* keyserver.c (parse_keyserver_uri, add_canonical_option): Always append
[gnupg.git] / g10 / keyserver.c
1 /* keyserver.c - generic keyserver code
2  * Copyright (C) 2001, 2002, 2003, 2004, 2005 Free Software Foundation, Inc.
3  *
4  * This file is part of GnuPG.
5  *
6  * GnuPG is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 2 of the License, or
9  * (at your option) any later version.
10  *
11  * GnuPG is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, write to the Free Software
18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
19  * USA.
20  */
21
22 #include <config.h>
23 #include <ctype.h>
24 #include <stdio.h>
25 #include <string.h>
26 #include <stdlib.h>
27 #include <assert.h>
28 #ifdef HAVE_LIBCURL
29 #include <curl/curl.h>
30 #endif
31 #include "filter.h"
32 #include "keydb.h"
33 #include "status.h"
34 #include "exec.h"
35 #include "main.h"
36 #include "i18n.h"
37 #include "iobuf.h"
38 #include "memory.h"
39 #include "ttyio.h"
40 #include "options.h"
41 #include "packet.h"
42 #include "trustdb.h"
43 #include "keyserver-internal.h"
44 #include "util.h"
45
46 #define GPGKEYS_PREFIX "gpgkeys_"
47
48 #if defined(HAVE_LIBCURL) || defined(FAKE_CURL)
49 #define GPGKEYS_CURL "gpgkeys_curl"
50 #endif
51
52 #ifdef GPGKEYS_CURL
53 #define GPGKEYS_PREFIX_LEN (strlen(GPGKEYS_PREFIX)+strlen(GPGKEYS_CURL))
54 #else
55 #define GPGKEYS_PREFIX_LEN (strlen(GPGKEYS_PREFIX))
56 #endif
57
58 struct keyrec
59 {
60   KEYDB_SEARCH_DESC desc;
61   u32 createtime,expiretime;
62   int size,flags;
63   byte type;
64   IOBUF uidbuf;
65   unsigned int lines;
66 };
67
68 enum ks_action {KS_UNKNOWN=0,KS_GET,KS_GETNAME,KS_SEND,KS_SEARCH};
69
70 /* Tell remote processes about these options */
71 #define REMOTE_TELL (KEYSERVER_INCLUDE_REVOKED|KEYSERVER_INCLUDE_SUBKEYS|KEYSERVER_TRY_DNS_SRV)
72
73 static struct parse_options keyserver_opts[]=
74   {
75     {"max-cert-size",0,NULL,NULL},
76     {"include-revoked",KEYSERVER_INCLUDE_REVOKED,NULL,
77      N_("include revoked keys in search results")},
78     {"include-subkeys",KEYSERVER_INCLUDE_SUBKEYS,NULL,
79      N_("include subkeys when searching by key ID")},
80     /* not a real option - just for the help message */
81     {"use-temp-files",0,NULL,
82      N_("use temporary files to pass data to keyserver helpers")},
83     {"keep-temp-files",KEYSERVER_KEEP_TEMP_FILES,NULL,
84      N_("do not delete temporary files after using them")},
85     {"refresh-add-fake-v3-keyids",KEYSERVER_ADD_FAKE_V3,NULL,
86      NULL},
87     {"auto-key-retrieve",KEYSERVER_AUTO_KEY_RETRIEVE,NULL,
88      N_("automatically retrieve keys when verifying signatures")},
89     {"try-dns-srv",KEYSERVER_TRY_DNS_SRV,NULL,
90      NULL},
91     {"honor-keyserver-url",KEYSERVER_HONOR_KEYSERVER_URL,NULL,
92      N_("honor the preferred keyserver URL set on the key")},
93     {"honor-pka-record",KEYSERVER_HONOR_PKA_RECORD,NULL,
94      N_("honor the PKA record set on a key when retrieving keys")},
95     {NULL,0,NULL,NULL}
96   };
97
98 static int keyserver_work(enum ks_action action,STRLIST list,
99                           KEYDB_SEARCH_DESC *desc,int count,
100                           struct keyserver_spec *keyserver);
101
102 /* Reasonable guess */
103 #define DEFAULT_MAX_CERT_SIZE 16384
104
105 static size_t max_cert_size=DEFAULT_MAX_CERT_SIZE;
106
107 static void
108 add_canonical_option(char *option,STRLIST *list)
109 {
110   char *arg=argsplit(option);
111
112   if(arg)
113     {
114       char *joined;
115
116       joined=xmalloc(strlen(option)+1+strlen(arg)+1);
117       /* Make a canonical name=value form with no spaces */
118       strcpy(joined,option);
119       strcat(joined,"=");
120       strcat(joined,arg);
121       append_to_strlist(list,joined);
122       xfree(joined);
123     }
124   else
125     append_to_strlist(list,option);
126 }
127
128 int
129 parse_keyserver_options(char *options)
130 {
131   int ret=1;
132   char *tok;
133   char *max_cert;
134
135   keyserver_opts[0].value=&max_cert;
136
137   while((tok=optsep(&options)))
138     {
139       if(tok[0]=='\0')
140         continue;
141
142       /* For backwards compatibility.  1.2.x used honor-http-proxy and
143          there are a good number of documents published that recommend
144          it. */
145       if(ascii_strcasecmp(tok,"honor-http-proxy")==0)
146         tok="http-proxy";
147       else if(ascii_strcasecmp(tok,"no-honor-http-proxy")==0)
148         tok="no-http-proxy";
149
150       /* We accept quite a few possible options here - some options to
151          handle specially, the keyserver_options list, and import and
152          export options that pertain to keyserver operations.  Note
153          that you must use strncasecmp here as there might be an
154          =argument attached which will foil the use of strcasecmp. */
155
156 #ifdef EXEC_TEMPFILE_ONLY
157       if(ascii_strncasecmp(tok,"use-temp-files",14)==0 ||
158               ascii_strncasecmp(tok,"no-use-temp-files",17)==0)
159         log_info(_("WARNING: keyserver option `%s' is not used"
160                    " on this platform\n"),tok);
161 #else
162       if(ascii_strncasecmp(tok,"use-temp-files",14)==0)
163         opt.keyserver_options.options|=KEYSERVER_USE_TEMP_FILES;
164       else if(ascii_strncasecmp(tok,"no-use-temp-files",17)==0)
165         opt.keyserver_options.options&=~KEYSERVER_USE_TEMP_FILES;
166 #endif
167       else if(!parse_options(tok,&opt.keyserver_options.options,
168                              keyserver_opts,0)
169          && !parse_import_options(tok,
170                                   &opt.keyserver_options.import_options,0)
171          && !parse_export_options(tok,
172                                   &opt.keyserver_options.export_options,0))
173         {
174           /* All of the standard options have failed, so the option is
175              destined for a keyserver plugin. */
176           add_canonical_option(tok,&opt.keyserver_options.other);
177         }
178     }
179
180   if(max_cert)
181     {
182       max_cert_size=strtoul(max_cert,(char **)NULL,10);
183
184       if(max_cert_size==0)
185         max_cert_size=DEFAULT_MAX_CERT_SIZE;
186     }
187
188   return ret;
189 }
190
191 void
192 free_keyserver_spec(struct keyserver_spec *keyserver)
193 {
194   xfree(keyserver->uri);
195   xfree(keyserver->scheme);
196   xfree(keyserver->auth);
197   xfree(keyserver->host);
198   xfree(keyserver->port);
199   xfree(keyserver->path);
200   xfree(keyserver->opaque);
201   free_strlist(keyserver->options);
202   xfree(keyserver);
203 }
204
205 /* TODO: once we cut over to an all-curl world, we don't need this
206    parser any longer so it can be removed, or at least moved to
207    keyserver/ksutil.c for limited use in gpgkeys_ldap or the like. */
208
209 struct keyserver_spec *
210 parse_keyserver_uri(const char *string,int require_scheme,
211                     const char *configname,unsigned int configlineno)
212 {
213   int assume_hkp=0;
214   struct keyserver_spec *keyserver;
215   const char *idx;
216   int count;
217   char *uri,*options;
218
219   assert(string!=NULL);
220
221   keyserver=xmalloc_clear(sizeof(struct keyserver_spec));
222
223   uri=xstrdup(string);
224
225   options=strchr(uri,' ');
226   if(options)
227     {
228       char *tok;
229
230       *options='\0';
231       options++;
232
233       while((tok=optsep(&options)))
234         add_canonical_option(tok,&keyserver->options);
235     }
236
237   /* Get the scheme */
238
239   for(idx=uri,count=0;*idx && *idx!=':';idx++)
240     {
241       count++;
242
243       /* Do we see the start of an RFC-2732 ipv6 address here?  If so,
244          there clearly isn't a scheme so get out early. */
245       if(*idx=='[')
246         {
247           /* Was the '[' the first thing in the string?  If not, we
248              have a mangled scheme with a [ in it so fail. */
249           if(count==1)
250             break;
251           else
252             goto fail;
253         }
254     }
255
256   if(count==0)
257     goto fail;
258
259   if(*idx=='\0' || *idx=='[')
260     {
261       if(require_scheme)
262         return NULL;
263
264       /* Assume HKP if there is no scheme */
265       assume_hkp=1;
266       keyserver->scheme=xstrdup("hkp");
267
268       keyserver->uri=xmalloc(strlen(keyserver->scheme)+3+strlen(uri)+1);
269       strcpy(keyserver->uri,keyserver->scheme);
270       strcat(keyserver->uri,"://");
271       strcat(keyserver->uri,uri);
272     }
273   else
274     {
275       int i;
276
277       keyserver->uri=xstrdup(uri);
278
279       keyserver->scheme=xmalloc(count+1);
280
281       /* Force to lowercase */
282       for(i=0;i<count;i++)
283         keyserver->scheme[i]=ascii_tolower(uri[i]);
284
285       keyserver->scheme[i]='\0';
286
287       /* Skip past the scheme and colon */
288       uri+=count+1;
289     }
290
291   if(ascii_strcasecmp(keyserver->scheme,"x-broken-hkp")==0)
292     {
293       deprecated_warning(configname,configlineno,"x-broken-hkp",
294                          "--keyserver-options ","broken-http-proxy");
295       xfree(keyserver->scheme);
296       keyserver->scheme=xstrdup("hkp");
297       append_to_strlist(&opt.keyserver_options.other,"broken-http-proxy");
298     }
299   else if(ascii_strcasecmp(keyserver->scheme,"x-hkp")==0)
300     {
301       /* Canonicalize this to "hkp" so it works with both the internal
302          and external keyserver interface. */
303       xfree(keyserver->scheme);
304       keyserver->scheme=xstrdup("hkp");
305     }
306
307   if(assume_hkp || (uri[0]=='/' && uri[1]=='/'))
308     {
309       /* Two slashes means network path. */
310
311       /* Skip over the "//", if any */
312       if(!assume_hkp)
313         uri+=2;
314
315       /* Do we have userinfo auth data present? */
316       for(idx=uri,count=0;*idx && *idx!='@' && *idx!='/';idx++)
317         count++;
318
319       /* We found a @ before the slash, so that means everything
320          before the @ is auth data. */
321       if(*idx=='@')
322         {
323           if(count==0)
324             goto fail;
325
326           keyserver->auth=xmalloc(count+1);
327           strncpy(keyserver->auth,uri,count);
328           keyserver->auth[count]='\0';
329           uri+=count+1;
330         }
331
332       /* Is it an RFC-2732 ipv6 [literal address] ? */
333       if(*uri=='[')
334         {
335           for(idx=uri+1,count=1;*idx
336                 && ((isascii (*idx) && isxdigit(*idx))
337                     || *idx==':' || *idx=='.');idx++)
338             count++;
339
340           /* Is the ipv6 literal address terminated? */
341           if(*idx==']')
342             count++;
343           else
344             goto fail;
345         }
346       else
347         for(idx=uri,count=0;*idx && *idx!=':' && *idx!='/';idx++)
348           count++;
349
350       if(count==0)
351         goto fail;
352
353       keyserver->host=xmalloc(count+1);
354       strncpy(keyserver->host,uri,count);
355       keyserver->host[count]='\0';
356
357       /* Skip past the host */
358       uri+=count;
359
360       if(*uri==':')
361         {
362           /* It would seem to be reasonable to limit the range of the
363              ports to values between 1-65535, but RFC 1738 and 1808
364              imply there is no limit.  Of course, the real world has
365              limits. */
366
367           for(idx=uri+1,count=0;*idx && *idx!='/';idx++)
368             {
369               count++;
370
371               /* Ports are digits only */
372               if(!digitp(idx))
373                 goto fail;
374             }
375
376           keyserver->port=xmalloc(count+1);
377           strncpy(keyserver->port,uri+1,count);
378           keyserver->port[count]='\0';
379
380           /* Skip past the colon and port number */
381           uri+=1+count;
382         }
383
384       /* Everything else is the path */
385       if(*uri)
386         keyserver->path=xstrdup(uri);
387       else
388         keyserver->path=xstrdup("/");
389
390       if(keyserver->path[1]!='\0')
391         keyserver->flags.direct_uri=1;
392     }
393   else if(uri[0]!='/')
394     {
395       /* No slash means opaque.  Just record the opaque blob and get
396          out. */
397       keyserver->opaque=xstrdup(uri);
398     }
399   else
400     {
401       /* One slash means absolute path.  We don't need to support that
402          yet. */
403       goto fail;
404     }
405
406   return keyserver;
407
408  fail:
409   free_keyserver_spec(keyserver);
410
411   return NULL;
412 }
413
414 struct keyserver_spec *
415 parse_preferred_keyserver(PKT_signature *sig)
416 {
417   struct keyserver_spec *spec=NULL;
418   const byte *p;
419   size_t plen;
420
421   p=parse_sig_subpkt(sig->hashed,SIGSUBPKT_PREF_KS,&plen);
422   if(p && plen)
423     {
424       byte *dupe=xmalloc(plen+1);
425
426       memcpy(dupe,p,plen);
427       dupe[plen]='\0';
428       spec=parse_keyserver_uri(dupe,1,NULL,0);
429       xfree(dupe);
430     }
431
432   return spec;
433 }
434
435 static void
436 print_keyrec(int number,struct keyrec *keyrec)
437 {
438   int i;
439
440   iobuf_writebyte(keyrec->uidbuf,0);
441   iobuf_flush_temp(keyrec->uidbuf);
442   printf("(%d)\t%s  ",number,iobuf_get_temp_buffer(keyrec->uidbuf));
443
444   if(keyrec->size>0)
445     printf("%d bit ",keyrec->size);
446
447   if(keyrec->type)
448     {
449       const char *str=pubkey_algo_to_string(keyrec->type);
450
451       if(str)
452         printf("%s ",str);
453       else
454         printf("unknown ");
455     }
456
457   switch(keyrec->desc.mode)
458     {
459       /* If the keyserver helper gave us a short keyid, we have no
460          choice but to use it.  Do check --keyid-format to add a 0x if
461          needed. */
462     case KEYDB_SEARCH_MODE_SHORT_KID:
463       printf("key %s%08lX",
464              (opt.keyid_format==KF_0xSHORT
465               || opt.keyid_format==KF_0xLONG)?"0x":"",
466              (ulong)keyrec->desc.u.kid[1]);
467       break;
468
469       /* However, if it gave us a long keyid, we can honor
470          --keyid-format */
471     case KEYDB_SEARCH_MODE_LONG_KID:
472       printf("key %s",keystr(keyrec->desc.u.kid));
473       break;
474
475     case KEYDB_SEARCH_MODE_FPR16:
476       printf("key ");
477       for(i=0;i<16;i++)
478         printf("%02X",keyrec->desc.u.fpr[i]);
479       break;
480
481     case KEYDB_SEARCH_MODE_FPR20:
482       printf("key ");
483       for(i=0;i<20;i++)
484         printf("%02X",keyrec->desc.u.fpr[i]);
485       break;
486
487     default:
488       BUG();
489       break;
490     }
491
492   if(keyrec->createtime>0)
493     {
494       printf(", ");
495       printf(_("created: %s"),strtimestamp(keyrec->createtime));
496     }
497
498   if(keyrec->expiretime>0)
499     {
500       printf(", ");
501       printf(_("expires: %s"),strtimestamp(keyrec->expiretime));
502     }
503
504   if(keyrec->flags&1)
505     printf(" (%s)",_("revoked"));
506   if(keyrec->flags&2)
507     printf(" (%s)",_("disabled"));
508   if(keyrec->flags&4)
509     printf(" (%s)",_("expired"));
510
511   printf("\n");
512 }
513
514 /* Returns a keyrec (which must be freed) once a key is complete, and
515    NULL otherwise.  Call with a NULL keystring once key parsing is
516    complete to return any unfinished keys. */
517 static struct keyrec *
518 parse_keyrec(char *keystring)
519 {
520   static struct keyrec *work=NULL;
521   struct keyrec *ret=NULL;
522   char *record;
523   int i;
524
525   if(keystring==NULL)
526     {
527       if(work==NULL)
528         return NULL;
529       else if(work->desc.mode==KEYDB_SEARCH_MODE_NONE)
530         {
531           xfree(work);
532           return NULL;
533         }
534       else
535         {
536           ret=work;
537           work=NULL;
538           return ret;
539         }
540     }
541
542   if(work==NULL)
543     {
544       work=xmalloc_clear(sizeof(struct keyrec));
545       work->uidbuf=iobuf_temp();
546     }
547
548   /* Remove trailing whitespace */
549   for(i=strlen(keystring);i>0;i--)
550     if(ascii_isspace(keystring[i-1]))
551       keystring[i-1]='\0';
552     else
553       break;
554
555   if((record=strsep(&keystring,":"))==NULL)
556     return ret;
557
558   if(ascii_strcasecmp("pub",record)==0)
559     {
560       char *tok;
561
562       if(work->desc.mode)
563         {
564           ret=work;
565           work=xmalloc_clear(sizeof(struct keyrec));
566           work->uidbuf=iobuf_temp();
567         }
568
569       if((tok=strsep(&keystring,":"))==NULL)
570         return ret;
571
572       classify_user_id(tok,&work->desc);
573       if(work->desc.mode!=KEYDB_SEARCH_MODE_SHORT_KID
574          && work->desc.mode!=KEYDB_SEARCH_MODE_LONG_KID
575          && work->desc.mode!=KEYDB_SEARCH_MODE_FPR16
576          && work->desc.mode!=KEYDB_SEARCH_MODE_FPR20)
577         {
578           work->desc.mode=KEYDB_SEARCH_MODE_NONE;
579           return ret;
580         }
581
582       /* Note all items after this are optional.  This allows us to
583          have a pub line as simple as pub:keyid and nothing else. */
584
585       work->lines++;
586
587       if((tok=strsep(&keystring,":"))==NULL)
588         return ret;
589
590       work->type=atoi(tok);
591
592       if((tok=strsep(&keystring,":"))==NULL)
593         return ret;
594
595       work->size=atoi(tok);
596
597       if((tok=strsep(&keystring,":"))==NULL)
598         return ret;
599
600       if(atoi(tok)<=0)
601         work->createtime=0;
602       else
603         work->createtime=atoi(tok);
604
605       if((tok=strsep(&keystring,":"))==NULL)
606         return ret;
607
608       if(atoi(tok)<=0)
609         work->expiretime=0;
610       else
611         {
612           work->expiretime=atoi(tok);
613           /* Force the 'e' flag on if this key is expired. */
614           if(work->expiretime<=make_timestamp())
615             work->flags|=4;
616         }
617
618       if((tok=strsep(&keystring,":"))==NULL)
619         return ret;
620
621       while(*tok)
622         switch(*tok++)
623           {
624           case 'r':
625           case 'R':
626             work->flags|=1;
627             break;
628             
629           case 'd':
630           case 'D':
631             work->flags|=2;
632             break;
633
634           case 'e':
635           case 'E':
636             work->flags|=4;
637             break;
638           }
639     }
640   else if(ascii_strcasecmp("uid",record)==0 && work->desc.mode)
641     {
642       char *userid,*tok,*decoded;
643
644       if((tok=strsep(&keystring,":"))==NULL)
645         return ret;
646
647       if(strlen(tok)==0)
648         return ret;
649
650       userid=tok;
651
652       /* By definition, de-%-encoding is always smaller than the
653          original string so we can decode in place. */
654
655       i=0;
656
657       while(*tok)
658         if(tok[0]=='%' && tok[1] && tok[2])
659           {
660             if((userid[i]=hextobyte(&tok[1]))==-1)
661               userid[i]='?';
662
663             i++;
664             tok+=3;
665           }
666         else
667           userid[i++]=*tok++;
668
669       /* We don't care about the other info provided in the uid: line
670          since no keyserver supports marking userids with timestamps
671          or revoked/expired/disabled yet. */
672
673       /* No need to check for control characters, as utf8_to_native
674          does this for us. */
675
676       decoded=utf8_to_native(userid,i,0);
677       if(strlen(decoded)>opt.screen_columns-10)
678         decoded[opt.screen_columns-10]='\0';
679       iobuf_writestr(work->uidbuf,decoded);
680       xfree(decoded);
681       iobuf_writestr(work->uidbuf,"\n\t");
682       work->lines++;
683     }
684
685   /* Ignore any records other than "pri" and "uid" for easy future
686      growth. */
687
688   return ret;
689 }
690
691 /* TODO: do this as a list sent to keyserver_work rather than calling
692    it once for each key to get the correct counts after the import
693    (cosmetics, really) and to better take advantage of the keyservers
694    that can do multiple fetches in one go (LDAP). */
695 static int
696 show_prompt(KEYDB_SEARCH_DESC *desc,int numdesc,int count,const char *search)
697 {
698   char *answer;
699
700   if(count && opt.command_fd==-1)
701     {
702       static int from=1;
703       tty_printf("Keys %d-%d of %d for \"%s\".  ",from,numdesc,count,search);
704       from=numdesc+1;
705     }
706
707   answer=cpr_get_no_help("keysearch.prompt",
708                          _("Enter number(s), N)ext, or Q)uit > "));
709   /* control-d */
710   if(answer[0]=='\x04')
711     {
712       printf("Q\n");
713       answer[0]='q';
714     }
715
716   if(answer[0]=='q' || answer[0]=='Q')
717     {
718       xfree(answer);
719       return 1;
720     }
721   else if(atoi(answer)>=1 && atoi(answer)<=numdesc)
722     {
723       char *split=answer,*num;
724
725       while((num=strsep(&split," ,"))!=NULL)
726         if(atoi(num)>=1 && atoi(num)<=numdesc)
727           keyserver_work(KS_GET,NULL,&desc[atoi(num)-1],1,opt.keyserver);
728
729       xfree(answer);
730       return 1;
731     }
732
733   return 0;
734 }
735
736 /* Count and searchstr are just for cosmetics.  If the count is too
737    small, it will grow safely.  If negative it disables the "Key x-y
738    of z" messages.  searchstr should be UTF-8 (rather than native). */
739 static void
740 keyserver_search_prompt(IOBUF buffer,const char *searchstr)
741 {
742   int i=0,validcount=0,started=0,header=0,count=1;
743   unsigned int maxlen,buflen,numlines=0;
744   KEYDB_SEARCH_DESC *desc;
745   byte *line=NULL;
746   char *localstr=NULL;
747
748   if(searchstr)
749     localstr=utf8_to_native(searchstr,strlen(searchstr),0);
750
751   desc=xmalloc(count*sizeof(KEYDB_SEARCH_DESC));
752
753   for(;;)
754     {
755       struct keyrec *keyrec;
756       int rl;
757
758       maxlen=1024;
759       rl=iobuf_read_line(buffer,&line,&buflen,&maxlen);
760
761       if(opt.with_colons)
762         {
763           if(!header && ascii_strncasecmp("SEARCH ",line,7)==0
764              && ascii_strncasecmp(" BEGIN",&line[strlen(line)-7],6)==0)
765             {
766               header=1;
767               continue;
768             }
769           else if(ascii_strncasecmp("SEARCH ",line,7)==0
770                   && ascii_strncasecmp(" END",&line[strlen(line)-5],4)==0)
771             continue;
772
773           printf("%s",line);
774         }
775
776       /* Look for an info: line.  The only current info: values
777          defined are the version and key count. */
778       if(!started && rl>0 && ascii_strncasecmp("info:",line,5)==0)
779         {
780           char *tok,*str=&line[5];
781
782           if((tok=strsep(&str,":"))!=NULL)
783             {
784               int version;
785
786               if(sscanf(tok,"%d",&version)!=1)
787                 version=1;
788
789               if(version!=1)
790                 {
791                   log_error(_("invalid keyserver protocol "
792                               "(us %d!=handler %d)\n"),1,version);
793                   break;
794                 }
795             }
796
797           if((tok=strsep(&str,":"))!=NULL && sscanf(tok,"%d",&count)==1)
798             {
799               if(count==0)
800                 goto notfound;
801               else if(count<0)
802                 count=10;
803               else
804                 validcount=1;
805
806               desc=xrealloc(desc,count*sizeof(KEYDB_SEARCH_DESC));
807             }
808
809           started=1;
810           continue;
811         }
812
813       if(rl==0)
814         {
815           keyrec=parse_keyrec(NULL);
816
817           if(keyrec==NULL)
818             {
819               if(i==0)
820                 {
821                   count=0;
822                   break;
823                 }
824
825               if(i!=count)
826                 validcount=0;
827
828               for(;;)
829                 {
830                   if(show_prompt(desc,i,validcount?count:0,localstr))
831                     break;
832                   validcount=0;
833                 }
834
835               break;
836             }
837         }
838       else
839         keyrec=parse_keyrec(line);
840
841       if(i==count)
842         {
843           /* keyserver helper sent more keys than they claimed in the
844              info: line. */
845           count+=10;
846           desc=xrealloc(desc,count*sizeof(KEYDB_SEARCH_DESC));
847           validcount=0;
848         }
849
850       if(keyrec)
851         {
852           desc[i]=keyrec->desc;
853
854           if(!opt.with_colons)
855             {
856               /* screen_lines - 1 for the prompt. */
857               if(numlines+keyrec->lines>opt.screen_lines-1)
858                 {
859                   if(show_prompt(desc,i,validcount?count:0,localstr))
860                     break;
861                   else
862                     numlines=0;
863                 }
864
865               print_keyrec(i+1,keyrec);
866             }
867
868           numlines+=keyrec->lines;
869           iobuf_close(keyrec->uidbuf);
870           xfree(keyrec);
871
872           started=1;
873           i++;
874         }
875     }
876
877  notfound:
878   /* Leave this commented out or now, and perhaps for a very long
879      time.  All HKPish servers return HTML error messages for
880      no-key-found. */
881   /* 
882      if(!started)
883      log_info(_("keyserver does not support searching\n"));
884      else
885   */
886   if(count==0)
887     {
888       if(localstr)
889         log_info(_("key \"%s\" not found on keyserver\n"),localstr);
890       else
891         log_info(_("key not found on keyserver\n"));
892     }
893
894   xfree(localstr);
895   xfree(desc);
896   xfree(line);
897 }
898
899 /* We sometimes want to use a different gpgkeys_xxx for a given
900    protocol (for example, ldaps is handled by gpgkeys_ldap).  Map
901    these here. */
902 static const char *
903 keyserver_typemap(const char *type)
904 {
905   if(strcmp(type,"ldaps")==0)
906     return "ldap";
907   else
908     return type;
909 }
910
911 #ifdef GPGKEYS_CURL
912 /* The PGP LDAP and the curl fetch-a-LDAP-object methodologies are
913    sufficiently different that we can't use curl to do LDAP. */
914 static int
915 curl_cant_handle(const char *scheme,unsigned int direct_uri)
916 {
917   if(!direct_uri && (strcmp(scheme,"ldap")==0 || strcmp(scheme,"ldaps")==0))
918     return 1;
919
920   return 0;
921 }
922 #endif
923
924 #define KEYSERVER_ARGS_KEEP " -o \"%O\" \"%I\""
925 #define KEYSERVER_ARGS_NOKEEP " -o \"%o\" \"%i\""
926
927 static int 
928 keyserver_spawn(enum ks_action action,STRLIST list,KEYDB_SEARCH_DESC *desc,
929                 int count,int *prog,struct keyserver_spec *keyserver)
930 {
931   int ret=0,i,gotversion=0,outofband=0;
932   STRLIST temp;
933   unsigned int maxlen,buflen;
934   char *command,*end,*searchstr=NULL;
935   byte *line=NULL;
936   struct parse_options *kopts;
937   struct exec_info *spawn;
938   const char *scheme;
939   const char *libexecdir = get_libexecdir ();
940
941   assert(keyserver);
942
943 #ifdef EXEC_TEMPFILE_ONLY
944   opt.keyserver_options.options|=KEYSERVER_USE_TEMP_FILES;
945 #endif
946
947   /* Build the filename for the helper to execute */
948   scheme=keyserver_typemap(keyserver->scheme);
949
950 #ifdef DISABLE_KEYSERVER_PATH
951   /* Destroy any path we might have.  This is a little tricky,
952      portability-wise.  It's not correct to delete the PATH
953      environment variable, as that may fall back to a system built-in
954      PATH.  Similarly, it is not correct to set PATH to the null
955      string (PATH="") since this actually deletes the PATH environment
956      variable under MinGW.  The safest thing to do here is to force
957      PATH to be GNUPG_LIBEXECDIR.  All this is not that meaningful on
958      Unix-like systems (since we're going to give a full path to
959      gpgkeys_foo), but on W32 it prevents loading any DLLs from
960      directories in %PATH%.
961
962      After some more thinking about this we came to the conclusion
963      that it is better to load the helpers from the directory where
964      the program of this process lives.  Fortunately Windows provides
965      a way to retrieve this and our get_libexecdir function has been
966      modified to return just this.  Setting the exec-path is not
967      anymore required.  
968        set_exec_path(libexecdir);
969  */
970 #else
971   if(opt.exec_path_set)
972     {
973       /* If exec-path was set, and DISABLE_KEYSERVER_PATH is
974          undefined, then don't specify a full path to gpgkeys_foo, so
975          that the PATH can work. */
976       command=xmalloc(GPGKEYS_PREFIX_LEN+strlen(scheme)+3+strlen(EXEEXT)+1);
977       command[0]='\0';
978     }
979   else
980 #endif
981     {
982       /* Specify a full path to gpgkeys_foo. */
983       command=xmalloc(strlen(libexecdir)+strlen(DIRSEP_S)+
984                       GPGKEYS_PREFIX_LEN+strlen(scheme)+3+strlen(EXEEXT)+1);
985       strcpy(command,libexecdir);
986       strcat(command,DIRSEP_S);
987     }
988
989   end=command+strlen(command);
990
991   strcat(command,GPGKEYS_PREFIX); 
992   strcat(command,scheme);
993
994   if(keyserver->flags.direct_uri)
995     strcat(command,"uri");
996
997   strcat(command,EXEEXT);
998
999 #ifdef GPGKEYS_CURL
1000   if(!curl_cant_handle(scheme,keyserver->flags.direct_uri)
1001      && path_access(command,X_OK)!=0)
1002     strcpy(end,GPGKEYS_CURL);
1003 #endif
1004
1005   if(opt.keyserver_options.options&KEYSERVER_USE_TEMP_FILES)
1006     {
1007       if(opt.keyserver_options.options&KEYSERVER_KEEP_TEMP_FILES)
1008         {
1009           command=xrealloc(command,strlen(command)+
1010                             strlen(KEYSERVER_ARGS_KEEP)+1);
1011           strcat(command,KEYSERVER_ARGS_KEEP);
1012         }
1013       else
1014         {
1015           command=xrealloc(command,strlen(command)+
1016                             strlen(KEYSERVER_ARGS_NOKEEP)+1);
1017           strcat(command,KEYSERVER_ARGS_NOKEEP);  
1018         }
1019
1020       ret=exec_write(&spawn,NULL,command,NULL,0,0);
1021     }
1022   else
1023     ret=exec_write(&spawn,command,NULL,NULL,0,0);
1024
1025   xfree(command);
1026
1027   if(ret)
1028     return ret;
1029
1030   fprintf(spawn->tochild,
1031           "# This is a GnuPG %s keyserver communications file\n",VERSION);
1032   fprintf(spawn->tochild,"VERSION %d\n",KEYSERVER_PROTO_VERSION);
1033   fprintf(spawn->tochild,"PROGRAM %s\n",VERSION);
1034   fprintf(spawn->tochild,"SCHEME %s\n",keyserver->scheme);
1035
1036   if(keyserver->opaque)
1037     fprintf(spawn->tochild,"OPAQUE %s\n",keyserver->opaque);
1038   else
1039     {
1040       if(keyserver->auth)
1041         fprintf(spawn->tochild,"AUTH %s\n",keyserver->auth);
1042
1043       if(keyserver->host)
1044         fprintf(spawn->tochild,"HOST %s\n",keyserver->host);
1045
1046       if(keyserver->port)
1047         fprintf(spawn->tochild,"PORT %s\n",keyserver->port);
1048
1049       if(keyserver->path)
1050         fprintf(spawn->tochild,"PATH %s\n",keyserver->path);
1051     }
1052
1053   /* Write options */
1054
1055   for(i=0,kopts=keyserver_opts;kopts[i].name;i++)
1056     if(opt.keyserver_options.options & kopts[i].bit & REMOTE_TELL)
1057       fprintf(spawn->tochild,"OPTION %s\n",kopts[i].name);
1058
1059   for(temp=opt.keyserver_options.other;temp;temp=temp->next)
1060     fprintf(spawn->tochild,"OPTION %s\n",temp->d);
1061
1062   for(temp=opt.keyserver->options;temp;temp=temp->next)
1063     fprintf(spawn->tochild,"OPTION %s\n",temp->d);
1064
1065   switch(action)
1066     {
1067     case KS_GET:
1068       {
1069         fprintf(spawn->tochild,"COMMAND GET\n\n");
1070
1071         /* Which keys do we want? */
1072
1073         for(i=0;i<count;i++)
1074           {
1075             int quiet=0;
1076
1077             if(desc[i].mode==KEYDB_SEARCH_MODE_FPR20)
1078               {
1079                 int f;
1080
1081                 fprintf(spawn->tochild,"0x");
1082
1083                 for(f=0;f<MAX_FINGERPRINT_LEN;f++)
1084                   fprintf(spawn->tochild,"%02X",desc[i].u.fpr[f]);
1085
1086                 fprintf(spawn->tochild,"\n");
1087               }
1088             else if(desc[i].mode==KEYDB_SEARCH_MODE_FPR16)
1089               {
1090                 int f;
1091
1092                 fprintf(spawn->tochild,"0x");
1093
1094                 for(f=0;f<16;f++)
1095                   fprintf(spawn->tochild,"%02X",desc[i].u.fpr[f]);
1096
1097                 fprintf(spawn->tochild,"\n");
1098               }
1099             else if(desc[i].mode==KEYDB_SEARCH_MODE_LONG_KID)
1100               fprintf(spawn->tochild,"0x%08lX%08lX\n",
1101                       (ulong)desc[i].u.kid[0],
1102                       (ulong)desc[i].u.kid[1]);
1103             else if(desc[i].mode==KEYDB_SEARCH_MODE_SHORT_KID)
1104               fprintf(spawn->tochild,"0x%08lX\n",
1105                       (ulong)desc[i].u.kid[1]);
1106             else if(desc[i].mode==KEYDB_SEARCH_MODE_EXACT)
1107               {
1108                 fprintf(spawn->tochild,"0x0000000000000000\n");
1109                 quiet=1;
1110               }
1111             else if(desc[i].mode==KEYDB_SEARCH_MODE_NONE)
1112               continue;
1113             else
1114               BUG();
1115
1116             if(!quiet)
1117               {
1118                 if(keyserver->host)
1119                   log_info(_("requesting key %s from %s server %s\n"),
1120                            keystr_from_desc(&desc[i]),
1121                            keyserver->scheme,keyserver->host);
1122                 else
1123                   log_info(_("requesting key %s from %s\n"),
1124                            keystr_from_desc(&desc[i]),keyserver->uri);
1125               }
1126           }
1127
1128         fprintf(spawn->tochild,"\n");
1129
1130         break;
1131       }
1132
1133     case KS_GETNAME:
1134       {
1135         STRLIST key;
1136
1137         fprintf(spawn->tochild,"COMMAND GETNAME\n\n");
1138
1139         /* Which names do we want? */
1140
1141         for(key=list;key!=NULL;key=key->next)
1142           fprintf(spawn->tochild,"%s\n",key->d);
1143
1144         fprintf(spawn->tochild,"\n");
1145
1146         if(keyserver->host)
1147           log_info(_("searching for names from %s server %s\n"),
1148                    keyserver->scheme,keyserver->host);
1149         else
1150           log_info(_("searching for names from %s\n"),keyserver->uri);
1151
1152         break;
1153       }
1154
1155     case KS_SEND:
1156       {
1157         STRLIST key;
1158
1159         /* Note the extra \n here to send an empty keylist block */
1160         fprintf(spawn->tochild,"COMMAND SEND\n\n\n");
1161
1162         for(key=list;key!=NULL;key=key->next)
1163           {
1164             armor_filter_context_t afx;
1165             IOBUF buffer=iobuf_temp();
1166             KBNODE block;
1167
1168             temp=NULL;
1169             add_to_strlist(&temp,key->d);
1170
1171             memset(&afx,0,sizeof(afx));
1172             afx.what=1;
1173             /* Tell the armor filter to use Unix-style \n line
1174                endings, since we're going to fprintf this to a file
1175                that (on Win32) is open in text mode.  The win32 stdio
1176                will transform the \n to \r\n and we'll end up with the
1177                proper line endings on win32.  This is a no-op on
1178                Unix. */
1179             afx.eol[0]='\n';
1180             iobuf_push_filter(buffer,armor_filter,&afx);
1181
1182             /* TODO: Remove Comment: lines from keys exported this
1183                way? */
1184
1185             if(export_pubkeys_stream(buffer,temp,&block,
1186                                      opt.keyserver_options.export_options)==-1)
1187               iobuf_close(buffer);
1188             else
1189               {
1190                 KBNODE node;
1191
1192                 iobuf_flush_temp(buffer);
1193
1194                 merge_keys_and_selfsig(block);
1195
1196                 fprintf(spawn->tochild,"INFO %08lX%08lX BEGIN\n",
1197                         (ulong)block->pkt->pkt.public_key->keyid[0],
1198                         (ulong)block->pkt->pkt.public_key->keyid[1]);
1199
1200                 for(node=block;node;node=node->next)
1201                   {
1202                     switch(node->pkt->pkttype)
1203                       {
1204                       default:
1205                         continue;
1206
1207                       case PKT_PUBLIC_KEY:
1208                       case PKT_PUBLIC_SUBKEY:
1209                         {
1210                           PKT_public_key *pk=node->pkt->pkt.public_key;
1211
1212                           keyid_from_pk(pk,NULL);
1213
1214                           fprintf(spawn->tochild,"%sb:%08lX%08lX:%u:%u:%u:%u:",
1215                                   node->pkt->pkttype==PKT_PUBLIC_KEY?"pu":"su",
1216                                   (ulong)pk->keyid[0],(ulong)pk->keyid[1],
1217                                   pk->pubkey_algo,
1218                                   nbits_from_pk(pk),
1219                                   pk->timestamp,
1220                                   pk->expiredate);
1221
1222                           if(pk->is_revoked)
1223                             fprintf(spawn->tochild,"r");
1224                           if(pk->has_expired)
1225                             fprintf(spawn->tochild,"e");
1226
1227                           fprintf(spawn->tochild,"\n");
1228                         }
1229                         break;
1230
1231                       case PKT_USER_ID:
1232                         {
1233                           PKT_user_id *uid=node->pkt->pkt.user_id;
1234                           int r;
1235
1236                           if(uid->attrib_data)
1237                             continue;
1238
1239                           fprintf(spawn->tochild,"uid:");
1240
1241                           /* Quote ':', '%', and any 8-bit
1242                              characters */
1243                           for(r=0;r<uid->len;r++)
1244                             {
1245                               if(uid->name[r]==':' || uid->name[r]=='%'
1246                                  || uid->name[r]&0x80)
1247                                 fprintf(spawn->tochild,"%%%02X",
1248                                         (byte)uid->name[r]);
1249                               else
1250                                 fprintf(spawn->tochild,"%c",uid->name[r]);
1251                             }
1252
1253                           fprintf(spawn->tochild,":%u:%u:",
1254                                   uid->created,uid->expiredate);
1255
1256                           if(uid->is_revoked)
1257                             fprintf(spawn->tochild,"r");
1258                           if(uid->is_expired)
1259                             fprintf(spawn->tochild,"e");
1260
1261                           fprintf(spawn->tochild,"\n");
1262                         }
1263                         break;
1264
1265                         /* This bit is really for the benefit of
1266                            people who store their keys in LDAP
1267                            servers.  It makes it easy to do queries
1268                            for things like "all keys signed by
1269                            Isabella". */
1270                       case PKT_SIGNATURE:
1271                         {
1272                           PKT_signature *sig=node->pkt->pkt.signature;
1273
1274                           if(!IS_UID_SIG(sig))
1275                             continue;
1276
1277                           fprintf(spawn->tochild,"sig:%08lX%08lX:%X:%u:%u\n",
1278                                   (ulong)sig->keyid[0],(ulong)sig->keyid[1],
1279                                   sig->sig_class,sig->timestamp,
1280                                   sig->expiredate);
1281                         }
1282                         break;
1283                       }
1284                   }
1285
1286                 fprintf(spawn->tochild,"INFO %08lX%08lX END\n",
1287                         (ulong)block->pkt->pkt.public_key->keyid[0],
1288                         (ulong)block->pkt->pkt.public_key->keyid[1]);
1289
1290                 fprintf(spawn->tochild,"KEY %s BEGIN\n",key->d);
1291                 fwrite(iobuf_get_temp_buffer(buffer),
1292                        iobuf_get_temp_length(buffer),1,spawn->tochild);
1293                 fprintf(spawn->tochild,"KEY %s END\n",key->d);
1294
1295                 iobuf_close(buffer);
1296
1297                 if(keyserver->host)
1298                   log_info(_("sending key %s to %s server %s\n"),
1299                            keystr(block->pkt->pkt.public_key->keyid),
1300                            keyserver->scheme,keyserver->host);
1301                 else
1302                   log_info(_("sending key %s to %s\n"),
1303                            keystr(block->pkt->pkt.public_key->keyid),
1304                            keyserver->uri);
1305
1306                 release_kbnode(block);
1307               }
1308
1309             free_strlist(temp);
1310           }
1311
1312         break;
1313       }
1314
1315     case KS_SEARCH:
1316       {
1317         STRLIST key;
1318
1319         fprintf(spawn->tochild,"COMMAND SEARCH\n\n");
1320
1321         /* Which keys do we want?  Remember that the gpgkeys_ program
1322            is going to lump these together into a search string. */
1323
1324         for(key=list;key!=NULL;key=key->next)
1325           {
1326             fprintf(spawn->tochild,"%s\n",key->d);
1327             if(key!=list)
1328               {
1329                 searchstr=xrealloc(searchstr,
1330                                     strlen(searchstr)+strlen(key->d)+2);
1331                 strcat(searchstr," ");
1332               }
1333             else
1334               {
1335                 searchstr=xmalloc(strlen(key->d)+1);
1336                 searchstr[0]='\0';
1337               }
1338
1339             strcat(searchstr,key->d);
1340           }
1341
1342         fprintf(spawn->tochild,"\n");
1343
1344         if(keyserver->host)
1345           log_info(_("searching for \"%s\" from %s server %s\n"),
1346                    searchstr,keyserver->scheme,keyserver->host);
1347         else
1348           log_info(_("searching for \"%s\" from %s\n"),
1349                    searchstr,keyserver->uri);
1350
1351         break;
1352       }
1353
1354     default:
1355       log_fatal(_("no keyserver action!\n"));
1356       break;
1357     }
1358
1359   /* Done sending, so start reading. */
1360   ret=exec_read(spawn);
1361   if(ret)
1362     goto fail;
1363
1364   /* Now handle the response */
1365
1366   for(;;)
1367     {
1368       int plen;
1369       char *ptr;
1370
1371       maxlen=1024;
1372       if(iobuf_read_line(spawn->fromchild,&line,&buflen,&maxlen)==0)
1373         {
1374           ret=G10ERR_READ_FILE;
1375           goto fail; /* i.e. EOF */
1376         }
1377
1378       ptr=line;
1379
1380       /* remove trailing whitespace */
1381       plen=strlen(ptr);
1382       while(plen>0 && ascii_isspace(ptr[plen-1]))
1383         plen--;
1384       plen[ptr]='\0';
1385
1386       if(*ptr=='\0')
1387         break;
1388
1389       if(ascii_strncasecmp(ptr,"VERSION ",8)==0)
1390         {
1391           gotversion=1;
1392
1393           if(atoi(&ptr[8])!=KEYSERVER_PROTO_VERSION)
1394             {
1395               log_error(_("invalid keyserver protocol (us %d!=handler %d)\n"),
1396                         KEYSERVER_PROTO_VERSION,atoi(&ptr[8]));
1397               goto fail;
1398             }
1399         }
1400       else if(ascii_strncasecmp(ptr,"PROGRAM ",8)==0)
1401         {
1402           if(ascii_strncasecmp(&ptr[8],VERSION,strlen(VERSION))!=0)
1403             log_info(_("WARNING: keyserver handler from a different"
1404                        " version of GnuPG (%s)\n"),&ptr[8]);
1405         }
1406       else if(ascii_strncasecmp(ptr,"OPTION OUTOFBAND",16)==0)
1407         outofband=1; /* Currently the only OPTION */
1408     }
1409
1410   if(!gotversion)
1411     {
1412       log_error(_("keyserver did not send VERSION\n"));
1413       goto fail;
1414     }
1415
1416   if(!outofband)
1417     switch(action)
1418       {
1419       case KS_GET:
1420       case KS_GETNAME:
1421         {
1422           void *stats_handle;
1423
1424           stats_handle=import_new_stats_handle();
1425
1426           /* Slurp up all the key data.  In the future, it might be
1427              nice to look for KEY foo OUTOFBAND and FAILED indicators.
1428              It's harmless to ignore them, but ignoring them does make
1429              gpg complain about "no valid OpenPGP data found".  One
1430              way to do this could be to continue parsing this
1431              line-by-line and make a temp iobuf for each key. */
1432
1433           import_keys_stream(spawn->fromchild,stats_handle,
1434                              opt.keyserver_options.import_options);
1435
1436           import_print_stats(stats_handle);
1437           import_release_stats_handle(stats_handle);
1438
1439           break;
1440         }
1441
1442         /* Nothing to do here */
1443       case KS_SEND:
1444         break;
1445
1446       case KS_SEARCH:
1447         keyserver_search_prompt(spawn->fromchild,searchstr);
1448         break;
1449
1450       default:
1451         log_fatal(_("no keyserver action!\n"));
1452         break;
1453       }
1454
1455  fail:
1456   xfree(line);
1457   xfree(searchstr);
1458
1459
1460   *prog=exec_finish(spawn);
1461
1462   return ret;
1463 }
1464
1465 static int 
1466 keyserver_work(enum ks_action action,STRLIST list,KEYDB_SEARCH_DESC *desc,
1467                int count,struct keyserver_spec *keyserver)
1468 {
1469   int rc=0,ret=0;
1470
1471   if(!keyserver)
1472     {
1473       log_error(_("no keyserver known (use option --keyserver)\n"));
1474       return G10ERR_BAD_URI;
1475     }
1476
1477 #ifdef DISABLE_KEYSERVER_HELPERS
1478
1479   log_error(_("external keyserver calls are not supported in this build\n"));
1480   return G10ERR_KEYSERVER;
1481
1482 #else
1483   /* Spawn a handler */
1484
1485   rc=keyserver_spawn(action,list,desc,count,&ret,keyserver);
1486   if(ret)
1487     {
1488       switch(ret)
1489         {
1490         case KEYSERVER_SCHEME_NOT_FOUND:
1491           log_error(_("no handler for keyserver scheme `%s'\n"),
1492                     keyserver->scheme);
1493           break;
1494
1495         case KEYSERVER_NOT_SUPPORTED:
1496           log_error(_("action `%s' not supported with keyserver "
1497                       "scheme `%s'\n"),
1498                     action==KS_GET?"get":action==KS_SEND?"send":
1499                     action==KS_SEARCH?"search":"unknown",
1500                     keyserver->scheme);
1501           break;
1502
1503         case KEYSERVER_VERSION_ERROR:
1504           log_error(_(GPGKEYS_PREFIX "%s does not support"
1505                       " handler version %d\n"),
1506                     keyserver_typemap(keyserver->scheme),
1507                     KEYSERVER_PROTO_VERSION);
1508           break;
1509
1510         case KEYSERVER_TIMEOUT:
1511           log_error(_("keyserver timed out\n"));
1512           break;
1513
1514         case KEYSERVER_INTERNAL_ERROR:
1515         default:
1516           log_error(_("keyserver internal error\n"));
1517           break;
1518         }
1519
1520       return G10ERR_KEYSERVER;
1521     }
1522
1523   if(rc)
1524     {
1525       log_error(_("keyserver communications error: %s\n"),g10_errstr(rc));
1526
1527       return rc;
1528     }
1529
1530   return 0;
1531 #endif /* ! DISABLE_KEYSERVER_HELPERS*/
1532 }
1533
1534 int 
1535 keyserver_export(STRLIST users)
1536 {
1537   STRLIST sl=NULL;
1538   KEYDB_SEARCH_DESC desc;
1539   int rc=0;
1540
1541   /* Weed out descriptors that we don't support sending */
1542   for(;users;users=users->next)
1543     {
1544       classify_user_id (users->d, &desc);
1545       if(desc.mode!=KEYDB_SEARCH_MODE_SHORT_KID &&
1546          desc.mode!=KEYDB_SEARCH_MODE_LONG_KID &&
1547          desc.mode!=KEYDB_SEARCH_MODE_FPR16 &&
1548          desc.mode!=KEYDB_SEARCH_MODE_FPR20)
1549         {
1550           log_error(_("\"%s\" not a key ID: skipping\n"),users->d);
1551           continue;
1552         }
1553       else
1554         append_to_strlist(&sl,users->d);
1555     }
1556
1557   if(sl)
1558     {
1559       rc=keyserver_work(KS_SEND,sl,NULL,0,opt.keyserver);
1560       free_strlist(sl);
1561     }
1562
1563   return rc;
1564 }
1565
1566 int 
1567 keyserver_import(STRLIST users)
1568 {
1569   KEYDB_SEARCH_DESC *desc;
1570   int num=100,count=0;
1571   int rc=0;
1572
1573   /* Build a list of key ids */
1574   desc=xmalloc(sizeof(KEYDB_SEARCH_DESC)*num);
1575
1576   for(;users;users=users->next)
1577     {
1578       classify_user_id (users->d, &desc[count]);
1579       if(desc[count].mode!=KEYDB_SEARCH_MODE_SHORT_KID &&
1580          desc[count].mode!=KEYDB_SEARCH_MODE_LONG_KID &&
1581          desc[count].mode!=KEYDB_SEARCH_MODE_FPR16 &&
1582          desc[count].mode!=KEYDB_SEARCH_MODE_FPR20)
1583         {
1584           log_error(_("\"%s\" not a key ID: skipping\n"),users->d);
1585           continue;
1586         }
1587
1588       count++;
1589       if(count==num)
1590         {
1591           num+=100;
1592           desc=xrealloc(desc,sizeof(KEYDB_SEARCH_DESC)*num);
1593         }
1594     }
1595
1596   if(count>0)
1597     rc=keyserver_work(KS_GET,NULL,desc,count,opt.keyserver);
1598
1599   xfree(desc);
1600
1601   return rc;
1602 }
1603
1604 int
1605 keyserver_import_fprint(const byte *fprint,size_t fprint_len,
1606                         struct keyserver_spec *keyserver)
1607 {
1608   KEYDB_SEARCH_DESC desc;
1609
1610   memset(&desc,0,sizeof(desc));
1611
1612   if(fprint_len==16)
1613     desc.mode=KEYDB_SEARCH_MODE_FPR16;
1614   else if(fprint_len==20)
1615     desc.mode=KEYDB_SEARCH_MODE_FPR20;
1616   else
1617     return -1;
1618
1619   memcpy(desc.u.fpr,fprint,fprint_len);
1620
1621   return keyserver_work(KS_GET,NULL,&desc,1,keyserver);
1622 }
1623
1624 int 
1625 keyserver_import_keyid(u32 *keyid,struct keyserver_spec *keyserver)
1626 {
1627   KEYDB_SEARCH_DESC desc;
1628
1629   memset(&desc,0,sizeof(desc));
1630
1631   desc.mode=KEYDB_SEARCH_MODE_LONG_KID;
1632   desc.u.kid[0]=keyid[0];
1633   desc.u.kid[1]=keyid[1];
1634
1635   return keyserver_work(KS_GET,NULL,&desc,1,keyserver);
1636 }
1637
1638 /* code mostly stolen from do_export_stream */
1639 static int 
1640 keyidlist(STRLIST users,KEYDB_SEARCH_DESC **klist,int *count,int fakev3)
1641 {
1642   int rc=0,ndesc,num=100;
1643   KBNODE keyblock=NULL,node;
1644   KEYDB_HANDLE kdbhd;
1645   KEYDB_SEARCH_DESC *desc;
1646   STRLIST sl;
1647
1648   *count=0;
1649
1650   *klist=xmalloc(sizeof(KEYDB_SEARCH_DESC)*num);
1651
1652   kdbhd=keydb_new(0);
1653
1654   if(!users)
1655     {
1656       ndesc = 1;
1657       desc = xmalloc_clear ( ndesc * sizeof *desc);
1658       desc[0].mode = KEYDB_SEARCH_MODE_FIRST;
1659     }
1660   else
1661     {
1662       for (ndesc=0, sl=users; sl; sl = sl->next, ndesc++) 
1663         ;
1664       desc = xmalloc ( ndesc * sizeof *desc);
1665         
1666       for (ndesc=0, sl=users; sl; sl = sl->next)
1667         {
1668           if(classify_user_id (sl->d, desc+ndesc))
1669             ndesc++;
1670           else
1671             log_error (_("key \"%s\" not found: %s\n"),
1672                        sl->d, g10_errstr (G10ERR_INV_USER_ID));
1673         }
1674     }
1675
1676   while (!(rc = keydb_search (kdbhd, desc, ndesc)))
1677     {
1678       if (!users) 
1679         desc[0].mode = KEYDB_SEARCH_MODE_NEXT;
1680
1681       /* read the keyblock */
1682       rc = keydb_get_keyblock (kdbhd, &keyblock );
1683       if( rc )
1684         {
1685           log_error (_("error reading keyblock: %s\n"), g10_errstr(rc) );
1686           goto leave;
1687         }
1688
1689       if((node=find_kbnode(keyblock,PKT_PUBLIC_KEY)))
1690         {
1691           /* This is to work around a bug in some keyservers (pksd and
1692              OKS) that calculate v4 RSA keyids as if they were v3 RSA.
1693              The answer is to refresh both the correct v4 keyid
1694              (e.g. 99242560) and the fake v3 keyid (e.g. 68FDDBC7).
1695              This only happens for key refresh using the HKP scheme
1696              and if the refresh-add-fake-v3-keyids keyserver option is
1697              set. */
1698           if(fakev3 && is_RSA(node->pkt->pkt.public_key->pubkey_algo) &&
1699              node->pkt->pkt.public_key->version>=4)
1700             {
1701               (*klist)[*count].mode=KEYDB_SEARCH_MODE_LONG_KID;
1702               mpi_get_keyid(node->pkt->pkt.public_key->pkey[0],
1703                             (*klist)[*count].u.kid);
1704               (*count)++;
1705
1706               if(*count==num)
1707                 {
1708                   num+=100;
1709                   *klist=xrealloc(*klist,sizeof(KEYDB_SEARCH_DESC)*num);
1710                 }
1711             }
1712
1713           /* v4 keys get full fingerprints.  v3 keys get long keyids.
1714              This is because it's easy to calculate any sort of keyid
1715              from a v4 fingerprint, but not a v3 fingerprint. */
1716
1717           if(node->pkt->pkt.public_key->version<4)
1718             {
1719               (*klist)[*count].mode=KEYDB_SEARCH_MODE_LONG_KID;
1720               keyid_from_pk(node->pkt->pkt.public_key,
1721                             (*klist)[*count].u.kid);
1722             }
1723           else
1724             {
1725               size_t dummy;
1726
1727               (*klist)[*count].mode=KEYDB_SEARCH_MODE_FPR20;
1728               fingerprint_from_pk(node->pkt->pkt.public_key,
1729                                   (*klist)[*count].u.fpr,&dummy);
1730             }
1731
1732           /* This is a little hackish, using the skipfncvalue as a
1733              void* pointer to the keyserver spec, but we don't need
1734              the skipfnc here, and it saves having an additional field
1735              for this (which would be wasted space most of the
1736              time). */
1737
1738           (*klist)[*count].skipfncvalue=NULL;
1739
1740           /* Are we honoring preferred keyservers? */
1741           if(opt.keyserver_options.options&KEYSERVER_HONOR_KEYSERVER_URL)
1742             {
1743               PKT_user_id *uid=NULL;
1744               PKT_signature *sig=NULL;
1745
1746               merge_keys_and_selfsig(keyblock);
1747
1748               for(node=node->next;node;node=node->next)
1749                 {
1750                   if(node->pkt->pkttype==PKT_USER_ID
1751                      && node->pkt->pkt.user_id->is_primary)
1752                     uid=node->pkt->pkt.user_id;
1753                   else if(node->pkt->pkttype==PKT_SIGNATURE
1754                           && node->pkt->pkt.signature->
1755                           flags.chosen_selfsig && uid)
1756                     {
1757                       sig=node->pkt->pkt.signature;
1758                       break;
1759                     }
1760                 }
1761
1762               /* Try and parse the keyserver URL.  If it doesn't work,
1763                  then we end up writing NULL which indicates we are
1764                  the same as any other key. */
1765               if(sig)
1766                 (*klist)[*count].skipfncvalue=parse_preferred_keyserver(sig);
1767             }
1768
1769           (*count)++;
1770
1771           if(*count==num)
1772             {
1773               num+=100;
1774               *klist=xrealloc(*klist,sizeof(KEYDB_SEARCH_DESC)*num);
1775             }
1776         }
1777     }
1778
1779   if(rc==-1)
1780     rc=0;
1781   
1782  leave:
1783   if(rc)
1784     xfree(*klist);
1785   xfree(desc);
1786   keydb_release(kdbhd);
1787   release_kbnode(keyblock);
1788
1789   return rc;
1790 }
1791
1792 /* Note this is different than the original HKP refresh.  It allows
1793    usernames to refresh only part of the keyring. */
1794
1795 int
1796 keyserver_refresh(STRLIST users)
1797 {
1798   int rc,count,numdesc,fakev3=0;
1799   KEYDB_SEARCH_DESC *desc;
1800   unsigned int options=opt.keyserver_options.import_options;
1801
1802   /* We switch merge-only on during a refresh, as 'refresh' should
1803      never import new keys, even if their keyids match. */
1804   opt.keyserver_options.import_options|=IMPORT_MERGE_ONLY;
1805
1806   /* Similarly, we switch on fast-import, since refresh may make
1807      multiple import sets (due to preferred keyserver URLs).  We don't
1808      want each set to rebuild the trustdb.  Instead we do it once at
1809      the end here. */
1810   opt.keyserver_options.import_options|=IMPORT_FAST;
1811
1812   /* If refresh_add_fake_v3_keyids is on and it's a HKP or MAILTO
1813      scheme, then enable fake v3 keyid generation. */
1814   if((opt.keyserver_options.options&KEYSERVER_ADD_FAKE_V3) && opt.keyserver
1815      && (ascii_strcasecmp(opt.keyserver->scheme,"hkp")==0 ||
1816          ascii_strcasecmp(opt.keyserver->scheme,"mailto")==0))
1817     fakev3=1;
1818
1819   rc=keyidlist(users,&desc,&numdesc,fakev3);
1820   if(rc)
1821     return rc;
1822
1823   count=numdesc;
1824   if(count>0)
1825     {
1826       int i;
1827
1828       /* Try to handle preferred keyserver keys first */
1829       for(i=0;i<numdesc;i++)
1830         {
1831           if(desc[i].skipfncvalue)
1832             {
1833               struct keyserver_spec *keyserver=desc[i].skipfncvalue;
1834
1835               /* We use the keyserver structure we parsed out before.
1836                  Note that a preferred keyserver without a scheme://
1837                  will be interpreted as hkp:// */
1838
1839               rc=keyserver_work(KS_GET,NULL,&desc[i],1,keyserver);
1840               if(rc)
1841                 log_info(_("WARNING: unable to refresh key %s"
1842                            " via %s: %s\n"),keystr_from_desc(&desc[i]),
1843                          keyserver->uri,g10_errstr(rc));
1844               else
1845                 {
1846                   /* We got it, so mark it as NONE so we don't try and
1847                      get it again from the regular keyserver. */
1848
1849                   desc[i].mode=KEYDB_SEARCH_MODE_NONE;
1850                   count--;
1851                 }
1852
1853               free_keyserver_spec(keyserver);
1854             }
1855         }
1856     }
1857
1858   if(count>0)
1859     {
1860       if(opt.keyserver)
1861         {
1862           if(count==1)
1863             log_info(_("refreshing 1 key from %s\n"),opt.keyserver->uri);
1864           else
1865             log_info(_("refreshing %d keys from %s\n"),
1866                      count,opt.keyserver->uri);
1867         }
1868
1869       rc=keyserver_work(KS_GET,NULL,desc,numdesc,opt.keyserver);
1870     }
1871
1872   xfree(desc);
1873
1874   opt.keyserver_options.import_options=options;
1875
1876   /* If the original options didn't have fast import, and the trustdb
1877      is dirty, rebuild. */
1878   if(!(opt.keyserver_options.import_options&IMPORT_FAST))
1879     trustdb_check_or_update();
1880
1881   return rc;
1882 }
1883
1884 int
1885 keyserver_search(STRLIST tokens)
1886 {
1887   if(tokens)
1888     return keyserver_work(KS_SEARCH,tokens,NULL,0,opt.keyserver);
1889   else
1890     return 0;
1891 }
1892
1893 int
1894 keyserver_fetch(STRLIST urilist)
1895 {
1896   KEYDB_SEARCH_DESC desc;
1897   STRLIST sl;
1898   unsigned int options=opt.keyserver_options.import_options;
1899
1900   /* Switch on fast-import, since fetch can handle more than one
1901      import and we don't want each set to rebuild the trustdb.
1902      Instead we do it once at the end. */
1903   opt.keyserver_options.import_options|=IMPORT_FAST;
1904
1905   /* A dummy desc since we're not actually fetching a particular key
1906      ID */
1907   memset(&desc,0,sizeof(desc));
1908   desc.mode=KEYDB_SEARCH_MODE_EXACT;
1909
1910   for(sl=urilist;sl;sl=sl->next)
1911     {
1912       struct keyserver_spec *spec;
1913
1914       spec=parse_keyserver_uri(sl->d,1,NULL,0);
1915       if(spec)
1916         {
1917           int rc;
1918
1919           /*
1920             Set the direct_uri flag so we know later to call a direct
1921             handler instead of the keyserver style.  This lets us use
1922             gpgkeys_curl or gpgkeys_ldapuri instead of gpgkeys_ldap to
1923             fetch things like
1924             ldap://keyserver.pgp.com/o=PGP%20keys?pgpkey?sub?pgpkeyid=99242560
1925           */
1926           spec->flags.direct_uri=1;
1927
1928           rc=keyserver_work(KS_GET,NULL,&desc,1,spec);
1929           if(rc)
1930             log_info (_("WARNING: unable to fetch URI %s: %s\n"),
1931                      sl->d,g10_errstr(rc));
1932
1933           free_keyserver_spec(spec);
1934         }
1935       else
1936         log_info (_("WARNING: unable to parse URI %s\n"),sl->d);
1937     }
1938
1939   opt.keyserver_options.import_options=options;
1940
1941   /* If the original options didn't have fast import, and the trustdb
1942      is dirty, rebuild. */
1943   if(!(opt.keyserver_options.import_options&IMPORT_FAST))
1944     trustdb_check_or_update();
1945
1946   return 0;
1947 }
1948
1949 /* Import key in a CERT or pointed to by a CERT */
1950 int
1951 keyserver_import_cert(const char *name)
1952 {
1953   char *domain,*look,*url;
1954   IOBUF key;
1955   int type,rc=-1;
1956
1957   look=xstrdup(name);
1958
1959   domain=strrchr(look,'@');
1960   if(domain)
1961     *domain='.';
1962
1963   type=get_cert(look,max_cert_size,&key,&url);
1964   if(type==1)
1965     {
1966       int armor_status=opt.no_armor;
1967
1968       /* CERTs are always in binary format */
1969       opt.no_armor=1;
1970
1971       rc=import_keys_stream(key,NULL,opt.keyserver_options.import_options);
1972
1973       opt.no_armor=armor_status;
1974
1975       iobuf_close(key);
1976     }
1977   else if(type==2)
1978     {
1979       struct keyserver_spec *spec;
1980
1981       spec=parse_keyserver_uri(url,1,NULL,0);
1982       if(spec)
1983         {
1984           STRLIST list=NULL;
1985
1986           add_to_strlist(&list,url);
1987
1988           rc=keyserver_fetch(list);
1989
1990           free_strlist(list);
1991           free_keyserver_spec(spec);
1992         }
1993
1994       xfree(url);
1995     }
1996
1997   xfree(look);
1998
1999   return rc;
2000 }
2001
2002 /* Import key pointed to by a PKA record. Return the requested
2003    fingerprint in fpr. */
2004 int
2005 keyserver_import_pka(const char *name,unsigned char *fpr)
2006 {
2007   char *uri;
2008   int rc=-1;
2009
2010   uri = get_pka_info (name, fpr);
2011   if (uri)
2012     {
2013       struct keyserver_spec *spec;
2014       spec = parse_keyserver_uri (uri, 1, NULL, 0);
2015       if (spec)
2016         {
2017           rc=keyserver_import_fprint (fpr, 20, spec);
2018           free_keyserver_spec (spec);
2019         }
2020       xfree (uri);
2021     }
2022
2023   return rc;
2024 }
2025
2026 /* Import all keys that match name */
2027 int
2028 keyserver_import_name(const char *name,struct keyserver_spec *keyserver)
2029 {
2030   STRLIST list=NULL;
2031   int rc;
2032
2033   append_to_strlist(&list,name);
2034
2035   rc=keyserver_work(KS_GETNAME,list,NULL,0,keyserver);
2036
2037   free_strlist(list);
2038
2039   return rc;
2040 }
2041
2042 /* Use the PGP Universal trick of asking ldap://keys.(maildomain) for
2043    the key. */
2044 int
2045 keyserver_import_ldap(const char *name)
2046 {
2047   char *domain;
2048   struct keyserver_spec *keyserver;
2049   STRLIST list=NULL;
2050   int rc;
2051
2052   append_to_strlist(&list,name);
2053
2054   /* Parse out the domain */
2055   domain=strrchr(name,'@');
2056   if(!domain)
2057     return G10ERR_GENERAL;
2058
2059   domain++;
2060
2061   keyserver=xmalloc_clear(sizeof(struct keyserver_spec));
2062
2063   keyserver->scheme=xstrdup("ldap");
2064   keyserver->host=xmalloc(5+strlen(domain)+1);
2065   strcpy(keyserver->host,"keys.");
2066   strcat(keyserver->host,domain);
2067   keyserver->uri=xmalloc(strlen(keyserver->scheme)+
2068                          3+strlen(keyserver->host)+1);
2069   strcpy(keyserver->uri,keyserver->scheme);
2070   strcat(keyserver->uri,"://");
2071   strcat(keyserver->uri,keyserver->host);
2072     
2073   rc=keyserver_work(KS_GETNAME,list,NULL,0,keyserver);
2074
2075   free_strlist(list);
2076
2077   free_keyserver_spec(keyserver);
2078
2079   return rc;
2080 }