summaryrefslogtreecommitdiffstats
path: root/dirmngr/crlfetch.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Use gpgrt_b64* API of libgpg-error.NIIBE Yutaka2023-09-261-7/+9
| | | | | | | | | | | | | | | | | | | | | | * common/Makefile.am (common_sources): Remove b64enc.c and b64dec.c. (module_maint_tests): Remove t-b64. (t_b64_LDADD): Remove. * common/util.h: Remove the internal API. * common/ssh-utils.c (get_fingerprint): Use the gpgrt_b64 API. (ssh_public_key_in_base64): Likewise. * dirmngr/crlfetch.c (my_es_read, crl_close_reader): Likewise. * dirmngr/dirmngr-client.c (data_cb, do_lookup): Likewise. * dirmngr/misc.c (armor_data): Likewise. * g10/export.c (export_one_ssh_key, export_secret_ssh_key): Likewise. * tools/gpg-card.c (cmd_writecert): Likewise. * tools/mime-parser.c (parse_message_cb, mime_parser_release) (process_part_data): Likewise. * tools/wks-util.c (wks_armor_key): Likewise. -- GnuPG-bug-id: 6734 Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* dirmngr: Distinguish between "no crl" and "crl not trusted".Werner Koch2023-03-091-0/+3
| | | | | | | | | | | | | | | | | * dirmngr/crlcache.h (CRL_CACHE_NOTTRUSTED): New. * dirmngr/crlcache.c (cache_isvalid): Set this status. (crl_cache_cert_isvalid): Map it to GPG_ERR_NOT_TRUSTED. (crl_cache_reload_crl): Move diagnostic to ... * dirmngr/crlfetch.c (crl_fetch): here. * dirmngr/server.c (cmd_isvalid): Map it to GPG_ERR_NOT_TRUSTED. * dirmngr/validate.c (check_revocations): Handle new status. Improve diagnostics. * common/status.c (get_inv_recpsgnr_code): Map INV_CRL_OBJ. * common/audit.c (proc_type_verify): Ditto. -- This avoids repeated loading of CRLs in case of untrusted root certificates.
* agent,dirmngr,gpg,scd: Clean up for modern compiler.NIIBE Yutaka2022-09-141-2/+2
| | | | | | | | | | | | | | | | | | * agent/protect.c (agent_get_shadow_info_type): It's a write only variable, useful for debugging. * g10/key-check.c (key_check_all_keysigs): Likewise. * g10/keyedit.c (show_basic_key_info, menu_expire): Likewise. * scd/app-sc-hsm.c (read_ef_prkd): Likewise. * dirmngr/crlfetch.c (fetch_next_ksba_cert): Initialize the vars. * dirmngr/ks-action.c (ks_action_help): Remove unused variables. * dirmngr/server.c (make_keyserver_item): Likewise. * dirmngr/validate.c (check_cert_sig): Initialize the variable. * scd/app-p15.c (select_and_read_record): Likewise. * tests/gpgscm/scheme.c (scheme_init_new): A function with no args. -- Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* sm: Print diagnostic about CRL problems due to Tor mode.Werner Koch2022-04-111-12/+17
| | | | | | | | | | | | | | | | | | | | | | * dirmngr/crlfetch.c (crl_fetch, crl_fetch_default) (ca_cert_fetch, start_cert_fetch): Factor Tor error out to ... (no_crl_due_to_tor): new. Print status note. * dirmngr/ks-engine-ldap.c (ks_ldap_get) (ks_ldap_search, ks_ldap_put): Factor Tor error out to ... (no_ldap_due_to_tor): new. Print status note. * dirmngr/ocsp.c (do_ocsp_request): Print status note. * sm/misc.c (gpgsm_print_further_info): New. * sm/call-dirmngr.c (warning_and_note_printer): New. (isvalid_status_cb): Call it. (lookup_status_cb): Ditto. (run_command_status_cb): Ditto. * common/asshelp2.c (vprint_assuan_status): Strip a possible trailing LF. --
* agent,dirmngr,kbx,scd,tpm2d: Use gnupg_sleep.NIIBE Yutaka2021-10-051-1/+1
| | | | | | | | | | | | | | | | * agent/findkey.c (unprotect): Use gnupg_sleep. * agent/gpg-agent.c (handle_connections): Likewise. * dirmngr/crlfetch.c (handle_connections): Likewise. * kbx/keyboxd.c (handle_connections): Likewise. * tpm2d/tpm3daemon.c (handle_connections): Likewise. * scd/scdaemon.c (handle_connections): Likewise. * scd/command.c (cmd_lock): Likewise. * dirmngr/ldap-wrapper.c (ldap_reaper_thread): Likewise. (ldap_wrapper_wait_connections): Use gnupg_usleep. -- Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* dirmngr: Rewrite the LDAP wrapper toolWerner Koch2021-06-161-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/ldap-misc.c: New. * dirmngr/ldap-misc.h: New. * dirmngr/ks-engine-ldap.c: Include ldap-misc.h. (ldap_err_to_gpg_err, ldap_to_gpg_err): Move to ldap-misc.c. * dirmngr/ldap-wrapper.c (ldap_wrapper): Print list of args in debug mode. * dirmngr/server.c (lookup_cert_by_pattern): Handle GPG_ERR_NOT_FOUND the saqme as GPG_ERR_NO_DATA. * dirmngr/ldap.c (run_ldap_wrapper): Add args tls_mode and ntds. Remove arg url. Adjust for changes in dirmngr_ldap. (url_fetch_ldap): Remove args host and port. Parse the URL and use these values to call run_ldap_wrapper. (attr_fetch_ldap): Pass tls flags to run_ldap_wrapper. (rfc2254_need_escape, rfc2254_escape): New. (extfilt_need_escape, extfilt_escape): New. (parse_one_pattern): Rename to ... (make_one_filter): this. Change for new dirmngr_ldap calling convention. Make issuer DN searching partly work. (escape4url, make_url): Remove. (start_cert_fetch_ldap): Change for new dirmngr_ldap calling convention. * dirmngr/dirmngr_ldap.c: Major rewrite. * dirmngr/t-ldap-misc.c: New. * dirmngr/t-support.h (DIM, DIMof): New. * dirmngr/Makefile.am (dirmngr_ldap_SOURCES): Add ldap-misc.c (module_tests) [USE_LDAP]: Add t-ldap-misc. (t_ldap_parse_uri_SOURCES): Ditto. (t_ldap_misc_SOURCES): New. -- This rewrite allows to properly handle TLS and avoids some code duplication. Signed-off-by: Werner Koch <wk@gnupg.org> (cherry picked from commit 39815c023f0371dea01f7c51469b19c06ad18718)
* dirmngr: Minor cleanup for better readability.Werner Koch2020-10-051-1/+1
| | | | | | | | | | * dirmngr/ldap.c (start_default_fetch_ldap): Rename to start_cacert_fetch_ldap and remove arg attr. Instead use "cACertificate" directly. * dirmngr/crlfetch.c (ca_cert_fetch): Change the only caller. (start_cert_fetch_ldap): Rename arg for clarity. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Allow http URLs with "LOOKUP --url"Werner Koch2020-04-161-20/+103
| | | | | | | | * dirmngr/crlfetch.c (read_cert_via_http): New. (fetch_cert_by_url): Implement http scheme. -- Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Allow redirection from https to http for CRLsWerner Koch2018-04-251-5/+8
| | | | | | | | | | | | | | | | | * dirmngr/ks-engine.h (KS_HTTP_FETCH_NOCACHE): New flag. (KS_HTTP_FETCH_TRUST_CFG): Ditto. (KS_HTTP_FETCH_NO_CRL): Ditto. (KS_HTTP_FETCH_ALLOW_DOWNGRADE): Ditto. * dirmngr/ks-engine-http.c (ks_http_fetch): Replace args send_no_cache and extra_http_trust_flags by a new flags arg. Allow redirectiong from https to http it KS_HTTP_FETCH_ALLOW_DOWNGRADE is set. * dirmngr/loadswdb.c (fetch_file): Call with KS_HTTP_FETCH_NOCACHE. * dirmngr/ks-action.c (ks_action_get): Ditto. (ks_action_fetch): Ditto. * dirmngr/crlfetch.c (crl_fetch): Call with the appropriate flags. -- Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Implement CRL fetching via https.Werner Koch2018-04-251-113/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/http.h (HTTP_FLAG_TRUST_CFG): New flag. * dirmngr/http.c (http_register_cfg_ca): New. (http_session_new) [HTTP_USE_GNUTLS]: Implement new trust flag. * dirmngr/certcache.c (load_certs_from_dir): Call new function. (cert_cache_deinit): Ditto. * dirmngr/http-ntbtls.c (gnupg_http_tls_verify_cb): Ditto. * dirmngr/ks-engine-http.c (ks_http_fetch): Add new args 'send_no_cache' and 'extra_http_trust_flags'. Change all callers to provide the default value. * dirmngr/crlfetch.c (crl_fetch): Rewrite to make use of ks_http_fetch. -- The old code simply did not use https for downloading of CRLS. Instead it rewrote https to http under the assumption that the CRL service was also available without encryption. Note that a CRL is self-standing and thus it does not need to have extra authenticity as provided by TLS. These days we should not use any unencrypted content and thus this patch. Be aware that cacert.org give a https CRL DP but that currently redirects to to http! This is a downgrade attack which we detect and don't allow. The outcome is that it is right now not possible to use CAcert certificates. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: New option --disable-ipv6Werner Koch2017-04-031-0/+1
| | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.h (struct opt): Add field 'disable_ipv6'. * dirmngr/dirmngr.c (oDisableIPv6): New const. (opts): New option --disable-ipv6. (parse_rereadable_options): Set that option. * dirmngr/dns-stuff.c (opt_disable_ipv6): New var. (set_dns_disable_ipv6): New. (resolve_name_standard): Make use of it. * dirmngr/ks-engine-finger.c (ks_finger_fetch): Take care of OPT.DISABLE_IPV6. * dirmngr/ks-engine-hkp.c (map_host): Ditto. (send_request): Ditto. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ocsp.c (do_ocsp_request): Ditto. Signed-off-by: Werner Koch <wk@gnupg.org>
* indent: Reformat and extend some comments in dirmngr.Werner Koch2017-02-161-9/+10
| | | | | | -- Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: New option --no-use-tor and internal changes.Werner Koch2017-02-011-5/+5
| | | | | | | | | | | | | | | | | | | | | | * dirmngr/dns-stuff.c (disable_dns_tormode): New. * dirmngr/dirmngr.c (oNoUseTor): New const. (opts): New option --no-use-tor. (tor_mode): New var. (parse_rereadable_options): Change to use TOR_MODE. (dirmngr_use_tor): New. (set_tor_mode): Call disable_dns_tormode. Implement oNoUseTor. * dirmngr/dirmngr.h (opt): Remove field 'use_tor'. Replace all references by a call to dirmngr_use_tor(). * dirmngr/server.c (cmd_getinfo): Distinguish between default and enforced TOR_MODE. -- This patch replaces the global variable opt.use_tar by a function testing a file local mode flag. This patch prepares for a use-tor-if-available mode. GnuPG-bug-id: 2935 Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: New option --disable-ipv4.Werner Koch2017-01-241-1/+3
| | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (oDisableIPv4): New const. (opts): New option --disable-ipv4. (parse_rereadable_options): Set that option. * dirmngr/dirmngr.h (opt): New field 'disable_ipv4'. * dirmngr/dns-stuff.c (opt_disable_ipv4): bew var. (set_dns_disable_ipv4): New. (resolve_name_standard): Skip v4 addresses when OPT_DISABLE_IPV4 is set. * dirmngr/ks-engine-hkp.c (map_host): Ditto. (send_request): Pass HTTP_FLAG_IGNORE_IPv4 if opt.disable_v4 is set. * dirmngr/crlfetch.c (crl_fetch): Ditto. * dirmngr/ks-engine-finger.c (ks_finger_fetch): Ditto. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ocsp.c (do_ocsp_request): Ditto. Signed-off-by: Werner Koch <wk@gnupg.org>
* Change all http://www.gnu.org in license notices to https://Werner Koch2016-11-051-1/+1
| | | | --
* Change capitalization of TOR to Tor.Werner Koch2015-10-211-8/+8
| | | | --
* dirmngr: Add option --use-tor as a stub.Werner Koch2015-09-181-2/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.h (opt): Add field "use_tor". * dirmngr/dirmngr.c (oUseTor): New. (opts): Add --use-tor. (parse_rereadable_options): Set option. (main): Tell gpgconf about that option. * dirmngr/crlfetch.c (crl_fetch): Pass TOR flag to the http module and return an error if LDAP is used in TOR mode. (ca_cert_fetch): Return an error in TOR mode. (start_cert_fetch): Ditto. * dirmngr/ks-engine-finger.c (ks_finger_fetch): Pass TOR flag to the http module. * dirmngr/ks-engine-hkp.c (send_request): Ditto. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ks-engine-ldap.c (ks_ldap_get): Return an error in TOR mode. (ks_ldap_search): Ditto. (ks_ldap_put): Ditto. * dirmngr/ocsp.c (do_ocsp_request): Ditto. Also pass TOR flag to the http module. * dirmngr/server.c (option_handler): Add "honor-keyserver-url-used". (cmd_dns_cert): Return an error in TOR mode. (cmd_getinfo): Add subcommand "tor" * tools/gpgconf-comp.c (gc_options_dirmngr): Add TOR group. -- More work is required to actually make --use-tor useful. For now it returns an error for almost all network access but as soon as we have added the TOR feature to the http module some parts will start to work. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Add http proxy support for keyservers.Werner Koch2015-04-211-5/+1
| | | | | | | | | | | | | | | | * dirmngr/dirmngr.h (server_control_s): Add field http_proxy. * dirmngr/dirmngr.c (dirmngr_init_default_ctrl): Copy http_proxy value from OPT. (dirmngr_deinit_default_ctrl): New. (main): Call dirmngr_deinit_default_ctrl. * dirmngr/server.c (start_command_handler): Ditto. (option_handler): Add option "http-proxy". * dirmngr/crlfetch.c (crl_fetch): Take http_proxy from CTRL. * dirmngr/ocsp.c (do_ocsp_request): Ditto. * dirmngr/ks-engine-hkp.c (send_request): Add proxy support. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Remove un-needed check.Werner Koch2014-12-221-1/+4
| | | | | | | | | | | | | | | * dirmngr/crlfetch.c (crl_fetch): Check that URL is not NULL. -- Reported-by: Joshua Rogers <git@internot.info> "Remove un-needed check. If 'url' were not to be true, http_parse_uri(parse_uri(do_parse_uri))) would fail, leaving 'err' false." In addition I added an explicit check for the URL arg not beeing NULL. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Allow building without LDAP support.Werner Koch2014-10-171-5/+66
| | | | | | | | | | | | * configure.ac: Add option --disable-ldap. (USE_LDAP): New ac_define and am_conditional. * dirmngr/Makefile.am: Take care of USE_LDAP. * dirmngr/dirmngr.c (!USE_LDAP): Make all ldap options dummy options and do not call any ldap function. * dirmngr/server.c (!USE_LDAP): Do not call any ldap function. * dirmngr/crlfetch.c (!USE_LDAP): Ditto. Signed-off-by: Werner Koch <wk@gnupg.org>
* Switch to the libgpg-error provided estream.Werner Koch2014-08-261-1/+0
| | | | | | | | | | * configure.ac (NEED_GPG_ERROR_VERSION): Reguire 1.14. (GPGRT_ENABLE_ES_MACROS): Define. (estream_INIT): Remove. * m4/estream.m4: Remove. * common/estream-printf.c, common/estream-printf.h: Remove. * common/estream.c, common/estream.h: Remove. * common/init.c (_init_common_subsystems): Call gpgrt initialization.
* Change all quotes in strings and comments to the new GNU standard.Werner Koch2012-06-051-3/+3
| | | | | | | | | | | | | | | | | | | The asymmetric quotes used by GNU in the past (`...') don't render nicely on modern systems. We now use two \x27 characters ('...'). The proper solution would be to use the correct Unicode symmetric quotes here. However this has the disadvantage that the system requires Unicode support. We don't want that today. If Unicode is available a generated po file can be used to output proper quotes. A simple sed script like the one used for en@quote is sufficient to change them. The changes have been done by applying sed -i "s/\`\([^'\`]*\)'/'\1'/g" to most files and fixing obvious problems by hand. The msgid strings in the po files were fixed with a similar command.
* Port to npth.Marcus Brinkmann2012-01-251-2/+2
| | | | | | | | | | | | | | | | | | | | | * configure.ac: Don't check for PTH but for NPTH. (AH_BOTTOM): Remove PTH_SYSCALL_SOFT. (have_pth): Rename to ... (have_npth): ... this. (USE_GNU_NPTH): Rename to ... (USE_GNU_PTH): ... this. * m4/npth.m4: New file. * agent/Makefile.am, agent/cache.c, agent/call-pinentry.c, agent/call-scd.c, agent/findkey.c, agent/gpg-agent.c, agent/trustlist.c, common/Makefile.am, common/estream.c, common/exechelp-posix.c, common/exechelp-w32.c, common/exechelp-w32ce.c, common/http.c, common/init.c, common/sysutils.c, dirmngr/Makefile.am, dirmngr/crlfetch.c, dirmngr/dirmngr.c, dirmngr/dirmngr_ldap.c, dirmngr/ldap-wrapper-ce.c, dirmngr/ldap-wrapper.c, dirmngr/ldap.c, g13/Makefile.am, g13/call-gpg.c, g13/g13.c, g13/runner.c, scd/Makefile.am, scd/apdu.c, scd/app.c, scd/ccid-driver.c, scd/command.c, scd/scdaemon.c, tools/Makefile.am: Port to npth.
* Nuked almost all trailing white space.post-nuke-of-trailing-wsWerner Koch2011-02-041-11/+11
| | | | | | | | We better do this once and for all instead of cluttering all future commits with diffs of trailing white spaces. In the majority of cases blank or single lines are affected and thus this change won't disturb a git blame too much. For future commits the pre-commit scripts checks that this won't happen again.
* Initial code checking for backup - not yet working.Werner Koch2011-01-101-2/+2
|
* More work on the dirmngr. It now builds for W32 and W32CE and quickWerner Koch2010-08-061-1/+3
| | | | | tests show that it works on W32.
* Typo fixWerner Koch2010-08-051-1/+1
|
* Some work on porting dirmngr (unfinished)Werner Koch2010-07-161-2/+1
| | | | | Ported gpgtar to W32.
* Merged Dirmngr with GnuPG.Werner Koch2010-06-091-0/+479
A few code changes to support dirmngr.
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-30 16:06:44 +0100