2006-11-17 Werner Koch * Makefile.am (dirmngr_LDADD): Use LIBASSUAN_PTH_LIBS. 2006-11-16 Werner Koch * server.c (start_command_handler): Replaced assuan_init_connected_socket_server by assuan_init_socket_server_ext. * crlcache.c (update_dir): Put a diagnostic into DIR.txt. (open_dir): Detect invalid and duplicate entries. (update_dir): Fixed search for second field. 2006-10-23 Werner Koch * dirmngr.c (main): New command --gpgconf-test. 2006-09-14 Werner Koch * server.c (start_command_handler): In vebose mode print information about the peer. This may later be used to restrict certain commands. 2006-09-12 Werner Koch * server.c (start_command_handler): Print a more informative hello line. * dirmngr.c: Moved config_filename into the opt struct. 2006-09-11 Werner Koch Changed everything to use Assuan with gpg-error codes. * maperror.c: Removed. * server.c (map_to_assuan_status): Removed. * dirmngr.c (main): Set assuan error source. * dirmngr-client.c (main): Ditto. 2006-09-04 Werner Koch * crlfetch.c (crl_fetch): Implement HTTP redirection. * ocsp.c (do_ocsp_request): Ditto. New HTTP code version taken from gnupg svn release 4236. * http.c (http_get_header): New. (capitalize_header_name, store_header): New. (parse_response): Store headers away. (send_request): Return GPG_ERR_NOT_FOUND if connect_server failed. * http.h: New flag HTTP_FLAG_NEED_HEADER. 2006-09-01 Werner Koch * crlfetch.c (register_file_reader, get_file_reader): New. (crl_fetch): Register the file pointer for HTTP. (crl_close_reader): And release it. * http.c, http.h: Updated from GnuPG SVN trunk. Changed all users to adopt the new API. * dirmngr.h: Moved inclusion of jnlib header to ... * util.h: .. here. This is required becuase http.c includes only a file util.h but makes use of log_foo. Include gcrypt.h so that gcry_malloc et al are declared. 2006-08-31 Werner Koch * ocsp.c (check_signature): Make use of the responder id. 2006-08-30 Werner Koch * validate.c (check_cert_sig): Workaround for rimemd160. (allowed_ca): Always allow trusted CAs. * dirmngr.h (cert_ref_t): New. (struct server_control_s): Add field OCSP_CERTS. * server.c (start_command_handler): Release new field * ocsp.c (release_ctrl_ocsp_certs): New. (check_signature): Store certificates in OCSP_CERTS. * certcache.c (find_issuing_cert): Reset error if cert was found by subject. (put_cert): Add new arg FPR_BUFFER. Changed callers. (cache_cert_silent): New. * dirmngr.c (parse_rereadable_options): New options --ocsp-max-clock-skew and --ocsp-current-period. * ocsp.c (ocsp_isvalid): Use them here. * ocsp.c (validate_responder_cert): New optional arg signer_cert. (check_signature_core): Ditto. (check_signature): Use the default signer certificate here. 2006-06-27 Werner Koch * dirmngr-client.c (inq_cert): Take care of SENDCERT_SKI. 2006-06-26 Werner Koch * crlcache.c (lock_db_file): Count open files when needed. (find_entry): Fixed deleted case. 2006-06-23 Werner Koch * misc.c (cert_log_name): New. * certcache.c (load_certs_from_dir): Also print certificate name. (find_cert_bysn): Release ISSDN. * validate.h: New VALIDATE_MODE_CERT. * server.c (cmd_validate): Use it here so that no policy checks are done. Try to validated a cached copy of the target. * validate.c (validate_cert_chain): Implement a validation cache. (check_revocations): Print more diagnostics. Actually use the loop variable and not the head of the list. (validate_cert_chain): Do not check revocations of CRL issuer certificates in plain CRL check mode. * ocsp.c (ocsp_isvalid): Make sure it is reset for a status of revoked. 2006-06-22 Werner Koch * validate.c (cert_use_crl_p): New. (cert_usage_p): Add a mode 6 for CRL signing. (validate_cert_chain): Check that the certificate may be used for CRL signing. Print a note when not running as system daemon. (validate_cert_chain): Reduce the maximum depth from 50 to 10. * certcache.c (find_cert_bysn): Minor restructuring (find_cert_bysubject): Ditto. Use get_cert_local when called without KEYID. * crlcache.c (get_crlissuer_cert_bysn): Removed. (get_crlissuer_cert): Removed. (crl_parse_insert): Use find_cert_bysubject and find_cert_bysn instead of the removed functions. 2006-06-19 Werner Koch * certcache.c (compare_serialno): Silly me. Using 0 as true is that hard; tsss. Fixed call cases except for the only working one which are both numbers of the same length. 2006-05-15 Werner Koch * crlfetch.c (crl_fetch): Use no-shutdown flag for HTTP. This seems to be required for "IBM_HTTP_Server/2.0.47.1 Apache/2.0.47 (Unix)". * http.c (parse_tuple): Set flag to to indicate no value. (build_rel_path): Take care of it. * crlcache.c (crl_cache_reload_crl): Also iterate over all names within a DP. 2005-09-28 Marcus Brinkmann * Makefile.am (dirmngr_LDADD): Add @LIBINTL@ and @LIBICONV@. (dirmngr_ldap_LDADD): Likewise. (dirmngr_client_LDADD): Likewise. 2005-09-12 Werner Koch * dirmngr.c: Fixed description to match the one in gpgconf. 2005-06-15 Werner Koch * server.c (cmd_lookup): Take care of NO_DATA which might get returned also by start_cert_fetch(). 2005-04-20 Werner Koch * ldap.c (ldap_wrapper_wait_connections): Set a shutdown flag. (ldap_wrapper_thread): Handle shutdown in a special way. 2005-04-19 Werner Koch * server.c (get_cert_local, get_issuing_cert_local) (get_cert_local_ski): Bail out if called without a local context. 2005-04-18 Werner Koch * certcache.c (find_issuing_cert): Fixed last resort method which should be finding by subject and not by issuer. Try to locate it also using the keyIdentifier method. Improve error reporting. (cmp_simple_canon_sexp): New. (find_cert_bysubject): New. (find_cert_bysn): Ask back to the caller before trying an extarnl lookup. * server.c (get_cert_local_ski): New. * crlcache.c (crl_parse_insert): Also try to locate issuer certificate using the keyIdentifier. Improved error reporting. 2005-04-14 Werner Koch * ldap.c (start_cert_fetch_ldap): Really return ERR. 2005-03-17 Werner Koch * http.c (parse_response): Changed MAXLEN and LEN to size_t to match the requirement of read_line. * http.h (http_context_s): Ditto for BUFFER_SIZE. 2005-03-15 Werner Koch * ldap.c: Included time.h. Reported by Bernhard Herzog. 2005-03-09 Werner Koch * dirmngr.c: Add a note to the help listing check the man page for other options. 2005-02-01 Werner Koch * crlcache.c (crl_parse_insert): Renamed a few variables and changed diagnostic strings for clarity. (get_issuer_cert): Renamed to get_crlissuer_cert. Try to locate the certificate from the cache using the subject name. Use new fetch function. (get_crlissuer_cert_bysn): New. (crl_parse_insert): Use it here. * crlfetch.c (ca_cert_fetch): Changed interface. (fetch_next_ksba_cert): New. * ldap.c (run_ldap_wrapper): Add arg MULTI_MODE. Changed all callers. (start_default_fetch_ldap): New * certcache.c (get_cert_bysubject): New. (clean_cache_slot, put_cert): Store the subject DN if available. (MAX_EXTRA_CACHED_CERTS): Increase limit of cachable certificates to 1000. (find_cert_bysn): Loop until a certificate with a matching S/N has been found. * dirmngr.c (main): Add honor-http-proxy to the gpgconf list. 2005-01-31 Werner Koch * ldap.c: Started to work on support for userSMIMECertificates. * dirmngr.c (main): Make sure to always pass a server control structure to the caching functions. Reported by Neil Dunbar. 2005-01-05 Werner Koch * dirmngr-client.c (read_pem_certificate): Skip trailing percent escaped linefeeds. 2005-01-03 Werner Koch * dirmngr-client.c (read_pem_certificate): New. (read_certificate): Divert to it depending on pem option. (squid_loop_body): New. (main): New options --pem and --squid-mode. 2004-12-17 Werner Koch * dirmngr.c (launch_ripper_thread): Renamed to launch_reaper_thread. (shutdown_reaper): New. Use it for --server and --daemon. * ldap.c (ldap_wrapper_wait_connections): New. 2004-12-17 Werner Koch * Makefile.am (dirmngr_ldap_LDADD): Adjusted for new LDAP checks. 2004-12-16 Werner Koch * ldap.c (ldap_wrapper): Peek on the output to detect empty output early. 2004-12-15 Werner Koch * ldap.c (ldap_wrapper): Print a diagnostic after forking for the ldap wrapper. * certcache.h (find_cert_bysn): Add this prototype. * crlcache.c (start_sig_check): Write CRL hash debug file. (finish_sig_check): Dump the signer's certificate. (crl_parse_insert): Try to get the issuing cert by authKeyId. Moved certificate retrieval after item processing. 2004-12-13 Werner Koch * dirmngr_ldap.c (catch_alarm, set_timeout): new. (main): Install alarm handler. Add new option --only-search-timeout. (print_ldap_entries, fetch_ldap): Use set_timeout (); * dirmngr.h: Make LDAPTIMEOUT a simple unsigned int. Change all initializations. * ldap.c (start_cert_fetch_ldap, run_ldap_wrapper): Pass timeout option to the wrapper. (INACTIVITY_TIMEOUT): Depend on LDAPTIMEOUT. (run_ldap_wrapper): Add arg IGNORE_TIMEOUT. (ldap_wrapper_thread): Check for special timeout exit code. * dirmngr.c: Workaround a typo in gpgconf for ignore-ocsp-service-url. 2004-12-10 Werner Koch * ldap.c (url_fetch_ldap): Use TMP and not a HOST which is always NULL. * misc.c (host_and_port_from_url): Fixed bad encoding detection. 2004-12-03 Werner Koch * crlcache.c (crl_cache_load): Re-implement it. * dirmngr-client.c: New command --load-crl (do_loadcrl): New. * dirmngr.c (parse_rereadable_options, main): Make --allow-ocsp, --ocsp-responder, --ocsp-signer and --max-replies re-readable. * ocsp.c (check_signature): try to get the cert from the cache first. (ocsp_isvalid): Print the next and this update times on time conflict. * certcache.c (load_certs_from_dir): Print the fingerprint for trusted certificates. (get_cert_byhexfpr): New. * misc.c (get_fingerprint_hexstring_colon): New. 2004-12-01 Werner Koch * Makefile.am (dirmngr_LDADD): Don't use LDAP_LIBS. * validate.c (validate_cert_chain): Fixed test; as written in the comment we want to do this only in daemon mode. For clarity reworked by using a linked list of certificates and include root and tragte certificate. (check_revocations): Likewise. Introduced a recursion sentinel. 2004-11-30 Werner Koch * crlfetch.c (ca_cert_fetch, crl_fetch_default): Do not use the binary prefix as this will be handled in the driver. * dirmngr_ldap.c: New option --log-with-pid. (fetch_ldap): Handle LDAP_NO_SUCH_OBJECT. * ldap.c (run_ldap_wrapper, start_cert_fetch_ldap): Use new log option. 2004-11-25 Werner Koch * Makefile.am (dirmngr_ldap_CFLAGS): Added GPG_ERROR_CFLAGS. Noted by Bernhard Herzog. 2004-11-24 Werner Koch * ldap.c (ldap_wrapper): Fixed default name of the ldap wrapper. * b64enc.c (b64enc_start, b64enc_finish): Use standard strdup/free to manage memory. * dirmngr.c: New options --ignore-http-dp, --ignore-ldap-dp and --ignore-ocsp-service-url. * crlcache.c (crl_cache_reload_crl): Implement them. * ocsp.c (ocsp_isvalid): Ditto. 2004-11-23 Werner Koch * ldap.c (ldap_wrapper_thread, reader_callback, ldap_wrapper): Keep a timestamp and terminate the wrapper after some time of inactivity. * dirmngr-client.c (do_lookup): New. (main): New option --lookup. (data_cb): New. * b64enc.c: New. Taken from GnuPG 1.9. * no-libgcrypt.c (gcry_strdup): Added. * ocsp.c (ocsp_isvalid): New arg CERT and lookup the issuer certificate using the standard methods. * server.c (cmd_lookup): Truncation is now also an indication for error. (cmd_checkocsp): Implemented. * dirmngr_ldap.c (fetch_ldap): Write an error marker for a truncated search. * ldap.c (add_server_to_servers): Reactivated. (url_fetch_ldap): Call it here and try all configured servers in case of a a failed lookup. (fetch_next_cert_ldap): Detect the truncation error flag. * misc.c (host_and_port_from_url, remove_percent_escapes): New. 2004-11-22 Werner Koch * dirmngr_ldap.c (main): New option --proxy. * ocsp.c (do_ocsp_request): Take care of opt.disable_http. * crlfetch.c (crl_fetch): Honor the --honor-http-proxy variable. (crl_fetch): Take care of opt.disable_http and disable_ldap. (crl_fetch_default, ca_cert_fetch, start_cert_fetch): * ldap.c (run_ldap_wrapper): New arg PROXY. (url_fetch_ldap, attr_fetch_ldap, start_cert_fetch_ldap): Pass it. * http.c (http_open_document): Add arg PROXY. (http_open): Ditto. (send_request): Ditto and implement it as an override. * ocsp.c (validate_responder_cert): Use validate_cert_chain. * Makefile.am (AM_CPPFLAGS): Add macros for a few system directories. * dirmngr.h (opt): New members homedir_data, homedir_cache, ldap_wrapper_program, system_daemon, honor_http_proxy, http_proxy, ldap_proxy, only_ldap_proxy, disable_ldap, disable_http. * dirmngr.c (main): Initialize new opt members HOMEDIR_DATA and HOMEDIR_CACHE. (parse_rereadable_options): New options --ldap-wrapper-program, --http-wrapper-program, --disable-ldap, --disable-http, --honor-http-proxy, --http-proxy, --ldap-proxy, --only-ldap-proxy. (reread_configuration): New. * ldap.c (ldap_wrapper): Use the correct name for the wrapper. * crlcache.c (DBDIR_D): Make it depend on opt.SYSTEM_DAEMON. (cleanup_cache_dir, open_dir, update_dir, make_db_file_name) (crl_cache_insert, create_directory_if_needed): Use opt.HOMEDIR_CACHE * validate.c (check_revocations): New. * crlcache.c (crl_cache_isvalid): Factored most code out to (cache_isvalid): .. new. (crl_cache_cert_isvalid): New. * server.c (cmd_checkcrl): Cleaned up by using this new function. (reload_crl): Moved to .. * crlcache.c (crl_cache_reload_crl): .. here and made global. * certcache.c (cert_compute_fpr): Renamed from computer_fpr and made global. (find_cert_bysn): Try to lookup missing certs. (cert_cache_init): Intialize using opt.HOMEDIR_DATA. 2004-11-19 Werner Koch * dirmngr-client.c (status_cb): New. Use it in very verbose mode. * server.c (start_command_handler): Malloc the control structure and properly release it. Removed the primary_connection hack. Cleanup running wrappers. (dirmngr_status): Return an error code. (dirmngr_tick): Return an error code and detect a cancellation. Use wall time and not CPU time. * validate.c (validate_cert_chain): Add CTRL arg and changed callers. * crlcache.c (crl_cache_isvalid): * crlfetch.c (ca_cert_fetch, start_cert_fetch, crl_fetch_default) (crl_fetch): Ditto. * ldap.c (ldap_wrapper, run_ldap_wrapper, url_fetch_ldap) (attr_fetch_ldap, start_cert_fetch_ldap): Ditto. (ldap_wrapper_release_context): Reset the stored CTRL. (reader_callback): Periodically call dirmngr_tick. (ldap_wrapper_release_context): Print an error message for read errors. (ldap_wrapper_connection_cleanup): New. 2004-11-18 Werner Koch * dirmngr.c (main): Do not cd / if not running detached. * dirmngr-client.c: New options --cache-cert and --validate. (do_cache, do_validate): New. * server.c (cmd_cachecert, cmd_validate): New. * crlcache.c (get_issuer_cert): Make use of the certificate cache. (crl_parse_insert): Validate the issuer certificate. * dirmngr.c (handle_signal): Reinitialize the certificate cache on a HUP. (struct opts): Add --homedir to enable the already implemented code. (handle_signal): Print stats on SIGUSR1. * certcache.c (clean_cache_slot, cert_cache_init) (cert_cache_deinit): New. (acquire_cache_read_lock, acquire_cache_write_lock) (release_cache_lock): New. Use them where needed. (put_cert): Renamed from put_loaded_cert. (cache_cert): New. (cert_cache_print_stats): New. (compare_serialno): Fixed. 2004-11-16 Werner Koch * Makefile.am (AM_CPPFLAGS): Define DIRMNGR_SYSCONFDIR and DIRMNGR_LIBEXECDIR. * misc.c (dump_isotime, dump_string, dump_cert): New. Taken from gnupg 1.9. (dump_serial): New. 2004-11-15 Werner Koch * validate.c: New. Based on gnupg's certchain.c * ldap.c (get_cert_ldap): Removed. (read_buffer): New. (start_cert_fetch_ldap, fetch_next_cert_ldap) (end_cert_fetch_ldap): Rewritten to make use of the ldap wrapper. 2004-11-12 Werner Koch * http.c (insert_escapes): Print the percent sign too. * dirmngr-client.c (inq_cert): Ignore "SENDCERT" and "SENDISSUERCERT". * server.c (do_get_cert_local): Limit the length of a retruned certificate. Return NULL without an error if an empry value has been received. * crlfetch.c (ca_cert_fetch): Use the ksba_reader_object. (setup_funopen, fun_reader, fun_closer): Removed. * crlcache.c (get_issuer_cert): Adjust accordingly. * ldap.c (attr_fetch_ldap_internal, attr_fetch_fun_closer) (attr_fetch_fun_reader, url_fetch_ldap_internal) (get_attr_from_result_ldap): Removed. (destroy_wrapper, print_log_line, ldap_wrapper_thread) (ldap_wrapper_release_context, reader_callback, ldap_wrapper) (run_ldap_wrapper): New. (url_fetch_ldap): Make use of the new ldap wrapper and return a ksba reader object instead of a stdio stream. (attr_fetch_ldap): Ditto. (make_url, escape4url): New. 2004-11-11 Werner Koch * dirmngr.c (launch_ripper_thread): New. (main): Start it wheere appropriate. Always ignore SIGPIPE. (start_connection_thread): Maintain a connection count. (handle_signal, handle_connections): Use it here instead of the thread count. * crlcache.c (crl_cache_insert): Changed to use ksba reader object. Changed all callers to pass this argument. 2004-11-08 Werner Koch * dirmngr_ldap.c: New. * crlcache.c (crl_cache_init): Don't return a cache object but keep it module local. We only need one. (crl_cache_deinit): Don't take cache object but work on existing one. (get_current_cache): New. (crl_cache_insert, crl_cache_list, crl_cache_load): Use the global cache object and removed the cache arg. Changed all callers. * dirmngr-client.c: New option --ping. * dirmngr.c (main): New option --daemon. Initialize PTH. (handle_connections, start_connection_thread): New. (handle_signal): New. (parse_rereadable_options): New. Changed main to make use of it. (set_debug): Don't bail out on invalid debug levels. (main): Init the crl_chache for server and daemon mode. * server.c (start_command_handler): New arg FD. Changed callers. 2004-11-06 Werner Koch * server.c (map_assuan_err): Factored out to .. * maperror.c: .. new file. * util.h: Add prototype 2004-11-05 Werner Koch * no-libgcrypt.c: New, used as helper for dirmngr-client which does not need libgcrypt proper but jnlib references the memory functions. Taken from gnupg 1.9.12. * dirmngr.h: Factored i18n and xmalloc code out to .. * i18n.h, util.h: .. New. * dirmngr-client.c: New. Some code taken from gnupg 1.9.12. * Makefile.am (bin_PROGRAMS) Add dirmngr-client. 2004-11-04 Werner Koch * src/server.c (get_fingerprint_from_line, cmd_checkcrl) (cmd_checkocsp): New. (register_commands): Register new commands. (inquire_cert_and_load_crl): Factored most code out to .. (reload_crl): .. new function. * src/certcache.h, src/certcache.c: New. * src/Makefile.am (dirmngr_SOURCES): Add new files. 2004-11-04 Werner Koch Please note that earlier entries are found in the top level ChangeLog. Copyright 2004, 2005, 2006 g10 Code GmbH This file is free software; as a special exception the author gives unlimited permission to copy and/or distribute it, with or without modifications, as long as this notice is preserved. This file is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY, to the extent permitted by law; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.