[git] GnuPG - branch, master, updated. gnupg-2.1.8-66-gae471fa
by Werner Koch
cvs at cvs.gnupg.org
Mon Oct 5 17:57:16 CEST 2015
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".
The branch, master has been updated
via ae471fa978589fb61ecb0f89bbfe4d43cf2d5eac (commit)
via a48e6de603c3a312f02b1b5fdb813032eeae9074 (commit)
from 438730323a5d9bbf8dd5cd60d479b6c03f8721d0 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit ae471fa978589fb61ecb0f89bbfe4d43cf2d5eac
Author: Werner Koch <wk at gnupg.org>
Date: Mon Oct 5 17:52:28 2015 +0200
gpg: Deprecate the --keyserver option.
* g10/keyserver.c (keyserver_refresh): Change return type to
gpg_error_t. Use gpg_dirmngr_ks_list to print the name of the
keyserver to use.
(keyserver_search): Do not print the "no keyserver" error
message. The same error is anyway returned from dirmngr.
* g10/call-dirmngr.c (ks_status_parm_s): Add field "keyword".
(ks_status_cb): Handle other status keywords.
(gpg_dirmngr_ks_list): New.
* tools/gpgconf-comp.c (gc_options_gpg): Deprecate "keyserver".
(gc_options_dirmngr): Add "Keyserver" group and "keyserver".
--
Along with the corresponding dirmngr change this option allows to
configure the keyserver only in dirmngr.conf. Existing
configurations will continue to work. However, GUIs using gpgconf
now the keyserver option under the dirmngr (aka Key Acquirer) tab
unless they are in export mode in which the keyserver option is also
show for gpg.
Signed-off-by: Werner Koch <wk at gnupg.org>
diff --git a/doc/gpg.texi b/doc/gpg.texi
index 28e4f83..7d78e9e 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -1504,6 +1504,9 @@ ignored if the option --with-colons is used.
@item --keyserver @code{name}
@opindex keyserver
+This option is deprecated - please use the @option{--keyserver} in
+ at file{dirmngr.conf} instead.
+
Use @code{name} as your keyserver. This is the server that
@option{--recv-keys}, @option{--send-keys}, and @option{--search-keys}
will communicate with to receive keys from, send keys to, and search for
@@ -1586,6 +1589,7 @@ are available for all keyserver types, some common options are:
@option{--recv-keys} command as a whole. Defaults to 30 seconds.
@item http-proxy=@code{value}
+ This options is deprecated.
Set the proxy to use for HTTP and HKP keyservers.
This overrides any proxy defined in @file{dirmngr.conf}.
diff --git a/g10/call-dirmngr.c b/g10/call-dirmngr.c
index df19e4c..75cd51d 100644
--- a/g10/call-dirmngr.c
+++ b/g10/call-dirmngr.c
@@ -44,6 +44,7 @@
/* Parameter structure used to gather status info. */
struct ks_status_parm_s
{
+ const char *keyword; /* Look for this keyword or NULL for "SOURCE". */
char *source;
};
@@ -334,7 +335,7 @@ clear_context_flags (ctrl_t ctrl, assuan_context_t ctx)
-/* Status callback for ks_get and ks_search. */
+/* Status callback for ks_list, ks_get and ks_search. */
static gpg_error_t
ks_status_cb (void *opaque, const char *line)
{
@@ -342,7 +343,7 @@ ks_status_cb (void *opaque, const char *line)
gpg_error_t err = 0;
const char *s;
- if ((s = has_leading_keyword (line, "SOURCE")))
+ if ((s = has_leading_keyword (line, parm->keyword? parm->keyword : "SOURCE")))
{
if (!parm->source)
{
@@ -357,6 +358,44 @@ ks_status_cb (void *opaque, const char *line)
+/* Run the "KEYSERVER" command to return the name of the used
+ keyserver at R_KEYSERVER. */
+gpg_error_t
+gpg_dirmngr_ks_list (ctrl_t ctrl, char **r_keyserver)
+{
+ gpg_error_t err;
+ assuan_context_t ctx;
+ struct ks_status_parm_s stparm;
+
+ memset (&stparm, 0, sizeof stparm);
+ stparm.keyword = "KEYSERVER";
+ *r_keyserver = NULL;
+
+ err = open_context (ctrl, &ctx);
+ if (err)
+ return err;
+
+ err = assuan_transact (ctx, "KEYSERVER", NULL, NULL,
+ NULL, NULL, ks_status_cb, &stparm);
+ if (err)
+ goto leave;
+ if (!stparm.source)
+ {
+ err = gpg_error (GPG_ERR_NO_KEYSERVER);
+ goto leave;
+ }
+
+ *r_keyserver = stparm.source;
+ stparm.source = NULL;
+
+ leave:
+ xfree (stparm.source);
+ close_context (ctrl, ctx);
+ return err;
+}
+
+
+
/* Data callback for the KS_SEARCH command. */
static gpg_error_t
ks_search_data_cb (void *opaque, const void *data, size_t datalen)
diff --git a/g10/call-dirmngr.h b/g10/call-dirmngr.h
index b9b8e21..cdad645 100644
--- a/g10/call-dirmngr.h
+++ b/g10/call-dirmngr.h
@@ -21,6 +21,7 @@
void gpg_dirmngr_deinit_session_data (ctrl_t ctrl);
+gpg_error_t gpg_dirmngr_ks_list (ctrl_t ctrl, char **r_keyserver);
gpg_error_t gpg_dirmngr_ks_search (ctrl_t ctrl, const char *searchstr,
gpg_error_t (*cb)(void*, int, char *),
void *cb_value);
diff --git a/g10/keyserver-internal.h b/g10/keyserver-internal.h
index fc1c343..beaa13c 100644
--- a/g10/keyserver-internal.h
+++ b/g10/keyserver-internal.h
@@ -37,7 +37,7 @@ int keyserver_import_fprint (ctrl_t ctrl, const byte *fprint,size_t fprint_len,
struct keyserver_spec *keyserver);
int keyserver_import_keyid (ctrl_t ctrl, u32 *keyid,
struct keyserver_spec *keyserver);
-int keyserver_refresh (ctrl_t ctrl, strlist_t users);
+gpg_error_t keyserver_refresh (ctrl_t ctrl, strlist_t users);
gpg_error_t keyserver_search (ctrl_t ctrl, strlist_t tokens);
int keyserver_fetch (ctrl_t ctrl, strlist_t urilist);
int keyserver_import_cert (ctrl_t ctrl, const char *name,
diff --git a/g10/keyserver.c b/g10/keyserver.c
index 40ba49a..e20c16b 100644
--- a/g10/keyserver.c
+++ b/g10/keyserver.c
@@ -1357,10 +1357,12 @@ keyidlist(strlist_t users,KEYDB_SEARCH_DESC **klist,int *count,int fakev3)
/* Note this is different than the original HKP refresh. It allows
usernames to refresh only part of the keyring. */
-int
+gpg_error_t
keyserver_refresh (ctrl_t ctrl, strlist_t users)
{
- int rc,count,numdesc,fakev3=0;
+ gpg_error_t err;
+ int count, numdesc;
+ int fakev3 = 0;
KEYDB_SEARCH_DESC *desc;
unsigned int options=opt.keyserver_options.import_options;
@@ -1381,9 +1383,9 @@ keyserver_refresh (ctrl_t ctrl, strlist_t users)
ascii_strcasecmp(opt.keyserver->scheme,"mailto")==0))
fakev3=1;
- rc=keyidlist(users,&desc,&numdesc,fakev3);
- if(rc)
- return rc;
+ err = keyidlist (users, &desc, &numdesc, fakev3);
+ if (err)
+ return err;
count=numdesc;
if(count>0)
@@ -1403,11 +1405,11 @@ keyserver_refresh (ctrl_t ctrl, strlist_t users)
/* We use the keyserver structure we parsed out before.
Note that a preferred keyserver without a scheme://
will be interpreted as hkp:// */
- rc = keyserver_get (ctrl, &desc[i], 1, keyserver, NULL, NULL);
- if(rc)
+ err = keyserver_get (ctrl, &desc[i], 1, keyserver, NULL, NULL);
+ if (err)
log_info(_("WARNING: unable to refresh key %s"
" via %s: %s\n"),keystr_from_desc(&desc[i]),
- keyserver->uri,gpg_strerror (rc));
+ keyserver->uri,gpg_strerror (err));
else
{
/* We got it, so mark it as NONE so we don't try and
@@ -1424,16 +1426,22 @@ keyserver_refresh (ctrl_t ctrl, strlist_t users)
if(count>0)
{
- if(opt.keyserver && !opt.quiet)
- {
- if(count==1)
- log_info(_("refreshing 1 key from %s\n"),opt.keyserver->uri);
- else
- log_info(_("refreshing %d keys from %s\n"),
- count,opt.keyserver->uri);
- }
+ char *tmpuri;
- rc=keyserver_get (ctrl, desc, numdesc, NULL, NULL, NULL);
+ err = gpg_dirmngr_ks_list (ctrl, &tmpuri);
+ if (!err)
+ {
+ if (!opt.quiet)
+ {
+ if(count==1)
+ log_info(_("refreshing 1 key from %s\n"), tmpuri);
+ else
+ log_info(_("refreshing %d keys from %s\n"), count, tmpuri);
+ }
+ xfree (tmpuri);
+
+ err = keyserver_get (ctrl, desc, numdesc, NULL, NULL, NULL);
+ }
}
xfree(desc);
@@ -1445,7 +1453,7 @@ keyserver_refresh (ctrl_t ctrl, strlist_t users)
if(!(opt.keyserver_options.import_options&IMPORT_FAST))
check_or_update_trustdb ();
- return rc;
+ return err;
}
@@ -1463,12 +1471,6 @@ keyserver_search (ctrl_t ctrl, strlist_t tokens)
if (!tokens)
return 0; /* Return success if no patterns are given. */
- if (!opt.keyserver)
- {
- log_error (_("no keyserver known (use option --keyserver)\n"));
- return gpg_error (GPG_ERR_NO_KEYSERVER);
- }
-
/* Write global options */
/* for(temp=opt.keyserver_options.other;temp;temp=temp->next) */
diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index 464b89b..e736162 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -724,8 +724,8 @@ static gc_option_t gc_options_gpg[] =
{ "Keyserver",
GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
"gnupg", N_("Configuration for Keyservers") },
- { "keyserver", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
- "gnupg", N_("|URL|use keyserver at URL"),
+ { "keyserver", GC_OPT_FLAG_NONE, GC_LEVEL_EXPERT,
+ "gnupg", N_("|URL|use keyserver at URL"), /* Deprecated - use dirmngr */
GC_ARG_TYPE_STRING, GC_BACKEND_GPG },
{ "allow-pka-lookup", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
"gnupg", N_("allow PKA lookups (DNS requests)"),
@@ -735,8 +735,6 @@ static gc_option_t gc_options_gpg[] =
GC_ARG_TYPE_STRING, GC_BACKEND_GPG },
-
-
GC_OPTION_NULL
};
#endif /*BUILD_WITH_GPG*/
@@ -915,6 +913,13 @@ static gc_option_t gc_options_dirmngr[] =
"dirmngr", "route all network traffic via TOR",
GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
+ { "Keyserver",
+ GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
+ "gnupg", N_("Configuration for Keyservers") },
+ { "keyserver", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
+ "gnupg", N_("|URL|use keyserver at URL"),
+ GC_ARG_TYPE_STRING, GC_BACKEND_DIRMNGR },
+
{ "HTTP",
GC_OPT_FLAG_GROUP, GC_LEVEL_ADVANCED,
"gnupg", N_("Configuration for HTTP servers") },
commit a48e6de603c3a312f02b1b5fdb813032eeae9074
Author: Werner Koch <wk at gnupg.org>
Date: Mon Oct 5 17:44:20 2015 +0200
dirmngr: Add option --keyserver.
* dirmngr/dirmngr.c (oKeyServer): New.
(opts): Add "keyserver".
(parse_rereadable_options): Parse that options
(main): Add option to the gpgconf list.
* dirmngr/dirmngr.h (opt): Add field "keyserver".
* dirmngr/server.c (ensure_keyserver): New.
(make_keyserver_item): New. Factored out from
(cmd_keyserver): here. Call ensure_keyserver.
(cmd_ks_search): Call ensure_keyserver.
(cmd_ks_get): Ditto.
(cmd_ks_fetch): Ditto.
(cmd_ks_put): Ditto.
--
This option specifies the keyserver to be used if the client does not
set another keyserver. We want to fade out the use of --keyserver in
gpg.conf in favor of specifying it here.
Signed-off-by: Werner Koch <wk at gnupg.org>
diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 31833eb..847a65d 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -141,6 +141,7 @@ enum cmd_and_opt_values {
oHTTPWrapperProgram,
oIgnoreCertExtension,
oUseTor,
+ oKeyServer,
aTest
};
@@ -213,6 +214,7 @@ static ARGPARSE_OPTS opts[] = {
ARGPARSE_s_i (oMaxReplies, "max-replies",
N_("|N|do not return more than N items in one query")),
+ ARGPARSE_s_s (oKeyServer, "keyserver", "@"),
ARGPARSE_s_s (oHkpCaCert, "hkp-cacert",
N_("|FILE|use the CA certificates in FILE for HKP over TLS")),
@@ -520,7 +522,9 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread)
}
FREE_STRLIST (opt.ignored_cert_extensions);
http_register_tls_ca (NULL);
- /* We do not allow resetting of opt.use_tor at runtime. */
+ xfree (opt.keyserver);
+ opt.keyserver = NULL;
+ /* Note: We do not allow resetting of opt.use_tor at runtime. */
return 1;
}
@@ -585,6 +589,11 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread)
case oUseTor: opt.use_tor = 1; break;
+ case oKeyServer:
+ xfree (opt.keyserver);
+ opt.keyserver = *pargs->r.ret_str? xtrystrdup (pargs->r.ret_str) : NULL;
+ break;
+
default:
return 0; /* Not handled. */
}
@@ -1418,7 +1427,9 @@ main (int argc, char **argv)
/* Note: The next one is to fix a typo in gpgconf - should be
removed eventually. */
es_printf ("ignore-ocsp-servic-url:%lu:\n", flags | GC_OPT_FLAG_NONE);
+
es_printf ("use-tor:%lu:\n", flags | GC_OPT_FLAG_NONE);
+ es_printf ("keyserver:%lu:\n", flags | GC_OPT_FLAG_NONE);
}
cleanup ();
return !!rc;
diff --git a/dirmngr/dirmngr.h b/dirmngr/dirmngr.h
index a2db627..b2b94f9 100644
--- a/dirmngr/dirmngr.h
+++ b/dirmngr/dirmngr.h
@@ -130,6 +130,8 @@ struct
considered valid after thisUpdate. */
unsigned int ocsp_current_period; /* Seconds a response is considered
current after nextUpdate. */
+
+ char *keyserver; /* Malloced string with the default keyserver. */
} opt;
diff --git a/dirmngr/server.c b/dirmngr/server.c
index 694a881..5400a98 100644
--- a/dirmngr/server.c
+++ b/dirmngr/server.c
@@ -1626,7 +1626,65 @@ cmd_validate (assuan_context_t ctx, char *line)
return leave_cmd (ctx, err);
}
+
+/* Parse an keyserver URI and store it in a new uri item which is
+ returned at R_ITEM. On error return an error code. */
+static gpg_error_t
+make_keyserver_item (const char *uri, uri_item_t *r_item)
+{
+ gpg_error_t err;
+ uri_item_t item;
+
+ *r_item = NULL;
+ item = xtrymalloc (sizeof *item + strlen (uri));
+ if (!item)
+ return gpg_error_from_syserror ();
+
+ item->next = NULL;
+ item->parsed_uri = NULL;
+ strcpy (item->uri, uri);
+
+#if USE_LDAP
+ if (ldap_uri_p (item->uri))
+ err = ldap_parse_uri (&item->parsed_uri, uri);
+ else
+#endif
+ {
+ err = http_parse_uri (&item->parsed_uri, uri, 1);
+ }
+
+ if (err)
+ xfree (item);
+ else
+ *r_item = item;
+ return err;
+}
+
+
+/* If no keyserver is stored in CTRL but a global keyserver has been
+ set, put that global keyserver into CTRL. We need use this
+ function to help migrate from the old gpg based keyserver
+ configuration to the new dirmngr based configuration. */
+static gpg_error_t
+ensure_keyserver (ctrl_t ctrl)
+{
+ gpg_error_t err;
+ uri_item_t item;
+
+ if (ctrl->server_local->keyservers)
+ return 0; /* Already set for this session. */
+ if (!opt.keyserver)
+ return 0; /* No global option set. */
+
+ err = make_keyserver_item (opt.keyserver, &item);
+ if (!err)
+ ctrl->server_local->keyservers = item;
+
+ return err;
+}
+
+
static const char hlp_keyserver[] =
"KEYSERVER [<options>] [<uri>|<host>]\n"
"Options are:\n"
@@ -1671,7 +1729,9 @@ cmd_keyserver (assuan_context_t ctx, char *line)
if (resolve_flag)
{
- err = ks_action_resolve (ctrl, ctrl->server_local->keyservers);
+ err = ensure_keyserver (ctrl);
+ if (!err)
+ err = ks_action_resolve (ctrl, ctrl->server_local->keyservers);
if (err)
goto leave;
}
@@ -1711,29 +1771,9 @@ cmd_keyserver (assuan_context_t ctx, char *line)
if (add_flag)
{
- item = xtrymalloc (sizeof *item + strlen (line));
- if (!item)
- {
- err = gpg_error_from_syserror ();
- goto leave;
- }
- item->next = NULL;
- item->parsed_uri = NULL;
- strcpy (item->uri, line);
-
-#if USE_LDAP
- if (ldap_uri_p (item->uri))
- err = ldap_parse_uri (&item->parsed_uri, line);
- else
-#endif
- {
- err = http_parse_uri (&item->parsed_uri, line, 1);
- }
+ err = make_keyserver_item (line, &item);
if (err)
- {
- xfree (item);
- goto leave;
- }
+ goto leave;
}
if (clear_flag)
release_ctrl_keyservers (ctrl);
@@ -1743,10 +1783,20 @@ cmd_keyserver (assuan_context_t ctx, char *line)
ctrl->server_local->keyservers = item;
}
- if (!add_flag && !clear_flag && !help_flag) /* List configured keyservers. */
+ if (!add_flag && !clear_flag && !help_flag)
{
+ /* List configured keyservers. However, we first add a global
+ keyserver. */
uri_item_t u;
+ err = ensure_keyserver (ctrl);
+ if (err)
+ {
+ assuan_set_error (ctx, err,
+ "Bad keyserver configuration in dirmngr.conf");
+ goto leave;
+ }
+
for (u=ctrl->server_local->keyservers; u; u = u->next)
dirmngr_status (ctrl, "KEYSERVER", u->uri, NULL);
}
@@ -1799,6 +1849,10 @@ cmd_ks_search (assuan_context_t ctx, char *line)
}
}
+ err = ensure_keyserver (ctrl);
+ if (err)
+ goto leave;
+
/* Setup an output stream and perform the search. */
outfp = es_fopencookie (ctx, "w", data_line_cookie_functions);
if (!outfp)
@@ -1861,6 +1915,10 @@ cmd_ks_get (assuan_context_t ctx, char *line)
}
}
+ err = ensure_keyserver (ctrl);
+ if (err)
+ goto leave;
+
/* Setup an output stream and perform the get. */
outfp = es_fopencookie (ctx, "w", data_line_cookie_functions);
if (!outfp)
@@ -1891,6 +1949,10 @@ cmd_ks_fetch (assuan_context_t ctx, char *line)
/* No options for now. */
line = skip_options (line);
+ err = ensure_keyserver (ctrl);
+ if (err)
+ goto leave;
+
/* Setup an output stream and perform the get. */
outfp = es_fopencookie (ctx, "w", data_line_cookie_functions);
if (!outfp)
@@ -1901,6 +1963,7 @@ cmd_ks_fetch (assuan_context_t ctx, char *line)
es_fclose (outfp);
}
+ leave:
return leave_cmd (ctx, err);
}
@@ -1936,6 +1999,10 @@ cmd_ks_put (assuan_context_t ctx, char *line)
/* No options for now. */
line = skip_options (line);
+ err = ensure_keyserver (ctrl);
+ if (err)
+ goto leave;
+
/* Ask for the key material. */
err = assuan_inquire (ctx, "KEYBLOCK",
&value, &valuelen, MAX_KEYBLOCK_LENGTH);
diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
index 7757acf..a5bcc73 100644
--- a/doc/dirmngr.texi
+++ b/doc/dirmngr.texi
@@ -242,6 +242,25 @@ This options is not yet functional! It will eventually switch GnuPG
into a TOR mode to route all network access via TOR (an anonymity
network).
+ at item --keyserver @code{name}
+ at opindex keyserver
+Use @code{name} as your keyserver. This is the server that @command{gpg}
+communicates with to receive keys, send keys, and search for
+keys. The format of the @code{name} is a URI:
+`scheme:[//]keyservername[:port]' The scheme is the type of keyserver:
+"hkp" for the HTTP (or compatible) keyservers, "ldap" for the LDAP
+keyservers, or "mailto" for the Graff email keyserver. Note that your
+particular installation of GnuPG may have other keyserver types
+available as well. Keyserver schemes are case-insensitive. After the
+keyserver name, optional keyserver configuration options may be
+provided. These are the same as the global @option{--keyserver-options}
+from below, but apply only to this particular keyserver.
+
+Most keyservers synchronize with each other, so there is generally no
+need to send keys to more than one server. The keyserver
+ at code{hkp://keys.gnupg.net} uses round robin DNS to give a different
+keyserver each time you use it.
+
@item --disable-ldap
@opindex disable-ldap
Entirely disables the use of LDAP.
-----------------------------------------------------------------------
Summary of changes:
dirmngr/dirmngr.c | 13 +++++-
dirmngr/dirmngr.h | 2 +
dirmngr/server.c | 115 +++++++++++++++++++++++++++++++++++++----------
doc/dirmngr.texi | 19 ++++++++
doc/gpg.texi | 4 ++
g10/call-dirmngr.c | 43 +++++++++++++++++-
g10/call-dirmngr.h | 1 +
g10/keyserver-internal.h | 2 +-
g10/keyserver.c | 50 +++++++++++----------
tools/gpgconf-comp.c | 13 ++++--
10 files changed, 206 insertions(+), 56 deletions(-)
hooks/post-receive
--
The GNU Privacy Guard
http://git.gnupg.org
More information about the Gnupg-commits
mailing list