diff --git a/agent/command.c b/agent/command.c index 9bb6fa306..6efd1bff2 100644 --- a/agent/command.c +++ b/agent/command.c @@ -1,3658 +1,3658 @@ /* command.c - gpg-agent command handler * Copyright (C) 2001-2011 Free Software Foundation, Inc. * Copyright (C) 2001-2013 Werner Koch * Copyright (C) 2015 g10 Code GmbH. * * This file is part of GnuPG. * * GnuPG is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. * * GnuPG is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, see . */ /* FIXME: we should not use the default assuan buffering but setup some buffering in secure mempory to protect session keys etc. */ #include #include #include #include #include #include #include #include #include #include #include #include "agent.h" #include #include "../common/i18n.h" #include "cvt-openpgp.h" #include "../common/ssh-utils.h" #include "../common/asshelp.h" #include "../common/server-help.h" /* Maximum allowed size of the inquired ciphertext. */ #define MAXLEN_CIPHERTEXT 4096 /* Maximum allowed size of the key parameters. */ #define MAXLEN_KEYPARAM 1024 /* Maximum allowed size of key data as used in inquiries (bytes). */ #define MAXLEN_KEYDATA 8192 /* Maximum length of a secret to store under one key. */ #define MAXLEN_PUT_SECRET 4096 /* The size of the import/export KEK key (in bytes). */ #define KEYWRAP_KEYSIZE (128/8) /* A shortcut to call assuan_set_error using an gpg_err_code_t and a text string. */ #define set_error(e,t) assuan_set_error (ctx, gpg_error (e), (t)) /* Check that the maximum digest length we support has at least the length of the keygrip. */ #if MAX_DIGEST_LEN < 20 #error MAX_DIGEST_LEN shorter than keygrip #endif /* Data used to associate an Assuan context with local server data. This is this modules local part of the server_control_s struct. */ struct server_local_s { /* Our Assuan context. */ assuan_context_t assuan_ctx; /* If this flag is true, the passphrase cache is used for signing operations. It defaults to true but may be set on a per connection base. The global option opt.ignore_cache_for_signing takes precedence over this flag. */ unsigned int use_cache_for_signing : 1; /* Flag to suppress I/O logging during a command. */ unsigned int pause_io_logging : 1; /* Flag indicating that the connection is from ourselves. */ unsigned int connect_from_self : 1; /* Helper flag for io_monitor to allow suppressing of our own * greeting in some cases. See io_monitor for details. */ unsigned int greeting_seen : 1; /* If this flag is set to true the agent will be terminated after the end of the current session. */ unsigned int stopme : 1; /* Flag indicating whether pinentry notifications shall be done. */ unsigned int allow_pinentry_notify : 1; /* An allocated description for the next key operation. This is used if a pinnetry needs to be popped up. */ char *keydesc; /* Malloced KEK (Key-Encryption-Key) for the import_key command. */ void *import_key; /* Malloced KEK for the export_key command. */ void *export_key; /* Client is aware of the error code GPG_ERR_FULLY_CANCELED. */ int allow_fully_canceled; /* Last CACHE_NONCE sent as status (malloced). */ char *last_cache_nonce; /* Last PASSWD_NONCE sent as status (malloced). */ char *last_passwd_nonce; }; /* An entry for the getval/putval commands. */ struct putval_item_s { struct putval_item_s *next; size_t off; /* Offset to the value into DATA. */ size_t len; /* Length of the value. */ char d[1]; /* Key | Nul | value. */ }; /* A list of key value pairs fpr the getval/putval commands. */ static struct putval_item_s *putval_list; /* To help polling clients, we keep track of the number of certain events. This structure keeps those counters. The counters are integers and there should be no problem if they are overflowing as callers need to check only whether a counter changed. The actual values are not meaningful. */ struct { /* Incremented if any of the other counters below changed. */ unsigned int any; /* Incremented if a key is added or removed from the internal privat key database. */ unsigned int key; /* Incremented if a change of the card readers stati has been detected. */ unsigned int card; } eventcounter; /* Local prototypes. */ static int command_has_option (const char *cmd, const char *cmdopt); /* Release the memory buffer MB but first wipe out the used memory. */ static void clear_outbuf (membuf_t *mb) { void *p; size_t n; p = get_membuf (mb, &n); if (p) { wipememory (p, n); xfree (p); } } /* Write the content of memory buffer MB as assuan data to CTX and wipe the buffer out afterwards. */ static gpg_error_t write_and_clear_outbuf (assuan_context_t ctx, membuf_t *mb) { gpg_error_t ae; void *p; size_t n; p = get_membuf (mb, &n); if (!p) return out_of_core (); ae = assuan_send_data (ctx, p, n); memset (p, 0, n); xfree (p); return ae; } /* Clear the nonces used to enable the passphrase cache for certain multi-command command sequences. */ static void clear_nonce_cache (ctrl_t ctrl) { if (ctrl->server_local->last_cache_nonce) { agent_put_cache (ctrl, ctrl->server_local->last_cache_nonce, CACHE_MODE_NONCE, NULL, 0); xfree (ctrl->server_local->last_cache_nonce); ctrl->server_local->last_cache_nonce = NULL; } if (ctrl->server_local->last_passwd_nonce) { agent_put_cache (ctrl, ctrl->server_local->last_passwd_nonce, CACHE_MODE_NONCE, NULL, 0); xfree (ctrl->server_local->last_passwd_nonce); ctrl->server_local->last_passwd_nonce = NULL; } } /* This function is called by Libassuan whenever the client sends a reset. It has been registered similar to the other Assuan commands. */ static gpg_error_t reset_notify (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); (void) line; memset (ctrl->keygrip, 0, 20); ctrl->have_keygrip = 0; ctrl->digest.valuelen = 0; xfree (ctrl->server_local->keydesc); ctrl->server_local->keydesc = NULL; clear_nonce_cache (ctrl); return 0; } /* Replace all '+' by a blank in the string S. */ static void plus_to_blank (char *s) { for (; *s; s++) { if (*s == '+') *s = ' '; } } /* Parse a hex string. Return an Assuan error code or 0 on success and the length of the parsed string in LEN. */ static int parse_hexstring (assuan_context_t ctx, const char *string, size_t *len) { const char *p; size_t n; /* parse the hash value */ for (p=string, n=0; hexdigitp (p); p++, n++) ; if (*p != ' ' && *p != '\t' && *p) return set_error (GPG_ERR_ASS_PARAMETER, "invalid hexstring"); if ((n&1)) return set_error (GPG_ERR_ASS_PARAMETER, "odd number of digits"); *len = n; return 0; } /* Parse the keygrip in STRING into the provided buffer BUF. BUF must provide space for 20 bytes. BUF is not changed if the function returns an error. */ static int parse_keygrip (assuan_context_t ctx, const char *string, unsigned char *buf) { int rc; size_t n = 0; rc = parse_hexstring (ctx, string, &n); if (rc) return rc; n /= 2; if (n != 20) return set_error (GPG_ERR_ASS_PARAMETER, "invalid length of keygrip"); if (hex2bin (string, buf, 20) < 0) return set_error (GPG_ERR_BUG, "hex2bin"); return 0; } /* Parse the TTL from STRING. Leading and trailing spaces are * skipped. The value is constrained to -1 .. MAXINT. On error 0 is * returned, else the number of bytes scanned. */ static size_t parse_ttl (const char *string, int *r_ttl) { const char *string_orig = string; long ttl; char *pend; ttl = strtol (string, &pend, 10); string = pend; if (string == string_orig || !(spacep (string) || !*string) || ttl < -1L || (int)ttl != (long)ttl) { *r_ttl = 0; return 0; } while (spacep (string) || *string== '\n') string++; *r_ttl = (int)ttl; return string - string_orig; } /* Write an Assuan status line. KEYWORD is the first item on the * status line. The following arguments are all separated by a space * in the output. The last argument must be a NULL. Linefeeds and * carriage returns characters (which are not allowed in an Assuan * status line) are silently quoted in C-style. */ gpg_error_t agent_write_status (ctrl_t ctrl, const char *keyword, ...) { gpg_error_t err; va_list arg_ptr; assuan_context_t ctx = ctrl->server_local->assuan_ctx; va_start (arg_ptr, keyword); err = vprint_assuan_status_strings (ctx, keyword, arg_ptr); va_end (arg_ptr); return err; } /* This function is similar to print_assuan_status but takes a CTRL arg instead of an assuan context as first argument. */ gpg_error_t agent_print_status (ctrl_t ctrl, const char *keyword, const char *format, ...) { gpg_error_t err; va_list arg_ptr; assuan_context_t ctx = ctrl->server_local->assuan_ctx; va_start (arg_ptr, format); err = vprint_assuan_status (ctx, keyword, format, arg_ptr); va_end (arg_ptr); return err; } /* Helper to notify the client about a launched Pinentry. Because that might disturb some older clients, this is only done if enabled via an option. Returns an gpg error code. */ gpg_error_t agent_inq_pinentry_launched (ctrl_t ctrl, unsigned long pid, const char *extra) { char line[256]; if (!ctrl || !ctrl->server_local || !ctrl->server_local->allow_pinentry_notify) return 0; snprintf (line, DIM(line), "PINENTRY_LAUNCHED %lu%s%s", pid, extra?" ":"", extra? extra:""); return assuan_inquire (ctrl->server_local->assuan_ctx, line, NULL, NULL, 0); } /* An agent progress callback for Libgcrypt. This has been registered * to be called via the progress dispatcher mechanism from * gpg-agent.c */ static void progress_cb (ctrl_t ctrl, const char *what, int printchar, int current, int total) { if (!ctrl || !ctrl->server_local || !ctrl->server_local->assuan_ctx) ; else if (printchar == '\n' && what && !strcmp (what, "primegen")) agent_print_status (ctrl, "PROGRESS", "%.20s X 100 100", what); else agent_print_status (ctrl, "PROGRESS", "%.20s %c %d %d", what, printchar=='\n'?'X':printchar, current, total); } /* Helper to print a message while leaving a command. Note that this * function does not call assuan_set_error; the caller may do this * prior to calling us. */ static gpg_error_t leave_cmd (assuan_context_t ctx, gpg_error_t err) { if (err) { const char *name = assuan_get_command_name (ctx); if (!name) name = "?"; /* Not all users of gpg-agent know about the fully canceled error code; map it back if needed. */ if (gpg_err_code (err) == GPG_ERR_FULLY_CANCELED) { ctrl_t ctrl = assuan_get_pointer (ctx); if (!ctrl->server_local->allow_fully_canceled) err = gpg_err_make (gpg_err_source (err), GPG_ERR_CANCELED); } /* Most code from common/ does not know the error source, thus we fix this here. */ if (gpg_err_source (err) == GPG_ERR_SOURCE_UNKNOWN) err = gpg_err_make (GPG_ERR_SOURCE_DEFAULT, gpg_err_code (err)); if (gpg_err_source (err) == GPG_ERR_SOURCE_DEFAULT) log_error ("command '%s' failed: %s\n", name, gpg_strerror (err)); else log_error ("command '%s' failed: %s <%s>\n", name, gpg_strerror (err), gpg_strsource (err)); } return err; } static const char hlp_geteventcounter[] = "GETEVENTCOUNTER\n" "\n" "Return a status line named EVENTCOUNTER with the current values\n" "of all event counters. The values are decimal numbers in the range\n" "0 to UINT_MAX and wrapping around to 0. The actual values should\n" "not be relied upon, they shall only be used to detect a change.\n" "\n" "The currently defined counters are:\n" "\n" "ANY - Incremented with any change of any of the other counters.\n" "KEY - Incremented for added or removed private keys.\n" "CARD - Incremented for changes of the card readers stati."; static gpg_error_t cmd_geteventcounter (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); (void)line; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); return agent_print_status (ctrl, "EVENTCOUNTER", "%u %u %u", eventcounter.any, eventcounter.key, eventcounter.card); } /* This function should be called once for all key removals or additions. This function is assured not to do any context switches. */ void bump_key_eventcounter (void) { eventcounter.key++; eventcounter.any++; } /* This function should be called for all card reader status changes. This function is assured not to do any context switches. */ void bump_card_eventcounter (void) { eventcounter.card++; eventcounter.any++; } static const char hlp_istrusted[] = "ISTRUSTED \n" "\n" "Return OK when we have an entry with this fingerprint in our\n" "trustlist"; static gpg_error_t cmd_istrusted (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int rc, n, i; char *p; char fpr[41]; /* Parse the fingerprint value. */ for (p=line,n=0; hexdigitp (p); p++, n++) ; if (*p || !(n == 40 || n == 32)) return set_error (GPG_ERR_ASS_PARAMETER, "invalid fingerprint"); i = 0; if (n==32) { strcpy (fpr, "00000000"); i += 8; } for (p=line; i < 40; p++, i++) fpr[i] = *p >= 'a'? (*p & 0xdf): *p; fpr[i] = 0; rc = agent_istrusted (ctrl, fpr, NULL); if (!rc || gpg_err_code (rc) == GPG_ERR_NOT_TRUSTED) return rc; else if (rc == -1 || gpg_err_code (rc) == GPG_ERR_EOF ) return gpg_error (GPG_ERR_NOT_TRUSTED); else return leave_cmd (ctx, rc); } static const char hlp_listtrusted[] = "LISTTRUSTED\n" "\n" "List all entries from the trustlist."; static gpg_error_t cmd_listtrusted (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int rc; (void)line; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); rc = agent_listtrusted (ctx); return leave_cmd (ctx, rc); } static const char hlp_martrusted[] = "MARKTRUSTED \n" "\n" "Store a new key in into the trustlist."; static gpg_error_t cmd_marktrusted (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int rc, n, i; char *p; char fpr[41]; int flag; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); /* parse the fingerprint value */ for (p=line,n=0; hexdigitp (p); p++, n++) ; if (!spacep (p) || !(n == 40 || n == 32)) return set_error (GPG_ERR_ASS_PARAMETER, "invalid fingerprint"); i = 0; if (n==32) { strcpy (fpr, "00000000"); i += 8; } for (p=line; i < 40; p++, i++) fpr[i] = *p >= 'a'? (*p & 0xdf): *p; fpr[i] = 0; while (spacep (p)) p++; flag = *p++; if ( (flag != 'S' && flag != 'P') || !spacep (p) ) return set_error (GPG_ERR_ASS_PARAMETER, "invalid flag - must be P or S"); while (spacep (p)) p++; rc = agent_marktrusted (ctrl, p, fpr, flag); return leave_cmd (ctx, rc); } static const char hlp_havekey[] = "HAVEKEY \n" "\n" "Return success if at least one of the secret keys with the given\n" "keygrips is available."; static gpg_error_t cmd_havekey (assuan_context_t ctx, char *line) { gpg_error_t err; unsigned char buf[20]; do { err = parse_keygrip (ctx, line, buf); if (err) return err; if (!agent_key_available (buf)) return 0; /* Found. */ while (*line && *line != ' ' && *line != '\t') line++; while (*line == ' ' || *line == '\t') line++; } while (*line); /* No leave_cmd() here because errors are expected and would clutter the log. */ return gpg_error (GPG_ERR_NO_SECKEY); } static const char hlp_sigkey[] = "SIGKEY \n" "SETKEY \n" "\n" "Set the key used for a sign or decrypt operation."; static gpg_error_t cmd_sigkey (assuan_context_t ctx, char *line) { int rc; ctrl_t ctrl = assuan_get_pointer (ctx); rc = parse_keygrip (ctx, line, ctrl->keygrip); if (rc) return rc; ctrl->have_keygrip = 1; return 0; } static const char hlp_setkeydesc[] = "SETKEYDESC plus_percent_escaped_string\n" "\n" "Set a description to be used for the next PKSIGN, PKDECRYPT, IMPORT_KEY\n" "or EXPORT_KEY operation if this operation requires a passphrase. If\n" "this command is not used a default text will be used. Note, that\n" "this description implictly selects the label used for the entry\n" "box; if the string contains the string PIN (which in general will\n" "not be translated), \"PIN\" is used, otherwise the translation of\n" "\"passphrase\" is used. The description string should not contain\n" "blanks unless they are percent or '+' escaped.\n" "\n" "The description is only valid for the next PKSIGN, PKDECRYPT,\n" "IMPORT_KEY, EXPORT_KEY, or DELETE_KEY operation."; static gpg_error_t cmd_setkeydesc (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); char *desc, *p; for (p=line; *p == ' '; p++) ; desc = p; p = strchr (desc, ' '); if (p) *p = 0; /* We ignore any garbage; we might late use it for other args. */ if (!*desc) return set_error (GPG_ERR_ASS_PARAMETER, "no description given"); /* Note, that we only need to replace the + characters and should leave the other escaping in place because the escaped string is send verbatim to the pinentry which does the unescaping (but not the + replacing) */ plus_to_blank (desc); xfree (ctrl->server_local->keydesc); if (ctrl->restricted) { ctrl->server_local->keydesc = strconcat ((ctrl->restricted == 2 ? _("Note: Request from the web browser.") : _("Note: Request from a remote site.") ), "%0A%0A", desc, NULL); } else ctrl->server_local->keydesc = xtrystrdup (desc); if (!ctrl->server_local->keydesc) return out_of_core (); return 0; } static const char hlp_sethash[] = "SETHASH (--hash=)|() \n" "\n" "The client can use this command to tell the server about the data\n" "(which usually is a hash) to be signed."; static gpg_error_t cmd_sethash (assuan_context_t ctx, char *line) { int rc; size_t n; char *p; ctrl_t ctrl = assuan_get_pointer (ctx); unsigned char *buf; char *endp; int algo; /* Parse the alternative hash options which may be used instead of the algo number. */ if (has_option_name (line, "--hash")) { if (has_option (line, "--hash=sha1")) algo = GCRY_MD_SHA1; else if (has_option (line, "--hash=sha224")) algo = GCRY_MD_SHA224; else if (has_option (line, "--hash=sha256")) algo = GCRY_MD_SHA256; else if (has_option (line, "--hash=sha384")) algo = GCRY_MD_SHA384; else if (has_option (line, "--hash=sha512")) algo = GCRY_MD_SHA512; else if (has_option (line, "--hash=rmd160")) algo = GCRY_MD_RMD160; else if (has_option (line, "--hash=md5")) algo = GCRY_MD_MD5; else if (has_option (line, "--hash=tls-md5sha1")) algo = MD_USER_TLS_MD5SHA1; else return set_error (GPG_ERR_ASS_PARAMETER, "invalid hash algorithm"); } else algo = 0; line = skip_options (line); if (!algo) { /* No hash option has been given: require an algo number instead */ algo = (int)strtoul (line, &endp, 10); for (line = endp; *line == ' ' || *line == '\t'; line++) ; if (!algo || gcry_md_test_algo (algo)) return set_error (GPG_ERR_UNSUPPORTED_ALGORITHM, NULL); } ctrl->digest.algo = algo; ctrl->digest.raw_value = 0; /* Parse the hash value. */ n = 0; rc = parse_hexstring (ctx, line, &n); if (rc) return rc; n /= 2; if (algo == MD_USER_TLS_MD5SHA1 && n == 36) ; else if (n != 16 && n != 20 && n != 24 && n != 28 && n != 32 && n != 48 && n != 64) return set_error (GPG_ERR_ASS_PARAMETER, "unsupported length of hash"); if (n > MAX_DIGEST_LEN) return set_error (GPG_ERR_ASS_PARAMETER, "hash value to long"); buf = ctrl->digest.value; ctrl->digest.valuelen = n; for (p=line, n=0; n < ctrl->digest.valuelen; p += 2, n++) buf[n] = xtoi_2 (p); for (; n < ctrl->digest.valuelen; n++) buf[n] = 0; return 0; } static const char hlp_pksign[] = "PKSIGN [] []\n" "\n" "Perform the actual sign operation. Neither input nor output are\n" "sensitive to eavesdropping."; static gpg_error_t cmd_pksign (assuan_context_t ctx, char *line) { gpg_error_t err; cache_mode_t cache_mode = CACHE_MODE_NORMAL; ctrl_t ctrl = assuan_get_pointer (ctx); membuf_t outbuf; char *cache_nonce = NULL; char *p; line = skip_options (line); for (p=line; *p && *p != ' ' && *p != '\t'; p++) ; *p = '\0'; if (*line) cache_nonce = xtrystrdup (line); if (opt.ignore_cache_for_signing) cache_mode = CACHE_MODE_IGNORE; else if (!ctrl->server_local->use_cache_for_signing) cache_mode = CACHE_MODE_IGNORE; init_membuf (&outbuf, 512); err = agent_pksign (ctrl, cache_nonce, ctrl->server_local->keydesc, &outbuf, cache_mode); if (err) clear_outbuf (&outbuf); else err = write_and_clear_outbuf (ctx, &outbuf); xfree (cache_nonce); xfree (ctrl->server_local->keydesc); ctrl->server_local->keydesc = NULL; return leave_cmd (ctx, err); } static const char hlp_pkdecrypt[] = "PKDECRYPT []\n" "\n" "Perform the actual decrypt operation. Input is not\n" "sensitive to eavesdropping."; static gpg_error_t cmd_pkdecrypt (assuan_context_t ctx, char *line) { int rc; ctrl_t ctrl = assuan_get_pointer (ctx); unsigned char *value; size_t valuelen; membuf_t outbuf; int padding; (void)line; /* First inquire the data to decrypt */ rc = print_assuan_status (ctx, "INQUIRE_MAXLEN", "%u", MAXLEN_CIPHERTEXT); if (!rc) rc = assuan_inquire (ctx, "CIPHERTEXT", &value, &valuelen, MAXLEN_CIPHERTEXT); if (rc) return rc; init_membuf (&outbuf, 512); rc = agent_pkdecrypt (ctrl, ctrl->server_local->keydesc, value, valuelen, &outbuf, &padding); xfree (value); if (rc) clear_outbuf (&outbuf); else { if (padding != -1) rc = print_assuan_status (ctx, "PADDING", "%d", padding); else rc = 0; if (!rc) rc = write_and_clear_outbuf (ctx, &outbuf); } xfree (ctrl->server_local->keydesc); ctrl->server_local->keydesc = NULL; return leave_cmd (ctx, rc); } static const char hlp_genkey[] = "GENKEY [--no-protection] [--preset] [--inq-passwd]\n" " [--passwd-nonce=] []\n" "\n" "Generate a new key, store the secret part and return the public\n" "part. Here is an example transaction:\n" "\n" " C: GENKEY\n" " S: INQUIRE KEYPARAM\n" " C: D (genkey (rsa (nbits 3072)))\n" " C: END\n" " S: D (public-key\n" " S: D (rsa (n 326487324683264) (e 10001)))\n" " S: OK key created\n" "\n" "When the --preset option is used the passphrase for the generated\n" "key will be added to the cache. When --inq-passwd is used an inquire\n" "with the keyword NEWPASSWD is used to request the passphrase for the\n" "new key. When a --passwd-nonce is used, the corresponding cached\n" "passphrase is used to protect the new key."; static gpg_error_t cmd_genkey (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int rc; int no_protection; unsigned char *value = NULL; size_t valuelen; unsigned char *newpasswd = NULL; membuf_t outbuf; char *cache_nonce = NULL; char *passwd_nonce = NULL; int opt_preset; int opt_inq_passwd; size_t n; char *p, *pend; int c; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); no_protection = has_option (line, "--no-protection"); opt_preset = has_option (line, "--preset"); opt_inq_passwd = has_option (line, "--inq-passwd"); passwd_nonce = option_value (line, "--passwd-nonce"); if (passwd_nonce) { for (pend = passwd_nonce; *pend && !spacep (pend); pend++) ; c = *pend; *pend = '\0'; passwd_nonce = xtrystrdup (passwd_nonce); *pend = c; if (!passwd_nonce) { rc = gpg_error_from_syserror (); goto leave; } } line = skip_options (line); for (p=line; *p && *p != ' ' && *p != '\t'; p++) ; *p = '\0'; if (*line) cache_nonce = xtrystrdup (line); /* First inquire the parameters */ rc = print_assuan_status (ctx, "INQUIRE_MAXLEN", "%u", MAXLEN_KEYPARAM); if (!rc) rc = assuan_inquire (ctx, "KEYPARAM", &value, &valuelen, MAXLEN_KEYPARAM); if (rc) return rc; init_membuf (&outbuf, 512); /* If requested, ask for the password to be used for the key. If this is not used the regular Pinentry mechanism is used. */ if (opt_inq_passwd && !no_protection) { /* (N is used as a dummy) */ assuan_begin_confidential (ctx); rc = assuan_inquire (ctx, "NEWPASSWD", &newpasswd, &n, 256); assuan_end_confidential (ctx); if (rc) goto leave; if (!*newpasswd) { /* Empty password given - switch to no-protection mode. */ xfree (newpasswd); newpasswd = NULL; no_protection = 1; } } else if (passwd_nonce) newpasswd = agent_get_cache (ctrl, passwd_nonce, CACHE_MODE_NONCE); rc = agent_genkey (ctrl, cache_nonce, (char*)value, valuelen, no_protection, newpasswd, opt_preset, &outbuf); leave: if (newpasswd) { /* Assuan_inquire does not allow us to read into secure memory thus we need to wipe it ourself. */ wipememory (newpasswd, strlen (newpasswd)); xfree (newpasswd); } xfree (value); if (rc) clear_outbuf (&outbuf); else rc = write_and_clear_outbuf (ctx, &outbuf); xfree (cache_nonce); xfree (passwd_nonce); return leave_cmd (ctx, rc); } static const char hlp_readkey[] = "READKEY \n" " --card \n" "\n" "Return the public key for the given keygrip or keyid.\n" "With --card, private key file with card information will be created."; static gpg_error_t cmd_readkey (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int rc; unsigned char grip[20]; gcry_sexp_t s_pkey = NULL; unsigned char *pkbuf = NULL; char *serialno = NULL; size_t pkbuflen; const char *opt_card; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); opt_card = has_option_name (line, "--card"); line = skip_options (line); if (opt_card) { const char *keyid = opt_card; rc = agent_card_getattr (ctrl, "SERIALNO", &serialno); if (rc) { log_error (_("error getting serial number of card: %s\n"), gpg_strerror (rc)); goto leave; } rc = agent_card_readkey (ctrl, keyid, &pkbuf); if (rc) goto leave; pkbuflen = gcry_sexp_canon_len (pkbuf, 0, NULL, NULL); rc = gcry_sexp_sscan (&s_pkey, NULL, (char*)pkbuf, pkbuflen); if (rc) goto leave; if (!gcry_pk_get_keygrip (s_pkey, grip)) { rc = gcry_pk_testkey (s_pkey); if (rc == 0) rc = gpg_error (GPG_ERR_INTERNAL); goto leave; } rc = agent_write_shadow_key (grip, serialno, keyid, pkbuf, 0); if (rc) goto leave; rc = assuan_send_data (ctx, pkbuf, pkbuflen); } else { rc = parse_keygrip (ctx, line, grip); if (rc) goto leave; rc = agent_public_key_from_file (ctrl, grip, &s_pkey); if (!rc) { pkbuflen = gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, NULL, 0); log_assert (pkbuflen); pkbuf = xtrymalloc (pkbuflen); if (!pkbuf) rc = gpg_error_from_syserror (); else { pkbuflen = gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, pkbuf, pkbuflen); rc = assuan_send_data (ctx, pkbuf, pkbuflen); } } } leave: xfree (serialno); xfree (pkbuf); gcry_sexp_release (s_pkey); return leave_cmd (ctx, rc); } static const char hlp_keyinfo[] = "KEYINFO [--[ssh-]list] [--data] [--ssh-fpr[=algo]] [--with-ssh] \n" "\n" "Return information about the key specified by the KEYGRIP. If the\n" "key is not available GPG_ERR_NOT_FOUND is returned. If the option\n" "--list is given the keygrip is ignored and information about all\n" "available keys are returned. If --ssh-list is given information\n" "about all keys listed in the sshcontrol are returned. With --with-ssh\n" "information from sshcontrol is always added to the info. Unless --data\n" "is given, the information is returned as a status line using the format:\n" "\n" " KEYINFO \n" "\n" "KEYGRIP is the keygrip.\n" "\n" "TYPE is describes the type of the key:\n" " 'D' - Regular key stored on disk,\n" " 'T' - Key is stored on a smartcard (token),\n" " 'X' - Unknown type,\n" " '-' - Key is missing.\n" "\n" "SERIALNO is an ASCII string with the serial number of the\n" " smartcard. If the serial number is not known a single\n" " dash '-' is used instead.\n" "\n" "IDSTR is the IDSTR used to distinguish keys on a smartcard. If it\n" " is not known a dash is used instead.\n" "\n" "CACHED is 1 if the passphrase for the key was found in the key cache.\n" " If not, a '-' is used instead.\n" "\n" "PROTECTION describes the key protection type:\n" " 'P' - The key is protected with a passphrase,\n" " 'C' - The key is not protected,\n" " '-' - Unknown protection.\n" "\n" "FPR returns the formatted ssh-style fingerprint of the key. It is only\n" " printed if the option --ssh-fpr has been used. If ALGO is not given\n" " to that option the default ssh fingerprint algo is used. Without the\n" " option a '-' is printed.\n" "\n" "TTL is the TTL in seconds for that key or '-' if n/a.\n" "\n" "FLAGS is a word consisting of one-letter flags:\n" " 'D' - The key has been disabled,\n" " 'S' - The key is listed in sshcontrol (requires --with-ssh),\n" " 'c' - Use of the key needs to be confirmed,\n" " '-' - No flags given.\n" "\n" "More information may be added in the future."; static gpg_error_t do_one_keyinfo (ctrl_t ctrl, const unsigned char *grip, assuan_context_t ctx, int data, int with_ssh_fpr, int in_ssh, int ttl, int disabled, int confirm) { gpg_error_t err; char hexgrip[40+1]; char *fpr = NULL; int keytype; unsigned char *shadow_info = NULL; char *serialno = NULL; char *idstr = NULL; const char *keytypestr; const char *cached; const char *protectionstr; char *pw; int missing_key = 0; char ttlbuf[20]; char flagsbuf[5]; err = agent_key_info_from_file (ctrl, grip, &keytype, &shadow_info); if (err) { if (in_ssh && gpg_err_code (err) == GPG_ERR_NOT_FOUND) missing_key = 1; else goto leave; } /* Reformat the grip so that we use uppercase as good style. */ bin2hex (grip, 20, hexgrip); if (ttl > 0) snprintf (ttlbuf, sizeof ttlbuf, "%d", ttl); else strcpy (ttlbuf, "-"); *flagsbuf = 0; if (disabled) strcat (flagsbuf, "D"); if (in_ssh) strcat (flagsbuf, "S"); if (confirm) strcat (flagsbuf, "c"); if (!*flagsbuf) strcpy (flagsbuf, "-"); if (missing_key) { protectionstr = "-"; keytypestr = "-"; } else { switch (keytype) { case PRIVATE_KEY_CLEAR: case PRIVATE_KEY_OPENPGP_NONE: protectionstr = "C"; keytypestr = "D"; break; case PRIVATE_KEY_PROTECTED: protectionstr = "P"; keytypestr = "D"; break; case PRIVATE_KEY_SHADOWED: protectionstr = "-"; keytypestr = "T"; break; default: protectionstr = "-"; keytypestr = "X"; break; } } /* Compute the ssh fingerprint if requested. */ if (with_ssh_fpr) { gcry_sexp_t key; if (!agent_raw_key_from_file (ctrl, grip, &key)) { ssh_get_fingerprint_string (key, with_ssh_fpr, &fpr); gcry_sexp_release (key); } } /* Here we have a little race by doing the cache check separately from the retrieval function. Given that the cache flag is only a hint, it should not really matter. */ pw = agent_get_cache (ctrl, hexgrip, CACHE_MODE_NORMAL); cached = pw ? "1" : "-"; xfree (pw); if (shadow_info) { err = parse_shadow_info (shadow_info, &serialno, &idstr, NULL); if (err) goto leave; } if (!data) err = agent_write_status (ctrl, "KEYINFO", hexgrip, keytypestr, serialno? serialno : "-", idstr? idstr : "-", cached, protectionstr, fpr? fpr : "-", ttlbuf, flagsbuf, NULL); else { char *string; string = xtryasprintf ("%s %s %s %s %s %s %s %s %s\n", hexgrip, keytypestr, serialno? serialno : "-", idstr? idstr : "-", cached, protectionstr, fpr? fpr : "-", ttlbuf, flagsbuf); if (!string) err = gpg_error_from_syserror (); else err = assuan_send_data (ctx, string, strlen(string)); xfree (string); } leave: xfree (fpr); xfree (shadow_info); xfree (serialno); xfree (idstr); return err; } -/* Entry int for the command KEYINFO. This function handles the - command option processing. For details see hlp_keyinfo above. */ +/* Entry into the command KEYINFO. This function handles the + * command option processing. For details see hlp_keyinfo above. */ static gpg_error_t cmd_keyinfo (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int err; unsigned char grip[20]; DIR *dir = NULL; int list_mode; int opt_data, opt_ssh_fpr, opt_with_ssh; ssh_control_file_t cf = NULL; char hexgrip[41]; int disabled, ttl, confirm, is_ssh; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); if (has_option (line, "--ssh-list")) list_mode = 2; else list_mode = has_option (line, "--list"); opt_data = has_option (line, "--data"); if (has_option_name (line, "--ssh-fpr")) { if (has_option (line, "--ssh-fpr=md5")) opt_ssh_fpr = GCRY_MD_MD5; else if (has_option (line, "--ssh-fpr=sha1")) opt_ssh_fpr = GCRY_MD_SHA1; else if (has_option (line, "--ssh-fpr=sha256")) opt_ssh_fpr = GCRY_MD_SHA256; else opt_ssh_fpr = opt.ssh_fingerprint_digest; } else opt_ssh_fpr = 0; opt_with_ssh = has_option (line, "--with-ssh"); line = skip_options (line); if (opt_with_ssh || list_mode == 2) cf = ssh_open_control_file (); if (list_mode == 2) { if (cf) { while (!ssh_read_control_file (cf, hexgrip, &disabled, &ttl, &confirm)) { if (hex2bin (hexgrip, grip, 20) < 0 ) continue; /* Bad hex string. */ err = do_one_keyinfo (ctrl, grip, ctx, opt_data, opt_ssh_fpr, 1, ttl, disabled, confirm); if (err) goto leave; } } err = 0; } else if (list_mode) { char *dirname; struct dirent *dir_entry; dirname = make_filename_try (gnupg_homedir (), GNUPG_PRIVATE_KEYS_DIR, NULL); if (!dirname) { err = gpg_error_from_syserror (); goto leave; } dir = opendir (dirname); if (!dir) { err = gpg_error_from_syserror (); xfree (dirname); goto leave; } xfree (dirname); while ( (dir_entry = readdir (dir)) ) { if (strlen (dir_entry->d_name) != 44 || strcmp (dir_entry->d_name + 40, ".key")) continue; strncpy (hexgrip, dir_entry->d_name, 40); hexgrip[40] = 0; if ( hex2bin (hexgrip, grip, 20) < 0 ) continue; /* Bad hex string. */ disabled = ttl = confirm = is_ssh = 0; if (opt_with_ssh) { err = ssh_search_control_file (cf, hexgrip, &disabled, &ttl, &confirm); if (!err) is_ssh = 1; else if (gpg_err_code (err) != GPG_ERR_NOT_FOUND) goto leave; } err = do_one_keyinfo (ctrl, grip, ctx, opt_data, opt_ssh_fpr, is_ssh, ttl, disabled, confirm); if (err) goto leave; } err = 0; } else { err = parse_keygrip (ctx, line, grip); if (err) goto leave; disabled = ttl = confirm = is_ssh = 0; if (opt_with_ssh) { err = ssh_search_control_file (cf, line, &disabled, &ttl, &confirm); if (!err) is_ssh = 1; else if (gpg_err_code (err) != GPG_ERR_NOT_FOUND) goto leave; } err = do_one_keyinfo (ctrl, grip, ctx, opt_data, opt_ssh_fpr, is_ssh, ttl, disabled, confirm); } leave: ssh_close_control_file (cf); if (dir) closedir (dir); if (err && gpg_err_code (err) != GPG_ERR_NOT_FOUND) leave_cmd (ctx, err); return err; } /* Helper for cmd_get_passphrase. */ static int send_back_passphrase (assuan_context_t ctx, int via_data, const char *pw) { size_t n; int rc; assuan_begin_confidential (ctx); n = strlen (pw); if (via_data) rc = assuan_send_data (ctx, pw, n); else { char *p = xtrymalloc_secure (n*2+1); if (!p) rc = gpg_error_from_syserror (); else { bin2hex (pw, n, p); rc = assuan_set_okay_line (ctx, p); xfree (p); } } return rc; } static const char hlp_get_passphrase[] = "GET_PASSPHRASE [--data] [--check] [--no-ask] [--repeat[=N]]\n" " [--qualitybar] \n" " [ ]\n" "\n" "This function is usually used to ask for a passphrase to be used\n" "for conventional encryption, but may also be used by programs which\n" "need specal handling of passphrases. This command uses a syntax\n" "which helps clients to use the agent with minimum effort. The\n" "agent either returns with an error or with a OK followed by the hex\n" "encoded passphrase. Note that the length of the strings is\n" "implicitly limited by the maximum length of a command.\n" "\n" "If the option \"--data\" is used the passphrase is returned by usual\n" "data lines and not on the okay line.\n" "\n" "If the option \"--check\" is used the passphrase constraints checks as\n" "implemented by gpg-agent are applied. A check is not done if the\n" "passphrase has been found in the cache.\n" "\n" "If the option \"--no-ask\" is used and the passphrase is not in the\n" "cache the user will not be asked to enter a passphrase but the error\n" "code GPG_ERR_NO_DATA is returned. \n" "\n" "If the option \"--qualitybar\" is used a visual indication of the\n" "entered passphrase quality is shown. (Unless no minimum passphrase\n" "length has been configured.)"; static gpg_error_t cmd_get_passphrase (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int rc; char *pw; char *response; char *cacheid = NULL, *desc = NULL, *prompt = NULL, *errtext = NULL; const char *desc2 = _("Please re-enter this passphrase"); char *p; int opt_data, opt_check, opt_no_ask, opt_qualbar; int opt_repeat = 0; char *entry_errtext = NULL; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); opt_data = has_option (line, "--data"); opt_check = has_option (line, "--check"); opt_no_ask = has_option (line, "--no-ask"); if (has_option_name (line, "--repeat")) { p = option_value (line, "--repeat"); if (p) opt_repeat = atoi (p); else opt_repeat = 1; } opt_qualbar = has_option (line, "--qualitybar"); line = skip_options (line); cacheid = line; p = strchr (cacheid, ' '); if (p) { *p++ = 0; while (*p == ' ') p++; errtext = p; p = strchr (errtext, ' '); if (p) { *p++ = 0; while (*p == ' ') p++; prompt = p; p = strchr (prompt, ' '); if (p) { *p++ = 0; while (*p == ' ') p++; desc = p; p = strchr (desc, ' '); if (p) *p = 0; /* Ignore trailing garbage. */ } } } if (!*cacheid || strlen (cacheid) > 50) return set_error (GPG_ERR_ASS_PARAMETER, "invalid length of cacheID"); if (!desc) return set_error (GPG_ERR_ASS_PARAMETER, "no description given"); if (!strcmp (cacheid, "X")) cacheid = NULL; if (!strcmp (errtext, "X")) errtext = NULL; if (!strcmp (prompt, "X")) prompt = NULL; if (!strcmp (desc, "X")) desc = NULL; pw = cacheid ? agent_get_cache (ctrl, cacheid, CACHE_MODE_USER) : NULL; if (pw) { rc = send_back_passphrase (ctx, opt_data, pw); xfree (pw); } else if (opt_no_ask) rc = gpg_error (GPG_ERR_NO_DATA); else { /* Note, that we only need to replace the + characters and should leave the other escaping in place because the escaped string is send verbatim to the pinentry which does the unescaping (but not the + replacing) */ if (errtext) plus_to_blank (errtext); if (prompt) plus_to_blank (prompt); if (desc) plus_to_blank (desc); next_try: rc = agent_get_passphrase (ctrl, &response, desc, prompt, entry_errtext? entry_errtext:errtext, opt_qualbar, cacheid, CACHE_MODE_USER); xfree (entry_errtext); entry_errtext = NULL; if (!rc) { int i; if (opt_check && check_passphrase_constraints (ctrl, response, &entry_errtext)) { xfree (response); goto next_try; } for (i = 0; i < opt_repeat; i++) { char *response2; if (ctrl->pinentry_mode == PINENTRY_MODE_LOOPBACK) break; rc = agent_get_passphrase (ctrl, &response2, desc2, prompt, errtext, 0, cacheid, CACHE_MODE_USER); if (rc) break; if (strcmp (response2, response)) { xfree (response2); xfree (response); entry_errtext = try_percent_escape (_("does not match - try again"), NULL); if (!entry_errtext) { rc = gpg_error_from_syserror (); break; } goto next_try; } xfree (response2); } if (!rc) { if (cacheid) agent_put_cache (ctrl, cacheid, CACHE_MODE_USER, response, 0); rc = send_back_passphrase (ctx, opt_data, response); } xfree (response); } } return leave_cmd (ctx, rc); } static const char hlp_clear_passphrase[] = "CLEAR_PASSPHRASE [--mode=normal] \n" "\n" "may be used to invalidate the cache entry for a passphrase. The\n" "function returns with OK even when there is no cached passphrase.\n" "The --mode=normal option is used to clear an entry for a cacheid\n" "added by the agent. The --mode=ssh option is used for a cacheid\n" "added for ssh.\n"; static gpg_error_t cmd_clear_passphrase (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); char *cacheid = NULL; char *p; cache_mode_t cache_mode = CACHE_MODE_USER; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); if (has_option (line, "--mode=normal")) cache_mode = CACHE_MODE_NORMAL; else if (has_option (line, "--mode=ssh")) cache_mode = CACHE_MODE_SSH; line = skip_options (line); /* parse the stuff */ for (p=line; *p == ' '; p++) ; cacheid = p; p = strchr (cacheid, ' '); if (p) *p = 0; /* ignore garbage */ if (!*cacheid || strlen (cacheid) > 50) return set_error (GPG_ERR_ASS_PARAMETER, "invalid length of cacheID"); agent_put_cache (ctrl, cacheid, cache_mode, NULL, 0); agent_clear_passphrase (ctrl, cacheid, cache_mode); return 0; } static const char hlp_get_confirmation[] = "GET_CONFIRMATION \n" "\n" "This command may be used to ask for a simple confirmation.\n" "DESCRIPTION is displayed along with a Okay and Cancel button. This\n" "command uses a syntax which helps clients to use the agent with\n" "minimum effort. The agent either returns with an error or with a\n" "OK. Note, that the length of DESCRIPTION is implicitly limited by\n" "the maximum length of a command. DESCRIPTION should not contain\n" "any spaces, those must be encoded either percent escaped or simply\n" "as '+'."; static gpg_error_t cmd_get_confirmation (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int rc; char *desc = NULL; char *p; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); /* parse the stuff */ for (p=line; *p == ' '; p++) ; desc = p; p = strchr (desc, ' '); if (p) *p = 0; /* We ignore any garbage -may be later used for other args. */ if (!*desc) return set_error (GPG_ERR_ASS_PARAMETER, "no description given"); if (!strcmp (desc, "X")) desc = NULL; /* Note, that we only need to replace the + characters and should leave the other escaping in place because the escaped string is send verbatim to the pinentry which does the unescaping (but not the + replacing) */ if (desc) plus_to_blank (desc); rc = agent_get_confirmation (ctrl, desc, NULL, NULL, 0); return leave_cmd (ctx, rc); } static const char hlp_learn[] = "LEARN [--send] [--sendinfo] [--force]\n" "\n" "Learn something about the currently inserted smartcard. With\n" "--sendinfo information about the card is returned; with --send\n" "the available certificates are returned as D lines; with --force\n" "private key storage will be updated by the result."; static gpg_error_t cmd_learn (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); gpg_error_t err; int send, sendinfo, force; send = has_option (line, "--send"); sendinfo = send? 1 : has_option (line, "--sendinfo"); force = has_option (line, "--force"); if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); err = agent_handle_learn (ctrl, send, sendinfo? ctx : NULL, force); return leave_cmd (ctx, err); } static const char hlp_passwd[] = "PASSWD [--cache-nonce=] [--passwd-nonce=] [--preset]\n" " [--verify] \n" "\n" "Change the passphrase/PIN for the key identified by keygrip in LINE. If\n" "--preset is used then the new passphrase will be added to the cache.\n" "If --verify is used the command asks for the passphrase and verifies\n" "that the passphrase valid.\n"; static gpg_error_t cmd_passwd (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); gpg_error_t err; int c; char *cache_nonce = NULL; char *passwd_nonce = NULL; unsigned char grip[20]; gcry_sexp_t s_skey = NULL; unsigned char *shadow_info = NULL; char *passphrase = NULL; char *pend; int opt_preset, opt_verify; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); opt_preset = has_option (line, "--preset"); cache_nonce = option_value (line, "--cache-nonce"); opt_verify = has_option (line, "--verify"); if (cache_nonce) { for (pend = cache_nonce; *pend && !spacep (pend); pend++) ; c = *pend; *pend = '\0'; cache_nonce = xtrystrdup (cache_nonce); *pend = c; if (!cache_nonce) { err = gpg_error_from_syserror (); goto leave; } } passwd_nonce = option_value (line, "--passwd-nonce"); if (passwd_nonce) { for (pend = passwd_nonce; *pend && !spacep (pend); pend++) ; c = *pend; *pend = '\0'; passwd_nonce = xtrystrdup (passwd_nonce); *pend = c; if (!passwd_nonce) { err = gpg_error_from_syserror (); goto leave; } } line = skip_options (line); err = parse_keygrip (ctx, line, grip); if (err) goto leave; ctrl->in_passwd++; err = agent_key_from_file (ctrl, opt_verify? NULL : cache_nonce, ctrl->server_local->keydesc, grip, &shadow_info, CACHE_MODE_IGNORE, NULL, &s_skey, &passphrase); if (err) ; else if (shadow_info) { log_error ("changing a smartcard PIN is not yet supported\n"); err = gpg_error (GPG_ERR_NOT_IMPLEMENTED); } else if (opt_verify) { /* All done. */ if (passphrase) { if (!passwd_nonce) { char buf[12]; gcry_create_nonce (buf, 12); passwd_nonce = bin2hex (buf, 12, NULL); } if (passwd_nonce && !agent_put_cache (ctrl, passwd_nonce, CACHE_MODE_NONCE, passphrase, CACHE_TTL_NONCE)) { assuan_write_status (ctx, "PASSWD_NONCE", passwd_nonce); xfree (ctrl->server_local->last_passwd_nonce); ctrl->server_local->last_passwd_nonce = passwd_nonce; passwd_nonce = NULL; } } } else { char *newpass = NULL; if (passwd_nonce) newpass = agent_get_cache (ctrl, passwd_nonce, CACHE_MODE_NONCE); err = agent_protect_and_store (ctrl, s_skey, &newpass); if (!err && passphrase) { /* A passphrase existed on the old key and the change was successful. Return a nonce for that old passphrase to let the caller try to unprotect the other subkeys with the same key. */ if (!cache_nonce) { char buf[12]; gcry_create_nonce (buf, 12); cache_nonce = bin2hex (buf, 12, NULL); } if (cache_nonce && !agent_put_cache (ctrl, cache_nonce, CACHE_MODE_NONCE, passphrase, CACHE_TTL_NONCE)) { assuan_write_status (ctx, "CACHE_NONCE", cache_nonce); xfree (ctrl->server_local->last_cache_nonce); ctrl->server_local->last_cache_nonce = cache_nonce; cache_nonce = NULL; } if (newpass) { /* If we have a new passphrase (which might be empty) we store it under a passwd nonce so that the caller may send that nonce again to use it for another key. */ if (!passwd_nonce) { char buf[12]; gcry_create_nonce (buf, 12); passwd_nonce = bin2hex (buf, 12, NULL); } if (passwd_nonce && !agent_put_cache (ctrl, passwd_nonce, CACHE_MODE_NONCE, newpass, CACHE_TTL_NONCE)) { assuan_write_status (ctx, "PASSWD_NONCE", passwd_nonce); xfree (ctrl->server_local->last_passwd_nonce); ctrl->server_local->last_passwd_nonce = passwd_nonce; passwd_nonce = NULL; } } } if (!err && opt_preset) { char hexgrip[40+1]; bin2hex(grip, 20, hexgrip); err = agent_put_cache (ctrl, hexgrip, CACHE_MODE_ANY, newpass, ctrl->cache_ttl_opt_preset); } xfree (newpass); } ctrl->in_passwd--; xfree (ctrl->server_local->keydesc); ctrl->server_local->keydesc = NULL; leave: xfree (passphrase); gcry_sexp_release (s_skey); xfree (shadow_info); xfree (cache_nonce); xfree (passwd_nonce); return leave_cmd (ctx, err); } static const char hlp_preset_passphrase[] = "PRESET_PASSPHRASE [--inquire] []\n" "\n" "Set the cached passphrase/PIN for the key identified by the keygrip\n" "to passwd for the given time, where -1 means infinite and 0 means\n" "the default (currently only a timeout of -1 is allowed, which means\n" "to never expire it). If passwd is not provided, ask for it via the\n" "pinentry module unless --inquire is passed in which case the passphrase\n" "is retrieved from the client via a server inquire.\n"; static gpg_error_t cmd_preset_passphrase (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int rc; char *grip_clear = NULL; unsigned char *passphrase = NULL; int ttl; size_t len; int opt_inquire; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); if (!opt.allow_preset_passphrase) return set_error (GPG_ERR_NOT_SUPPORTED, "no --allow-preset-passphrase"); opt_inquire = has_option (line, "--inquire"); line = skip_options (line); grip_clear = line; while (*line && (*line != ' ' && *line != '\t')) line++; if (!*line) return gpg_error (GPG_ERR_MISSING_VALUE); *line = '\0'; line++; while (*line && (*line == ' ' || *line == '\t')) line++; /* Currently, only infinite timeouts are allowed. */ ttl = -1; if (line[0] != '-' || line[1] != '1') return gpg_error (GPG_ERR_NOT_IMPLEMENTED); line++; line++; while (!(*line != ' ' && *line != '\t')) line++; /* Syntax check the hexstring. */ len = 0; rc = parse_hexstring (ctx, line, &len); if (rc) return rc; line[len] = '\0'; /* If there is a passphrase, use it. Currently, a passphrase is required. */ if (*line) { if (opt_inquire) { rc = set_error (GPG_ERR_ASS_PARAMETER, "both --inquire and passphrase specified"); goto leave; } /* Do in-place conversion. */ passphrase = line; if (!hex2str (passphrase, passphrase, strlen (passphrase)+1, NULL)) rc = set_error (GPG_ERR_ASS_PARAMETER, "invalid hexstring"); } else if (opt_inquire) { /* Note that the passphrase will be truncated at any null byte and the * limit is 480 characters. */ size_t maxlen = 480; rc = print_assuan_status (ctx, "INQUIRE_MAXLEN", "%zu", maxlen); if (!rc) rc = assuan_inquire (ctx, "PASSPHRASE", &passphrase, &len, maxlen); } else rc = set_error (GPG_ERR_NOT_IMPLEMENTED, "passphrase is required"); if (!rc) { rc = agent_put_cache (ctrl, grip_clear, CACHE_MODE_ANY, passphrase, ttl); if (opt_inquire) xfree (passphrase); } leave: return leave_cmd (ctx, rc); } static const char hlp_scd[] = "SCD \n" " \n" "This is a general quote command to redirect everything to the\n" "SCdaemon."; static gpg_error_t cmd_scd (assuan_context_t ctx, char *line) { int rc; #ifdef BUILD_WITH_SCDAEMON ctrl_t ctrl = assuan_get_pointer (ctx); if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); rc = divert_generic_cmd (ctrl, line, ctx); #else (void)ctx; (void)line; rc = gpg_error (GPG_ERR_NOT_SUPPORTED); #endif return rc; } static const char hlp_keywrap_key[] = "KEYWRAP_KEY [--clear] \n" "\n" "Return a key to wrap another key. For now the key is returned\n" "verbatim and thus makes not much sense because an eavesdropper on\n" "the gpg-agent connection will see the key as well as the wrapped key.\n" "However, this function may either be equipped with a public key\n" "mechanism or not used at all if the key is a pre-shared key. In any\n" "case wrapping the import and export of keys is a requirement for\n" "certain cryptographic validations and thus useful. The key persists\n" "until a RESET command but may be cleared using the option --clear.\n" "\n" "Supported modes are:\n" " --import - Return a key to import a key into gpg-agent\n" " --export - Return a key to export a key from gpg-agent"; static gpg_error_t cmd_keywrap_key (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); gpg_error_t err = 0; int clearopt = has_option (line, "--clear"); if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); assuan_begin_confidential (ctx); if (has_option (line, "--import")) { xfree (ctrl->server_local->import_key); if (clearopt) ctrl->server_local->import_key = NULL; else if (!(ctrl->server_local->import_key = gcry_random_bytes (KEYWRAP_KEYSIZE, GCRY_STRONG_RANDOM))) err = gpg_error_from_syserror (); else err = assuan_send_data (ctx, ctrl->server_local->import_key, KEYWRAP_KEYSIZE); } else if (has_option (line, "--export")) { xfree (ctrl->server_local->export_key); if (clearopt) ctrl->server_local->export_key = NULL; else if (!(ctrl->server_local->export_key = gcry_random_bytes (KEYWRAP_KEYSIZE, GCRY_STRONG_RANDOM))) err = gpg_error_from_syserror (); else err = assuan_send_data (ctx, ctrl->server_local->export_key, KEYWRAP_KEYSIZE); } else err = set_error (GPG_ERR_ASS_PARAMETER, "unknown value for MODE"); assuan_end_confidential (ctx); return leave_cmd (ctx, err); } static const char hlp_import_key[] = "IMPORT_KEY [--unattended] [--force] []\n" "\n" "Import a secret key into the key store. The key is expected to be\n" "encrypted using the current session's key wrapping key (cf. command\n" "KEYWRAP_KEY) using the AESWRAP-128 algorithm. This function takes\n" "no arguments but uses the inquiry \"KEYDATA\" to ask for the actual\n" "key data. The unwrapped key must be a canonical S-expression. The\n" "option --unattended tries to import the key as-is without any\n" "re-encryption. Existing key can be overwritten with --force."; static gpg_error_t cmd_import_key (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); gpg_error_t err; int opt_unattended; int force; unsigned char *wrappedkey = NULL; size_t wrappedkeylen; gcry_cipher_hd_t cipherhd = NULL; unsigned char *key = NULL; size_t keylen, realkeylen; char *passphrase = NULL; unsigned char *finalkey = NULL; size_t finalkeylen; unsigned char grip[20]; gcry_sexp_t openpgp_sexp = NULL; char *cache_nonce = NULL; char *p; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); if (!ctrl->server_local->import_key) { err = gpg_error (GPG_ERR_MISSING_KEY); goto leave; } opt_unattended = has_option (line, "--unattended"); force = has_option (line, "--force"); line = skip_options (line); for (p=line; *p && *p != ' ' && *p != '\t'; p++) ; *p = '\0'; if (*line) cache_nonce = xtrystrdup (line); assuan_begin_confidential (ctx); err = assuan_inquire (ctx, "KEYDATA", &wrappedkey, &wrappedkeylen, MAXLEN_KEYDATA); assuan_end_confidential (ctx); if (err) goto leave; if (wrappedkeylen < 24) { err = gpg_error (GPG_ERR_INV_LENGTH); goto leave; } keylen = wrappedkeylen - 8; key = xtrymalloc_secure (keylen); if (!key) { err = gpg_error_from_syserror (); goto leave; } err = gcry_cipher_open (&cipherhd, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_AESWRAP, 0); if (err) goto leave; err = gcry_cipher_setkey (cipherhd, ctrl->server_local->import_key, KEYWRAP_KEYSIZE); if (err) goto leave; err = gcry_cipher_decrypt (cipherhd, key, keylen, wrappedkey, wrappedkeylen); if (err) goto leave; gcry_cipher_close (cipherhd); cipherhd = NULL; xfree (wrappedkey); wrappedkey = NULL; realkeylen = gcry_sexp_canon_len (key, keylen, NULL, &err); if (!realkeylen) goto leave; /* Invalid canonical encoded S-expression. */ err = keygrip_from_canon_sexp (key, realkeylen, grip); if (err) { /* This might be due to an unsupported S-expression format. Check whether this is openpgp-private-key and trigger that import code. */ if (!gcry_sexp_sscan (&openpgp_sexp, NULL, key, realkeylen)) { const char *tag; size_t taglen; tag = gcry_sexp_nth_data (openpgp_sexp, 0, &taglen); if (tag && taglen == 19 && !memcmp (tag, "openpgp-private-key", 19)) ; else { gcry_sexp_release (openpgp_sexp); openpgp_sexp = NULL; } } if (!openpgp_sexp) goto leave; /* Note that ERR is still set. */ } if (openpgp_sexp) { /* In most cases the key is encrypted and thus the conversion function from the OpenPGP format to our internal format will ask for a passphrase. That passphrase will be returned and used to protect the key using the same code as for regular key import. */ xfree (key); key = NULL; err = convert_from_openpgp (ctrl, openpgp_sexp, force, grip, ctrl->server_local->keydesc, cache_nonce, &key, opt_unattended? NULL : &passphrase); if (err) goto leave; realkeylen = gcry_sexp_canon_len (key, 0, NULL, &err); if (!realkeylen) goto leave; /* Invalid canonical encoded S-expression. */ if (passphrase) { assert (!opt_unattended); if (!cache_nonce) { char buf[12]; gcry_create_nonce (buf, 12); cache_nonce = bin2hex (buf, 12, NULL); } if (cache_nonce && !agent_put_cache (ctrl, cache_nonce, CACHE_MODE_NONCE, passphrase, CACHE_TTL_NONCE)) assuan_write_status (ctx, "CACHE_NONCE", cache_nonce); } } else if (opt_unattended) { err = set_error (GPG_ERR_ASS_PARAMETER, "\"--unattended\" may only be used with OpenPGP keys"); goto leave; } else { if (!force && !agent_key_available (grip)) err = gpg_error (GPG_ERR_EEXIST); else { char *prompt = xtryasprintf (_("Please enter the passphrase to protect the " "imported object within the %s system."), GNUPG_NAME); if (!prompt) err = gpg_error_from_syserror (); else err = agent_ask_new_passphrase (ctrl, prompt, &passphrase); xfree (prompt); } if (err) goto leave; } if (passphrase) { err = agent_protect (key, passphrase, &finalkey, &finalkeylen, ctrl->s2k_count, -1); if (!err) err = agent_write_private_key (grip, finalkey, finalkeylen, force, NULL, NULL); } else err = agent_write_private_key (grip, key, realkeylen, force, NULL, NULL); leave: gcry_sexp_release (openpgp_sexp); xfree (finalkey); xfree (passphrase); xfree (key); gcry_cipher_close (cipherhd); xfree (wrappedkey); xfree (cache_nonce); xfree (ctrl->server_local->keydesc); ctrl->server_local->keydesc = NULL; return leave_cmd (ctx, err); } static const char hlp_export_key[] = "EXPORT_KEY [--cache-nonce=] [--openpgp] \n" "\n" "Export a secret key from the key store. The key will be encrypted\n" "using the current session's key wrapping key (cf. command KEYWRAP_KEY)\n" "using the AESWRAP-128 algorithm. The caller needs to retrieve that key\n" "prior to using this command. The function takes the keygrip as argument.\n" "\n" "If --openpgp is used, the secret key material will be exported in RFC 4880\n" "compatible passphrase-protected form. Without --openpgp, the secret key\n" "material will be exported in the clear (after prompting the user to unlock\n" "it, if needed).\n"; static gpg_error_t cmd_export_key (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); gpg_error_t err; unsigned char grip[20]; gcry_sexp_t s_skey = NULL; unsigned char *key = NULL; size_t keylen; gcry_cipher_hd_t cipherhd = NULL; unsigned char *wrappedkey = NULL; size_t wrappedkeylen; int openpgp; char *cache_nonce; char *passphrase = NULL; unsigned char *shadow_info = NULL; char *pend; int c; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); openpgp = has_option (line, "--openpgp"); cache_nonce = option_value (line, "--cache-nonce"); if (cache_nonce) { for (pend = cache_nonce; *pend && !spacep (pend); pend++) ; c = *pend; *pend = '\0'; cache_nonce = xtrystrdup (cache_nonce); *pend = c; if (!cache_nonce) { err = gpg_error_from_syserror (); goto leave; } } line = skip_options (line); if (!ctrl->server_local->export_key) { err = set_error (GPG_ERR_MISSING_KEY, "did you run KEYWRAP_KEY ?"); goto leave; } err = parse_keygrip (ctx, line, grip); if (err) goto leave; if (agent_key_available (grip)) { err = gpg_error (GPG_ERR_NO_SECKEY); goto leave; } /* Get the key from the file. With the openpgp flag we also ask for the passphrase so that we can use it to re-encrypt it. */ err = agent_key_from_file (ctrl, cache_nonce, ctrl->server_local->keydesc, grip, &shadow_info, CACHE_MODE_IGNORE, NULL, &s_skey, openpgp ? &passphrase : NULL); if (err) goto leave; if (shadow_info) { /* Key is on a smartcard. */ err = gpg_error (GPG_ERR_UNUSABLE_SECKEY); goto leave; } if (openpgp) { /* The openpgp option changes the key format into the OpenPGP key transfer format. The result is already a padded canonical S-expression. */ if (!passphrase) { err = agent_ask_new_passphrase (ctrl, _("This key (or subkey) is not protected with a passphrase." " Please enter a new passphrase to export it."), &passphrase); if (err) goto leave; } err = convert_to_openpgp (ctrl, s_skey, passphrase, &key, &keylen); if (!err && passphrase) { if (!cache_nonce) { char buf[12]; gcry_create_nonce (buf, 12); cache_nonce = bin2hex (buf, 12, NULL); } if (cache_nonce && !agent_put_cache (ctrl, cache_nonce, CACHE_MODE_NONCE, passphrase, CACHE_TTL_NONCE)) { assuan_write_status (ctx, "CACHE_NONCE", cache_nonce); xfree (ctrl->server_local->last_cache_nonce); ctrl->server_local->last_cache_nonce = cache_nonce; cache_nonce = NULL; } } } else { /* Convert into a canonical S-expression and wrap that. */ err = make_canon_sexp_pad (s_skey, 1, &key, &keylen); } if (err) goto leave; gcry_sexp_release (s_skey); s_skey = NULL; err = gcry_cipher_open (&cipherhd, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_AESWRAP, 0); if (err) goto leave; err = gcry_cipher_setkey (cipherhd, ctrl->server_local->export_key, KEYWRAP_KEYSIZE); if (err) goto leave; wrappedkeylen = keylen + 8; wrappedkey = xtrymalloc (wrappedkeylen); if (!wrappedkey) { err = gpg_error_from_syserror (); goto leave; } err = gcry_cipher_encrypt (cipherhd, wrappedkey, wrappedkeylen, key, keylen); if (err) goto leave; xfree (key); key = NULL; gcry_cipher_close (cipherhd); cipherhd = NULL; assuan_begin_confidential (ctx); err = assuan_send_data (ctx, wrappedkey, wrappedkeylen); assuan_end_confidential (ctx); leave: xfree (cache_nonce); xfree (passphrase); xfree (wrappedkey); gcry_cipher_close (cipherhd); xfree (key); gcry_sexp_release (s_skey); xfree (ctrl->server_local->keydesc); ctrl->server_local->keydesc = NULL; xfree (shadow_info); return leave_cmd (ctx, err); } static const char hlp_delete_key[] = "DELETE_KEY [--force|--stub-only] \n" "\n" "Delete a secret key from the key store. If --force is used\n" "and a loopback pinentry is allowed, the agent will not ask\n" "the user for confirmation. If --stub-only is used the key will\n" "only be deleted if it is a reference to a token."; static gpg_error_t cmd_delete_key (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); gpg_error_t err; int force, stub_only; unsigned char grip[20]; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); force = has_option (line, "--force"); stub_only = has_option (line, "--stub-only"); line = skip_options (line); /* If the use of a loopback pinentry has been disabled, we assume * that a silent deletion of keys shall also not be allowed. */ if (!opt.allow_loopback_pinentry) force = 0; err = parse_keygrip (ctx, line, grip); if (err) goto leave; err = agent_delete_key (ctrl, ctrl->server_local->keydesc, grip, force, stub_only); if (err) goto leave; leave: xfree (ctrl->server_local->keydesc); ctrl->server_local->keydesc = NULL; return leave_cmd (ctx, err); } #if SIZEOF_TIME_T > SIZEOF_UNSIGNED_LONG #define KEYTOCARD_TIMESTAMP_FORMAT "(10:created-at10:%010llu))" #else #define KEYTOCARD_TIMESTAMP_FORMAT "(10:created-at10:%010lu))" #endif static const char hlp_keytocard[] = "KEYTOCARD [--force] []\n" "\n" "TIMESTAMP is required for OpenPGP and defaults to the Epoch. The\n" "SERIALNO is used for checking; use \"-\" to disable the check."; static gpg_error_t cmd_keytocard (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int force; gpg_error_t err = 0; char *argv[5]; int argc; unsigned char grip[20]; const char *serialno, *timestamp_str, *keyref; gcry_sexp_t s_skey = NULL; unsigned char *keydata; size_t keydatalen; unsigned char *shadow_info = NULL; time_t timestamp; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); force = has_option (line, "--force"); line = skip_options (line); argc = split_fields (line, argv, DIM (argv)); if (argc < 3) { err = gpg_error (GPG_ERR_MISSING_VALUE); goto leave; } err = parse_keygrip (ctx, argv[0], grip); if (err) goto leave; if (agent_key_available (grip)) { err =gpg_error (GPG_ERR_NO_SECKEY); goto leave; } /* Note that checking of the s/n is currently not implemented but we * want to provide a clean interface if we ever implement it. */ serialno = argv[1]; if (!strcmp (serialno, "-")) serialno = NULL; keyref = argv[2]; /* FIXME: Default to the creation time as stored in the private * key. The parameter is here so that gpg can make sure that the * timestamp as used for key creation (and thus the openPGP * fingerprint) is used. */ timestamp_str = argc > 3? argv[3] : "19700101T000000"; if ((timestamp = isotime2epoch (timestamp_str)) == (time_t)(-1)) { err = gpg_error (GPG_ERR_INV_TIME); goto leave; } err = agent_key_from_file (ctrl, NULL, ctrl->server_local->keydesc, grip, &shadow_info, CACHE_MODE_IGNORE, NULL, &s_skey, NULL); if (err) goto leave; if (shadow_info) { /* Key is already on a smartcard - we can't extract it. */ err = gpg_error (GPG_ERR_UNUSABLE_SECKEY); goto leave; } /* Note: We can't use make_canon_sexp because we need to allocate a * few extra bytes for our hack below. */ keydatalen = gcry_sexp_sprint (s_skey, GCRYSEXP_FMT_CANON, NULL, 0); keydata = xtrymalloc_secure (keydatalen + 30); if (keydata == NULL) { err = gpg_error_from_syserror (); goto leave; } gcry_sexp_sprint (s_skey, GCRYSEXP_FMT_CANON, keydata, keydatalen); gcry_sexp_release (s_skey); s_skey = NULL; keydatalen--; /* Decrement for last '\0'. */ /* Hack to insert the timestamp "created-at" into the private key. */ snprintf (keydata+keydatalen-1, 30, KEYTOCARD_TIMESTAMP_FORMAT, timestamp); keydatalen += 10 + 19 - 1; err = divert_writekey (ctrl, force, serialno, keyref, keydata, keydatalen); xfree (keydata); leave: gcry_sexp_release (s_skey); xfree (shadow_info); return leave_cmd (ctx, err); } static const char hlp_get_secret[] = "GET_SECRET \n" "\n" "Return the secret value stored under KEY\n"; static gpg_error_t cmd_get_secret (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); gpg_error_t err; char *p, *key; char *value = NULL; size_t valuelen; /* For now we allow this only for local connections. */ if (ctrl->restricted) { err = gpg_error (GPG_ERR_FORBIDDEN); goto leave; } line = skip_options (line); for (p=line; *p == ' '; p++) ; key = p; p = strchr (key, ' '); if (p) { *p++ = 0; for (; *p == ' '; p++) ; if (*p) { err = set_error (GPG_ERR_ASS_PARAMETER, "too many arguments"); goto leave; } } if (!*key) { err = set_error (GPG_ERR_ASS_PARAMETER, "no key given"); goto leave; } value = agent_get_cache (ctrl, key, CACHE_MODE_DATA); if (!value) { err = gpg_error (GPG_ERR_NO_DATA); goto leave; } valuelen = percent_unescape_inplace (value, 0); err = assuan_send_data (ctx, value, valuelen); wipememory (value, valuelen); leave: xfree (value); return leave_cmd (ctx, err); } static const char hlp_put_secret[] = "PUT_SECRET [--clear] []\n" "\n" "This commands stores a secret under KEY in gpg-agent's in-memory\n" "cache. The TTL must be explicitly given by TTL and the options\n" "from the configuration file are not used. The value is either given\n" "percent-escaped as 3rd argument or if not given inquired by gpg-agent\n" "using the keyword \"SECRET\".\n" "The option --clear removes the secret from the cache." ""; static gpg_error_t cmd_put_secret (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); gpg_error_t err = 0; int opt_clear; unsigned char *value = NULL; size_t valuelen = 0; size_t n; char *p, *key, *ttlstr; unsigned char *valstr; int ttl; char *string = NULL; /* For now we allow this only for local connections. */ if (ctrl->restricted) { err = gpg_error (GPG_ERR_FORBIDDEN); goto leave; } opt_clear = has_option (line, "--clear"); line = skip_options (line); for (p=line; *p == ' '; p++) ; key = p; ttlstr = NULL; valstr = NULL; p = strchr (key, ' '); if (p) { *p++ = 0; for (; *p == ' '; p++) ; if (*p) { ttlstr = p; p = strchr (ttlstr, ' '); if (p) { *p++ = 0; for (; *p == ' '; p++) ; if (*p) valstr = p; } } } if (!*key) { err = set_error (GPG_ERR_ASS_PARAMETER, "no key given"); goto leave; } if (!ttlstr || !*ttlstr || !(n = parse_ttl (ttlstr, &ttl))) { err = set_error (GPG_ERR_ASS_PARAMETER, "no or invalid TTL given"); goto leave; } if (valstr && opt_clear) { err = set_error (GPG_ERR_ASS_PARAMETER, "value not expected with --clear"); goto leave; } if (valstr) { valuelen = percent_unescape_inplace (valstr, 0); value = NULL; } else /* Inquire the value to store */ { err = print_assuan_status (ctx, "INQUIRE_MAXLEN", "%u",MAXLEN_PUT_SECRET); if (!err) err = assuan_inquire (ctx, "SECRET", &value, &valuelen, MAXLEN_PUT_SECRET); if (err) goto leave; } /* Our cache expects strings and thus we need to turn the buffer * into a string. Instead of resorting to base64 encoding we use a * special percent escaping which only quoted the Nul and the * percent character. */ string = percent_data_escape (0, NULL, value? value : valstr, valuelen); if (!string) { err = gpg_error_from_syserror (); goto leave; } err = agent_put_cache (ctrl, key, CACHE_MODE_DATA, string, ttl); leave: if (string) { wipememory (string, strlen (string)); xfree (string); } if (value) { wipememory (value, valuelen); xfree (value); } return leave_cmd (ctx, err); } static const char hlp_getval[] = "GETVAL \n" "\n" "Return the value for KEY from the special environment as created by\n" "PUTVAL."; static gpg_error_t cmd_getval (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int rc = 0; char *key = NULL; char *p; struct putval_item_s *vl; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); for (p=line; *p == ' '; p++) ; key = p; p = strchr (key, ' '); if (p) { *p++ = 0; for (; *p == ' '; p++) ; if (*p) return set_error (GPG_ERR_ASS_PARAMETER, "too many arguments"); } if (!*key) return set_error (GPG_ERR_ASS_PARAMETER, "no key given"); for (vl=putval_list; vl; vl = vl->next) if ( !strcmp (vl->d, key) ) break; if (vl) /* Got an entry. */ rc = assuan_send_data (ctx, vl->d+vl->off, vl->len); else return gpg_error (GPG_ERR_NO_DATA); return leave_cmd (ctx, rc); } static const char hlp_putval[] = "PUTVAL []\n" "\n" "The gpg-agent maintains a kind of environment which may be used to\n" "store key/value pairs in it, so that they can be retrieved later.\n" "This may be used by helper daemons to daemonize themself on\n" "invocation and register them with gpg-agent. Callers of the\n" "daemon's service may now first try connect to get the information\n" "for that service from gpg-agent through the GETVAL command and then\n" "try to connect to that daemon. Only if that fails they may start\n" "an own instance of the service daemon. \n" "\n" "KEY is an arbitrary symbol with the same syntax rules as keys\n" "for shell environment variables. PERCENT_ESCAPED_VALUE is the\n" "corresponding value; they should be similar to the values of\n" "envronment variables but gpg-agent does not enforce any\n" "restrictions. If that value is not given any value under that KEY\n" "is removed from this special environment."; static gpg_error_t cmd_putval (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int rc = 0; char *key = NULL; char *value = NULL; size_t valuelen = 0; char *p; struct putval_item_s *vl, *vlprev; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); for (p=line; *p == ' '; p++) ; key = p; p = strchr (key, ' '); if (p) { *p++ = 0; for (; *p == ' '; p++) ; if (*p) { value = p; p = strchr (value, ' '); if (p) *p = 0; valuelen = percent_plus_unescape_inplace (value, 0); } } if (!*key) return set_error (GPG_ERR_ASS_PARAMETER, "no key given"); for (vl=putval_list,vlprev=NULL; vl; vlprev=vl, vl = vl->next) if ( !strcmp (vl->d, key) ) break; if (vl) /* Delete old entry. */ { if (vlprev) vlprev->next = vl->next; else putval_list = vl->next; xfree (vl); } if (valuelen) /* Add entry. */ { vl = xtrymalloc (sizeof *vl + strlen (key) + valuelen); if (!vl) rc = gpg_error_from_syserror (); else { vl->len = valuelen; vl->off = strlen (key) + 1; strcpy (vl->d, key); memcpy (vl->d + vl->off, value, valuelen); vl->next = putval_list; putval_list = vl; } } return leave_cmd (ctx, rc); } static const char hlp_updatestartuptty[] = "UPDATESTARTUPTTY\n" "\n" "Set startup TTY and X11 DISPLAY variables to the values of this\n" "session. This command is useful to pull future pinentries to\n" "another screen. It is only required because there is no way in the\n" "ssh-agent protocol to convey this information."; static gpg_error_t cmd_updatestartuptty (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); gpg_error_t err = 0; session_env_t se; char *lc_ctype = NULL; char *lc_messages = NULL; int iterator; const char *name; (void)line; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); se = session_env_new (); if (!se) err = gpg_error_from_syserror (); iterator = 0; while (!err && (name = session_env_list_stdenvnames (&iterator, NULL))) { const char *value = session_env_getenv (ctrl->session_env, name); if (value) err = session_env_setenv (se, name, value); } if (!err && ctrl->lc_ctype) if (!(lc_ctype = xtrystrdup (ctrl->lc_ctype))) err = gpg_error_from_syserror (); if (!err && ctrl->lc_messages) if (!(lc_messages = xtrystrdup (ctrl->lc_messages))) err = gpg_error_from_syserror (); if (err) { session_env_release (se); xfree (lc_ctype); xfree (lc_messages); } else { session_env_release (opt.startup_env); opt.startup_env = se; xfree (opt.startup_lc_ctype); opt.startup_lc_ctype = lc_ctype; xfree (opt.startup_lc_messages); opt.startup_lc_messages = lc_messages; } return err; } static const char hlp_killagent[] = "KILLAGENT\n" "\n" "Stop the agent."; static gpg_error_t cmd_killagent (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); (void)line; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); ctrl->server_local->stopme = 1; assuan_set_flag (ctx, ASSUAN_FORCE_CLOSE, 1); return 0; } static const char hlp_reloadagent[] = "RELOADAGENT\n" "\n" "This command is an alternative to SIGHUP\n" "to reload the configuration."; static gpg_error_t cmd_reloadagent (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); (void)line; if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); agent_sighup_action (); return 0; } static const char hlp_getinfo[] = "GETINFO \n" "\n" "Multipurpose function to return a variety of information.\n" "Supported values for WHAT are:\n" "\n" " version - Return the version of the program.\n" " pid - Return the process id of the server.\n" " socket_name - Return the name of the socket.\n" " ssh_socket_name - Return the name of the ssh socket.\n" " scd_running - Return OK if the SCdaemon is already running.\n" " s2k_time - Return the time in milliseconds required for S2K.\n" " s2k_count - Return the standard S2K count.\n" " s2k_count_cal - Return the calibrated S2K count.\n" " std_env_names - List the names of the standard environment.\n" " std_session_env - List the standard session environment.\n" " std_startup_env - List the standard startup environment.\n" " getenv NAME - Return value of envvar NAME.\n" " connections - Return number of active connections.\n" " jent_active - Returns OK if Libgcrypt's JENT is active.\n" " restricted - Returns OK if the connection is in restricted mode.\n" " cmd_has_option CMD OPT\n" " - Returns OK if command CMD has option OPT.\n"; static gpg_error_t cmd_getinfo (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); int rc = 0; if (!strcmp (line, "version")) { const char *s = VERSION; rc = assuan_send_data (ctx, s, strlen (s)); } else if (!strncmp (line, "cmd_has_option", 14) && (line[14] == ' ' || line[14] == '\t' || !line[14])) { char *cmd, *cmdopt; line += 14; while (*line == ' ' || *line == '\t') line++; if (!*line) rc = gpg_error (GPG_ERR_MISSING_VALUE); else { cmd = line; while (*line && (*line != ' ' && *line != '\t')) line++; if (!*line) rc = gpg_error (GPG_ERR_MISSING_VALUE); else { *line++ = 0; while (*line == ' ' || *line == '\t') line++; if (!*line) rc = gpg_error (GPG_ERR_MISSING_VALUE); else { cmdopt = line; if (!command_has_option (cmd, cmdopt)) rc = gpg_error (GPG_ERR_GENERAL); } } } } else if (!strcmp (line, "s2k_count")) { char numbuf[50]; snprintf (numbuf, sizeof numbuf, "%lu", get_standard_s2k_count ()); rc = assuan_send_data (ctx, numbuf, strlen (numbuf)); } else if (!strcmp (line, "restricted")) { rc = ctrl->restricted? 0 : gpg_error (GPG_ERR_GENERAL); } else if (ctrl->restricted) { rc = gpg_error (GPG_ERR_FORBIDDEN); } /* All sub-commands below are not allowed in restricted mode. */ else if (!strcmp (line, "pid")) { char numbuf[50]; snprintf (numbuf, sizeof numbuf, "%lu", (unsigned long)getpid ()); rc = assuan_send_data (ctx, numbuf, strlen (numbuf)); } else if (!strcmp (line, "socket_name")) { const char *s = get_agent_socket_name (); if (s) rc = assuan_send_data (ctx, s, strlen (s)); else rc = gpg_error (GPG_ERR_NO_DATA); } else if (!strcmp (line, "ssh_socket_name")) { const char *s = get_agent_ssh_socket_name (); if (s) rc = assuan_send_data (ctx, s, strlen (s)); else rc = gpg_error (GPG_ERR_NO_DATA); } else if (!strcmp (line, "scd_running")) { rc = agent_scd_check_running ()? 0 : gpg_error (GPG_ERR_GENERAL); } else if (!strcmp (line, "std_env_names")) { int iterator; const char *name; iterator = 0; while ((name = session_env_list_stdenvnames (&iterator, NULL))) { rc = assuan_send_data (ctx, name, strlen (name)+1); if (!rc) rc = assuan_send_data (ctx, NULL, 0); if (rc) break; } } else if (!strcmp (line, "std_session_env") || !strcmp (line, "std_startup_env")) { int iterator; const char *name, *value; char *string; iterator = 0; while ((name = session_env_list_stdenvnames (&iterator, NULL))) { value = session_env_getenv_or_default (line[5] == 't'? opt.startup_env:ctrl->session_env, name, NULL); if (value) { string = xtryasprintf ("%s=%s", name, value); if (!string) rc = gpg_error_from_syserror (); else { rc = assuan_send_data (ctx, string, strlen (string)+1); if (!rc) rc = assuan_send_data (ctx, NULL, 0); } if (rc) break; } } } else if (!strncmp (line, "getenv", 6) && (line[6] == ' ' || line[6] == '\t' || !line[6])) { line += 6; while (*line == ' ' || *line == '\t') line++; if (!*line) rc = gpg_error (GPG_ERR_MISSING_VALUE); else { const char *s = getenv (line); if (!s) rc = set_error (GPG_ERR_NOT_FOUND, "No such envvar"); else rc = assuan_send_data (ctx, s, strlen (s)); } } else if (!strcmp (line, "connections")) { char numbuf[20]; snprintf (numbuf, sizeof numbuf, "%d", get_agent_active_connection_count ()); rc = assuan_send_data (ctx, numbuf, strlen (numbuf)); } else if (!strcmp (line, "jent_active")) { #if GCRYPT_VERSION_NUMBER >= 0x010800 char *buf; char *fields[5]; buf = gcry_get_config (0, "rng-type"); if (buf && split_fields_colon (buf, fields, DIM (fields)) >= 5 && atoi (fields[4]) > 0) rc = 0; else rc = gpg_error (GPG_ERR_FALSE); gcry_free (buf); #else rc = gpg_error (GPG_ERR_FALSE); #endif } else if (!strcmp (line, "s2k_count_cal")) { char numbuf[50]; snprintf (numbuf, sizeof numbuf, "%lu", get_calibrated_s2k_count ()); rc = assuan_send_data (ctx, numbuf, strlen (numbuf)); } else if (!strcmp (line, "s2k_time")) { char numbuf[50]; snprintf (numbuf, sizeof numbuf, "%lu", get_standard_s2k_time ()); rc = assuan_send_data (ctx, numbuf, strlen (numbuf)); } else rc = set_error (GPG_ERR_ASS_PARAMETER, "unknown value for WHAT"); return rc; } /* This function is called by Libassuan to parse the OPTION command. It has been registered similar to the other Assuan commands. */ static gpg_error_t option_handler (assuan_context_t ctx, const char *key, const char *value) { ctrl_t ctrl = assuan_get_pointer (ctx); gpg_error_t err = 0; if (!strcmp (key, "agent-awareness")) { /* The value is a version string telling us of which agent version the caller is aware of. */ ctrl->server_local->allow_fully_canceled = gnupg_compare_version (value, "2.1.0"); } else if (ctrl->restricted) { err = gpg_error (GPG_ERR_FORBIDDEN); } /* All options below are not allowed in restricted mode. */ else if (!strcmp (key, "putenv")) { /* Change the session's environment to be used for the Pinentry. Valid values are: Delete envvar NAME = Set envvar NAME to the empty string = Set envvar NAME to VALUE */ err = session_env_putenv (ctrl->session_env, value); } else if (!strcmp (key, "display")) { err = session_env_setenv (ctrl->session_env, "DISPLAY", value); } else if (!strcmp (key, "ttyname")) { if (!opt.keep_tty) err = session_env_setenv (ctrl->session_env, "GPG_TTY", value); } else if (!strcmp (key, "ttytype")) { if (!opt.keep_tty) err = session_env_setenv (ctrl->session_env, "TERM", value); } else if (!strcmp (key, "lc-ctype")) { if (ctrl->lc_ctype) xfree (ctrl->lc_ctype); ctrl->lc_ctype = xtrystrdup (value); if (!ctrl->lc_ctype) return out_of_core (); } else if (!strcmp (key, "lc-messages")) { if (ctrl->lc_messages) xfree (ctrl->lc_messages); ctrl->lc_messages = xtrystrdup (value); if (!ctrl->lc_messages) return out_of_core (); } else if (!strcmp (key, "xauthority")) { err = session_env_setenv (ctrl->session_env, "XAUTHORITY", value); } else if (!strcmp (key, "pinentry-user-data")) { err = session_env_setenv (ctrl->session_env, "PINENTRY_USER_DATA", value); } else if (!strcmp (key, "use-cache-for-signing")) ctrl->server_local->use_cache_for_signing = *value? !!atoi (value) : 0; else if (!strcmp (key, "allow-pinentry-notify")) ctrl->server_local->allow_pinentry_notify = 1; else if (!strcmp (key, "pinentry-mode")) { int tmp = parse_pinentry_mode (value); if (tmp == -1) err = gpg_error (GPG_ERR_INV_VALUE); else if (tmp == PINENTRY_MODE_LOOPBACK && !opt.allow_loopback_pinentry) err = gpg_error (GPG_ERR_NOT_SUPPORTED); else ctrl->pinentry_mode = tmp; } else if (!strcmp (key, "cache-ttl-opt-preset")) { ctrl->cache_ttl_opt_preset = *value? atoi (value) : 0; } else if (!strcmp (key, "s2k-count")) { ctrl->s2k_count = *value? strtoul(value, NULL, 10) : 0; if (ctrl->s2k_count && ctrl->s2k_count < 65536) { ctrl->s2k_count = 0; } } else if (!strcmp (key, "pretend-request-origin")) { log_assert (!ctrl->restricted); switch (parse_request_origin (value)) { case REQUEST_ORIGIN_LOCAL: ctrl->restricted = 0; break; case REQUEST_ORIGIN_REMOTE: ctrl->restricted = 1; break; case REQUEST_ORIGIN_BROWSER: ctrl->restricted = 2; break; default: err = gpg_error (GPG_ERR_INV_VALUE); /* Better pretend to be remote in case of a bad value. */ ctrl->restricted = 1; break; } } else err = gpg_error (GPG_ERR_UNKNOWN_OPTION); return err; } /* Called by libassuan after all commands. ERR is the error from the last assuan operation and not the one returned from the command. */ static void post_cmd_notify (assuan_context_t ctx, gpg_error_t err) { ctrl_t ctrl = assuan_get_pointer (ctx); (void)err; /* Switch off any I/O monitor controlled logging pausing. */ ctrl->server_local->pause_io_logging = 0; } /* This function is called by libassuan for all I/O. We use it here to disable logging for the GETEVENTCOUNTER commands. This is so that the debug output won't get cluttered by this primitive command. */ static unsigned int io_monitor (assuan_context_t ctx, void *hook, int direction, const char *line, size_t linelen) { ctrl_t ctrl = assuan_get_pointer (ctx); (void) hook; /* We want to suppress all Assuan log messages for connections from * self. However, assuan_get_pid works only after * assuan_accept. Now, assuan_accept already logs a line ending with * the process id. We use this hack here to get the peers pid so * that we can compare it to our pid. We should add an assuan * function to return the pid for a file descriptor and use that to * detect connections to self. */ if (ctx && !ctrl->server_local->greeting_seen && direction == ASSUAN_IO_TO_PEER) { ctrl->server_local->greeting_seen = 1; if (linelen > 32 && !strncmp (line, "OK Pleased to meet you, process ", 32) && strtoul (line+32, NULL, 10) == getpid ()) return ASSUAN_IO_MONITOR_NOLOG; } /* Do not log self-connections. This makes the log cleaner because * we won't see the check-our-own-socket calls. */ if (ctx && ctrl->server_local->connect_from_self) return ASSUAN_IO_MONITOR_NOLOG; /* Note that we only check for the uppercase name. This allows the user to see the logging for debugging if using a non-upercase command name. */ if (ctx && direction == ASSUAN_IO_FROM_PEER && linelen >= 15 && !strncmp (line, "GETEVENTCOUNTER", 15) && (linelen == 15 || spacep (line+15))) { ctrl->server_local->pause_io_logging = 1; } return ctrl->server_local->pause_io_logging? ASSUAN_IO_MONITOR_NOLOG : 0; } /* Return true if the command CMD implements the option OPT. */ static int command_has_option (const char *cmd, const char *cmdopt) { if (!strcmp (cmd, "GET_PASSPHRASE")) { if (!strcmp (cmdopt, "repeat")) return 1; } return 0; } /* Tell Libassuan about our commands. Also register the other Assuan handlers. */ static int register_commands (assuan_context_t ctx) { static struct { const char *name; assuan_handler_t handler; const char * const help; } table[] = { { "GETEVENTCOUNTER",cmd_geteventcounter, hlp_geteventcounter }, { "ISTRUSTED", cmd_istrusted, hlp_istrusted }, { "HAVEKEY", cmd_havekey, hlp_havekey }, { "KEYINFO", cmd_keyinfo, hlp_keyinfo }, { "SIGKEY", cmd_sigkey, hlp_sigkey }, { "SETKEY", cmd_sigkey, hlp_sigkey }, { "SETKEYDESC", cmd_setkeydesc,hlp_setkeydesc }, { "SETHASH", cmd_sethash, hlp_sethash }, { "PKSIGN", cmd_pksign, hlp_pksign }, { "PKDECRYPT", cmd_pkdecrypt, hlp_pkdecrypt }, { "GENKEY", cmd_genkey, hlp_genkey }, { "READKEY", cmd_readkey, hlp_readkey }, { "GET_PASSPHRASE", cmd_get_passphrase, hlp_get_passphrase }, { "PRESET_PASSPHRASE", cmd_preset_passphrase, hlp_preset_passphrase }, { "CLEAR_PASSPHRASE", cmd_clear_passphrase, hlp_clear_passphrase }, { "GET_CONFIRMATION", cmd_get_confirmation, hlp_get_confirmation }, { "LISTTRUSTED", cmd_listtrusted, hlp_listtrusted }, { "MARKTRUSTED", cmd_marktrusted, hlp_martrusted }, { "LEARN", cmd_learn, hlp_learn }, { "PASSWD", cmd_passwd, hlp_passwd }, { "INPUT", NULL }, { "OUTPUT", NULL }, { "SCD", cmd_scd, hlp_scd }, { "KEYWRAP_KEY", cmd_keywrap_key, hlp_keywrap_key }, { "IMPORT_KEY", cmd_import_key, hlp_import_key }, { "EXPORT_KEY", cmd_export_key, hlp_export_key }, { "DELETE_KEY", cmd_delete_key, hlp_delete_key }, { "GET_SECRET", cmd_get_secret, hlp_get_secret }, { "PUT_SECRET", cmd_put_secret, hlp_put_secret }, { "GETVAL", cmd_getval, hlp_getval }, { "PUTVAL", cmd_putval, hlp_putval }, { "UPDATESTARTUPTTY", cmd_updatestartuptty, hlp_updatestartuptty }, { "KILLAGENT", cmd_killagent, hlp_killagent }, { "RELOADAGENT", cmd_reloadagent,hlp_reloadagent }, { "GETINFO", cmd_getinfo, hlp_getinfo }, { "KEYTOCARD", cmd_keytocard, hlp_keytocard }, { NULL } }; int i, rc; for (i=0; table[i].name; i++) { rc = assuan_register_command (ctx, table[i].name, table[i].handler, table[i].help); if (rc) return rc; } assuan_register_post_cmd_notify (ctx, post_cmd_notify); assuan_register_reset_notify (ctx, reset_notify); assuan_register_option_handler (ctx, option_handler); return 0; } /* Startup the server. If LISTEN_FD and FD is given as -1, this is a simple piper server, otherwise it is a regular server. CTRL is the control structure for this connection; it has only the basic initialization. */ void start_command_handler (ctrl_t ctrl, gnupg_fd_t listen_fd, gnupg_fd_t fd) { int rc; assuan_context_t ctx = NULL; if (ctrl->restricted) { if (agent_copy_startup_env (ctrl)) return; } rc = assuan_new (&ctx); if (rc) { log_error ("failed to allocate assuan context: %s\n", gpg_strerror (rc)); agent_exit (2); } if (listen_fd == GNUPG_INVALID_FD && fd == GNUPG_INVALID_FD) { assuan_fd_t filedes[2]; filedes[0] = assuan_fdopen (0); filedes[1] = assuan_fdopen (1); rc = assuan_init_pipe_server (ctx, filedes); } else if (listen_fd != GNUPG_INVALID_FD) { rc = assuan_init_socket_server (ctx, listen_fd, 0); /* FIXME: Need to call assuan_sock_set_nonce for Windows. But this branch is currently not used. */ } else { rc = assuan_init_socket_server (ctx, fd, ASSUAN_SOCKET_SERVER_ACCEPTED); } if (rc) { log_error ("failed to initialize the server: %s\n", gpg_strerror(rc)); agent_exit (2); } rc = register_commands (ctx); if (rc) { log_error ("failed to register commands with Assuan: %s\n", gpg_strerror(rc)); agent_exit (2); } assuan_set_pointer (ctx, ctrl); ctrl->server_local = xcalloc (1, sizeof *ctrl->server_local); ctrl->server_local->assuan_ctx = ctx; ctrl->server_local->use_cache_for_signing = 1; ctrl->digest.raw_value = 0; assuan_set_io_monitor (ctx, io_monitor, NULL); agent_set_progress_cb (progress_cb, ctrl); for (;;) { assuan_peercred_t client_creds; /* Note: Points into CTX. */ pid_t pid; rc = assuan_accept (ctx); if (gpg_err_code (rc) == GPG_ERR_EOF || rc == -1) { break; } else if (rc) { log_info ("Assuan accept problem: %s\n", gpg_strerror (rc)); break; } rc = assuan_get_peercred (ctx, &client_creds); if (rc) { if (listen_fd == GNUPG_INVALID_FD && fd == GNUPG_INVALID_FD) ; else log_info ("Assuan get_peercred failed: %s\n", gpg_strerror (rc)); pid = assuan_get_pid (ctx); ctrl->client_uid = -1; } else { #ifdef HAVE_W32_SYSTEM pid = assuan_get_pid (ctx); ctrl->client_uid = -1; #else pid = client_creds->pid; ctrl->client_uid = client_creds->uid; #endif } ctrl->client_pid = (pid == ASSUAN_INVALID_PID)? 0 : (unsigned long)pid; ctrl->server_local->connect_from_self = (pid == getpid ()); rc = assuan_process (ctx); if (rc) { log_info ("Assuan processing failed: %s\n", gpg_strerror (rc)); continue; } } /* Reset the nonce caches. */ clear_nonce_cache (ctrl); /* Reset the SCD if needed. */ agent_reset_scd (ctrl); /* Reset the pinentry (in case of popup messages). */ agent_reset_query (ctrl); /* Cleanup. */ assuan_release (ctx); xfree (ctrl->server_local->keydesc); xfree (ctrl->server_local->import_key); xfree (ctrl->server_local->export_key); if (ctrl->server_local->stopme) agent_exit (0); xfree (ctrl->server_local); ctrl->server_local = NULL; } /* Helper for the pinentry loopback mode. It merely passes the parameters on to the client. */ gpg_error_t pinentry_loopback(ctrl_t ctrl, const char *keyword, unsigned char **buffer, size_t *size, size_t max_length) { gpg_error_t rc; assuan_context_t ctx = ctrl->server_local->assuan_ctx; rc = print_assuan_status (ctx, "INQUIRE_MAXLEN", "%zu", max_length); if (rc) return rc; assuan_begin_confidential (ctx); rc = assuan_inquire (ctx, keyword, buffer, size, max_length); assuan_end_confidential (ctx); return rc; } diff --git a/dirmngr/http.c b/dirmngr/http.c index d6856fe05..32c0fb181 100644 --- a/dirmngr/http.c +++ b/dirmngr/http.c @@ -1,3724 +1,3725 @@ /* http.c - HTTP protocol handler * Copyright (C) 1999, 2001, 2002, 2003, 2004, 2006, 2009, 2010, * 2011 Free Software Foundation, Inc. * Copyright (C) 2014 Werner Koch * Copyright (C) 2015-2018 g10 Code GmbH * * This file is part of GnuPG. * * This file is free software; you can redistribute it and/or modify * it under the terms of either * * - the GNU Lesser General Public License as published by the Free * Software Foundation; either version 3 of the License, or (at * your option) any later version. * * or * * - the GNU General Public License as published by the Free * Software Foundation; either version 2 of the License, or (at * your option) any later version. * * or both in parallel, as here. * * This file is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, see . */ /* Simple HTTP client implementation. We try to keep the code as self-contained as possible. There are some constraints however: - estream is required. We now require estream because it provides a very useful and portable asprintf implementation and the fopencookie function. - stpcpy is required - fixme: list other requirements. - With HTTP_USE_NTBTLS or HTTP_USE_GNUTLS support for https is provided (this also requires estream). - With HTTP_NO_WSASTARTUP the socket initialization is not done under Windows. This is useful if the socket layer has already been initialized elsewhere. This also avoids the installation of an exit handler to cleanup the socket layer. */ #ifdef HAVE_CONFIG_H # include #endif #include #include #include #include #include #include #include #ifdef HAVE_W32_SYSTEM # ifdef HAVE_WINSOCK2_H # include # endif # include #else /*!HAVE_W32_SYSTEM*/ # include # include # include # include # include # include # include # include #endif /*!HAVE_W32_SYSTEM*/ #ifdef WITHOUT_NPTH /* Give the Makefile a chance to build without Pth. */ # undef USE_NPTH #endif #ifdef USE_NPTH # include #endif #if defined (HTTP_USE_GNUTLS) && defined (HTTP_USE_NTBTLS) # error Both, HTTP_USE_GNUTLS and HTTP_USE_NTBTLS, are defined. #endif #ifdef HTTP_USE_NTBTLS # include #elif HTTP_USE_GNUTLS # include # include #endif /*HTTP_USE_GNUTLS*/ #include /* We need the socket wrapper. */ #include "../common/util.h" #include "../common/i18n.h" #include "../common/sysutils.h" /* (gnupg_fd_t) */ #include "dns-stuff.h" #include "http.h" #include "http-common.h" #ifdef USE_NPTH # define my_select(a,b,c,d,e) npth_select ((a), (b), (c), (d), (e)) # define my_accept(a,b,c) npth_accept ((a), (b), (c)) #else # define my_select(a,b,c,d,e) select ((a), (b), (c), (d), (e)) # define my_accept(a,b,c) accept ((a), (b), (c)) #endif #ifdef HAVE_W32_SYSTEM #define sock_close(a) closesocket(a) #else #define sock_close(a) close(a) #endif #ifndef EAGAIN #define EAGAIN EWOULDBLOCK #endif #ifndef INADDR_NONE /* Slowaris is missing that. */ #define INADDR_NONE ((unsigned long)(-1)) #endif /*INADDR_NONE*/ #define HTTP_PROXY_ENV "http_proxy" #define MAX_LINELEN 20000 /* Max. length of a HTTP header line. */ #define VALID_URI_CHARS "abcdefghijklmnopqrstuvwxyz" \ "ABCDEFGHIJKLMNOPQRSTUVWXYZ" \ "01234567890@" \ "!\"#$%&'()*+,-./:;<=>?[\\]^_{|}~" #if HTTP_USE_NTBTLS typedef ntbtls_t tls_session_t; # define USE_TLS 1 #elif HTTP_USE_GNUTLS typedef gnutls_session_t tls_session_t; # define USE_TLS 1 #else typedef void *tls_session_t; # undef USE_TLS #endif static gpg_err_code_t do_parse_uri (parsed_uri_t uri, int only_local_part, int no_scheme_check, int force_tls); static gpg_error_t parse_uri (parsed_uri_t *ret_uri, const char *uri, int no_scheme_check, int force_tls); static int remove_escapes (char *string); static int insert_escapes (char *buffer, const char *string, const char *special); static uri_tuple_t parse_tuple (char *string); static gpg_error_t send_request (ctrl_t ctrl, http_t hd, const char *httphost, const char *auth,const char *proxy, const char *srvtag, unsigned int timeout, strlist_t headers); static char *build_rel_path (parsed_uri_t uri); static gpg_error_t parse_response (http_t hd); static gpg_error_t connect_server (ctrl_t ctrl, const char *server, unsigned short port, unsigned int flags, const char *srvtag, unsigned int timeout, assuan_fd_t *r_sock); static gpgrt_ssize_t read_server (assuan_fd_t sock, void *buffer, size_t size); static gpg_error_t write_server (assuan_fd_t sock, const char *data, size_t length); static gpgrt_ssize_t cookie_read (void *cookie, void *buffer, size_t size); static gpgrt_ssize_t cookie_write (void *cookie, const void *buffer, size_t size); static int cookie_close (void *cookie); #if defined(HAVE_W32_SYSTEM) && defined(HTTP_USE_NTBTLS) static gpgrt_ssize_t simple_cookie_read (void *cookie, void *buffer, size_t size); static gpgrt_ssize_t simple_cookie_write (void *cookie, const void *buffer, size_t size); #endif /* A socket object used to a allow ref counting of sockets. */ struct my_socket_s { assuan_fd_t fd; /* The actual socket - shall never be ASSUAN_INVALID_FD. */ int refcount; /* Number of references to this socket. */ }; typedef struct my_socket_s *my_socket_t; /* Cookie function structure and cookie object. */ static es_cookie_io_functions_t cookie_functions = { cookie_read, cookie_write, NULL, cookie_close }; struct cookie_s { /* Socket object or NULL if already closed. */ my_socket_t sock; /* The session object or NULL if not used. */ http_session_t session; /* True if TLS is to be used. */ int use_tls; /* The remaining content length and a flag telling whether to use the content length. */ uint64_t content_length; unsigned int content_length_valid:1; }; typedef struct cookie_s *cookie_t; /* Simple cookie functions. Here the cookie is an int with the * socket. */ #if defined(HAVE_W32_SYSTEM) && defined(HTTP_USE_NTBTLS) static es_cookie_io_functions_t simple_cookie_functions = { simple_cookie_read, simple_cookie_write, NULL, NULL }; #endif #if SIZEOF_UNSIGNED_LONG == 8 # define HTTP_SESSION_MAGIC 0x0068545470534553 /* "hTTpSES" */ #else # define HTTP_SESSION_MAGIC 0x68547365 /* "hTse" */ #endif /* The session object. */ struct http_session_s { unsigned long magic; int refcount; /* Number of references to this object. */ #ifdef HTTP_USE_GNUTLS gnutls_certificate_credentials_t certcred; #endif /*HTTP_USE_GNUTLS*/ #ifdef USE_TLS tls_session_t tls_session; struct { int done; /* Verifciation has been done. */ int rc; /* TLS verification return code. */ unsigned int status; /* Verification status. */ } verify; char *servername; /* Malloced server name. */ #endif /*USE_TLS*/ /* A callback function to log details of TLS certifciates. */ void (*cert_log_cb) (http_session_t, gpg_error_t, const char *, const void **, size_t *); /* The flags passed to the session object. */ unsigned int flags; /* A per-session TLS verification callback. */ http_verify_cb_t verify_cb; void *verify_cb_value; /* The connect timeout */ unsigned int connect_timeout; }; /* An object to save header lines. */ struct header_s { struct header_s *next; char *value; /* The value of the header (malloced). */ char name[1]; /* The name of the header (canonicalized). */ }; typedef struct header_s *header_t; #if SIZEOF_UNSIGNED_LONG == 8 # define HTTP_CONTEXT_MAGIC 0x0068545470435458 /* "hTTpCTX" */ #else # define HTTP_CONTEXT_MAGIC 0x68546378 /* "hTcx" */ #endif /* Our handle context. */ struct http_context_s { unsigned long magic; unsigned int status_code; my_socket_t sock; unsigned int in_data:1; unsigned int is_http_0_9:1; estream_t fp_read; estream_t fp_write; void *write_cookie; void *read_cookie; http_session_t session; parsed_uri_t uri; http_req_t req_type; char *buffer; /* Line buffer. */ size_t buffer_size; unsigned int flags; header_t headers; /* Received headers. */ }; /* Two flags to enable verbose and debug mode. Although currently not * set-able a value > 1 for OPT_DEBUG enables debugging of the session * reference counting. */ static int opt_verbose; static int opt_debug; /* The global callback for the verification function. */ static gpg_error_t (*tls_callback) (http_t, http_session_t, int); /* The list of files with trusted CA certificates. */ static strlist_t tls_ca_certlist; /* The list of files with extra trusted CA certificates. */ static strlist_t cfg_ca_certlist; /* The global callback for net activity. */ static void (*netactivity_cb)(void); #if defined(HAVE_W32_SYSTEM) && !defined(HTTP_NO_WSASTARTUP) #if GNUPG_MAJOR_VERSION == 1 #define REQ_WINSOCK_MAJOR 1 #define REQ_WINSOCK_MINOR 1 #else #define REQ_WINSOCK_MAJOR 2 #define REQ_WINSOCK_MINOR 2 #endif static void deinit_sockets (void) { WSACleanup(); } static void init_sockets (void) { static int initialized; static WSADATA wsdata; if (initialized) return; if ( WSAStartup( MAKEWORD (REQ_WINSOCK_MINOR, REQ_WINSOCK_MAJOR), &wsdata ) ) { log_error ("error initializing socket library: ec=%d\n", (int)WSAGetLastError () ); return; } if ( LOBYTE(wsdata.wVersion) != REQ_WINSOCK_MAJOR || HIBYTE(wsdata.wVersion) != REQ_WINSOCK_MINOR ) { log_error ("socket library version is %x.%x - but %d.%d needed\n", LOBYTE(wsdata.wVersion), HIBYTE(wsdata.wVersion), REQ_WINSOCK_MAJOR, REQ_WINSOCK_MINOR); WSACleanup(); return; } atexit ( deinit_sockets ); initialized = 1; } #endif /*HAVE_W32_SYSTEM && !HTTP_NO_WSASTARTUP*/ /* Create a new socket object. Returns NULL and closes FD if not enough memory is available. */ static my_socket_t _my_socket_new (int lnr, assuan_fd_t fd) { my_socket_t so; so = xtrymalloc (sizeof *so); if (!so) { int save_errno = errno; assuan_sock_close (fd); gpg_err_set_errno (save_errno); return NULL; } so->fd = fd; so->refcount = 1; if (opt_debug) log_debug ("http.c:%d:socket_new: object %p for fd %d created\n", lnr, so, (int)so->fd); return so; } #define my_socket_new(a) _my_socket_new (__LINE__, (a)) /* Bump up the reference counter for the socket object SO. */ static my_socket_t _my_socket_ref (int lnr, my_socket_t so) { so->refcount++; if (opt_debug > 1) log_debug ("http.c:%d:socket_ref: object %p for fd %d refcount now %d\n", lnr, so, (int)so->fd, so->refcount); return so; } #define my_socket_ref(a) _my_socket_ref (__LINE__,(a)) /* Bump down the reference counter for the socket object SO. If SO has no more references, close the socket and release the object. */ static void _my_socket_unref (int lnr, my_socket_t so, void (*preclose)(void*), void *preclosearg) { if (so) { so->refcount--; if (opt_debug > 1) log_debug ("http.c:%d:socket_unref: object %p for fd %d ref now %d\n", lnr, so, (int)so->fd, so->refcount); if (!so->refcount) { if (preclose) preclose (preclosearg); assuan_sock_close (so->fd); xfree (so); } } } #define my_socket_unref(a,b,c) _my_socket_unref (__LINE__,(a),(b),(c)) #ifdef HTTP_USE_GNUTLS static ssize_t my_gnutls_read (gnutls_transport_ptr_t ptr, void *buffer, size_t size) { my_socket_t sock = ptr; #if USE_NPTH return npth_read (sock->fd, buffer, size); #else return read (sock->fd, buffer, size); #endif } static ssize_t my_gnutls_write (gnutls_transport_ptr_t ptr, const void *buffer, size_t size) { my_socket_t sock = ptr; #if USE_NPTH return npth_write (sock->fd, buffer, size); #else return write (sock->fd, buffer, size); #endif } #endif /*HTTP_USE_GNUTLS*/ #ifdef HTTP_USE_NTBTLS /* Connect the ntbls callback to our generic callback. */ static gpg_error_t my_ntbtls_verify_cb (void *opaque, ntbtls_t tls, unsigned int verify_flags) { http_t hd = opaque; (void)verify_flags; log_assert (hd && hd->session && hd->session->verify_cb); log_assert (hd->magic == HTTP_CONTEXT_MAGIC); log_assert (hd->session->magic == HTTP_SESSION_MAGIC); return hd->session->verify_cb (hd->session->verify_cb_value, hd, hd->session, (hd->flags | hd->session->flags), tls); } #endif /*HTTP_USE_NTBTLS*/ /* This notification function is called by estream whenever stream is closed. Its purpose is to mark the closing in the handle so that a http_close won't accidentally close the estream. The function http_close removes this notification so that it won't be called if http_close was used before an es_fclose. */ static void fp_onclose_notification (estream_t stream, void *opaque) { http_t hd = opaque; log_assert (hd->magic == HTTP_CONTEXT_MAGIC); if (hd->fp_read && hd->fp_read == stream) hd->fp_read = NULL; else if (hd->fp_write && hd->fp_write == stream) hd->fp_write = NULL; } /* * Helper function to create an HTTP header with hex encoded data. A * new buffer is returned. This buffer is the concatenation of the * string PREFIX, the hex-encoded DATA of length LEN and the string * SUFFIX. On error NULL is returned and ERRNO set. */ static char * make_header_line (const char *prefix, const char *suffix, const void *data, size_t len ) { static unsigned char bintoasc[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" "abcdefghijklmnopqrstuvwxyz" "0123456789+/"; const unsigned char *s = data; char *buffer, *p; buffer = xtrymalloc (strlen (prefix) + (len+2)/3*4 + strlen (suffix) + 1); if (!buffer) return NULL; p = stpcpy (buffer, prefix); for ( ; len >= 3 ; len -= 3, s += 3 ) { *p++ = bintoasc[(s[0] >> 2) & 077]; *p++ = bintoasc[(((s[0] <<4)&060)|((s[1] >> 4)&017))&077]; *p++ = bintoasc[(((s[1]<<2)&074)|((s[2]>>6)&03))&077]; *p++ = bintoasc[s[2]&077]; *p = 0; } if ( len == 2 ) { *p++ = bintoasc[(s[0] >> 2) & 077]; *p++ = bintoasc[(((s[0] <<4)&060)|((s[1] >> 4)&017))&077]; *p++ = bintoasc[((s[1]<<2)&074)]; *p++ = '='; } else if ( len == 1 ) { *p++ = bintoasc[(s[0] >> 2) & 077]; *p++ = bintoasc[(s[0] <<4)&060]; *p++ = '='; *p++ = '='; } *p = 0; strcpy (p, suffix); return buffer; } /* Set verbosity and debug mode for this module. */ void http_set_verbose (int verbose, int debug) { opt_verbose = verbose; opt_debug = debug; } /* Register a non-standard global TLS callback function. If no verification is desired a callback needs to be registered which always returns NULL. */ void http_register_tls_callback (gpg_error_t (*cb)(http_t, http_session_t, int)) { tls_callback = cb; } /* Register a CA certificate for future use. The certificate is expected to be in FNAME. PEM format is assume if FNAME has a suffix of ".pem". If FNAME is NULL the list of CA files is removed. */ void http_register_tls_ca (const char *fname) { strlist_t sl; if (!fname) { free_strlist (tls_ca_certlist); tls_ca_certlist = NULL; } else { /* Warn if we can't access right now, but register it anyway in case it becomes accessible later */ if (access (fname, F_OK)) log_info (_("can't access '%s': %s\n"), fname, gpg_strerror (gpg_error_from_syserror())); sl = add_to_strlist (&tls_ca_certlist, fname); if (*sl->d && !strcmp (sl->d + strlen (sl->d) - 4, ".pem")) sl->flags = 1; } } /* Register a CA certificate for future use. The certificate is * expected to be in FNAME. PEM format is assume if FNAME has a * suffix of ".pem". If FNAME is NULL the list of CA files is * removed. This is a variant of http_register_tls_ca which puts the * certificate into a separate list enabled using HTTP_FLAG_TRUST_CFG. */ void http_register_cfg_ca (const char *fname) { strlist_t sl; if (!fname) { free_strlist (cfg_ca_certlist); cfg_ca_certlist = NULL; } else { /* Warn if we can't access right now, but register it anyway in case it becomes accessible later */ if (access (fname, F_OK)) log_info (_("can't access '%s': %s\n"), fname, gpg_strerror (gpg_error_from_syserror())); sl = add_to_strlist (&cfg_ca_certlist, fname); if (*sl->d && !strcmp (sl->d + strlen (sl->d) - 4, ".pem")) sl->flags = 1; } } /* Register a callback which is called every time the HTTP mode has * made a successful connection to some server. */ void http_register_netactivity_cb (void (*cb)(void)) { netactivity_cb = cb; } /* Call the netactivity callback if any. */ static void notify_netactivity (void) { if (netactivity_cb) netactivity_cb (); } #ifdef USE_TLS /* Free the TLS session associated with SESS, if any. */ static void close_tls_session (http_session_t sess) { if (sess->tls_session) { # if HTTP_USE_NTBTLS /* FIXME!! Possibly, ntbtls_get_transport and close those streams. Somehow get SOCK to call my_socket_unref. */ ntbtls_release (sess->tls_session); # elif HTTP_USE_GNUTLS my_socket_t sock = gnutls_transport_get_ptr (sess->tls_session); my_socket_unref (sock, NULL, NULL); gnutls_deinit (sess->tls_session); if (sess->certcred) gnutls_certificate_free_credentials (sess->certcred); # endif /*HTTP_USE_GNUTLS*/ xfree (sess->servername); sess->tls_session = NULL; } } #endif /*USE_TLS*/ /* Release a session. Take care not to release it while it is being used by a http context object. */ static void session_unref (int lnr, http_session_t sess) { if (!sess) return; log_assert (sess->magic == HTTP_SESSION_MAGIC); sess->refcount--; if (opt_debug > 1) log_debug ("http.c:%d:session_unref: sess %p ref now %d\n", lnr, sess, sess->refcount); if (sess->refcount) return; #ifdef USE_TLS close_tls_session (sess); #endif /*USE_TLS*/ sess->magic = 0xdeadbeef; xfree (sess); } #define http_session_unref(a) session_unref (__LINE__, (a)) void http_session_release (http_session_t sess) { http_session_unref (sess); } /* Create a new session object which is currently used to enable TLS * support. It may eventually allow reusing existing connections. * Valid values for FLAGS are: * HTTP_FLAG_TRUST_DEF - Use the CAs set with http_register_tls_ca * HTTP_FLAG_TRUST_SYS - Also use the CAs defined by the system * HTTP_FLAG_TRUST_CFG - Also use CAs set with http_register_cfg_ca * HTTP_FLAG_NO_CRL - Do not consult CRLs for https. */ gpg_error_t http_session_new (http_session_t *r_session, const char *intended_hostname, unsigned int flags, http_verify_cb_t verify_cb, void *verify_cb_value) { gpg_error_t err; http_session_t sess; *r_session = NULL; sess = xtrycalloc (1, sizeof *sess); if (!sess) return gpg_error_from_syserror (); sess->magic = HTTP_SESSION_MAGIC; sess->refcount = 1; sess->flags = flags; sess->verify_cb = verify_cb; sess->verify_cb_value = verify_cb_value; sess->connect_timeout = 0; #if HTTP_USE_NTBTLS { (void)intended_hostname; /* Not needed because we do not preload * certificates. */ err = ntbtls_new (&sess->tls_session, NTBTLS_CLIENT); if (err) { log_error ("ntbtls_new failed: %s\n", gpg_strerror (err)); goto leave; } } #elif HTTP_USE_GNUTLS { const char *errpos; int rc; strlist_t sl; int add_system_cas = !!(flags & HTTP_FLAG_TRUST_SYS); int is_hkps_pool; rc = gnutls_certificate_allocate_credentials (&sess->certcred); if (rc < 0) { log_error ("gnutls_certificate_allocate_credentials failed: %s\n", gnutls_strerror (rc)); err = gpg_error (GPG_ERR_GENERAL); goto leave; } is_hkps_pool = (intended_hostname && !ascii_strcasecmp (intended_hostname, get_default_keyserver (1))); /* If the user has not specified a CA list, and they are looking * for the hkps pool from sks-keyservers.net, then default to * Kristian's certificate authority: */ if (!tls_ca_certlist && is_hkps_pool) { char *pemname = make_filename_try (gnupg_datadir (), "sks-keyservers.netCA.pem", NULL); if (!pemname) { err = gpg_error_from_syserror (); log_error ("setting CA from file '%s' failed: %s\n", pemname, gpg_strerror (err)); } else { rc = gnutls_certificate_set_x509_trust_file (sess->certcred, pemname, GNUTLS_X509_FMT_PEM); if (rc < 0) log_info ("setting CA from file '%s' failed: %s\n", pemname, gnutls_strerror (rc)); xfree (pemname); } } /* Add configured certificates to the session. */ if ((flags & HTTP_FLAG_TRUST_DEF)) { for (sl = tls_ca_certlist; sl; sl = sl->next) { rc = gnutls_certificate_set_x509_trust_file (sess->certcred, sl->d, (sl->flags & 1)? GNUTLS_X509_FMT_PEM : GNUTLS_X509_FMT_DER); if (rc < 0) log_info ("setting CA from file '%s' failed: %s\n", sl->d, gnutls_strerror (rc)); } if (!tls_ca_certlist && !is_hkps_pool) add_system_cas = 1; } /* Add system certificates to the session. */ if (add_system_cas) { #if GNUTLS_VERSION_NUMBER >= 0x030014 static int shown; rc = gnutls_certificate_set_x509_system_trust (sess->certcred); if (rc < 0) log_info ("setting system CAs failed: %s\n", gnutls_strerror (rc)); else if (!shown) { shown = 1; log_info ("number of system provided CAs: %d\n", rc); } #endif /* gnutls >= 3.0.20 */ } /* Add other configured certificates to the session. */ if ((flags & HTTP_FLAG_TRUST_CFG)) { for (sl = cfg_ca_certlist; sl; sl = sl->next) { rc = gnutls_certificate_set_x509_trust_file (sess->certcred, sl->d, (sl->flags & 1)? GNUTLS_X509_FMT_PEM : GNUTLS_X509_FMT_DER); if (rc < 0) log_info ("setting extra CA from file '%s' failed: %s\n", sl->d, gnutls_strerror (rc)); } } rc = gnutls_init (&sess->tls_session, GNUTLS_CLIENT); if (rc < 0) { log_error ("gnutls_init failed: %s\n", gnutls_strerror (rc)); err = gpg_error (GPG_ERR_GENERAL); goto leave; } /* A new session has the transport ptr set to (void*(-1), we need it to be NULL. */ gnutls_transport_set_ptr (sess->tls_session, NULL); rc = gnutls_priority_set_direct (sess->tls_session, "NORMAL", &errpos); if (rc < 0) { log_error ("gnutls_priority_set_direct failed at '%s': %s\n", errpos, gnutls_strerror (rc)); err = gpg_error (GPG_ERR_GENERAL); goto leave; } rc = gnutls_credentials_set (sess->tls_session, GNUTLS_CRD_CERTIFICATE, sess->certcred); if (rc < 0) { log_error ("gnutls_credentials_set failed: %s\n", gnutls_strerror (rc)); err = gpg_error (GPG_ERR_GENERAL); goto leave; } } #else /*!HTTP_USE_GNUTLS && !HTTP_USE_NTBTLS*/ { (void)intended_hostname; (void)flags; } #endif /*!HTTP_USE_GNUTLS && !HTTP_USE_NTBTLS*/ if (opt_debug > 1) log_debug ("http.c:session_new: sess %p created\n", sess); err = 0; #if USE_TLS leave: #endif /*USE_TLS*/ if (err) http_session_unref (sess); else *r_session = sess; return err; } /* Increment the reference count for session SESS. Passing NULL for SESS is allowed. */ http_session_t http_session_ref (http_session_t sess) { if (sess) { sess->refcount++; if (opt_debug > 1) log_debug ("http.c:session_ref: sess %p ref now %d\n", sess, sess->refcount); } return sess; } void http_session_set_log_cb (http_session_t sess, void (*cb)(http_session_t, gpg_error_t, const char *hostname, const void **certs, size_t *certlens)) { sess->cert_log_cb = cb; } /* Set the TIMEOUT in milliseconds for the connection's connect * calls. Using 0 disables the timeout. */ void http_session_set_timeout (http_session_t sess, unsigned int timeout) { sess->connect_timeout = timeout; } /* Start a HTTP retrieval and on success store at R_HD a context pointer for completing the request and to wait for the response. If HTTPHOST is not NULL it is used for the Host header instead of a Host header derived from the URL. */ gpg_error_t http_open (ctrl_t ctrl, http_t *r_hd, http_req_t reqtype, const char *url, const char *httphost, const char *auth, unsigned int flags, const char *proxy, http_session_t session, const char *srvtag, strlist_t headers) { gpg_error_t err; http_t hd; *r_hd = NULL; if (!(reqtype == HTTP_REQ_GET || reqtype == HTTP_REQ_POST)) return gpg_err_make (default_errsource, GPG_ERR_INV_ARG); /* Create the handle. */ hd = xtrycalloc (1, sizeof *hd); if (!hd) return gpg_error_from_syserror (); hd->magic = HTTP_CONTEXT_MAGIC; hd->req_type = reqtype; hd->flags = flags; hd->session = http_session_ref (session); err = parse_uri (&hd->uri, url, 0, !!(flags & HTTP_FLAG_FORCE_TLS)); if (!err) err = send_request (ctrl, hd, httphost, auth, proxy, srvtag, hd->session? hd->session->connect_timeout : 0, headers); if (err) { my_socket_unref (hd->sock, NULL, NULL); if (hd->fp_read) es_fclose (hd->fp_read); if (hd->fp_write) es_fclose (hd->fp_write); http_session_unref (hd->session); xfree (hd); } else *r_hd = hd; return err; } /* This function is useful to connect to a generic TCP service using this http abstraction layer. This has the advantage of providing service tags and an estream interface. TIMEOUT is in milliseconds. */ gpg_error_t http_raw_connect (ctrl_t ctrl, http_t *r_hd, const char *server, unsigned short port, unsigned int flags, const char *srvtag, unsigned int timeout) { gpg_error_t err = 0; http_t hd; cookie_t cookie; *r_hd = NULL; if ((flags & HTTP_FLAG_FORCE_TOR)) { int mode; if (assuan_sock_get_flag (ASSUAN_INVALID_FD, "tor-mode", &mode) || !mode) { log_error ("Tor support is not available\n"); return gpg_err_make (default_errsource, GPG_ERR_NOT_IMPLEMENTED); } /* Non-blocking connects do not work with our Tor proxy because * we can't continue the Socks protocol after the EINPROGRESS. * Disable the timeout to use a blocking connect. */ timeout = 0; } /* Create the handle. */ hd = xtrycalloc (1, sizeof *hd); if (!hd) return gpg_error_from_syserror (); hd->magic = HTTP_CONTEXT_MAGIC; hd->req_type = HTTP_REQ_OPAQUE; hd->flags = flags; /* Connect. */ { assuan_fd_t sock; err = connect_server (ctrl, server, port, hd->flags, srvtag, timeout, &sock); if (err) { xfree (hd); return err; } hd->sock = my_socket_new (sock); if (!hd->sock) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); xfree (hd); return err; } } /* Setup estreams for reading and writing. */ cookie = xtrycalloc (1, sizeof *cookie); if (!cookie) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); goto leave; } cookie->sock = my_socket_ref (hd->sock); hd->fp_write = es_fopencookie (cookie, "w", cookie_functions); if (!hd->fp_write) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); my_socket_unref (cookie->sock, NULL, NULL); xfree (cookie); goto leave; } hd->write_cookie = cookie; /* Cookie now owned by FP_WRITE. */ cookie = xtrycalloc (1, sizeof *cookie); if (!cookie) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); goto leave; } cookie->sock = my_socket_ref (hd->sock); hd->fp_read = es_fopencookie (cookie, "r", cookie_functions); if (!hd->fp_read) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); my_socket_unref (cookie->sock, NULL, NULL); xfree (cookie); goto leave; } hd->read_cookie = cookie; /* Cookie now owned by FP_READ. */ /* Register close notification to interlock the use of es_fclose in http_close and in user code. */ err = es_onclose (hd->fp_write, 1, fp_onclose_notification, hd); if (!err) err = es_onclose (hd->fp_read, 1, fp_onclose_notification, hd); leave: if (err) { if (hd->fp_read) es_fclose (hd->fp_read); if (hd->fp_write) es_fclose (hd->fp_write); my_socket_unref (hd->sock, NULL, NULL); xfree (hd); } else *r_hd = hd; return err; } void http_start_data (http_t hd) { if (!hd->in_data) { if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP)) log_debug_string ("\r\n", "http.c:request-header:"); es_fputs ("\r\n", hd->fp_write); es_fflush (hd->fp_write); hd->in_data = 1; } else es_fflush (hd->fp_write); } gpg_error_t http_wait_response (http_t hd) { gpg_error_t err; cookie_t cookie; int use_tls; /* Make sure that we are in the data. */ http_start_data (hd); /* Close the write stream. Note that the reference counted socket object keeps the actual system socket open. */ cookie = hd->write_cookie; if (!cookie) return gpg_err_make (default_errsource, GPG_ERR_INTERNAL); use_tls = cookie->use_tls; es_fclose (hd->fp_write); hd->fp_write = NULL; /* The close has released the cookie and thus we better set it to NULL. */ hd->write_cookie = NULL; /* Shutdown one end of the socket is desired. As per HTTP/1.0 this is not required but some very old servers (e.g. the original pksd keyserver didn't worked without it. */ if ((hd->flags & HTTP_FLAG_SHUTDOWN)) shutdown (FD2INT (hd->sock->fd), 1); hd->in_data = 0; /* Create a new cookie and a stream for reading. */ cookie = xtrycalloc (1, sizeof *cookie); if (!cookie) return gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); cookie->sock = my_socket_ref (hd->sock); cookie->session = http_session_ref (hd->session); cookie->use_tls = use_tls; hd->read_cookie = cookie; hd->fp_read = es_fopencookie (cookie, "r", cookie_functions); if (!hd->fp_read) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); my_socket_unref (cookie->sock, NULL, NULL); http_session_unref (cookie->session); xfree (cookie); hd->read_cookie = NULL; return err; } err = parse_response (hd); if (!err) err = es_onclose (hd->fp_read, 1, fp_onclose_notification, hd); return err; } /* Convenience function to send a request and wait for the response. Closes the handle on error. If PROXY is not NULL, this value will be used as an HTTP proxy and any enabled $http_proxy gets ignored. */ gpg_error_t http_open_document (ctrl_t ctrl, http_t *r_hd, const char *document, const char *auth, unsigned int flags, const char *proxy, http_session_t session, const char *srvtag, strlist_t headers) { gpg_error_t err; err = http_open (ctrl, r_hd, HTTP_REQ_GET, document, NULL, auth, flags, proxy, session, srvtag, headers); if (err) return err; err = http_wait_response (*r_hd); if (err) http_close (*r_hd, 0); return err; } void http_close (http_t hd, int keep_read_stream) { if (!hd) return; log_assert (hd->magic == HTTP_CONTEXT_MAGIC); /* First remove the close notifications for the streams. */ if (hd->fp_read) es_onclose (hd->fp_read, 0, fp_onclose_notification, hd); if (hd->fp_write) es_onclose (hd->fp_write, 0, fp_onclose_notification, hd); /* Now we can close the streams. */ my_socket_unref (hd->sock, NULL, NULL); if (hd->fp_read && !keep_read_stream) es_fclose (hd->fp_read); if (hd->fp_write) es_fclose (hd->fp_write); http_session_unref (hd->session); hd->magic = 0xdeadbeef; http_release_parsed_uri (hd->uri); while (hd->headers) { header_t tmp = hd->headers->next; xfree (hd->headers->value); xfree (hd->headers); hd->headers = tmp; } xfree (hd->buffer); xfree (hd); } estream_t http_get_read_ptr (http_t hd) { return hd?hd->fp_read:NULL; } estream_t http_get_write_ptr (http_t hd) { return hd?hd->fp_write:NULL; } unsigned int http_get_status_code (http_t hd) { return hd?hd->status_code:0; } /* Return information pertaining to TLS. If TLS is not in use for HD, NULL is returned. WHAT is used ask for specific information: (NULL) := Only check whether TLS is in use. Returns an unspecified string if TLS is in use. That string may even be the empty string. */ const char * http_get_tls_info (http_t hd, const char *what) { (void)what; if (!hd) return NULL; return hd->uri->use_tls? "":NULL; } static gpg_error_t parse_uri (parsed_uri_t *ret_uri, const char *uri, int no_scheme_check, int force_tls) { gpg_err_code_t ec; *ret_uri = xtrycalloc (1, sizeof **ret_uri + 2 * strlen (uri) + 1); if (!*ret_uri) return gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); strcpy ((*ret_uri)->buffer, uri); strcpy ((*ret_uri)->buffer + strlen (uri) + 1, uri); (*ret_uri)->original = (*ret_uri)->buffer + strlen (uri) + 1; ec = do_parse_uri (*ret_uri, 0, no_scheme_check, force_tls); if (ec) { http_release_parsed_uri (*ret_uri); *ret_uri = NULL; } return gpg_err_make (default_errsource, ec); } /* * Parse an URI and put the result into the newly allocated RET_URI. * On success the caller must use http_release_parsed_uri() to * releases the resources. If NO_SCHEME_CHECK is set, the function * tries to parse the URL in the same way it would do for an HTTP * style URI. */ gpg_error_t http_parse_uri (parsed_uri_t *ret_uri, const char *uri, int no_scheme_check) { return parse_uri (ret_uri, uri, no_scheme_check, 0); } void http_release_parsed_uri (parsed_uri_t uri) { if (uri) { uri_tuple_t r, r2; for (r = uri->params; r; r = r2) { r2 = r->next; xfree (r); } for (r = uri->query; r; r = r2) { r2 = r->next; xfree (r); } xfree (uri); } } static gpg_err_code_t do_parse_uri (parsed_uri_t uri, int only_local_part, int no_scheme_check, int force_tls) { uri_tuple_t *tail; char *p, *p2, *p3, *pp; int n; p = uri->buffer; n = strlen (uri->buffer); /* Initialize all fields to an empty string or an empty list. */ uri->scheme = uri->host = uri->path = p + n; uri->port = 0; uri->params = uri->query = NULL; uri->use_tls = 0; uri->is_http = 0; uri->opaque = 0; uri->v6lit = 0; uri->onion = 0; uri->explicit_port = 0; uri->off_host = 0; uri->off_path = 0; /* A quick validity check. */ if (strspn (p, VALID_URI_CHARS) != n) return GPG_ERR_BAD_URI; /* Invalid characters found. */ if (!only_local_part) { /* Find the scheme. */ if (!(p2 = strchr (p, ':')) || p2 == p) return GPG_ERR_BAD_URI; /* No scheme. */ *p2++ = 0; for (pp=p; *pp; pp++) *pp = tolower (*(unsigned char*)pp); uri->scheme = p; if (!strcmp (uri->scheme, "http") && !force_tls) { uri->port = 80; uri->is_http = 1; } else if (!strcmp (uri->scheme, "hkp") && !force_tls) { uri->port = 11371; uri->is_http = 1; } #ifdef USE_TLS else if (!strcmp (uri->scheme, "https") || !strcmp (uri->scheme,"hkps") || (force_tls && (!strcmp (uri->scheme, "http") || !strcmp (uri->scheme,"hkp")))) { uri->port = 443; uri->is_http = 1; uri->use_tls = 1; } #endif /*USE_TLS*/ else if (!no_scheme_check) return GPG_ERR_INV_URI; /* Unsupported scheme */ p = p2; if (*p == '/' && p[1] == '/' ) /* There seems to be a hostname. */ { p += 2; if ((p2 = strchr (p, '/'))) { if (p2 - uri->buffer > 10000) return GPG_ERR_BAD_URI; uri->off_path = p2 - uri->buffer; *p2++ = 0; } else { n = (p - uri->buffer) + strlen (p); if (n > 10000) return GPG_ERR_BAD_URI; uri->off_path = n; } /* Check for username/password encoding */ if ((p3 = strchr (p, '@'))) { uri->auth = p; *p3++ = '\0'; p = p3; } for (pp=p; *pp; pp++) *pp = tolower (*(unsigned char*)pp); /* Handle an IPv6 literal */ if( *p == '[' && (p3=strchr( p, ']' )) ) { *p3++ = '\0'; /* worst case, uri->host should have length 0, points to \0 */ uri->host = p + 1; if (p - uri->buffer > 10000) return GPG_ERR_BAD_URI; uri->off_host = (p + 1) - uri->buffer; uri->v6lit = 1; p = p3; } else { uri->host = p; if (p - uri->buffer > 10000) return GPG_ERR_BAD_URI; uri->off_host = p - uri->buffer; } if ((p3 = strchr (p, ':'))) { *p3++ = '\0'; uri->port = atoi (p3); uri->explicit_port = 1; } if ((n = remove_escapes (uri->host)) < 0) return GPG_ERR_BAD_URI; if (n != strlen (uri->host)) return GPG_ERR_BAD_URI; /* Hostname includes a Nul. */ p = p2 ? p2 : NULL; } else if (uri->is_http) return GPG_ERR_INV_URI; /* No Leading double slash for HTTP. */ else { uri->opaque = 1; uri->path = p; if (is_onion_address (uri->path)) uri->onion = 1; return 0; } } /* End global URI part. */ /* Parse the pathname part if any. */ if (p && *p) { /* TODO: Here we have to check params. */ /* Do we have a query part? */ if ((p2 = strchr (p, '?'))) *p2++ = 0; uri->path = p; if ((n = remove_escapes (p)) < 0) return GPG_ERR_BAD_URI; if (n != strlen (p)) return GPG_ERR_BAD_URI; /* Path includes a Nul. */ p = p2 ? p2 : NULL; /* Parse a query string if any. */ if (p && *p) { tail = &uri->query; for (;;) { uri_tuple_t elem; if ((p2 = strchr (p, '&'))) *p2++ = 0; if (!(elem = parse_tuple (p))) return GPG_ERR_BAD_URI; *tail = elem; tail = &elem->next; if (!p2) break; /* Ready. */ p = p2; } } } if (is_onion_address (uri->host)) uri->onion = 1; return 0; } /* * Remove all %xx escapes; this is done in-place. Returns: New length * of the string. */ static int remove_escapes (char *string) { int n = 0; unsigned char *p, *s; for (p = s = (unsigned char*)string; *s; s++) { if (*s == '%') { if (s[1] && s[2] && isxdigit (s[1]) && isxdigit (s[2])) { s++; *p = *s >= '0' && *s <= '9' ? *s - '0' : *s >= 'A' && *s <= 'F' ? *s - 'A' + 10 : *s - 'a' + 10; *p <<= 4; s++; *p |= *s >= '0' && *s <= '9' ? *s - '0' : *s >= 'A' && *s <= 'F' ? *s - 'A' + 10 : *s - 'a' + 10; p++; n++; } else { *p++ = *s++; if (*s) *p++ = *s++; if (*s) *p++ = *s++; if (*s) *p = 0; return -1; /* Bad URI. */ } } else { *p++ = *s; n++; } } *p = 0; /* Make sure to keep a string terminator. */ return n; } /* If SPECIAL is NULL this function escapes in forms mode. */ static size_t escape_data (char *buffer, const void *data, size_t datalen, const char *special) { int forms = !special; const unsigned char *s; size_t n = 0; if (forms) special = "%;?&="; for (s = data; datalen; s++, datalen--) { if (forms && *s == ' ') { if (buffer) *buffer++ = '+'; n++; } else if (forms && *s == '\n') { if (buffer) memcpy (buffer, "%0D%0A", 6); n += 6; } else if (forms && *s == '\r' && datalen > 1 && s[1] == '\n') { if (buffer) memcpy (buffer, "%0D%0A", 6); n += 6; s++; datalen--; } else if (strchr (VALID_URI_CHARS, *s) && !strchr (special, *s)) { if (buffer) *(unsigned char*)buffer++ = *s; n++; } else { if (buffer) { snprintf (buffer, 4, "%%%02X", *s); buffer += 3; } n += 3; } } return n; } static int insert_escapes (char *buffer, const char *string, const char *special) { return escape_data (buffer, string, strlen (string), special); } /* Allocate a new string from STRING using standard HTTP escaping as well as escaping of characters given in SPECIALS. A common pattern for SPECIALS is "%;?&=". However it depends on the needs, for example "+" and "/: often needs to be escaped too. Returns NULL on failure and sets ERRNO. If SPECIAL is NULL a dedicated forms encoding mode is used. */ char * http_escape_string (const char *string, const char *specials) { int n; char *buf; n = insert_escapes (NULL, string, specials); buf = xtrymalloc (n+1); if (buf) { insert_escapes (buf, string, specials); buf[n] = 0; } return buf; } /* Allocate a new string from {DATA,DATALEN} using standard HTTP escaping as well as escaping of characters given in SPECIALS. A common pattern for SPECIALS is "%;?&=". However it depends on the needs, for example "+" and "/: often needs to be escaped too. Returns NULL on failure and sets ERRNO. If SPECIAL is NULL a dedicated forms encoding mode is used. */ char * http_escape_data (const void *data, size_t datalen, const char *specials) { int n; char *buf; n = escape_data (NULL, data, datalen, specials); buf = xtrymalloc (n+1); if (buf) { escape_data (buf, data, datalen, specials); buf[n] = 0; } return buf; } static uri_tuple_t parse_tuple (char *string) { char *p = string; char *p2; int n; uri_tuple_t tuple; if ((p2 = strchr (p, '='))) *p2++ = 0; if ((n = remove_escapes (p)) < 0) return NULL; /* Bad URI. */ if (n != strlen (p)) return NULL; /* Name with a Nul in it. */ tuple = xtrycalloc (1, sizeof *tuple); if (!tuple) return NULL; /* Out of core. */ tuple->name = p; if (!p2) /* We have only the name, so we assume an empty value string. */ { tuple->value = p + strlen (p); tuple->valuelen = 0; tuple->no_value = 1; /* Explicitly mark that we have seen no '='. */ } else /* Name and value. */ { if ((n = remove_escapes (p2)) < 0) { xfree (tuple); return NULL; /* Bad URI. */ } tuple->value = p2; tuple->valuelen = n; } return tuple; } /* Return true if STRING is likely "hostname:port" or only "hostname". */ static int is_hostname_port (const char *string) { int colons = 0; if (!string || !*string) return 0; for (; *string; string++) { if (*string == ':') { if (colons) return 0; if (!string[1]) return 0; colons++; } else if (!colons && strchr (" \t\f\n\v_@[]/", *string)) return 0; /* Invalid characters in hostname. */ else if (colons && !digitp (string)) return 0; /* Not a digit in the port. */ } return 1; } /* * Send a HTTP request to the server * Returns 0 if the request was successful */ static gpg_error_t send_request (ctrl_t ctrl, http_t hd, const char *httphost, const char *auth, const char *proxy, const char *srvtag, unsigned int timeout, strlist_t headers) { gpg_error_t err; const char *server; char *request, *p; unsigned short port; const char *http_proxy = NULL; char *proxy_authstr = NULL; char *authstr = NULL; assuan_fd_t sock; #ifdef USE_TLS int have_http_proxy = 0; #endif if (hd->uri->use_tls && !hd->session) { log_error ("TLS requested but no session object provided\n"); return gpg_err_make (default_errsource, GPG_ERR_INTERNAL); } #ifdef USE_TLS if (hd->uri->use_tls && !hd->session->tls_session) { log_error ("TLS requested but no TLS context available\n"); return gpg_err_make (default_errsource, GPG_ERR_INTERNAL); } if (opt_debug) log_debug ("Using TLS library: %s %s\n", # if HTTP_USE_NTBTLS "NTBTLS", ntbtls_check_version (NULL) # elif HTTP_USE_GNUTLS "GNUTLS", gnutls_check_version (NULL) # else "?", "?" # endif /*HTTP_USE_*TLS*/ ); #endif /*USE_TLS*/ if ((hd->flags & HTTP_FLAG_FORCE_TOR)) { int mode; if (assuan_sock_get_flag (ASSUAN_INVALID_FD, "tor-mode", &mode) || !mode) { log_error ("Tor support is not available\n"); return gpg_err_make (default_errsource, GPG_ERR_NOT_IMPLEMENTED); } /* Non-blocking connects do not work with our Tor proxy because * we can't continue the Socks protocol after the EINPROGRESS. * Disable the timeout to use a blocking connect. */ timeout = 0; } server = *hd->uri->host ? hd->uri->host : "localhost"; port = hd->uri->port ? hd->uri->port : 80; /* Try to use SNI. */ #ifdef USE_TLS if (hd->uri->use_tls) { # if HTTP_USE_GNUTLS int rc; # endif xfree (hd->session->servername); hd->session->servername = xtrystrdup (httphost? httphost : server); if (!hd->session->servername) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); return err; } # if HTTP_USE_NTBTLS err = ntbtls_set_hostname (hd->session->tls_session, hd->session->servername); if (err) { log_info ("ntbtls_set_hostname failed: %s\n", gpg_strerror (err)); return err; } # elif HTTP_USE_GNUTLS rc = gnutls_server_name_set (hd->session->tls_session, GNUTLS_NAME_DNS, hd->session->servername, strlen (hd->session->servername)); if (rc < 0) log_info ("gnutls_server_name_set failed: %s\n", gnutls_strerror (rc)); # endif /*HTTP_USE_GNUTLS*/ } #endif /*USE_TLS*/ if ( (proxy && *proxy) || ( (hd->flags & HTTP_FLAG_TRY_PROXY) && (http_proxy = getenv (HTTP_PROXY_ENV)) && *http_proxy )) { parsed_uri_t uri; if (proxy) http_proxy = proxy; err = parse_uri (&uri, http_proxy, 0, 0); if (gpg_err_code (err) == GPG_ERR_INV_URI && is_hostname_port (http_proxy)) { /* Retry assuming a "hostname:port" string. */ char *tmpname = strconcat ("http://", http_proxy, NULL); if (tmpname && !parse_uri (&uri, tmpname, 0, 0)) err = 0; xfree (tmpname); } if (err) ; #ifdef USE_TLS else if (!strcmp (uri->scheme, "http")) have_http_proxy = 1; #endif else if (!strcmp (uri->scheme, "socks4") || !strcmp (uri->scheme, "socks5h")) err = gpg_err_make (default_errsource, GPG_ERR_NOT_IMPLEMENTED); else err = gpg_err_make (default_errsource, GPG_ERR_INV_URI); if (err) { log_error ("invalid HTTP proxy (%s): %s\n", http_proxy, gpg_strerror (err)); return gpg_err_make (default_errsource, GPG_ERR_CONFIGURATION); } if (uri->auth) { remove_escapes (uri->auth); proxy_authstr = make_header_line ("Proxy-Authorization: Basic ", "\r\n", uri->auth, strlen(uri->auth)); if (!proxy_authstr) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); http_release_parsed_uri (uri); return err; } } err = connect_server (ctrl, *uri->host ? uri->host : "localhost", uri->port ? uri->port : 80, hd->flags, NULL, timeout, &sock); http_release_parsed_uri (uri); } else { err = connect_server (ctrl, server, port, hd->flags, srvtag, timeout, &sock); } if (err) { xfree (proxy_authstr); return err; } hd->sock = my_socket_new (sock); if (!hd->sock) { xfree (proxy_authstr); return gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); } #if USE_TLS if (have_http_proxy && hd->uri->use_tls) { int saved_flags; cookie_t cookie; /* Try to use the CONNECT method to proxy our TLS stream. */ request = es_bsprintf ("CONNECT %s:%hu HTTP/1.0\r\nHost: %s:%hu\r\n%s", httphost ? httphost : server, port, httphost ? httphost : server, port, proxy_authstr ? proxy_authstr : ""); xfree (proxy_authstr); proxy_authstr = NULL; if (! request) return gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP)) log_debug_string (request, "http.c:request:"); cookie = xtrycalloc (1, sizeof *cookie); if (! cookie) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); xfree (request); return err; } cookie->sock = my_socket_ref (hd->sock); hd->write_cookie = cookie; hd->fp_write = es_fopencookie (cookie, "w", cookie_functions); if (! hd->fp_write) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); my_socket_unref (cookie->sock, NULL, NULL); xfree (cookie); xfree (request); hd->write_cookie = NULL; return err; } else if (es_fputs (request, hd->fp_write) || es_fflush (hd->fp_write)) err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); xfree (request); request = NULL; /* Make sure http_wait_response doesn't close the stream. */ saved_flags = hd->flags; hd->flags &= ~HTTP_FLAG_SHUTDOWN; /* Get the response. */ err = http_wait_response (hd); /* Restore flags, destroy stream. */ hd->flags = saved_flags; es_fclose (hd->fp_read); hd->fp_read = NULL; hd->read_cookie = NULL; /* Reset state. */ hd->in_data = 0; if (err) return err; if (hd->status_code != 200) { request = es_bsprintf ("CONNECT %s:%hu", httphost ? httphost : server, port); log_error (_("error accessing '%s': http status %u\n"), request ? request : "out of core", http_get_status_code (hd)); xfree (request); return gpg_error (GPG_ERR_NO_DATA); } /* We are done with the proxy, the code below will establish a * TLS session and talk directly to the target server. */ http_proxy = NULL; } #endif /* USE_TLS */ #if HTTP_USE_NTBTLS if (hd->uri->use_tls) { estream_t in, out; my_socket_ref (hd->sock); /* Until we support send/recv in estream under Windows we need * to use es_fopencookie. */ #ifdef HAVE_W32_SYSTEM in = es_fopencookie ((void*)(unsigned int)hd->sock->fd, "rb", simple_cookie_functions); #else in = es_fdopen_nc (hd->sock->fd, "rb"); #endif if (!in) { err = gpg_error_from_syserror (); xfree (proxy_authstr); return err; } #ifdef HAVE_W32_SYSTEM out = es_fopencookie ((void*)(unsigned int)hd->sock->fd, "wb", simple_cookie_functions); #else out = es_fdopen_nc (hd->sock->fd, "wb"); #endif if (!out) { err = gpg_error_from_syserror (); es_fclose (in); xfree (proxy_authstr); return err; } err = ntbtls_set_transport (hd->session->tls_session, in, out); if (err) { log_info ("TLS set_transport failed: %s <%s>\n", gpg_strerror (err), gpg_strsource (err)); xfree (proxy_authstr); return err; } #ifdef HTTP_USE_NTBTLS if (hd->session->verify_cb) { err = ntbtls_set_verify_cb (hd->session->tls_session, my_ntbtls_verify_cb, hd); if (err) { log_error ("ntbtls_set_verify_cb failed: %s\n", gpg_strerror (err)); xfree (proxy_authstr); return err; } } #endif /*HTTP_USE_NTBTLS*/ while ((err = ntbtls_handshake (hd->session->tls_session))) { switch (err) { default: log_info ("TLS handshake failed: %s <%s>\n", gpg_strerror (err), gpg_strsource (err)); xfree (proxy_authstr); return err; } } hd->session->verify.done = 0; /* Try the available verify callbacks until one returns success * or a real error. Note that NTBTLS does the verification * during the handshake via */ #ifdef HTTP_USE_NTBTLS err = 0; /* Fixme check that the CB has been called. */ #else err = gpg_error (GPG_ERR_NOT_IMPLEMENTED); #endif if (hd->session->verify_cb && gpg_err_source (err) == GPG_ERR_SOURCE_DIRMNGR && gpg_err_code (err) == GPG_ERR_NOT_IMPLEMENTED) err = hd->session->verify_cb (hd->session->verify_cb_value, hd, hd->session, (hd->flags | hd->session->flags), hd->session->tls_session); if (tls_callback && gpg_err_source (err) == GPG_ERR_SOURCE_DIRMNGR && gpg_err_code (err) == GPG_ERR_NOT_IMPLEMENTED) err = tls_callback (hd, hd->session, 0); if (gpg_err_source (err) == GPG_ERR_SOURCE_DIRMNGR && gpg_err_code (err) == GPG_ERR_NOT_IMPLEMENTED) err = http_verify_server_credentials (hd->session); if (err) { log_info ("TLS connection authentication failed: %s <%s>\n", gpg_strerror (err), gpg_strsource (err)); xfree (proxy_authstr); return err; } } #elif HTTP_USE_GNUTLS if (hd->uri->use_tls) { int rc; my_socket_ref (hd->sock); gnutls_transport_set_ptr (hd->session->tls_session, hd->sock); gnutls_transport_set_pull_function (hd->session->tls_session, my_gnutls_read); gnutls_transport_set_push_function (hd->session->tls_session, my_gnutls_write); handshake_again: do { rc = gnutls_handshake (hd->session->tls_session); } while (rc == GNUTLS_E_INTERRUPTED || rc == GNUTLS_E_AGAIN); if (rc < 0) { if (rc == GNUTLS_E_WARNING_ALERT_RECEIVED || rc == GNUTLS_E_FATAL_ALERT_RECEIVED) { gnutls_alert_description_t alertno; const char *alertstr; alertno = gnutls_alert_get (hd->session->tls_session); alertstr = gnutls_alert_get_name (alertno); log_info ("TLS handshake %s: %s (alert %d)\n", rc == GNUTLS_E_WARNING_ALERT_RECEIVED ? "warning" : "failed", alertstr, (int)alertno); if (alertno == GNUTLS_A_UNRECOGNIZED_NAME && server) log_info (" (sent server name '%s')\n", server); if (rc == GNUTLS_E_WARNING_ALERT_RECEIVED) goto handshake_again; } else log_info ("TLS handshake failed: %s\n", gnutls_strerror (rc)); xfree (proxy_authstr); return gpg_err_make (default_errsource, GPG_ERR_NETWORK); } hd->session->verify.done = 0; if (tls_callback) err = tls_callback (hd, hd->session, 0); else err = http_verify_server_credentials (hd->session); if (err) { log_info ("TLS connection authentication failed: %s\n", gpg_strerror (err)); xfree (proxy_authstr); return err; } } #endif /*HTTP_USE_GNUTLS*/ if (auth || hd->uri->auth) { char *myauth; if (auth) { myauth = xtrystrdup (auth); if (!myauth) { xfree (proxy_authstr); return gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); } remove_escapes (myauth); } else { remove_escapes (hd->uri->auth); myauth = hd->uri->auth; } authstr = make_header_line ("Authorization: Basic ", "\r\n", myauth, strlen (myauth)); if (auth) xfree (myauth); if (!authstr) { xfree (proxy_authstr); return gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); } } p = build_rel_path (hd->uri); if (!p) return gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); if (http_proxy && *http_proxy) { request = es_bsprintf ("%s %s://%s:%hu%s%s HTTP/1.0\r\n%s%s", hd->req_type == HTTP_REQ_GET ? "GET" : hd->req_type == HTTP_REQ_HEAD ? "HEAD" : hd->req_type == HTTP_REQ_POST ? "POST" : "OOPS", hd->uri->use_tls? "https" : "http", httphost? httphost : server, port, *p == '/' ? "" : "/", p, authstr ? authstr : "", proxy_authstr ? proxy_authstr : ""); } else { char portstr[35]; if (port == (hd->uri->use_tls? 443 : 80)) *portstr = 0; else snprintf (portstr, sizeof portstr, ":%u", port); request = es_bsprintf ("%s %s%s HTTP/1.0\r\nHost: %s%s\r\n%s", hd->req_type == HTTP_REQ_GET ? "GET" : hd->req_type == HTTP_REQ_HEAD ? "HEAD" : hd->req_type == HTTP_REQ_POST ? "POST" : "OOPS", *p == '/' ? "" : "/", p, httphost? httphost : server, portstr, authstr? authstr:""); } xfree (p); if (!request) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); xfree (authstr); xfree (proxy_authstr); return err; } if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP)) log_debug_string (request, "http.c:request:"); /* First setup estream so that we can write even the first line using estream. This is also required for the sake of gnutls. */ { cookie_t cookie; cookie = xtrycalloc (1, sizeof *cookie); if (!cookie) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); goto leave; } cookie->sock = my_socket_ref (hd->sock); hd->write_cookie = cookie; cookie->use_tls = hd->uri->use_tls; cookie->session = http_session_ref (hd->session); hd->fp_write = es_fopencookie (cookie, "w", cookie_functions); if (!hd->fp_write) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); my_socket_unref (cookie->sock, NULL, NULL); xfree (cookie); hd->write_cookie = NULL; } else if (es_fputs (request, hd->fp_write) || es_fflush (hd->fp_write)) err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); else err = 0; if (!err) { for (;headers; headers=headers->next) { if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP)) log_debug_string (headers->d, "http.c:request-header:"); if ((es_fputs (headers->d, hd->fp_write) || es_fflush (hd->fp_write)) || (es_fputs("\r\n",hd->fp_write) || es_fflush(hd->fp_write))) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); break; } } } } leave: es_free (request); xfree (authstr); xfree (proxy_authstr); return err; } /* * Build the relative path from the parsed URI. Minimal * implementation. May return NULL in case of memory failure; errno * is then set accordingly. */ static char * build_rel_path (parsed_uri_t uri) { uri_tuple_t r; char *rel_path, *p; int n; /* Count the needed space. */ n = insert_escapes (NULL, uri->path, "%;?&"); /* TODO: build params. */ for (r = uri->query; r; r = r->next) { n++; /* '?'/'&' */ n += insert_escapes (NULL, r->name, "%;?&="); if (!r->no_value) { n++; /* '=' */ n += insert_escapes (NULL, r->value, "%;?&="); } } n++; /* Now allocate and copy. */ p = rel_path = xtrymalloc (n); if (!p) return NULL; n = insert_escapes (p, uri->path, "%;?&"); p += n; /* TODO: add params. */ for (r = uri->query; r; r = r->next) { *p++ = r == uri->query ? '?' : '&'; n = insert_escapes (p, r->name, "%;?&="); p += n; if (!r->no_value) { *p++ = '='; /* TODO: Use valuelen. */ n = insert_escapes (p, r->value, "%;?&="); p += n; } } *p = 0; return rel_path; } /* Transform a header name into a standard capitalized format; e.g. "Content-Type". Conversion stops at the colon. As usual we don't use the localized versions of ctype.h. */ static void capitalize_header_name (char *name) { int first = 1; for (; *name && *name != ':'; name++) { if (*name == '-') first = 1; else if (first) { if (*name >= 'a' && *name <= 'z') *name = *name - 'a' + 'A'; first = 0; } else if (*name >= 'A' && *name <= 'Z') *name = *name - 'A' + 'a'; } } /* Store an HTTP header line in LINE away. Line continuation is supported as well as merging of headers with the same name. This function may modify LINE. */ static gpg_err_code_t store_header (http_t hd, char *line) { size_t n; char *p, *value; header_t h; n = strlen (line); if (n && line[n-1] == '\n') { line[--n] = 0; if (n && line[n-1] == '\r') line[--n] = 0; } if (!n) /* we are never called to hit this. */ return GPG_ERR_BUG; if (*line == ' ' || *line == '\t') { /* Continuation. This won't happen too often as it is not recommended. We use a straightforward implementation. */ if (!hd->headers) return GPG_ERR_PROTOCOL_VIOLATION; n += strlen (hd->headers->value); p = xtrymalloc (n+1); if (!p) return gpg_err_code_from_syserror (); strcpy (stpcpy (p, hd->headers->value), line); xfree (hd->headers->value); hd->headers->value = p; return 0; } capitalize_header_name (line); p = strchr (line, ':'); if (!p) return GPG_ERR_PROTOCOL_VIOLATION; *p++ = 0; while (*p == ' ' || *p == '\t') p++; value = p; for (h=hd->headers; h; h = h->next) if ( !strcmp (h->name, line) ) break; if (h) { /* We have already seen a line with that name. Thus we assume * it is a comma separated list and merge them. */ p = strconcat (h->value, ",", value, NULL); if (!p) return gpg_err_code_from_syserror (); xfree (h->value); h->value = p; return 0; } /* Append a new header. */ h = xtrymalloc (sizeof *h + strlen (line)); if (!h) return gpg_err_code_from_syserror (); strcpy (h->name, line); h->value = xtrymalloc (strlen (value)+1); if (!h->value) { xfree (h); return gpg_err_code_from_syserror (); } strcpy (h->value, value); h->next = hd->headers; hd->headers = h; return 0; } /* Return the header NAME from the last response. The returned value is valid as along as HD has not been closed and no other request has been send. If the header was not found, NULL is returned. NAME must be canonicalized, that is the first letter of each dash delimited part must be uppercase and all other letters lowercase. */ const char * http_get_header (http_t hd, const char *name) { header_t h; for (h=hd->headers; h; h = h->next) if ( !strcmp (h->name, name) ) return h->value; return NULL; } /* Return a newly allocated and NULL terminated array with pointers to header names. The array must be released with xfree() and its content is only values as long as no other request has been send. */ const char ** http_get_header_names (http_t hd) { const char **array; size_t n; header_t h; for (n=0, h = hd->headers; h; h = h->next) n++; array = xtrycalloc (n+1, sizeof *array); if (array) { for (n=0, h = hd->headers; h; h = h->next) array[n++] = h->name; } return array; } /* * Parse the response from a server. * Returns: Errorcode and sets some files in the handle */ static gpg_err_code_t parse_response (http_t hd) { char *line, *p, *p2; size_t maxlen, len; cookie_t cookie = hd->read_cookie; const char *s; /* Delete old header lines. */ while (hd->headers) { header_t tmp = hd->headers->next; xfree (hd->headers->value); xfree (hd->headers); hd->headers = tmp; } /* Wait for the status line. */ do { maxlen = MAX_LINELEN; len = es_read_line (hd->fp_read, &hd->buffer, &hd->buffer_size, &maxlen); line = hd->buffer; if (!line) return gpg_err_code_from_syserror (); /* Out of core. */ if (!maxlen) return GPG_ERR_TRUNCATED; /* Line has been truncated. */ if (!len) return GPG_ERR_EOF; if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP)) log_debug_string (line, "http.c:response:\n"); } while (!*line); if ((p = strchr (line, '/'))) *p++ = 0; if (!p || strcmp (line, "HTTP")) return 0; /* Assume http 0.9. */ if ((p2 = strpbrk (p, " \t"))) { *p2++ = 0; p2 += strspn (p2, " \t"); } if (!p2) return 0; /* Also assume http 0.9. */ p = p2; /* TODO: Add HTTP version number check. */ if ((p2 = strpbrk (p, " \t"))) *p2++ = 0; if (!isdigit ((unsigned int)p[0]) || !isdigit ((unsigned int)p[1]) || !isdigit ((unsigned int)p[2]) || p[3]) { /* Malformed HTTP status code - assume http 0.9. */ hd->is_http_0_9 = 1; hd->status_code = 200; return 0; } hd->status_code = atoi (p); /* Skip all the header lines and wait for the empty line. */ do { maxlen = MAX_LINELEN; len = es_read_line (hd->fp_read, &hd->buffer, &hd->buffer_size, &maxlen); line = hd->buffer; if (!line) return gpg_err_code_from_syserror (); /* Out of core. */ /* Note, that we can silently ignore truncated lines. */ if (!len) return GPG_ERR_EOF; /* Trim line endings of empty lines. */ if ((*line == '\r' && line[1] == '\n') || *line == '\n') *line = 0; if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP)) log_info ("http.c:RESP: '%.*s'\n", (int)strlen(line)-(*line&&line[1]?2:0),line); if (*line) { gpg_err_code_t ec = store_header (hd, line); if (ec) return ec; } } while (len && *line); cookie->content_length_valid = 0; if (!(hd->flags & HTTP_FLAG_IGNORE_CL)) { s = http_get_header (hd, "Content-Length"); if (s) { cookie->content_length_valid = 1; cookie->content_length = string_to_u64 (s); } } return 0; } #if 0 static int start_server () { struct sockaddr_in mya; struct sockaddr_in peer; int fd, client; fd_set rfds; int addrlen; int i; if ((fd = socket (AF_INET, SOCK_STREAM, 0)) == -1) { log_error ("socket() failed: %s\n", strerror (errno)); return -1; } i = 1; if (setsockopt (fd, SOL_SOCKET, SO_REUSEADDR, (byte *) & i, sizeof (i))) log_info ("setsockopt(SO_REUSEADDR) failed: %s\n", strerror (errno)); mya.sin_family = AF_INET; memset (&mya.sin_addr, 0, sizeof (mya.sin_addr)); mya.sin_port = htons (11371); if (bind (fd, (struct sockaddr *) &mya, sizeof (mya))) { log_error ("bind to port 11371 failed: %s\n", strerror (errno)); sock_close (fd); return -1; } if (listen (fd, 5)) { log_error ("listen failed: %s\n", strerror (errno)); sock_close (fd); return -1; } for (;;) { FD_ZERO (&rfds); FD_SET (fd, &rfds); if (my_select (fd + 1, &rfds, NULL, NULL, NULL) <= 0) continue; /* ignore any errors */ if (!FD_ISSET (fd, &rfds)) continue; addrlen = sizeof peer; client = my_accept (fd, (struct sockaddr *) &peer, &addrlen); if (client == -1) continue; /* oops */ log_info ("connect from %s\n", inet_ntoa (peer.sin_addr)); fflush (stdout); fflush (stderr); if (!fork ()) { int c; FILE *fp; fp = fdopen (client, "r"); while ((c = getc (fp)) != EOF) putchar (c); fclose (fp); exit (0); } sock_close (client); } return 0; } #endif /* Return true if SOCKS shall be used. This is the case if tor_mode * is enabled and the desired address is not the loopback address. * This function is basically a copy of the same internal function in * Libassuan. */ static int use_socks (struct sockaddr_storage *addr) { int mode; if (assuan_sock_get_flag (ASSUAN_INVALID_FD, "tor-mode", &mode) || !mode) return 0; /* Not in Tor mode. */ else if (addr->ss_family == AF_INET6) { struct sockaddr_in6 *addr_in6 = (struct sockaddr_in6 *)addr; const unsigned char *s; int i; s = (unsigned char *)&addr_in6->sin6_addr.s6_addr; if (s[15] != 1) return 1; /* Last octet is not 1 - not the loopback address. */ for (i=0; i < 15; i++, s++) if (*s) return 1; /* Non-zero octet found - not the loopback address. */ return 0; /* This is the loopback address. */ } else if (addr->ss_family == AF_INET) { struct sockaddr_in *addr_in = (struct sockaddr_in *)addr; if (*(unsigned char*)&addr_in->sin_addr.s_addr == 127) return 0; /* Loopback (127.0.0.0/8) */ return 1; } else return 0; } /* Wrapper around assuan_sock_new which takes the domain from an * address parameter. */ static assuan_fd_t my_sock_new_for_addr (struct sockaddr_storage *addr, int type, int proto) { int domain; if (use_socks (addr)) { /* Libassaun always uses 127.0.0.1 to connect to the socks * server (i.e. the Tor daemon). */ domain = AF_INET; } else domain = addr->ss_family; return assuan_sock_new (domain, type, proto); } /* Call WSAGetLastError and map it to a libgpg-error. */ #ifdef HAVE_W32_SYSTEM static gpg_error_t my_wsagetlasterror (void) { int wsaerr; gpg_err_code_t ec; wsaerr = WSAGetLastError (); switch (wsaerr) { case WSAENOTSOCK: ec = GPG_ERR_EINVAL; break; case WSAEWOULDBLOCK: ec = GPG_ERR_EAGAIN; break; case ERROR_BROKEN_PIPE: ec = GPG_ERR_EPIPE; break; case WSANOTINITIALISED: ec = GPG_ERR_ENOSYS; break; case WSAENOBUFS: ec = GPG_ERR_ENOBUFS; break; case WSAEMSGSIZE: ec = GPG_ERR_EMSGSIZE; break; case WSAECONNREFUSED: ec = GPG_ERR_ECONNREFUSED; break; case WSAEISCONN: ec = GPG_ERR_EISCONN; break; case WSAEALREADY: ec = GPG_ERR_EALREADY; break; case WSAETIMEDOUT: ec = GPG_ERR_ETIMEDOUT; break; default: ec = GPG_ERR_EIO; break; } return gpg_err_make (default_errsource, ec); } #endif /*HAVE_W32_SYSTEM*/ /* Connect SOCK and return GPG_ERR_ETIMEOUT if a connection could not * be established within TIMEOUT milliseconds. 0 indicates the * system's default timeout. The other args are the usual connect * args. On success 0 is returned, on timeout GPG_ERR_ETIMEDOUT, and * another error code for other errors. On timeout the caller needs * to close the socket as soon as possible to stop an ongoing * handshake. * * This implementation is for well-behaving systems; see Stevens, * Network Programming, 2nd edition, Vol 1, 15.4. */ static gpg_error_t connect_with_timeout (assuan_fd_t sock, struct sockaddr *addr, int addrlen, unsigned int timeout) { gpg_error_t err; int syserr; socklen_t slen; fd_set rset, wset; struct timeval tval; int n; #ifndef HAVE_W32_SYSTEM int oflags; # define RESTORE_BLOCKING() do { \ fcntl (sock, F_SETFL, oflags); \ } while (0) #else /*HAVE_W32_SYSTEM*/ # define RESTORE_BLOCKING() do { \ unsigned long along = 0; \ ioctlsocket (FD2INT (sock), FIONBIO, &along); \ } while (0) #endif /*HAVE_W32_SYSTEM*/ if (!timeout) { /* Shortcut. */ if (assuan_sock_connect (sock, addr, addrlen)) err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); else err = 0; return err; } /* Switch the socket into non-blocking mode. */ #ifdef HAVE_W32_SYSTEM { unsigned long along = 1; if (ioctlsocket (FD2INT (sock), FIONBIO, &along)) return my_wsagetlasterror (); } #else oflags = fcntl (sock, F_GETFL, 0); if (fcntl (sock, F_SETFL, oflags | O_NONBLOCK)) return gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); #endif /* Do the connect. */ if (!assuan_sock_connect (sock, addr, addrlen)) { /* Immediate connect. Restore flags. */ RESTORE_BLOCKING (); return 0; /* Success. */ } err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); if (gpg_err_code (err) != GPG_ERR_EINPROGRESS #ifdef HAVE_W32_SYSTEM && gpg_err_code (err) != GPG_ERR_EAGAIN #endif ) { RESTORE_BLOCKING (); return err; } FD_ZERO (&rset); FD_SET (FD2INT (sock), &rset); wset = rset; tval.tv_sec = timeout / 1000; tval.tv_usec = (timeout % 1000) * 1000; n = my_select (FD2INT(sock)+1, &rset, &wset, NULL, &tval); if (n < 0) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); RESTORE_BLOCKING (); return err; } if (!n) { /* Timeout: We do not restore the socket flags on timeout * because the caller is expected to close the socket. */ return gpg_err_make (default_errsource, GPG_ERR_ETIMEDOUT); } if (!FD_ISSET (sock, &rset) && !FD_ISSET (sock, &wset)) { /* select misbehaved. */ return gpg_err_make (default_errsource, GPG_ERR_SYSTEM_BUG); } slen = sizeof (syserr); if (getsockopt (FD2INT(sock), SOL_SOCKET, SO_ERROR, (void*)&syserr, &slen) < 0) { /* Assume that this is Solaris which returns the error in ERRNO. */ err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); } else if (syserr) err = gpg_err_make (default_errsource, gpg_err_code_from_errno (syserr)); else err = 0; /* Connected. */ RESTORE_BLOCKING (); return err; #undef RESTORE_BLOCKING } /* Actually connect to a server. On success 0 is returned and the * file descriptor for the socket is stored at R_SOCK; on error an * error code is returned and ASSUAN_INVALID_FD is stored at R_SOCK. * TIMEOUT is the connect timeout in milliseconds. Note that the * function tries to connect to all known addresses and the timeout is * for each one. */ static gpg_error_t connect_server (ctrl_t ctrl, const char *server, unsigned short port, unsigned int flags, const char *srvtag, unsigned int timeout, assuan_fd_t *r_sock) { gpg_error_t err; assuan_fd_t sock = ASSUAN_INVALID_FD; unsigned int srvcount = 0; int hostfound = 0; int anyhostaddr = 0; int srv, connected; gpg_error_t last_err = 0; struct srventry *serverlist = NULL; *r_sock = ASSUAN_INVALID_FD; #if defined(HAVE_W32_SYSTEM) && !defined(HTTP_NO_WSASTARTUP) init_sockets (); #endif /*Windows*/ /* Onion addresses require special treatment. */ if (is_onion_address (server)) { #ifdef ASSUAN_SOCK_TOR if (opt_debug) log_debug ("http.c:connect_server:onion: name='%s' port=%hu\n", server, port); sock = assuan_sock_connect_byname (server, port, 0, NULL, ASSUAN_SOCK_TOR); if (sock == ASSUAN_INVALID_FD) { err = gpg_err_make (default_errsource, (errno == EHOSTUNREACH)? GPG_ERR_UNKNOWN_HOST : gpg_err_code_from_syserror ()); log_error ("can't connect to '%s': %s\n", server, gpg_strerror (err)); return err; } notify_netactivity (); *r_sock = sock; return 0; #else /*!ASSUAN_SOCK_TOR*/ err = gpg_err_make (default_errsource, GPG_ERR_ENETUNREACH); return ASSUAN_INVALID_FD; #endif /*!HASSUAN_SOCK_TOR*/ } /* Do the SRV thing */ if (srvtag) { err = get_dns_srv (ctrl, server, srvtag, NULL, &serverlist, &srvcount); if (err) log_info ("getting '%s' SRV for '%s' failed: %s\n", srvtag, server, gpg_strerror (err)); /* Note that on error SRVCOUNT is zero. */ err = 0; } if (!serverlist) { /* Either we're not using SRV, or the SRV lookup failed. Make up a fake SRV record. */ serverlist = xtrycalloc (1, sizeof *serverlist); if (!serverlist) return gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); serverlist->port = port; strncpy (serverlist->target, server, DIMof (struct srventry, target)); serverlist->target[DIMof (struct srventry, target)-1] = '\0'; srvcount = 1; } connected = 0; for (srv=0; srv < srvcount && !connected; srv++) { dns_addrinfo_t aibuf, ai; if (opt_debug) log_debug ("http.c:connect_server: trying name='%s' port=%hu\n", serverlist[srv].target, port); err = resolve_dns_name (ctrl, serverlist[srv].target, port, 0, SOCK_STREAM, &aibuf, NULL); if (err) { log_info ("resolving '%s' failed: %s\n", serverlist[srv].target, gpg_strerror (err)); last_err = err; continue; /* Not found - try next one. */ } hostfound = 1; for (ai = aibuf; ai && !connected; ai = ai->next) { if (ai->family == AF_INET && (flags & HTTP_FLAG_IGNORE_IPv4)) continue; if (ai->family == AF_INET6 && (flags & HTTP_FLAG_IGNORE_IPv6)) continue; if (sock != ASSUAN_INVALID_FD) assuan_sock_close (sock); sock = my_sock_new_for_addr (ai->addr, ai->socktype, ai->protocol); if (sock == ASSUAN_INVALID_FD) { err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ()); log_error ("error creating socket: %s\n", gpg_strerror (err)); free_dns_addrinfo (aibuf); xfree (serverlist); return err; } anyhostaddr = 1; err = connect_with_timeout (sock, (struct sockaddr *)ai->addr, ai->addrlen, timeout); if (err) { last_err = err; } else { connected = 1; notify_netactivity (); } } free_dns_addrinfo (aibuf); } xfree (serverlist); if (!connected) { if (!hostfound) log_error ("can't connect to '%s': %s\n", server, "host not found"); else if (!anyhostaddr) log_error ("can't connect to '%s': %s\n", server, "no IP address for host"); else { #ifdef HAVE_W32_SYSTEM log_error ("can't connect to '%s': ec=%d\n", server, (int)WSAGetLastError()); #else log_error ("can't connect to '%s': %s\n", server, gpg_strerror (last_err)); #endif } err = last_err? last_err : gpg_err_make (default_errsource, GPG_ERR_UNKNOWN_HOST); if (sock != ASSUAN_INVALID_FD) assuan_sock_close (sock); return err; } *r_sock = sock; return 0; } /* Helper to read from a socket. This handles npth things and * EINTR. */ static gpgrt_ssize_t read_server (assuan_fd_t sock, void *buffer, size_t size) { int nread; do { #ifdef HAVE_W32_SYSTEM /* Under Windows we need to use recv for a socket. */ # if defined(USE_NPTH) npth_unprotect (); # endif nread = recv (FD2INT (sock), buffer, size, 0); # if defined(USE_NPTH) npth_protect (); # endif #else /*!HAVE_W32_SYSTEM*/ # ifdef USE_NPTH nread = npth_read (sock, buffer, size); # else nread = read (sock, buffer, size); # endif #endif /*!HAVE_W32_SYSTEM*/ } while (nread == -1 && errno == EINTR); return nread; } static gpg_error_t write_server (assuan_fd_t sock, const char *data, size_t length) { int nleft; int nwritten; nleft = length; while (nleft > 0) { #if defined(HAVE_W32_SYSTEM) # if defined(USE_NPTH) npth_unprotect (); # endif nwritten = send (FD2INT (sock), data, nleft, 0); # if defined(USE_NPTH) npth_protect (); # endif if ( nwritten == SOCKET_ERROR ) { log_info ("network write failed: ec=%d\n", (int)WSAGetLastError ()); return gpg_error (GPG_ERR_NETWORK); } #else /*!HAVE_W32_SYSTEM*/ # ifdef USE_NPTH nwritten = npth_write (sock, data, nleft); # else nwritten = write (sock, data, nleft); # endif if (nwritten == -1) { if (errno == EINTR) continue; if (errno == EAGAIN) { struct timeval tv; tv.tv_sec = 0; tv.tv_usec = 50000; my_select (0, NULL, NULL, NULL, &tv); continue; } log_info ("network write failed: %s\n", strerror (errno)); return gpg_error_from_syserror (); } #endif /*!HAVE_W32_SYSTEM*/ nleft -= nwritten; data += nwritten; } return 0; } /* Read handler for estream. */ static gpgrt_ssize_t cookie_read (void *cookie, void *buffer, size_t size) { cookie_t c = cookie; int nread; if (c->content_length_valid) { if (!c->content_length) return 0; /* EOF */ if (c->content_length < size) size = c->content_length; } #if HTTP_USE_NTBTLS if (c->use_tls && c->session && c->session->tls_session) { estream_t in, out; ntbtls_get_stream (c->session->tls_session, &in, &out); nread = es_fread (buffer, 1, size, in); if (opt_debug) log_debug ("TLS network read: %d/%zu\n", nread, size); } else #elif HTTP_USE_GNUTLS if (c->use_tls && c->session && c->session->tls_session) { again: nread = gnutls_record_recv (c->session->tls_session, buffer, size); if (nread < 0) { if (nread == GNUTLS_E_INTERRUPTED) goto again; if (nread == GNUTLS_E_AGAIN) { struct timeval tv; tv.tv_sec = 0; tv.tv_usec = 50000; my_select (0, NULL, NULL, NULL, &tv); goto again; } if (nread == GNUTLS_E_REHANDSHAKE) goto again; /* A client is allowed to just ignore this request. */ if (nread == GNUTLS_E_PREMATURE_TERMINATION) { /* The server terminated the connection. Close the TLS session, and indicate EOF using a short read. */ close_tls_session (c->session); return 0; } log_info ("TLS network read failed: %s\n", gnutls_strerror (nread)); gpg_err_set_errno (EIO); return -1; } } else #endif /*HTTP_USE_GNUTLS*/ { nread = read_server (c->sock->fd, buffer, size); } if (c->content_length_valid && nread > 0) { if (nread < c->content_length) c->content_length -= nread; else c->content_length = 0; } return (gpgrt_ssize_t)nread; } /* Write handler for estream. */ static gpgrt_ssize_t cookie_write (void *cookie, const void *buffer_arg, size_t size) { const char *buffer = buffer_arg; cookie_t c = cookie; int nwritten = 0; #if HTTP_USE_NTBTLS if (c->use_tls && c->session && c->session->tls_session) { estream_t in, out; ntbtls_get_stream (c->session->tls_session, &in, &out); if (size == 0) es_fflush (out); else nwritten = es_fwrite (buffer, 1, size, out); if (opt_debug) log_debug ("TLS network write: %d/%zu\n", nwritten, size); } else #elif HTTP_USE_GNUTLS if (c->use_tls && c->session && c->session->tls_session) { int nleft = size; while (nleft > 0) { nwritten = gnutls_record_send (c->session->tls_session, buffer, nleft); if (nwritten <= 0) { if (nwritten == GNUTLS_E_INTERRUPTED) continue; if (nwritten == GNUTLS_E_AGAIN) { struct timeval tv; tv.tv_sec = 0; tv.tv_usec = 50000; my_select (0, NULL, NULL, NULL, &tv); continue; } log_info ("TLS network write failed: %s\n", gnutls_strerror (nwritten)); gpg_err_set_errno (EIO); return -1; } nleft -= nwritten; buffer += nwritten; } } else #endif /*HTTP_USE_GNUTLS*/ { if ( write_server (c->sock->fd, buffer, size) ) { gpg_err_set_errno (EIO); nwritten = -1; } else nwritten = size; } return (gpgrt_ssize_t)nwritten; } #if defined(HAVE_W32_SYSTEM) && defined(HTTP_USE_NTBTLS) static gpgrt_ssize_t simple_cookie_read (void *cookie, void *buffer, size_t size) { assuan_fd_t sock = (assuan_fd_t)cookie; return read_server (sock, buffer, size); } static gpgrt_ssize_t simple_cookie_write (void *cookie, const void *buffer_arg, size_t size) { assuan_fd_t sock = (assuan_fd_t)cookie; const char *buffer = buffer_arg; int nwritten; if (write_server (sock, buffer, size)) { gpg_err_set_errno (EIO); nwritten = -1; } else nwritten = size; return (gpgrt_ssize_t)nwritten; } #endif /*HAVE_W32_SYSTEM*/ #ifdef HTTP_USE_GNUTLS /* Wrapper for gnutls_bye used by my_socket_unref. */ static void send_gnutls_bye (void *opaque) { tls_session_t tls_session = opaque; int ret; again: do ret = gnutls_bye (tls_session, GNUTLS_SHUT_RDWR); while (ret == GNUTLS_E_INTERRUPTED); if (ret == GNUTLS_E_AGAIN) { struct timeval tv; tv.tv_sec = 0; tv.tv_usec = 50000; my_select (0, NULL, NULL, NULL, &tv); goto again; } } #endif /*HTTP_USE_GNUTLS*/ /* Close handler for estream. */ static int cookie_close (void *cookie) { cookie_t c = cookie; if (!c) return 0; #if HTTP_USE_NTBTLS if (c->use_tls && c->session && c->session->tls_session) { /* FIXME!! Possibly call ntbtls_close_notify for close of write stream. */ my_socket_unref (c->sock, NULL, NULL); } else #elif HTTP_USE_GNUTLS if (c->use_tls && c->session && c->session->tls_session) my_socket_unref (c->sock, send_gnutls_bye, c->session->tls_session); else #endif /*HTTP_USE_GNUTLS*/ if (c->sock) my_socket_unref (c->sock, NULL, NULL); if (c->session) http_session_unref (c->session); xfree (c); return 0; } /* Verify the credentials of the server. Returns 0 on success and store the result in the session object. */ gpg_error_t http_verify_server_credentials (http_session_t sess) { #if HTTP_USE_GNUTLS static const char errprefix[] = "TLS verification of peer failed"; int rc; unsigned int status; const char *hostname; const gnutls_datum_t *certlist; unsigned int certlistlen; gnutls_x509_crt_t cert; gpg_error_t err = 0; sess->verify.done = 1; sess->verify.status = 0; sess->verify.rc = GNUTLS_E_CERTIFICATE_ERROR; if (gnutls_certificate_type_get (sess->tls_session) != GNUTLS_CRT_X509) { log_error ("%s: %s\n", errprefix, "not an X.509 certificate"); sess->verify.rc = GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE; return gpg_error (GPG_ERR_GENERAL); } rc = gnutls_certificate_verify_peers2 (sess->tls_session, &status); if (rc) { log_error ("%s: %s\n", errprefix, gnutls_strerror (rc)); if (!err) err = gpg_error (GPG_ERR_GENERAL); } else if (status) { log_error ("%s: status=0x%04x\n", errprefix, status); #if GNUTLS_VERSION_NUMBER >= 0x030104 { gnutls_datum_t statusdat; if (!gnutls_certificate_verification_status_print (status, GNUTLS_CRT_X509, &statusdat, 0)) { log_info ("%s: %s\n", errprefix, statusdat.data); gnutls_free (statusdat.data); } } #endif /*gnutls >= 3.1.4*/ sess->verify.status = status; if (!err) err = gpg_error (GPG_ERR_GENERAL); } hostname = sess->servername; if (!hostname || !strchr (hostname, '.')) { log_error ("%s: %s\n", errprefix, "hostname missing"); if (!err) err = gpg_error (GPG_ERR_GENERAL); } certlist = gnutls_certificate_get_peers (sess->tls_session, &certlistlen); if (!certlistlen) { log_error ("%s: %s\n", errprefix, "server did not send a certificate"); if (!err) err = gpg_error (GPG_ERR_GENERAL); /* Need to stop here. */ if (err) return err; } rc = gnutls_x509_crt_init (&cert); if (rc < 0) { if (!err) err = gpg_error (GPG_ERR_GENERAL); if (err) return err; } rc = gnutls_x509_crt_import (cert, &certlist[0], GNUTLS_X509_FMT_DER); if (rc < 0) { log_error ("%s: %s: %s\n", errprefix, "error importing certificate", gnutls_strerror (rc)); if (!err) err = gpg_error (GPG_ERR_GENERAL); } if (!gnutls_x509_crt_check_hostname (cert, hostname)) { log_error ("%s: %s\n", errprefix, "hostname does not match"); if (!err) err = gpg_error (GPG_ERR_GENERAL); } gnutls_x509_crt_deinit (cert); if (!err) sess->verify.rc = 0; if (sess->cert_log_cb) { const void *bufarr[10]; size_t buflenarr[10]; size_t n; for (n = 0; n < certlistlen && n < DIM (bufarr)-1; n++) { bufarr[n] = certlist[n].data; buflenarr[n] = certlist[n].size; } bufarr[n] = NULL; buflenarr[n] = 0; sess->cert_log_cb (sess, err, hostname, bufarr, buflenarr); } return err; #else /*!HTTP_USE_GNUTLS*/ (void)sess; return gpg_error (GPG_ERR_NOT_IMPLEMENTED); #endif } /* Return the first query variable with the specified key. If there is no such variable, return NULL. */ struct uri_tuple_s * uri_query_lookup (parsed_uri_t uri, const char *key) { struct uri_tuple_s *t; for (t = uri->query; t; t = t->next) if (strcmp (t->name, key) == 0) return t; return NULL; } /* Return true if both URI point to the same host for the purpose of * redirection check. A is the original host and B the host given in * the Location header. As a temporary workaround a fixed list of * exceptions is also consulted. */ static int same_host_p (parsed_uri_t a, parsed_uri_t b) { static struct { const char *from; /* NULL uses the last entry from the table. */ const char *to; } allow[] = { { "protonmail.com", "api.protonmail.com" }, { NULL, "api.protonmail.ch" }, { "protonmail.ch", "api.protonmail.com" }, - { NULL, "api.protonmail.ch" } + { NULL, "api.protonmail.ch" }, + { "pm.me", "api.protonmail.ch" } }; int i; const char *from; if (!a->host || !b->host) return 0; if (!ascii_strcasecmp (a->host, b->host)) return 1; from = NULL; for (i=0; i < DIM (allow); i++) { if (allow[i].from) from = allow[i].from; if (!from) continue; if (!ascii_strcasecmp (from, a->host) && !ascii_strcasecmp (allow[i].to, b->host)) return 1; } return 0; } /* Prepare a new URL for a HTTP redirect. INFO has flags controlling * the operation, STATUS_CODE is used for diagnostics, LOCATION is the * value of the "Location" header, and R_URL reveives the new URL on * success or NULL or error. Note that INFO->ORIG_URL is * required. */ gpg_error_t http_prepare_redirect (http_redir_info_t *info, unsigned int status_code, const char *location, char **r_url) { gpg_error_t err; parsed_uri_t locuri; parsed_uri_t origuri; char *newurl; char *p; *r_url = NULL; if (!info || !info->orig_url) return gpg_error (GPG_ERR_INV_ARG); if (!info->silent) log_info (_("URL '%s' redirected to '%s' (%u)\n"), info->orig_url, location? location:"[none]", status_code); if (!info->redirects_left) { if (!info->silent) log_error (_("too many redirections\n")); return gpg_error (GPG_ERR_NO_DATA); } info->redirects_left--; if (!location || !*location) return gpg_error (GPG_ERR_NO_DATA); err = http_parse_uri (&locuri, location, 0); if (err) return err; /* Make sure that an onion address only redirects to another * onion address, or that a https address only redirects to a * https address. */ if (info->orig_onion && !locuri->onion) { http_release_parsed_uri (locuri); return gpg_error (GPG_ERR_FORBIDDEN); } if (!info->allow_downgrade && info->orig_https && !locuri->use_tls) { http_release_parsed_uri (locuri); return gpg_error (GPG_ERR_FORBIDDEN); } if (info->trust_location) { /* We trust the Location - return it verbatim. */ http_release_parsed_uri (locuri); newurl = xtrystrdup (location); if (!newurl) { err = gpg_error_from_syserror (); http_release_parsed_uri (locuri); return err; } } else if ((err = http_parse_uri (&origuri, info->orig_url, 0))) { http_release_parsed_uri (locuri); return err; } else if (same_host_p (origuri, locuri)) { /* The host is the same or on an exception list and thus we can * take the location verbatim. */ http_release_parsed_uri (origuri); http_release_parsed_uri (locuri); newurl = xtrystrdup (location); if (!newurl) { err = gpg_error_from_syserror (); http_release_parsed_uri (locuri); return err; } } else { /* We take only the host and port from the URL given in the * Location. This limits the effects of redirection attacks by * rogue hosts returning an URL to servers in the client's own * network. We don't even include the userinfo because they * should be considered similar to the path and query parts. */ if (!(locuri->off_path - locuri->off_host)) { http_release_parsed_uri (origuri); http_release_parsed_uri (locuri); return gpg_error (GPG_ERR_BAD_URI); } if (!(origuri->off_path - origuri->off_host)) { http_release_parsed_uri (origuri); http_release_parsed_uri (locuri); return gpg_error (GPG_ERR_BAD_URI); } newurl = xtrymalloc (strlen (origuri->original) + (locuri->off_path - locuri->off_host) + 1); if (!newurl) { err = gpg_error_from_syserror (); http_release_parsed_uri (origuri); http_release_parsed_uri (locuri); return err; } /* Build new URL from * uriguri: scheme userinfo ---- ---- path rest * locuri: ------ -------- host port ---- ---- */ p = newurl; memcpy (p, origuri->original, origuri->off_host); p += origuri->off_host; memcpy (p, locuri->original + locuri->off_host, (locuri->off_path - locuri->off_host)); p += locuri->off_path - locuri->off_host; strcpy (p, origuri->original + origuri->off_path); http_release_parsed_uri (origuri); http_release_parsed_uri (locuri); if (!info->silent) log_info (_("redirection changed to '%s'\n"), newurl); } *r_url = newurl; return 0; } /* Return string describing the http STATUS. Returns an empty string * for an unknown status. */ const char * http_status2string (unsigned int status) { switch (status) { case 500: return "Internal Server Error"; case 501: return "Not Implemented"; case 502: return "Bad Gateway"; case 503: return "Service Unavailable"; case 504: return "Gateway Timeout"; case 505: return "HTTP version Not Supported"; case 506: return "Variant Also Negation"; case 507: return "Insufficient Storage"; case 508: return "Loop Detected"; case 510: return "Not Extended"; case 511: return "Network Authentication Required"; } return ""; }