_needpin): Call it.
* scd/command.c (set_key_for_pincache): New.
(pincache_put): Restructure and set key.
(pincache_get): Ditto.
--

This change does away with encrypting and decrypting the cached PIN in
the agent.  There is no need for this we can simply cache the
cryptogram and let scdaemon decrypt after retrieving it from the
agent.  This way we do not need to share a key between gpg-agent and
scdaemon and further the cached content is invalid after the scdaemon
process has been replaced.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-09 12:00:50 +01:00
NIIBE Yutaka
57b8ed61ab agent: SSH: SCD KEYINFO to list available keys.
* agent/agent.h (agent_card_cardlist): Remove.
(agent_card_keyinfo): Add CAP argument.
* agent/call-scd.c (card_cardlist_cb): Remove.
(agent_card_cardlist): Remove.
(agent_card_keyinfo): Support CAP constraint.
* agent/command-ssh.c (card_key_list): Remove.
(ssh_handler_request_identities): Use SCD KEYINFO command.
* agent/command.c (cmd_keyinfo): Follow the API change.
* agent/divert-scd.c (ask_for_card): Likewise.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-01-09 11:55:42 +09:00
Werner Koch
fbf97a7856
scd: First changes to implement a PIN cache.
* scd/command.c (pincache_put): New.  Uses a dummy key for now.
(pincache_get): New.
* scd/app.c (select_application): Flush the PIN cache.
(scd_update_reader_status_file): Ditto.
(maybe_switch_app): Call the new prep_reselect function.
(app_write_learn_status): Ditto.
* scd/app-openpgp.c (cache_pin): New helper to cache a PIN.
(verify_chv2): Call it.
(verify_chv3): Call it.
(clear_chv_status): Call it.
(do_change_pin): Call it.

* scd/app-common.h (struct app_ctx_s): Add function 'prep_select'.
* scd/app-openpgp.c (do_prep_reselect): New stub function.
(app_select_openpgp): Set new stub function.
* scd/app-piv.c (do_prep_reselect): New stub function.
(app_select_piv): Set new stub function.

* scd/app-common.h (struct app_ctx_s): Add parameter ctrl to setattr,
sign, auth, decipher, and check_pin.  Change all implementations and
callers to pass such a parameter.
--

This is work in progress.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-07 18:45:33 +01:00
Werner Koch
d5c00354bb
agent: First changes to support a PIN cache for scdaemon.
* agent/agent.h (CACHE_MODE_PIN): New.
* agent/cache.c (housekeeping): Special handling of new new mode.
(agent_flush_cache): Ditto.  Add arg 'pincache_only' and change
caller.
(agent_put_cache): Support new mode.
(agent_get_cache): Ditto.
* agent/call-scd.c (wait_child_thread): Flush the entire PIN cache.
(start_scd): Ditto.
(agent_card_killscd): Ditto.
(handle_pincache_put): New.  Uses a dummy encryption key for now.
(pincache_put_cb): New.
(inq_needpin): Prepare for PINCACHE_GET inquiry.
(learn_status_cb): Handle the PINENTRY_PUT status line.
(get_serialno_cb): Ditto
(agent_card_pksign): Ditto.
(padding_info_cb): Ditto.
(agent_card_readcert): Ditto.
(agent_card_readkey): Ditto.
(agent_card_writekey): Ditto.
(card_getattr_cb): Ditto.
(card_cardlist_cb): Ditto.
(card_keyinfo_cb): Ditto.
(pass_status_thru): Ditto.
--

Take care: This is not finished.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-07 18:36:18 +01:00
Werner Koch
41a8824436
kbx: Make sure the tables are joined in a select.
* kbx/backend-sqlite.c (run_select_statement): Join the tables.
--

For whatever reasons that part was missing or got lost before
committing.
2020-01-07 17:12:25 +01:00
Werner Koch
c0625c15c1
scd: Minor fix for readibility.
* scd/command.c (open_card_with_request): Use NULL instead of
APPTYPE_NULL.
--

Using the enum is wrong because a string is expected.  However it did
harm anything because the value of the enum is 0 and thus equivalent
to NULL.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-03 11:43:55 +01:00
Werner Koch
f4da1455c7
kbx: Initial support for an SQLite backend
* kbx/backend-sqlite.c: New.
* kbx/Makefile.am (keyboxd_SOURCES): Add it.
(keyboxd_CFLAGS, keyboxd_LDADD): Add SQLite flags.
* kbx/backend.h (enum database_types): Add DB_TYPE_SQLITE.
(be_sqlite_local_t): New typedef.
(struct db_request_part_s): Add field besqlite.
* kbx/backend-support.c (strdbtype): Add string for DB_TYPE_SQLITE.
(be_generic_release_backend): Support SQLite.
(be_release_request): Ditto.
(be_find_request_part): Ditto.
(is_x509_blob): Rename to ...
(be_is_x509_blob): this and make global.
* kbx/frontend.c (kbxd_set_database): Detect ".db" suffix and use that
for SQLite.
(kbxd_search): Support SQLite
(kbxd_store): Ditto.
(kbxd_delete): Ditto.
* kbx/frontend.h (kbxd_store_modes): Move to ...
* kbx/keyboxd.h (enum kbxd_store_modes): here.
* kbx/keyboxd.c (main): USe pubring.db for now.  This is a temporary
hack.

* kbx/backend-kbx.c (be_kbx_delete): Remove unused var cert.
--

Take care: This is not finished and in particular filling the database
takes quite long.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-01-02 14:21:12 +01:00
Werner Koch
a230bac339
Update wk's signing key
--
The expiration time of that smartcard based key has been prolonged
by 2 years.
2020-01-01 19:05:16 +01:00
Werner Koch
59d49e4a0a
gpg: Fix output of --with-secret if a pattern is given.
* g10/keylist.c (list_one): Probe for a secret key in --with-secret
mode.
--

In contrast to list_all(), list_one() did not tests for a secret key
and took MARK_TRUSTED verbatim as an indication for "secret key
available".

GnuPG-bug: 4061
Signed-off-by: Werner Koch <wk@gnupg.org>
2019-12-23 12:40:44 +01:00
Werner Koch
cc531cc210
doc: Typ fix in comment
--
2019-12-23 12:40:43 +01:00
Werner Koch
8a556c23a2
kbx: Change keyboxd to work only with one database.
* kbx/frontend.c (the_database): New var.
(db_desc_t): Remove.
(kbxd_add_resource): Renamed to ...
(kbxd_set_database): this.  Simplify.
(kbxd_search): Change to use only one database.
(kbxd_store): Ditto.
(kbxd_delete): Ditto.
--

The original implementation was way to complicated and would have only
brought back the problems deciding which database to use for each key.
The new scheme used one configured database and only that.  That
database needs to be set right at the start.

Signed-off-by: Werner Koch <wk@gnupg.org>
2019-12-23 12:40:43 +01:00
NIIBE Yutaka
b2a2df174b scd: Enhance KEYINFO command to limit listing with capability.
* scd/app-common.h: Add CAPABILITY argument to the WITH_KEYGRIP.
(app_do_with_keygrip): Likewise.
* scd/app-openpgp.c (send_keyinfo_if_available): New.
(do_with_keygrip): Support listing with CAPABILITY.
* scd/app-piv.c (do_with_keygrip): Likewise.
* scd/app.c (maybe_switch_app): Supply the argument.
(app_do_with_keygrip): Add CAPABILITY argument.
* scd/command.c (cmd_pksign, cmd_pkauth): Supply the argument.
(cmd_pkdecrypt): Likewise.
(cmd_keyinfo): Support listing with CAPABILITY.

--

GnuPG-bug-id: 4784
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2019-12-19 17:30:59 +09:00
Werner Koch
70cb02c059
Include release information from 2.2.17 to 2.2.19
--
2019-12-09 16:53:44 +01:00
Werner Koch
d246f317c0
sm: Add special case for expired intermediate certificates.
* sm/gpgsm.h (struct server_control_s): Add field 'current_time'.
* sm/certchain.c (find_up_search_by_keyid): Detect a corner case.
Also simplify by using ref-ed cert objects in place of an anyfound
var.
--

See the code for a description of the problem. Tested using the certs
from the bug report and various command lines

  gpgsm --faked-system-time=XXXX --disable-crl-checks \
         -ea -v --debug x509  -r 0x95599828

with XXXX being 20190230T000000 -> target cert too young
with XXXX being 20190330T000000 -> okay
with XXXX being 20190830T000000 -> okay, using the long term cert
with XXXX being 20220330T000000 -> target cert expired

The --disabled-crl-checks option is required because in our a simple
test setting dirmngr does not know about the faked time.

GnuPG-bug-id: 4696
Signed-off-by: Werner Koch <wk@gnupg.org>
2019-12-06 20:25:56 +01:00
Werner Koch
8a6ecc6ff5
dirmngr: Tell gpg about WKD looks resulting from a cache.
* dirmngr/server.c (proc_wkd_get): Print new NOTE status
"wkd_cached_result".
* g10/call-dirmngr.c (ks_status_cb): Detect this and print a not ein
verbose mode.
--

This little patch is helpful to see why a WKD change still does not
work after it has been updated on the server.

Signed-off-by: Werner Koch <wk@gnupg.org>
2019-12-06 20:04:56 +01:00