* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ * along with this program; if not, see <https://www.gnu.org/licenses/>.
*/
#include <config.h>
#include "options.h"
#include "call-agent.h"
#include "i18n.h"
-
-#include <assert.h>
-
-static int
-string_count_chr (const char *string, int c)
-{
- int count;
-
- for (count=0; *string; string++ )
- if ( *string == c )
- count++;
- return count;
-}
-
+#include "zb32.h"
#ifdef ENABLE_SELINUX_HACKS
struct stat buf;
struct secured_file_item *sf;
- /* Note that we stop immediatley if something goes wrong here. */
+ /* Note that we stop immediately if something goes wrong here. */
if (stat (fname, &buf))
log_fatal (_("fstat of '%s' failed in %s: %s\n"), fname,
"register_secured_file", strerror (errno));
return csum;
}
-u32
-buffer_to_u32( const byte *buffer )
-{
- unsigned long a;
- a = *buffer << 24;
- a |= buffer[1] << 16;
- a |= buffer[2] << 8;
- a |= buffer[3];
- return a;
-}
void
print_pubkey_algo_note (pubkey_algo_t algo)
if(!warn)
{
warn=1;
+ es_fflush (es_stdout);
log_info (_("WARNING: using experimental public key algorithm %s\n"),
openpgp_pk_algo_name (algo));
}
}
else if (algo == PUBKEY_ALGO_ELGAMAL)
{
+ es_fflush (es_stdout);
log_info (_("WARNING: Elgamal sign+encrypt keys are deprecated\n"));
}
}
if(!warn)
{
warn=1;
+ es_fflush (es_stdout);
log_info (_("WARNING: using experimental cipher algorithm %s\n"),
openpgp_cipher_algo_name (algo));
}
void
print_digest_algo_note (digest_algo_t algo)
{
+ const enum gcry_md_algos galgo = map_md_openpgp_to_gcry (algo);
+ const struct weakhash *weak;
+
if(algo >= 100 && algo <= 110)
{
static int warn=0;
if(!warn)
{
warn=1;
+ es_fflush (es_stdout);
log_info (_("WARNING: using experimental digest algorithm %s\n"),
- gcry_md_algo_name (algo));
+ gcry_md_algo_name (galgo));
}
}
- else if(algo==DIGEST_ALGO_MD5)
- log_info (_("WARNING: digest algorithm %s is deprecated\n"),
- gcry_md_algo_name (algo));
+ else
+ for (weak = opt.weak_digests; weak != NULL; weak = weak->next)
+ if (weak->algo == galgo)
+ {
+ es_fflush (es_stdout);
+ log_info (_("WARNING: digest algorithm %s is deprecated\n"),
+ gcry_md_algo_name (galgo));
+ }
+}
+
+
+void
+print_digest_rejected_note (enum gcry_md_algos algo)
+{
+ struct weakhash* weak;
+ int show = 1;
+ for (weak = opt.weak_digests; weak; weak = weak->next)
+ if (weak->algo == algo)
+ {
+ if (weak->rejection_shown)
+ show = 0;
+ else
+ weak->rejection_shown = 1;
+ break;
+ }
+
+ if (show)
+ {
+ es_fflush (es_stdout);
+ log_info
+ (_("Note: signatures using the %s algorithm are rejected\n"),
+ gcry_md_algo_name(algo));
+ }
+}
+
+
+/* Print a message
+ * "(reported error: %s)\n
+ * in verbose mode to further explain an error. If the error code has
+ * the value IGNORE_EC no message is printed. A message is also not
+ * printed if ERR is 0. */
+void
+print_reported_error (gpg_error_t err, gpg_err_code_t ignore_ec)
+{
+ if (!opt.verbose)
+ return;
+
+ if (!gpg_err_code (err))
+ ;
+ else if (gpg_err_code (err) == ignore_ec)
+ ;
+ else if (gpg_err_source (err) == GPG_ERR_SOURCE_DEFAULT)
+ log_info (_("(reported error: %s)\n"),
+ gpg_strerror (err));
+ else
+ log_info (_("(reported error: %s <%s>)\n"),
+ gpg_strerror (err), gpg_strsource (err));
+
+}
+
+
+/* Print a message
+ * "(further info: %s)\n
+ * in verbose mode to further explain an error. That message is
+ * intended to help debug a problem and should not be translated.
+ */
+void
+print_further_info (const char *format, ...)
+{
+ va_list arg_ptr;
+
+ if (!opt.verbose)
+ return;
+
+ log_info (_("(further info: "));
+ va_start (arg_ptr, format);
+ log_logv (GPGRT_LOG_CONT, format, arg_ptr);
+ va_end (arg_ptr);
+ log_printf (")\n");
}
}
/****************
- * Wrapper around the libgcrypt function with additonal checks on
+ * Wrapper around the libgcrypt function with additional checks on
* the OpenPGP contraints for the algo ID.
*/
int
case DIGEST_ALGO_SHA224: return 0;
#endif
-#ifdef GPG_USE_SHA256
case DIGEST_ALGO_SHA256: return GCRY_MD_SHA256;
-#else
- case DIGEST_ALGO_SHA256: return 0;
-#endif
#ifdef GPG_USE_SHA384
case DIGEST_ALGO_SHA384: return GCRY_MD_SHA384;
}
break;
- case 'p': /* primary pk fingerprint of a sk */
- case 'f': /* pk fingerprint */
- case 'g': /* sk fingerprint */
+ case 'f': /* Fingerprint of key being signed */
+ case 'p': /* Fingerprint of the primary key making the signature. */
+ case 'g': /* Fingerprint of the key making the signature. */
{
byte array[MAX_FINGERPRINT_LEN];
size_t len;
int i;
- if((*(ch+1))=='p' && args->pksk)
+ if ((*(ch+1))=='f' && args->pk)
+ fingerprint_from_pk (args->pk, array, &len);
+ else if ((*(ch+1))=='p' && args->pksk)
{
if(args->pksk->flags.primary)
fingerprint_from_pk (args->pksk, array, &len);
else if (args->pksk->main_keyid[0]
|| args->pksk->main_keyid[1])
{
- /* FIXME: Document teh code and check whether
- it is still needed. */
+ /* Not the primary key: Find the fingerprint
+ of the primary key. */
PKT_public_key *pk=
xmalloc_clear(sizeof(PKT_public_key));
memset (array, 0, (len=MAX_FINGERPRINT_LEN));
free_public_key (pk);
}
- else
+ else /* Oops: info about the primary key missing. */
memset(array,0,(len=MAX_FINGERPRINT_LEN));
}
- else if((*(ch+1))=='f' && args->pk)
- fingerprint_from_pk (args->pk, array, &len);
else if((*(ch+1))=='g' && args->pksk)
fingerprint_from_pk (args->pksk, array, &len);
else
void
-obsolete_option (const char *configname, unsigned int configlineno,
- const char *name)
+obsolete_scdaemon_option (const char *configname, unsigned int configlineno,
+ const char *name)
{
- if(configname)
- log_info (_("%s:%u: obsolete option \"%s\" - it has no effect\n"),
- configname, configlineno, name);
+ if (configname)
+ log_info (_("%s:%u: \"%s\" is obsolete in this file"
+ " - it only has effect in %s\n"),
+ configname, configlineno, name, SCDAEMON_NAME EXTSEP_S "conf");
else
- log_info (_("WARNING: \"%s\" is an obsolete option - it has no effect\n"),
- name);
+ log_info (_("WARNING: \"%s%s\" is an obsolete option"
+ " - it has no effect except on %s\n"),
+ "--", name, SCDAEMON_NAME);
}
{
int val;
- /* FIXME: We should make use of our wrapper fucntion and not assume
+ /* FIXME: We should make use of our wrapper function and not assume
that there is a 1 to 1 mapping between OpenPGP and Libgcrypt. */
val = gcry_md_map_name (string);
if (!val && string && (string[0]=='H' || string[0]=='h'))
#ifdef HAVE_BZIP2
case 3: return 0;
#endif
- default: return G10ERR_COMPR_ALGO;
+ default: return GPG_ERR_COMPR_ALGO;
}
}
case CO_GNUPG: return "--gnupg";
case CO_RFC4880: return "--openpgp";
case CO_RFC2440: return "--rfc2440";
- case CO_RFC1991: return "--rfc1991";
- case CO_PGP2: return "--pgp2";
case CO_PGP6: return "--pgp6";
case CO_PGP7: return "--pgp7";
case CO_PGP8: return "--pgp8";
+ case CO_DE_VS: return "--compliance=de-vs";
}
return ver;
ver="OpenPGP (older)";
break;
- case CO_RFC1991:
- ver="old PGP";
- break;
-
- case CO_PGP2:
- ver="PGP 2.x";
- break;
-
case CO_PGP6:
ver="PGP 6.x";
break;
case CO_PGP8:
ver="PGP 8.x";
break;
+
+ case CO_DE_VS:
+ ver="DE-VS applications";
+ break;
}
log_info(_("this message may not be usable by %s\n"),ver);
for(i=0;opts[i].name;i++)
if(opts[i].help)
- printf("%s%*s%s\n",opts[i].name,
- maxlen+2-(int)strlen(opts[i].name),"",_(opts[i].help));
+ es_printf("%s%*s%s\n",opts[i].name,
+ maxlen+2-(int)strlen(opts[i].name),"",_(opts[i].help));
g10_exit(0);
}
}
-/* Check whether the string has characters not valid in an RFC-822
- address. To cope with OpenPGP we ignore non-ascii characters
- so that for example umlauts are legal in an email address. An
- OpenPGP user ID must be utf-8 encoded but there is no strict
- requirement for RFC-822. Thus to avoid IDNA encoding we put the
- address verbatim as utf-8 into the user ID under the assumption
- that mail programs handle IDNA at a lower level and take OpenPGP
- user IDs as utf-8. Note that we can't do an utf-8 encoding
- checking here because in keygen.c this function is called with the
- native encoding and native to utf-8 encoding is only done later. */
-int
-has_invalid_email_chars (const char *s)
-{
- int at_seen=0;
- const char *valid_chars=
- "01234567890_-.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
-
- for ( ; *s; s++ )
- {
- if ( (*s & 0x80) )
- continue; /* We only care about ASCII. */
- if ( *s == '@' )
- at_seen=1;
- else if ( !at_seen && !(strchr (valid_chars, *s)
- || strchr ("!#$%&'*+/=?^`{|}~", *s)))
- return 1;
- else if ( at_seen && !strchr( valid_chars, *s ) )
- return 1;
- }
- return 0;
-}
-
-
-/* Check whether NAME represents a valid mailbox according to
- RFC822. Returns true if so. */
-int
-is_valid_mailbox (const char *name)
-{
- return !( !name
- || !*name
- || has_invalid_email_chars (name)
- || string_count_chr (name,'@') != 1
- || *name == '@'
- || name[strlen(name)-1] == '@'
- || name[strlen(name)-1] == '.'
- || strstr (name, "..") );
-}
-
-
-/* Check whether UID is a valid standard user id of the form
- "Heinrich Heine <heinrichh@duesseldorf.de>"
- and return true if this is the case. */
-int
-is_valid_user_id (const char *uid)
-{
- if (!uid || !*uid)
- return 0;
-
- return 1;
-}
-
-
-
/* Similar to access(2), but uses PATH to find the file. */
int
path_access(const char *file,int mode)
int
mpi_print (estream_t fp, gcry_mpi_t a, int mode)
{
- int n=0;
+ int n = 0;
+ size_t nwritten;
if (!a)
return es_fprintf (fp, "[MPI_NULL]");
n += es_fprintf (fp, "[invalid opaque value]");
else
{
- nbits = (nbits + 7)/8;
- for (; nbits; nbits--, p++)
- n += es_fprintf (fp, "%02X", *p);
+ if (!es_write_hexstring (fp, p, (nbits + 7)/8, 0, &nwritten))
+ n += nwritten;
}
}
else
{
unsigned char *buffer;
+ size_t buflen;
- if (gcry_mpi_aprint (GCRYMPI_FMT_HEX, &buffer, NULL, a))
+ if (gcry_mpi_aprint (GCRYMPI_FMT_USG, &buffer, &buflen, a))
BUG ();
- es_fputs (buffer, fp);
- n += strlen (buffer);
+ if (!es_write_hexstring (fp, buffer, buflen, 0, &nwritten))
+ n += nwritten;
gcry_free (buffer);
}
return n;
qbits /= 2;
return qbits;
}
+
+
+/* Ignore signatures and certifications made over certain digest
+ * algorithms by default, MD5 is considered weak. This allows users
+ * to deprecate support for other algorithms as well.
+ */
+void
+additional_weak_digest (const char* digestname)
+{
+ struct weakhash *weak = NULL;
+ const enum gcry_md_algos algo = string_to_digest_algo(digestname);
+
+ if (algo == GCRY_MD_NONE)
+ {
+ log_error (_("unknown weak digest '%s'\n"), digestname);
+ return;
+ }
+
+ /* Check to ensure it's not already present. */
+ for (weak = opt.weak_digests; weak; weak = weak->next)
+ if (algo == weak->algo)
+ return;
+
+ /* Add it to the head of the list. */
+ weak = xmalloc(sizeof(*weak));
+ weak->algo = algo;
+ weak->rejection_shown = 0;
+ weak->next = opt.weak_digests;
+ opt.weak_digests = weak;
+}
projects / gnupg.git / blobdiff