1 /* gpgconf-comp.c - Configuration utility for GnuPG.
2 * Copyright (C) 2004, 2007-2011 Free Software Foundation, Inc.
3 * Copyright (C) 2016 Werner Koch
5 * This file is part of GnuPG.
7 * GnuPG is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
12 * GnuPG is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with GnuPG; if not, see <https://www.gnu.org/licenses/>.
29 #include <sys/types.h>
38 #ifdef HAVE_W32_SYSTEM
39 # define WIN32_LEAN_AND_MEAN 1
46 /* For log_logv(), asctimestamp(), gnupg_get_time (). */
51 #include "gc-opt-flags.h"
54 /* There is a problem with gpg 1.4 under Windows: --gpgconf-list
55 returns a plain filename without escaping. As long as we have not
56 fixed that we need to use gpg2. */
57 #if defined(HAVE_W32_SYSTEM) && !defined(HAVE_W32CE_SYSTEM)
58 #define GPGNAME "gpg2"
60 #define GPGNAME GPG_NAME
65 Components: Add more components and their options.
66 Robustness: Do more validation. Call programs to do validation for us.
67 Add options to change backend binary path.
68 Extract binary path for some backends from gpgsm/gpg config.
72 #if (__GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 5 ))
73 void gc_error (int status, int errnum, const char *fmt, ...) \
74 __attribute__ ((format (printf, 3, 4)));
77 /* Output a diagnostic message. If ERRNUM is not 0, then the output
78 is followed by a colon, a white space, and the error string for the
79 error number ERRNUM. In any case the output is finished by a
80 newline. The message is prepended by the program name, a colon,
81 and a whitespace. The output may be further formatted or
82 redirected by the jnlib logging facility. */
84 gc_error (int status, int errnum, const char *fmt, ...)
88 va_start (arg_ptr, fmt);
89 log_logv (GPGRT_LOG_ERROR, fmt, arg_ptr);
93 log_printf (": %s\n", strerror (errnum));
100 log_printf ("fatal error (exit status %i)\n", status);
106 /* Forward declaration. */
107 static void gpg_agent_runtime_change (int killflag);
108 static void scdaemon_runtime_change (int killflag);
109 static void dirmngr_runtime_change (int killflag);
111 /* Backend configuration. Backends are used to decide how the default
112 and current value of an option can be determined, and how the
113 option can be changed. To every option in every component belongs
114 exactly one backend that controls and determines the option. Some
115 backends are programs from the GPG system. Others might be
116 implemented by GPGConf itself. If you change this enum, don't
117 forget to update GC_BACKEND below. */
120 /* Any backend, used for find_option (). */
123 /* The Gnu Privacy Guard. */
126 /* The Gnu Privacy Guard for S/MIME. */
130 GC_BACKEND_GPG_AGENT,
132 /* The GnuPG SCDaemon. */
135 /* The GnuPG directory manager. */
138 /* The LDAP server list file for the director manager. */
139 GC_BACKEND_DIRMNGR_LDAP_SERVER_LIST,
141 /* The Pinentry (not a part of GnuPG, proper). */
144 /* The number of the above entries. */
149 /* To be able to implement generic algorithms for the various
150 backends, we collect all information about them in this struct. */
153 /* The name of the backend. */
156 /* The name of the program that acts as the backend. Some backends
157 don't have an associated program, but are implemented directly by
158 GPGConf. In this case, PROGRAM is NULL. */
161 /* The module name (GNUPG_MODULE_NAME_foo) as defined by
162 ../common/util.h. This value is used to get the actual installed
163 path of the program. 0 is used if no backend program is
167 /* The runtime change callback. If KILLFLAG is true the component
168 is killed and not just reloaded. */
169 void (*runtime_change) (int killflag);
171 /* The option name for the configuration filename of this backend.
172 This must be an absolute filename. It can be an option from a
173 different backend (but then ordering of the options might
174 matter). Note: This must be unique among all components. */
175 const char *option_config_filename;
177 /* If this is a file backend rather than a program backend, then
178 this is the name of the option associated with the file. */
179 const char *option_name;
180 } gc_backend[GC_BACKEND_NR] =
182 { NULL }, /* GC_BACKEND_ANY dummy entry. */
183 { GPG_DISP_NAME, GPGNAME, GNUPG_MODULE_NAME_GPG,
184 NULL, GPGCONF_NAME "-" GPG_NAME ".conf" },
185 { GPGSM_DISP_NAME, GPGSM_NAME, GNUPG_MODULE_NAME_GPGSM,
186 NULL, GPGCONF_NAME "-" GPGSM_NAME ".conf" },
187 { GPG_AGENT_DISP_NAME, GPG_AGENT_NAME, GNUPG_MODULE_NAME_AGENT,
188 gpg_agent_runtime_change, GPGCONF_NAME"-" GPG_AGENT_NAME ".conf" },
189 { SCDAEMON_DISP_NAME, SCDAEMON_NAME, GNUPG_MODULE_NAME_SCDAEMON,
190 scdaemon_runtime_change, GPGCONF_NAME"-" SCDAEMON_NAME ".conf" },
191 { DIRMNGR_DISP_NAME, DIRMNGR_NAME, GNUPG_MODULE_NAME_DIRMNGR,
192 dirmngr_runtime_change, GPGCONF_NAME "-" DIRMNGR_NAME ".conf" },
193 { DIRMNGR_DISP_NAME " LDAP Server List", NULL, 0,
194 NULL, "ldapserverlist-file", "LDAP Server" },
195 { "Pinentry", "pinentry", GNUPG_MODULE_NAME_PINENTRY,
196 NULL, GPGCONF_NAME "-pinentry.conf" },
200 /* Option configuration. */
202 /* An option might take an argument, or not. Argument types can be
203 basic or complex. Basic types are generic and easy to validate.
204 Complex types provide more specific information about the intended
205 use, but can be difficult to validate. If you add to this enum,
206 don't forget to update GC_ARG_TYPE below. YOU MUST NOT CHANGE THE
207 NUMBERS OF THE EXISTING ENTRIES, AS THEY ARE PART OF THE EXTERNAL
211 /* Basic argument types. */
214 GC_ARG_TYPE_NONE = 0,
216 /* A String argument. */
217 GC_ARG_TYPE_STRING = 1,
219 /* A signed integer argument. */
220 GC_ARG_TYPE_INT32 = 2,
222 /* An unsigned integer argument. */
223 GC_ARG_TYPE_UINT32 = 3,
225 /* ADD NEW BASIC TYPE ENTRIES HERE. */
227 /* Complex argument types. */
229 /* A complete filename. */
230 GC_ARG_TYPE_FILENAME = 32,
232 /* An LDAP server in the format
233 HOSTNAME:PORT:USERNAME:PASSWORD:BASE_DN. */
234 GC_ARG_TYPE_LDAP_SERVER = 33,
236 /* A 40 character fingerprint. */
237 GC_ARG_TYPE_KEY_FPR = 34,
239 /* A user ID or key ID or fingerprint for a certificate. */
240 GC_ARG_TYPE_PUB_KEY = 35,
242 /* A user ID or key ID or fingerprint for a certificate with a key. */
243 GC_ARG_TYPE_SEC_KEY = 36,
245 /* A alias list made up of a key, an equal sign and a space
246 separated list of values. */
247 GC_ARG_TYPE_ALIAS_LIST = 37,
249 /* ADD NEW COMPLEX TYPE ENTRIES HERE. */
251 /* The number of the above entries. */
256 /* For every argument, we record some information about it in the
260 /* For every argument type exists a basic argument type that can be
261 used as a fallback for input and validation purposes. */
262 gc_arg_type_t fallback;
264 /* Human-readable name of the type. */
266 } gc_arg_type[GC_ARG_TYPE_NR] =
268 /* The basic argument types have their own types as fallback. */
269 { GC_ARG_TYPE_NONE, "none" },
270 { GC_ARG_TYPE_STRING, "string" },
271 { GC_ARG_TYPE_INT32, "int32" },
272 { GC_ARG_TYPE_UINT32, "uint32" },
274 /* Reserved basic type entries for future extension. */
275 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
276 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
277 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
278 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
279 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
280 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
281 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
282 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
283 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
284 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
285 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
286 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
287 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
288 { GC_ARG_TYPE_NR, NULL }, { GC_ARG_TYPE_NR, NULL },
290 /* The complex argument types have a basic type as fallback. */
291 { GC_ARG_TYPE_STRING, "filename" },
292 { GC_ARG_TYPE_STRING, "ldap server" },
293 { GC_ARG_TYPE_STRING, "key fpr" },
294 { GC_ARG_TYPE_STRING, "pub key" },
295 { GC_ARG_TYPE_STRING, "sec key" },
296 { GC_ARG_TYPE_STRING, "alias list" },
300 /* Every option has an associated expert level, than can be used to
301 hide advanced and expert options from beginners. If you add to
302 this list, don't forget to update GC_LEVEL below. YOU MUST NOT
303 CHANGE THE NUMBERS OF THE EXISTING ENTRIES, AS THEY ARE PART OF THE
304 EXTERNAL INTERFACE. */
307 /* The basic options should always be displayed. */
310 /* The advanced options may be hidden from beginners. */
313 /* The expert options should only be displayed to experts. */
316 /* The invisible options should normally never be displayed. */
319 /* The internal options are never exported, they mark options that
320 are recorded for internal use only. */
323 /* ADD NEW ENTRIES HERE. */
325 /* The number of the above entries. */
329 /* A description for each expert level. */
343 /* Option flags. The flags which are used by the backends are defined
344 by gc-opt-flags.h, included above.
346 YOU MUST NOT CHANGE THE NUMBERS OF THE EXISTING FLAGS, AS THEY ARE
347 PART OF THE EXTERNAL INTERFACE. */
349 /* Some entries in the option list are not options, but mark the
350 beginning of a new group of options. These entries have the GROUP
352 #define GC_OPT_FLAG_GROUP (1UL << 0)
353 /* The ARG_OPT flag for an option indicates that the argument is
354 optional. This is never set for GC_ARG_TYPE_NONE options. */
355 #define GC_OPT_FLAG_ARG_OPT (1UL << 1)
356 /* The LIST flag for an option indicates that the option can occur
357 several times. A comma separated list of arguments is used as the
359 #define GC_OPT_FLAG_LIST (1UL << 2)
362 /* A human-readable description for each flag. */
379 /* To each option, or group marker, the information in the GC_OPTION
380 struct is provided. If you change this, don't forget to update the
381 option list of each component. */
384 /* If this is NULL, then this is a terminator in an array of unknown
385 length. Otherwise, if this entry is a group marker (see FLAGS),
386 then this is the name of the group described by this entry.
387 Otherwise it is the name of the option described by this
388 entry. The name must not contain a colon. */
391 /* The option flags. If the GROUP flag is set, then this entry is a
392 group marker, not an option, and only the fields LEVEL,
393 DESC_DOMAIN and DESC are valid. In all other cases, this entry
394 describes a new option and all fields are valid. */
397 /* The expert level. This field is valid for options and groups. A
398 group has the expert level of the lowest-level option in the
400 gc_expert_level_t level;
402 /* A gettext domain in which the following description can be found.
403 If this is NULL, then DESC is not translated. Valid for groups
406 Note that we try to keep the description of groups within the
409 IMPORTANT: If you add a new domain please make sure to add a code
410 set switching call to the function my_dgettext further below. */
411 const char *desc_domain;
413 /* A gettext description for this group or option. If it starts
414 with a '|', then the string up to the next '|' describes the
415 argument, and the description follows the second '|'.
417 In general enclosing these description in N_() is not required
418 because the description should be identical to the one in the
419 help menu of the respective program. */
422 /* The following fields are only valid for options. */
424 /* The type of the option argument. */
425 gc_arg_type_t arg_type;
427 /* The backend that implements this option. */
428 gc_backend_t backend;
430 /* The following fields are set to NULL at startup (because all
431 option's are declared as static variables). They are at the end
432 of the list so that they can be omitted from the option
435 /* This is true if the option is supported by this version of the
439 /* The default value for this option. This is NULL if the option is
440 not present in the backend, the empty string if no default is
441 available, and otherwise a quoted string. */
444 /* The default argument is only valid if the "optional arg" flag is
445 set, and specifies the default argument (value) that is used if
446 the argument is omitted. */
449 /* The current value of this option. */
452 /* The new flags for this option. The only defined flag is actually
453 GC_OPT_FLAG_DEFAULT, and it means that the option should be
454 deleted. In this case, NEW_VALUE is NULL. */
455 unsigned long new_flags;
457 /* The new value of this option. */
460 typedef struct gc_option gc_option_t;
462 /* Use this macro to terminate an option list. */
463 #define GC_OPTION_NULL { NULL }
466 #ifndef BUILD_WITH_AGENT
467 #define gc_options_gpg_agent NULL
469 /* The options of the GC_COMPONENT_GPG_AGENT component. */
470 static gc_option_t gc_options_gpg_agent[] =
472 /* The configuration file to which we write the changes. */
473 { GPGCONF_NAME"-" GPG_AGENT_NAME ".conf",
474 GC_OPT_FLAG_NONE, GC_LEVEL_INTERNAL,
475 NULL, NULL, GC_ARG_TYPE_FILENAME, GC_BACKEND_GPG_AGENT },
478 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
479 "gnupg", N_("Options controlling the diagnostic output") },
480 { "verbose", GC_OPT_FLAG_LIST|GC_OPT_FLAG_RUNTIME, GC_LEVEL_BASIC,
482 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
483 { "quiet", GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME, GC_LEVEL_BASIC,
484 "gnupg", "be somewhat more quiet",
485 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
486 { "no-greeting", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
488 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
491 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
492 "gnupg", N_("Options controlling the configuration") },
493 { "options", GC_OPT_FLAG_NONE, GC_LEVEL_EXPERT,
494 "gnupg", "|FILE|read options from FILE",
495 GC_ARG_TYPE_FILENAME, GC_BACKEND_GPG_AGENT },
496 { "disable-scdaemon", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
497 "gnupg", "do not use the SCdaemon",
498 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
499 { "enable-ssh-support", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
500 "gnupg", "enable ssh support",
501 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
502 { "enable-putty-support", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
503 "gnupg", "enable putty support",
504 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
507 GC_OPT_FLAG_GROUP, GC_LEVEL_ADVANCED,
508 "gnupg", N_("Options useful for debugging") },
509 { "debug-level", GC_OPT_FLAG_ARG_OPT|GC_OPT_FLAG_RUNTIME, GC_LEVEL_ADVANCED,
510 "gnupg", "|LEVEL|set the debugging level to LEVEL",
511 GC_ARG_TYPE_STRING, GC_BACKEND_GPG_AGENT },
512 { "log-file", GC_OPT_FLAG_RUNTIME, GC_LEVEL_ADVANCED,
513 "gnupg", N_("|FILE|write server mode logs to FILE"),
514 GC_ARG_TYPE_FILENAME, GC_BACKEND_GPG_AGENT },
515 { "faked-system-time", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
517 GC_ARG_TYPE_UINT32, GC_BACKEND_GPG_AGENT },
520 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
521 "gnupg", N_("Options controlling the security") },
522 { "default-cache-ttl", GC_OPT_FLAG_RUNTIME,
523 GC_LEVEL_BASIC, "gnupg",
524 "|N|expire cached PINs after N seconds",
525 GC_ARG_TYPE_UINT32, GC_BACKEND_GPG_AGENT },
526 { "default-cache-ttl-ssh", GC_OPT_FLAG_RUNTIME,
527 GC_LEVEL_ADVANCED, "gnupg",
528 N_("|N|expire SSH keys after N seconds"),
529 GC_ARG_TYPE_UINT32, GC_BACKEND_GPG_AGENT },
530 { "max-cache-ttl", GC_OPT_FLAG_RUNTIME,
531 GC_LEVEL_EXPERT, "gnupg",
532 N_("|N|set maximum PIN cache lifetime to N seconds"),
533 GC_ARG_TYPE_UINT32, GC_BACKEND_GPG_AGENT },
534 { "max-cache-ttl-ssh", GC_OPT_FLAG_RUNTIME,
535 GC_LEVEL_EXPERT, "gnupg",
536 N_("|N|set maximum SSH key lifetime to N seconds"),
537 GC_ARG_TYPE_UINT32, GC_BACKEND_GPG_AGENT },
538 { "ignore-cache-for-signing", GC_OPT_FLAG_RUNTIME,
539 GC_LEVEL_BASIC, "gnupg", "do not use the PIN cache when signing",
540 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
541 { "allow-emacs-pinentry", GC_OPT_FLAG_RUNTIME,
543 "gnupg", "allow passphrase to be prompted through Emacs",
544 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
545 { "no-allow-external-cache", GC_OPT_FLAG_RUNTIME,
546 GC_LEVEL_BASIC, "gnupg", "disallow the use of an external password cache",
547 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
548 { "no-allow-mark-trusted", GC_OPT_FLAG_RUNTIME,
549 GC_LEVEL_ADVANCED, "gnupg", "disallow clients to mark keys as \"trusted\"",
550 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
551 { "no-allow-loopback-pinentry", GC_OPT_FLAG_RUNTIME,
552 GC_LEVEL_EXPERT, "gnupg", "disallow caller to override the pinentry",
553 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
554 { "no-grab", GC_OPT_FLAG_RUNTIME, GC_LEVEL_EXPERT,
555 "gnupg", "do not grab keyboard and mouse",
556 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
558 { "Passphrase policy",
559 GC_OPT_FLAG_GROUP, GC_LEVEL_ADVANCED,
560 "gnupg", N_("Options enforcing a passphrase policy") },
561 { "enforce-passphrase-constraints", GC_OPT_FLAG_RUNTIME,
562 GC_LEVEL_EXPERT, "gnupg",
563 N_("do not allow bypassing the passphrase policy"),
564 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
565 { "min-passphrase-len", GC_OPT_FLAG_RUNTIME,
566 GC_LEVEL_ADVANCED, "gnupg",
567 N_("|N|set minimal required length for new passphrases to N"),
568 GC_ARG_TYPE_UINT32, GC_BACKEND_GPG_AGENT },
569 { "min-passphrase-nonalpha", GC_OPT_FLAG_RUNTIME,
570 GC_LEVEL_EXPERT, "gnupg",
571 N_("|N|require at least N non-alpha characters for a new passphrase"),
572 GC_ARG_TYPE_UINT32, GC_BACKEND_GPG_AGENT },
573 { "check-passphrase-pattern", GC_OPT_FLAG_RUNTIME,
575 "gnupg", N_("|FILE|check new passphrases against pattern in FILE"),
576 GC_ARG_TYPE_FILENAME, GC_BACKEND_GPG_AGENT },
577 { "max-passphrase-days", GC_OPT_FLAG_RUNTIME,
578 GC_LEVEL_EXPERT, "gnupg",
579 N_("|N|expire the passphrase after N days"),
580 GC_ARG_TYPE_UINT32, GC_BACKEND_GPG_AGENT },
581 { "enable-passphrase-history", GC_OPT_FLAG_RUNTIME,
582 GC_LEVEL_EXPERT, "gnupg",
583 N_("do not allow the reuse of old passphrases"),
584 GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT },
585 { "pinentry-timeout", GC_OPT_FLAG_RUNTIME,
586 GC_LEVEL_ADVANCED, "gnupg",
587 N_("|N|set the Pinentry timeout to N seconds"),
588 GC_ARG_TYPE_UINT32, GC_BACKEND_GPG_AGENT },
592 #endif /*BUILD_WITH_AGENT*/
595 #ifndef BUILD_WITH_SCDAEMON
596 #define gc_options_scdaemon NULL
598 /* The options of the GC_COMPONENT_SCDAEMON component. */
599 static gc_option_t gc_options_scdaemon[] =
601 /* The configuration file to which we write the changes. */
602 { GPGCONF_NAME"-"SCDAEMON_NAME".conf",
603 GC_OPT_FLAG_NONE, GC_LEVEL_INTERNAL,
604 NULL, NULL, GC_ARG_TYPE_FILENAME, GC_BACKEND_SCDAEMON },
607 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
608 "gnupg", N_("Options controlling the diagnostic output") },
609 { "verbose", GC_OPT_FLAG_LIST|GC_OPT_FLAG_RUNTIME, GC_LEVEL_BASIC,
611 GC_ARG_TYPE_NONE, GC_BACKEND_SCDAEMON },
612 { "quiet", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
613 "gnupg", "be somewhat more quiet",
614 GC_ARG_TYPE_NONE, GC_BACKEND_SCDAEMON },
615 { "no-greeting", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
617 GC_ARG_TYPE_NONE, GC_BACKEND_SCDAEMON },
620 GC_OPT_FLAG_GROUP, GC_LEVEL_EXPERT,
621 "gnupg", N_("Options controlling the configuration") },
622 { "options", GC_OPT_FLAG_NONE, GC_LEVEL_EXPERT,
623 "gnupg", "|FILE|read options from FILE",
624 GC_ARG_TYPE_FILENAME, GC_BACKEND_SCDAEMON },
625 { "reader-port", GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME, GC_LEVEL_BASIC,
626 "gnupg", "|N|connect to reader at port N",
627 GC_ARG_TYPE_STRING, GC_BACKEND_SCDAEMON },
628 { "ctapi-driver", GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME, GC_LEVEL_ADVANCED,
629 "gnupg", "|NAME|use NAME as ct-API driver",
630 GC_ARG_TYPE_STRING, GC_BACKEND_SCDAEMON },
631 { "pcsc-driver", GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME, GC_LEVEL_ADVANCED,
632 "gnupg", "|NAME|use NAME as PC/SC driver",
633 GC_ARG_TYPE_STRING, GC_BACKEND_SCDAEMON },
634 { "disable-ccid", GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME, GC_LEVEL_EXPERT,
635 "gnupg", "do not use the internal CCID driver",
636 GC_ARG_TYPE_NONE, GC_BACKEND_SCDAEMON },
637 { "disable-pinpad", GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME, GC_LEVEL_BASIC,
638 "gnupg", "do not use a reader's pinpad",
639 GC_ARG_TYPE_NONE, GC_BACKEND_SCDAEMON },
640 { "enable-pinpad-varlen",
641 GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME, GC_LEVEL_BASIC,
642 "gnupg", "use variable length input for pinpad",
643 GC_ARG_TYPE_NONE, GC_BACKEND_SCDAEMON },
644 { "card-timeout", GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME, GC_LEVEL_BASIC,
645 "gnupg", "|N|disconnect the card after N seconds of inactivity",
646 GC_ARG_TYPE_UINT32, GC_BACKEND_SCDAEMON },
649 GC_OPT_FLAG_GROUP, GC_LEVEL_ADVANCED,
650 "gnupg", N_("Options useful for debugging") },
651 { "debug-level", GC_OPT_FLAG_ARG_OPT|GC_OPT_FLAG_RUNTIME, GC_LEVEL_ADVANCED,
652 "gnupg", "|LEVEL|set the debugging level to LEVEL",
653 GC_ARG_TYPE_STRING, GC_BACKEND_SCDAEMON },
654 { "log-file", GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME, GC_LEVEL_ADVANCED,
655 "gnupg", N_("|FILE|write a log to FILE"),
656 GC_ARG_TYPE_FILENAME, GC_BACKEND_SCDAEMON },
659 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
660 "gnupg", N_("Options controlling the security") },
661 { "deny-admin", GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME, GC_LEVEL_BASIC,
662 "gnupg", "deny the use of admin card commands",
663 GC_ARG_TYPE_NONE, GC_BACKEND_SCDAEMON },
668 #endif /*BUILD_WITH_SCDAEMON*/
670 #ifndef BUILD_WITH_GPG
671 #define gc_options_gpg NULL
673 /* The options of the GC_COMPONENT_GPG component. */
674 static gc_option_t gc_options_gpg[] =
676 /* The configuration file to which we write the changes. */
677 { GPGCONF_NAME"-"GPG_NAME".conf",
678 GC_OPT_FLAG_NONE, GC_LEVEL_INTERNAL,
679 NULL, NULL, GC_ARG_TYPE_FILENAME, GC_BACKEND_GPG },
682 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
683 "gnupg", N_("Options controlling the diagnostic output") },
684 { "verbose", GC_OPT_FLAG_LIST, GC_LEVEL_BASIC,
686 GC_ARG_TYPE_NONE, GC_BACKEND_GPG },
687 { "quiet", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
688 "gnupg", "be somewhat more quiet",
689 GC_ARG_TYPE_NONE, GC_BACKEND_GPG },
690 { "no-greeting", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
692 GC_ARG_TYPE_NONE, GC_BACKEND_GPG },
695 GC_OPT_FLAG_GROUP, GC_LEVEL_EXPERT,
696 "gnupg", N_("Options controlling the configuration") },
697 { "default-key", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
698 "gnupg", N_("|NAME|use NAME as default secret key"),
699 GC_ARG_TYPE_STRING, GC_BACKEND_GPG },
700 { "encrypt-to", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
701 "gnupg", N_("|NAME|encrypt to user ID NAME as well"),
702 GC_ARG_TYPE_STRING, GC_BACKEND_GPG },
703 { "group", GC_OPT_FLAG_LIST, GC_LEVEL_ADVANCED,
704 "gnupg", N_("|SPEC|set up email aliases"),
705 GC_ARG_TYPE_ALIAS_LIST, GC_BACKEND_GPG },
706 { "options", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
708 GC_ARG_TYPE_FILENAME, GC_BACKEND_GPG },
709 { "compliance", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
711 GC_ARG_TYPE_STRING, GC_BACKEND_GPG },
712 { "default-new-key-algo", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
714 GC_ARG_TYPE_STRING, GC_BACKEND_GPG },
715 { "default_pubkey_algo",
716 (GC_OPT_FLAG_ARG_OPT|GC_OPT_FLAG_NO_CHANGE), GC_LEVEL_INVISIBLE,
718 GC_ARG_TYPE_STRING, GC_BACKEND_GPG },
722 GC_OPT_FLAG_GROUP, GC_LEVEL_ADVANCED,
723 "gnupg", N_("Options useful for debugging") },
724 { "debug-level", GC_OPT_FLAG_ARG_OPT, GC_LEVEL_ADVANCED,
725 "gnupg", "|LEVEL|set the debugging level to LEVEL",
726 GC_ARG_TYPE_STRING, GC_BACKEND_GPG },
727 { "log-file", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
728 "gnupg", N_("|FILE|write server mode logs to FILE"),
729 GC_ARG_TYPE_FILENAME, GC_BACKEND_GPG },
730 /* { "faked-system-time", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE, */
732 /* GC_ARG_TYPE_UINT32, GC_BACKEND_GPG }, */
735 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
736 "gnupg", N_("Configuration for Keyservers") },
737 { "keyserver", GC_OPT_FLAG_NONE, GC_LEVEL_EXPERT,
738 "gnupg", N_("|URL|use keyserver at URL"), /* Deprecated - use dirmngr */
739 GC_ARG_TYPE_STRING, GC_BACKEND_GPG },
740 { "allow-pka-lookup", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
741 "gnupg", N_("allow PKA lookups (DNS requests)"),
742 GC_ARG_TYPE_NONE, GC_BACKEND_GPG },
743 { "auto-key-locate", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
744 "gnupg", N_("|MECHANISMS|use MECHANISMS to locate keys by mail address"),
745 GC_ARG_TYPE_STRING, GC_BACKEND_GPG },
750 #endif /*BUILD_WITH_GPG*/
753 #ifndef BUILD_WITH_GPGSM
754 #define gc_options_gpgsm NULL
756 /* The options of the GC_COMPONENT_GPGSM component. */
757 static gc_option_t gc_options_gpgsm[] =
759 /* The configuration file to which we write the changes. */
760 { GPGCONF_NAME"-"GPGSM_NAME".conf",
761 GC_OPT_FLAG_NONE, GC_LEVEL_INTERNAL,
762 NULL, NULL, GC_ARG_TYPE_FILENAME, GC_BACKEND_GPGSM },
765 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
766 "gnupg", N_("Options controlling the diagnostic output") },
767 { "verbose", GC_OPT_FLAG_LIST, GC_LEVEL_BASIC,
769 GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
770 { "quiet", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
771 "gnupg", "be somewhat more quiet",
772 GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
773 { "no-greeting", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
775 GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
778 GC_OPT_FLAG_GROUP, GC_LEVEL_EXPERT,
779 "gnupg", N_("Options controlling the configuration") },
780 { "default-key", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
781 "gnupg", N_("|NAME|use NAME as default secret key"),
782 GC_ARG_TYPE_STRING, GC_BACKEND_GPGSM },
783 { "encrypt-to", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
784 "gnupg", N_("|NAME|encrypt to user ID NAME as well"),
785 GC_ARG_TYPE_STRING, GC_BACKEND_GPGSM },
786 { "options", GC_OPT_FLAG_NONE, GC_LEVEL_EXPERT,
787 "gnupg", "|FILE|read options from FILE",
788 GC_ARG_TYPE_FILENAME, GC_BACKEND_GPGSM },
789 { "prefer-system-dirmngr", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
790 "gnupg", "use system's dirmngr if available",
791 GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
792 { "disable-dirmngr", GC_OPT_FLAG_NONE, GC_LEVEL_EXPERT,
793 "gnupg", N_("disable all access to the dirmngr"),
794 GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
795 { "p12-charset", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
796 "gnupg", N_("|NAME|use encoding NAME for PKCS#12 passphrases"),
797 GC_ARG_TYPE_STRING, GC_BACKEND_GPGSM },
798 { "keyserver", GC_OPT_FLAG_LIST, GC_LEVEL_BASIC,
799 "gnupg", N_("|SPEC|use this keyserver to lookup keys"),
800 GC_ARG_TYPE_LDAP_SERVER, GC_BACKEND_GPGSM },
801 { "default_pubkey_algo",
802 (GC_OPT_FLAG_ARG_OPT|GC_OPT_FLAG_NO_CHANGE), GC_LEVEL_INVISIBLE,
804 GC_ARG_TYPE_STRING, GC_BACKEND_GPGSM },
807 GC_OPT_FLAG_GROUP, GC_LEVEL_ADVANCED,
808 "gnupg", N_("Options useful for debugging") },
809 { "debug-level", GC_OPT_FLAG_ARG_OPT, GC_LEVEL_ADVANCED,
810 "gnupg", "|LEVEL|set the debugging level to LEVEL",
811 GC_ARG_TYPE_STRING, GC_BACKEND_GPGSM },
812 { "log-file", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
813 "gnupg", N_("|FILE|write server mode logs to FILE"),
814 GC_ARG_TYPE_FILENAME, GC_BACKEND_GPGSM },
815 { "faked-system-time", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
817 GC_ARG_TYPE_UINT32, GC_BACKEND_GPGSM },
820 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
821 "gnupg", N_("Options controlling the security") },
822 { "disable-crl-checks", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
823 "gnupg", "never consult a CRL",
824 GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
825 { "enable-crl-checks", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
827 GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
828 { "disable-trusted-cert-crl-check", GC_OPT_FLAG_NONE, GC_LEVEL_EXPERT,
829 "gnupg", N_("do not check CRLs for root certificates"),
830 GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
831 { "enable-ocsp", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
832 "gnupg", "check validity using OCSP",
833 GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
834 { "include-certs", GC_OPT_FLAG_NONE, GC_LEVEL_EXPERT,
835 "gnupg", "|N|number of certificates to include",
836 GC_ARG_TYPE_INT32, GC_BACKEND_GPGSM },
837 { "disable-policy-checks", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
838 "gnupg", "do not check certificate policies",
839 GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
840 { "auto-issuer-key-retrieve", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
841 "gnupg", "fetch missing issuer certificates",
842 GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
843 { "cipher-algo", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
844 "gnupg", "|NAME|use cipher algorithm NAME",
845 GC_ARG_TYPE_STRING, GC_BACKEND_GPGSM },
849 #endif /*BUILD_WITH_GPGSM*/
852 #ifndef BUILD_WITH_DIRMNGR
853 #define gc_options_dirmngr NULL
855 /* The options of the GC_COMPONENT_DIRMNGR component. */
856 static gc_option_t gc_options_dirmngr[] =
858 /* The configuration file to which we write the changes. */
859 { GPGCONF_NAME"-"DIRMNGR_NAME".conf",
860 GC_OPT_FLAG_NONE, GC_LEVEL_INTERNAL,
861 NULL, NULL, GC_ARG_TYPE_FILENAME, GC_BACKEND_DIRMNGR },
864 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
865 "gnupg", N_("Options controlling the diagnostic output") },
866 { "verbose", GC_OPT_FLAG_LIST, GC_LEVEL_BASIC,
867 "dirmngr", "verbose",
868 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
869 { "quiet", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
870 "dirmngr", "be somewhat more quiet",
871 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
872 { "no-greeting", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
874 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
877 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
878 "gnupg", N_("Options controlling the format of the output") },
879 { "sh", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
880 "dirmngr", "sh-style command output",
881 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
882 { "csh", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
883 "dirmngr", "csh-style command output",
884 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
887 GC_OPT_FLAG_GROUP, GC_LEVEL_EXPERT,
888 "gnupg", N_("Options controlling the configuration") },
889 { "options", GC_OPT_FLAG_NONE, GC_LEVEL_EXPERT,
890 "dirmngr", "|FILE|read options from FILE",
891 GC_ARG_TYPE_FILENAME, GC_BACKEND_DIRMNGR },
892 { "resolver-timeout", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
894 GC_ARG_TYPE_INT32, GC_BACKEND_DIRMNGR },
895 { "nameserver", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
897 GC_ARG_TYPE_STRING, GC_BACKEND_DIRMNGR },
900 GC_OPT_FLAG_GROUP, GC_LEVEL_ADVANCED,
901 "gnupg", N_("Options useful for debugging") },
902 { "debug-level", GC_OPT_FLAG_ARG_OPT, GC_LEVEL_ADVANCED,
903 "dirmngr", "|LEVEL|set the debugging level to LEVEL",
904 GC_ARG_TYPE_STRING, GC_BACKEND_DIRMNGR },
905 { "no-detach", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
906 "dirmngr", "do not detach from the console",
907 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
908 { "log-file", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
909 "dirmngr", N_("|FILE|write server mode logs to FILE"),
910 GC_ARG_TYPE_FILENAME, GC_BACKEND_DIRMNGR },
911 { "debug-wait", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
913 GC_ARG_TYPE_UINT32, GC_BACKEND_DIRMNGR },
914 { "faked-system-time", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
916 GC_ARG_TYPE_UINT32, GC_BACKEND_DIRMNGR },
919 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
920 "gnupg", N_("Options controlling the interactivity and enforcement") },
921 { "batch", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
922 "dirmngr", "run without asking a user",
923 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
924 { "force", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
925 "dirmngr", "force loading of outdated CRLs",
926 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
927 { "allow-version-check", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
928 "dirmngr", "allow online software version check",
929 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
932 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
933 "gnupg", N_("Options controlling the use of Tor") },
934 { "use-tor", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
935 "dirmngr", "route all network traffic via TOR",
936 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
939 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
940 "gnupg", N_("Configuration for Keyservers") },
941 { "keyserver", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
942 "gnupg", N_("|URL|use keyserver at URL"),
943 GC_ARG_TYPE_STRING, GC_BACKEND_DIRMNGR },
946 GC_OPT_FLAG_GROUP, GC_LEVEL_ADVANCED,
947 "gnupg", N_("Configuration for HTTP servers") },
948 { "disable-http", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
949 "dirmngr", "inhibit the use of HTTP",
950 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
951 { "ignore-http-dp", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
952 "dirmngr", "ignore HTTP CRL distribution points",
953 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
954 { "http-proxy", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
955 "dirmngr", "|URL|redirect all HTTP requests to URL",
956 GC_ARG_TYPE_STRING, GC_BACKEND_DIRMNGR },
957 { "honor-http-proxy", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
958 "gnupg", N_("use system's HTTP proxy setting"),
959 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
962 GC_OPT_FLAG_GROUP, GC_LEVEL_BASIC,
963 "gnupg", N_("Configuration of LDAP servers to use") },
964 { "disable-ldap", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
965 "dirmngr", "inhibit the use of LDAP",
966 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
967 { "ignore-ldap-dp", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
968 "dirmngr", "ignore LDAP CRL distribution points",
969 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
970 { "ldap-proxy", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
971 "dirmngr", "|HOST|use HOST for LDAP queries",
972 GC_ARG_TYPE_STRING, GC_BACKEND_DIRMNGR },
973 { "only-ldap-proxy", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
974 "dirmngr", "do not use fallback hosts with --ldap-proxy",
975 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
976 { "add-servers", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
977 "dirmngr", "add new servers discovered in CRL distribution points"
978 " to serverlist", GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
979 { "ldaptimeout", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
980 "dirmngr", "|N|set LDAP timeout to N seconds",
981 GC_ARG_TYPE_UINT32, GC_BACKEND_DIRMNGR },
982 /* The following entry must not be removed, as it is required for
983 the GC_BACKEND_DIRMNGR_LDAP_SERVER_LIST. */
984 { "ldapserverlist-file",
985 GC_OPT_FLAG_NONE, GC_LEVEL_INTERNAL,
986 "dirmngr", "|FILE|read LDAP server list from FILE",
987 GC_ARG_TYPE_FILENAME, GC_BACKEND_DIRMNGR },
988 /* This entry must come after at least one entry for
989 GC_BACKEND_DIRMNGR in this component, so that the entry for
990 "ldapserverlist-file will be initialized before this one. */
991 { "LDAP Server", GC_OPT_FLAG_ARG_OPT|GC_OPT_FLAG_LIST, GC_LEVEL_BASIC,
992 "gnupg", N_("LDAP server list"),
993 GC_ARG_TYPE_LDAP_SERVER, GC_BACKEND_DIRMNGR_LDAP_SERVER_LIST },
994 { "max-replies", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
995 "dirmngr", "|N|do not return more than N items in one query",
996 GC_ARG_TYPE_UINT32, GC_BACKEND_DIRMNGR },
999 GC_OPT_FLAG_GROUP, GC_LEVEL_ADVANCED,
1000 "gnupg", N_("Configuration for OCSP") },
1001 { "allow-ocsp", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
1002 "dirmngr", "allow sending OCSP requests",
1003 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
1004 { "ignore-ocsp-service-url", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
1005 "dirmngr", "ignore certificate contained OCSP service URLs",
1006 GC_ARG_TYPE_NONE, GC_BACKEND_DIRMNGR },
1007 { "ocsp-responder", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
1008 "dirmngr", "|URL|use OCSP responder at URL",
1009 GC_ARG_TYPE_STRING, GC_BACKEND_DIRMNGR },
1010 { "ocsp-signer", GC_OPT_FLAG_NONE, GC_LEVEL_ADVANCED,
1011 "dirmngr", "|FPR|OCSP response signed by FPR",
1012 GC_ARG_TYPE_STRING, GC_BACKEND_DIRMNGR },
1017 #endif /*BUILD_WITH_DIRMNGR*/
1020 /* The options of the GC_COMPONENT_PINENTRY component. */
1021 static gc_option_t gc_options_pinentry[] =
1023 /* A dummy option to allow gc_component_list_components to find the
1024 pinentry backend. Needs to be a conf file. */
1025 { GPGCONF_NAME"-pinentry.conf",
1026 GC_OPT_FLAG_NONE, GC_LEVEL_INTERNAL,
1027 NULL, NULL, GC_ARG_TYPE_FILENAME, GC_BACKEND_PINENTRY },
1034 /* Component system. Each component is a set of options that can be
1035 configured at the same time. If you change this, don't forget to
1036 update GC_COMPONENT below. */
1039 /* The classic GPG for OpenPGP. */
1042 /* The GPG Agent. */
1043 GC_COMPONENT_GPG_AGENT,
1045 /* The Smardcard Daemon. */
1046 GC_COMPONENT_SCDAEMON,
1048 /* GPG for S/MIME. */
1051 /* The LDAP Directory Manager for CRLs. */
1052 GC_COMPONENT_DIRMNGR,
1054 /* The external Pinentry. */
1055 GC_COMPONENT_PINENTRY,
1057 /* The number of components. */
1062 /* The information associated with each component. */
1065 /* The name of this component. Must not contain a colon (':')
1069 /* The gettext domain for the description DESC. If this is NULL,
1070 then the description is not translated. */
1071 const char *desc_domain;
1073 /* The description for this domain. */
1076 /* The list of options for this component, terminated by
1078 gc_option_t *options;
1081 { "gpg", "gnupg", N_("OpenPGP"), gc_options_gpg },
1082 { "gpg-agent","gnupg", N_("Private Keys"), gc_options_gpg_agent },
1083 { "scdaemon", "gnupg", N_("Smartcards"), gc_options_scdaemon },
1084 { "gpgsm", "gnupg", N_("S/MIME"), gc_options_gpgsm },
1085 { "dirmngr", "gnupg", N_("Network"), gc_options_dirmngr },
1086 { "pinentry", "gnupg", N_("Passphrase Entry"), gc_options_pinentry }
1091 /* Structure used to collect error output of the backend programs. */
1092 struct error_line_s;
1093 typedef struct error_line_s *error_line_t;
1096 error_line_t next; /* Link to next item. */
1097 const char *fname; /* Name of the config file (points into BUFFER). */
1098 unsigned int lineno; /* Line number of the config file. */
1099 const char *errtext; /* Text of the error message (points into BUFFER). */
1100 char buffer[1]; /* Helper buffer. */
1105 /* Engine specific support. */
1107 gpg_agent_runtime_change (int killflag)
1109 gpg_error_t err = 0;
1110 const char *pgmname;
1111 const char *argv[5];
1113 char *abs_homedir = NULL;
1116 pgmname = gnupg_module_name (GNUPG_MODULE_NAME_CONNECT_AGENT);
1117 if (!gnupg_default_homedir_p ())
1119 abs_homedir = make_absfilename_try (gnupg_homedir (), NULL);
1121 err = gpg_error_from_syserror ();
1123 argv[i++] = "--homedir";
1124 argv[i++] = abs_homedir;
1126 argv[i++] = "--no-autostart";
1127 argv[i++] = killflag? "KILLAGENT" : "RELOADAGENT";
1131 err = gnupg_spawn_process_fd (pgmname, argv, -1, -1, -1, &pid);
1133 err = gnupg_wait_process (pgmname, pid, 1, NULL);
1135 gc_error (0, 0, "error running '%s %s': %s",
1136 pgmname, argv[1], gpg_strerror (err));
1137 gnupg_release_process (pid);
1138 xfree (abs_homedir);
1143 scdaemon_runtime_change (int killflag)
1145 gpg_error_t err = 0;
1146 const char *pgmname;
1147 const char *argv[9];
1149 char *abs_homedir = NULL;
1152 (void)killflag; /* For scdaemon kill and reload are synonyms. */
1154 /* We use "GETINFO app_running" to see whether the agent is already
1155 running and kill it only in this case. This avoids an explicit
1156 starting of the agent in case it is not yet running. There is
1157 obviously a race condition but that should not harm too much. */
1159 pgmname = gnupg_module_name (GNUPG_MODULE_NAME_CONNECT_AGENT);
1160 if (!gnupg_default_homedir_p ())
1162 abs_homedir = make_absfilename_try (gnupg_homedir (), NULL);
1164 err = gpg_error_from_syserror ();
1166 argv[i++] = "--homedir";
1167 argv[i++] = abs_homedir;
1170 argv[i++] = "--no-autostart";
1171 argv[i++] = "GETINFO scd_running";
1172 argv[i++] = "/if ${! $?}";
1173 argv[i++] = "scd killscd";
1178 err = gnupg_spawn_process_fd (pgmname, argv, -1, -1, -1, &pid);
1180 err = gnupg_wait_process (pgmname, pid, 1, NULL);
1182 gc_error (0, 0, "error running '%s %s': %s",
1183 pgmname, argv[4], gpg_strerror (err));
1184 gnupg_release_process (pid);
1185 xfree (abs_homedir);
1190 dirmngr_runtime_change (int killflag)
1192 gpg_error_t err = 0;
1193 const char *pgmname;
1194 const char *argv[6];
1196 char *abs_homedir = NULL;
1198 pgmname = gnupg_module_name (GNUPG_MODULE_NAME_CONNECT_AGENT);
1199 argv[0] = "--no-autostart";
1200 argv[1] = "--dirmngr";
1201 argv[2] = killflag? "KILLDIRMNGR" : "RELOADDIRMNGR";
1202 if (gnupg_default_homedir_p ())
1206 abs_homedir = make_absfilename_try (gnupg_homedir (), NULL);
1208 err = gpg_error_from_syserror ();
1210 argv[3] = "--homedir";
1211 argv[4] = abs_homedir;
1216 err = gnupg_spawn_process_fd (pgmname, argv, -1, -1, -1, &pid);
1218 err = gnupg_wait_process (pgmname, pid, 1, NULL);
1220 gc_error (0, 0, "error running '%s %s': %s",
1221 pgmname, argv[2], gpg_strerror (err));
1222 gnupg_release_process (pid);
1223 xfree (abs_homedir);
1227 /* Launch the gpg-agent or the dirmngr if not already running. */
1229 gc_component_launch (int component)
1232 const char *pgmname;
1233 const char *argv[3];
1237 if (!(component == GC_COMPONENT_GPG_AGENT
1238 || component == GC_COMPONENT_DIRMNGR))
1240 es_fputs (_("Component not suitable for launching"), es_stderr);
1241 es_putc ('\n', es_stderr);
1245 pgmname = gnupg_module_name (GNUPG_MODULE_NAME_CONNECT_AGENT);
1247 if (component == GC_COMPONENT_DIRMNGR)
1248 argv[i++] = "--dirmngr";
1252 err = gnupg_spawn_process_fd (pgmname, argv, -1, -1, -1, &pid);
1254 err = gnupg_wait_process (pgmname, pid, 1, NULL);
1256 gc_error (0, 0, "error running '%s%s%s': %s",
1258 component == GC_COMPONENT_DIRMNGR? " --dirmngr":"",
1260 gpg_strerror (err));
1261 gnupg_release_process (pid);
1266 /* Unconditionally restart COMPONENT. */
1268 gc_component_kill (int component)
1270 int runtime[GC_BACKEND_NR];
1271 gc_option_t *option;
1272 gc_backend_t backend;
1274 /* Set a flag for the backends to be reloaded. */
1275 for (backend = 0; backend < GC_BACKEND_NR; backend++)
1276 runtime[backend] = 0;
1280 assert (component < GC_COMPONENT_NR);
1281 option = gc_component[component].options;
1282 for (; option && option->name; option++)
1283 runtime[option->backend] = 1;
1286 /* Do the restart for the selected backends. */
1287 for (backend = 0; backend < GC_BACKEND_NR; backend++)
1289 if (runtime[backend] && gc_backend[backend].runtime_change)
1290 (*gc_backend[backend].runtime_change) (1);
1295 /* Unconditionally reload COMPONENT or all components if COMPONENT is -1. */
1297 gc_component_reload (int component)
1299 int runtime[GC_BACKEND_NR];
1300 gc_option_t *option;
1301 gc_backend_t backend;
1303 /* Set a flag for the backends to be reloaded. */
1304 for (backend = 0; backend < GC_BACKEND_NR; backend++)
1305 runtime[backend] = 0;
1307 if (component == -1)
1309 for (component = 0; component < GC_COMPONENT_NR; component++)
1311 option = gc_component[component].options;
1312 for (; option && option->name; option++)
1313 runtime[option->backend] = 1;
1318 assert (component < GC_COMPONENT_NR);
1319 option = gc_component[component].options;
1320 for (; option && option->name; option++)
1321 runtime[option->backend] = 1;
1324 /* Do the reload for all selected backends. */
1325 for (backend = 0; backend < GC_BACKEND_NR; backend++)
1327 if (runtime[backend] && gc_backend[backend].runtime_change)
1328 (*gc_backend[backend].runtime_change) (0);
1334 /* More or less Robust version of dgettext. It has the side effect of
1335 switching the codeset to utf-8 because this is what we want to
1336 output. In theory it is posible to keep the original code set and
1337 switch back for regular disgnostic output (redefine "_(" for that)
1338 but given the natur of this tool, being something invoked from
1339 other pograms, it does not make much sense. */
1341 my_dgettext (const char *domain, const char *msgid)
1343 #ifdef USE_SIMPLE_GETTEXT
1346 static int switched_codeset;
1349 if (!switched_codeset)
1351 switched_codeset = 1;
1352 gettext_use_utf8 (1);
1355 if (!strcmp (domain, "gnupg"))
1356 domain = PACKAGE_GT;
1358 /* FIXME: we have no dgettext, thus we can't switch. */
1360 text = (char*)gettext (msgid);
1361 return text ? text : msgid;
1365 #elif defined(ENABLE_NLS)
1368 static int switched_codeset;
1371 if (!switched_codeset)
1373 switched_codeset = 1;
1374 bind_textdomain_codeset (PACKAGE_GT, "utf-8");
1376 bindtextdomain (DIRMNGR_NAME, LOCALEDIR);
1377 bind_textdomain_codeset (DIRMNGR_NAME, "utf-8");
1381 /* Note: This is a hack to actually use the gnupg2 domain as
1382 long we are in a transition phase where gnupg 1.x and 1.9 may
1384 if (!strcmp (domain, "gnupg"))
1385 domain = PACKAGE_GT;
1387 text = dgettext (domain, msgid);
1388 return text ? text : msgid;
1399 /* Percent-Escape special characters. The string is valid until the
1400 next invocation of the function. */
1402 gc_percent_escape (const char *src)
1404 static char *esc_str;
1405 static int esc_str_len;
1406 int new_len = 3 * strlen (src) + 1;
1409 if (esc_str_len < new_len)
1411 char *new_esc_str = realloc (esc_str, new_len);
1413 gc_error (1, errno, "can not escape string");
1414 esc_str = new_esc_str;
1415 esc_str_len = new_len;
1427 else if (*src == ':')
1429 /* The colon is used as field separator. */
1434 else if (*src == ',')
1436 /* The comma is used as list separator. */
1451 /* Percent-Deescape special characters. The string is valid until the
1452 next invocation of the function. */
1454 percent_deescape (const char *src)
1458 int new_len = 3 * strlen (src) + 1;
1461 if (str_len < new_len)
1463 char *new_str = realloc (str, new_len);
1465 gc_error (1, errno, "can not deescape string");
1475 int val = hextobyte (src + 1);
1478 gc_error (1, 0, "malformed end of string %s", src);
1480 *(dst++) = (char) val;
1484 *(dst++) = *(src++);
1491 /* List all components that are available. */
1493 gc_component_list_components (estream_t out)
1495 gc_component_t component;
1496 gc_option_t *option;
1497 gc_backend_t backend;
1498 int backend_seen[GC_BACKEND_NR];
1500 const char *pgmname;
1502 for (component = 0; component < GC_COMPONENT_NR; component++)
1504 option = gc_component[component].options;
1507 for (backend = 0; backend < GC_BACKEND_NR; backend++)
1508 backend_seen[backend] = 0;
1511 for (; option && option->name; option++)
1513 if ((option->flags & GC_OPT_FLAG_GROUP))
1515 backend = option->backend;
1516 if (backend_seen[backend])
1518 backend_seen[backend] = 1;
1519 assert (backend != GC_BACKEND_ANY);
1520 if (gc_backend[backend].program
1521 && !gc_backend[backend].module_name)
1523 pgmname = gnupg_module_name (gc_backend[backend].module_name);
1527 desc = gc_component[component].desc;
1528 desc = my_dgettext (gc_component[component].desc_domain, desc);
1529 es_fprintf (out, "%s:%s:",
1530 gc_component[component].name, gc_percent_escape (desc));
1531 es_fprintf (out, "%s\n", gc_percent_escape (pgmname));
1539 all_digits_p (const char *p, size_t len)
1543 for (; len; len--, p++)
1544 if (!isascii (*p) || !isdigit (*p))
1546 return 1; /* Yes. */
1550 /* Collect all error lines from stream FP. Only lines prefixed with
1551 TAG are considered. Returns a list of error line items (which may
1552 be empty). There is no error return. */
1554 collect_error_output (estream_t fp, const char *tag)
1560 error_line_t eitem, errlines, *errlines_tail;
1561 size_t taglen = strlen (tag);
1564 errlines_tail = &errlines;
1567 while ((c=es_getc (fp)) != EOF)
1570 if (pos >= sizeof buffer - 5 || c == '\n')
1572 buffer[pos - (c == '\n')] = 0;
1574 ; /*Ignore continuations of previous line. */
1575 else if (!strncmp (buffer, tag, taglen) && buffer[taglen] == ':')
1577 /* "gpgsm: foo:4: bla" */
1578 /* Yep, we are interested in this line. */
1579 p = buffer + taglen + 1;
1580 while (*p == ' ' || *p == '\t')
1582 trim_trailing_spaces (p); /* Get rid of extra CRs. */
1584 ; /* Empty lines are ignored. */
1585 else if ( (p2 = strchr (p, ':')) && (p3 = strchr (p2+1, ':'))
1586 && all_digits_p (p2+1, p3 - (p2+1)))
1588 /* Line in standard compiler format. */
1590 while (*p3 == ' ' || *p3 == '\t')
1592 eitem = xmalloc (sizeof *eitem + strlen (p));
1594 strcpy (eitem->buffer, p);
1595 eitem->fname = eitem->buffer;
1596 eitem->buffer[p2-p] = 0;
1597 eitem->errtext = eitem->buffer + (p3 - p);
1598 /* (we already checked that there are only ascii
1599 digits followed by a colon) */
1601 for (p2++; isdigit (*p2); p2++)
1602 eitem->lineno = eitem->lineno*10 + (*p2 - '0');
1603 *errlines_tail = eitem;
1604 errlines_tail = &eitem->next;
1608 /* Other error output. */
1609 eitem = xmalloc (sizeof *eitem + strlen (p));
1611 strcpy (eitem->buffer, p);
1612 eitem->fname = NULL;
1613 eitem->errtext = eitem->buffer;
1615 *errlines_tail = eitem;
1616 errlines_tail = &eitem->next;
1620 /* If this was not a complete line mark that we are in a
1622 cont_line = (c != '\n');
1626 /* We ignore error lines not terminated by a LF. */
1631 /* Check the options of a single component. Returns 0 if everything
1634 gc_component_check_options (int component, estream_t out, const char *conf_file)
1637 unsigned int result;
1638 int backend_seen[GC_BACKEND_NR];
1639 gc_backend_t backend;
1640 gc_option_t *option;
1641 const char *pgmname;
1642 const char *argv[4];
1647 error_line_t errlines;
1649 for (backend = 0; backend < GC_BACKEND_NR; backend++)
1650 backend_seen[backend] = 0;
1652 option = gc_component[component].options;
1653 for (; option && option->name; option++)
1655 if ((option->flags & GC_OPT_FLAG_GROUP))
1657 backend = option->backend;
1658 if (backend_seen[backend])
1660 backend_seen[backend] = 1;
1661 assert (backend != GC_BACKEND_ANY);
1662 if (!gc_backend[backend].program)
1664 if (!gc_backend[backend].module_name)
1669 if (! option || ! option->name)
1672 pgmname = gnupg_module_name (gc_backend[backend].module_name);
1676 argv[i++] = "--options";
1677 argv[i++] = conf_file;
1679 if (component == GC_COMPONENT_PINENTRY)
1680 argv[i++] = "--version";
1682 argv[i++] = "--gpgconf-test";
1687 err = gnupg_spawn_process (pgmname, argv, NULL, NULL, 0,
1688 NULL, NULL, &errfp, &pid);
1690 result |= 1; /* Program could not be run. */
1693 errlines = collect_error_output (errfp,
1694 gc_component[component].name);
1695 if (gnupg_wait_process (pgmname, pid, 1, &exitcode))
1698 result |= 1; /* Program could not be run or it
1699 terminated abnormally. */
1700 result |= 2; /* Program returned an error. */
1702 gnupg_release_process (pid);
1706 /* If the program could not be run, we can't tell whether
1707 the config file is good. */
1714 error_line_t errptr;
1716 desc = gc_component[component].desc;
1717 desc = my_dgettext (gc_component[component].desc_domain, desc);
1718 es_fprintf (out, "%s:%s:",
1719 gc_component[component].name, gc_percent_escape (desc));
1720 es_fputs (gc_percent_escape (pgmname), out);
1721 es_fprintf (out, ":%d:%d:", !(result & 1), !(result & 2));
1722 for (errptr = errlines; errptr; errptr = errptr->next)
1724 if (errptr != errlines)
1725 es_fputs ("\n:::::", out); /* Continuation line. */
1727 es_fputs (gc_percent_escape (errptr->fname), out);
1730 es_fprintf (out, "%u", errptr->lineno);
1732 es_fputs (gc_percent_escape (errptr->errtext), out);
1735 es_putc ('\n', out);
1740 error_line_t tmp = errlines->next;
1750 /* Check all components that are available. */
1752 gc_check_programs (estream_t out)
1754 gc_component_t component;
1756 for (component = 0; component < GC_COMPONENT_NR; component++)
1757 gc_component_check_options (component, out, NULL);
1762 /* Find the component with the name NAME. Returns -1 if not
1765 gc_component_find (const char *name)
1769 for (idx = 0; idx < GC_COMPONENT_NR; idx++)
1771 if (gc_component[idx].options
1772 && !strcmp (name, gc_component[idx].name))
1779 /* List the option OPTION. */
1781 list_one_option (const gc_option_t *option, estream_t out)
1783 const char *desc = NULL;
1784 char *arg_name = NULL;
1788 desc = my_dgettext (option->desc_domain, option->desc);
1792 const char *arg_tail = strchr (&desc[1], '|');
1796 int arg_len = arg_tail - &desc[1];
1797 arg_name = xmalloc (arg_len + 1);
1798 memcpy (arg_name, &desc[1], arg_len);
1799 arg_name[arg_len] = '\0';
1800 desc = arg_tail + 1;
1806 /* YOU MUST NOT REORDER THE FIELDS IN THIS OUTPUT, AS THEIR ORDER IS
1807 PART OF THE EXTERNAL INTERFACE. YOU MUST NOT REMOVE ANY
1810 /* The name field. */
1811 es_fprintf (out, "%s", option->name);
1813 /* The flags field. */
1814 es_fprintf (out, ":%lu", option->flags);
1820 es_fprintf (out, "none");
1823 unsigned long flags = option->flags;
1824 unsigned long flag = 0;
1825 unsigned long first = 1;
1835 es_fprintf (out, "%s", gc_flag[flag].name);
1843 /* The level field. */
1844 es_fprintf (out, ":%u", option->level);
1846 es_fprintf (out, " %s", gc_level[option->level].name);
1848 /* The description field. */
1849 es_fprintf (out, ":%s", desc ? gc_percent_escape (desc) : "");
1851 /* The type field. */
1852 es_fprintf (out, ":%u", option->arg_type);
1854 es_fprintf (out, " %s", gc_arg_type[option->arg_type].name);
1856 /* The alternate type field. */
1857 es_fprintf (out, ":%u", gc_arg_type[option->arg_type].fallback);
1859 es_fprintf (out, " %s",
1860 gc_arg_type[gc_arg_type[option->arg_type].fallback].name);
1862 /* The argument name field. */
1863 es_fprintf (out, ":%s", arg_name ? gc_percent_escape (arg_name) : "");
1866 /* The default value field. */
1867 es_fprintf (out, ":%s", option->default_value ? option->default_value : "");
1869 /* The default argument field. */
1870 es_fprintf (out, ":%s", option->default_arg ? option->default_arg : "");
1872 /* The value field. */
1873 if (gc_arg_type[option->arg_type].fallback == GC_ARG_TYPE_NONE
1874 && (option->flags & GC_OPT_FLAG_LIST)
1876 /* The special format "1,1,1,1,...,1" is converted to a number
1878 es_fprintf (out, ":%u", (unsigned int)((strlen (option->value) + 1) / 2));
1880 es_fprintf (out, ":%s", option->value ? option->value : "");
1882 /* ADD NEW FIELDS HERE. */
1884 es_putc ('\n', out);
1888 /* List all options of the component COMPONENT. */
1890 gc_component_list_options (int component, estream_t out)
1892 const gc_option_t *option = gc_component[component].options;
1894 while (option && option->name)
1896 /* Do not output unknown or internal options. */
1897 if (!(option->flags & GC_OPT_FLAG_GROUP)
1898 && (!option->active || option->level == GC_LEVEL_INTERNAL))
1904 if (option->flags & GC_OPT_FLAG_GROUP)
1906 const gc_option_t *group_option = option + 1;
1907 gc_expert_level_t level = GC_LEVEL_NR;
1909 /* The manual states that the group level is always the
1910 minimum of the levels of all contained options. Due to
1911 different active options, and because it is hard to
1912 maintain manually, we calculate it here. The value in
1913 the global static table is ignored. */
1915 while (group_option->name)
1917 if (group_option->flags & GC_OPT_FLAG_GROUP)
1919 if (group_option->level < level)
1920 level = group_option->level;
1924 /* Check if group is empty. */
1925 if (level != GC_LEVEL_NR)
1927 gc_option_t opt_copy;
1929 /* Fix up the group level. */
1930 memcpy (&opt_copy, option, sizeof (opt_copy));
1931 opt_copy.level = level;
1932 list_one_option (&opt_copy, out);
1936 list_one_option (option, out);
1943 /* Find the option NAME in component COMPONENT, for the backend
1944 BACKEND. If BACKEND is GC_BACKEND_ANY, any backend will match. */
1945 static gc_option_t *
1946 find_option (gc_component_t component, const char *name,
1947 gc_backend_t backend)
1949 gc_option_t *option = gc_component[component].options;
1950 while (option->name)
1952 if (!(option->flags & GC_OPT_FLAG_GROUP)
1953 && !strcmp (option->name, name)
1954 && (backend == GC_BACKEND_ANY || option->backend == backend))
1958 return option->name ? option : NULL;
1962 /* Determine the configuration filename for the component COMPONENT
1963 and backend BACKEND. */
1965 get_config_filename (gc_component_t component, gc_backend_t backend)
1967 char *filename = NULL;
1968 gc_option_t *option = find_option
1969 (component, gc_backend[backend].option_config_filename, GC_BACKEND_ANY);
1971 assert (option->arg_type == GC_ARG_TYPE_FILENAME);
1972 assert (!(option->flags & GC_OPT_FLAG_LIST));
1974 if (!option->active || !option->default_value)
1975 gc_error (1, 0, "Option %s, needed by backend %s, was not initialized",
1976 gc_backend[backend].option_config_filename,
1977 gc_backend[backend].name);
1979 if (option->value && *option->value)
1980 filename = percent_deescape (&option->value[1]);
1981 else if (option->default_value && *option->default_value)
1982 filename = percent_deescape (&option->default_value[1]);
1986 #if HAVE_W32CE_SYSTEM
1987 if (!(filename[0] == '/' || filename[0] == '\\'))
1988 #elif defined(HAVE_DOSISH_SYSTEM)
1990 && filename[1] == ':'
1991 && (filename[2] == '/' || filename[2] == '\\')))
1993 if (filename[0] != '/')
1995 gc_error (1, 0, "Option %s, needed by backend %s, is not absolute",
1996 gc_backend[backend].option_config_filename,
1997 gc_backend[backend].name);
2003 /* Retrieve the options for the component COMPONENT from backend
2004 BACKEND, which we already know is a program-type backend. */
2006 retrieve_options_from_program (gc_component_t component, gc_backend_t backend)
2009 const char *pgmname;
2010 const char *argv[2];
2015 size_t line_len = 0;
2018 char *config_filename;
2020 pgmname = (gc_backend[backend].module_name
2021 ? gnupg_module_name (gc_backend[backend].module_name)
2022 : gc_backend[backend].program );
2023 argv[0] = "--gpgconf-list";
2026 err = gnupg_spawn_process (pgmname, argv, NULL, NULL, 0,
2027 NULL, &outfp, NULL, &pid);
2030 gc_error (1, 0, "could not gather active options from '%s': %s",
2031 pgmname, gpg_strerror (err));
2034 while ((length = es_read_line (outfp, &line, &line_len, NULL)) > 0)
2036 gc_option_t *option;
2038 unsigned long flags = 0;
2039 char *default_value = NULL;
2041 /* Strip newline and carriage return, if present. */
2043 && (line[length - 1] == '\n' || line[length - 1] == '\r'))
2044 line[--length] = '\0';
2046 linep = strchr (line, ':');
2050 /* Extract additional flags. Default to none. */
2056 end = strchr (linep, ':');
2060 gpg_err_set_errno (0);
2061 flags = strtoul (linep, &tail, 0);
2063 gc_error (1, errno, "malformed flags in option %s from %s",
2065 if (!(*tail == '\0' || *tail == ':' || *tail == ' '))
2066 gc_error (1, 0, "garbage after flags in option %s from %s",
2072 /* Extract default value, if present. Default to empty if
2078 end = strchr (linep, ':');
2082 if (flags & GC_OPT_FLAG_DEFAULT)
2083 default_value = linep;
2088 /* Look up the option in the component and install the
2089 configuration data. */
2090 option = find_option (component, line, backend);
2094 gc_error (1, errno, "option %s returned twice from %s",
2098 option->flags |= flags;
2099 if (default_value && *default_value)
2100 option->default_value = xstrdup (default_value);
2103 if (length < 0 || es_ferror (outfp))
2104 gc_error (1, errno, "error reading from %s", pgmname);
2105 if (es_fclose (outfp))
2106 gc_error (1, errno, "error closing %s", pgmname);
2108 err = gnupg_wait_process (pgmname, pid, 1, &exitcode);
2110 gc_error (1, 0, "running %s failed (exitcode=%d): %s",
2111 pgmname, exitcode, gpg_strerror (err));
2112 gnupg_release_process (pid);
2115 /* At this point, we can parse the configuration file. */
2116 config_filename = get_config_filename (component, backend);
2118 config = es_fopen (config_filename, "r");
2120 gc_error (0, errno, "warning: can not open config file %s",
2124 while ((length = es_read_line (config, &line, &line_len, NULL)) > 0)
2128 gc_option_t *option;
2131 while (*name == ' ' || *name == '\t')
2133 if (!*name || *name == '#' || *name == '\r' || *name == '\n')
2137 while (*value && *value != ' ' && *value != '\t'
2138 && *value != '#' && *value != '\r' && *value != '\n')
2140 if (*value == ' ' || *value == '\t')
2145 while (*value == ' ' || *value == '\t')
2149 while (*end && *end != '#' && *end != '\r' && *end != '\n')
2151 while (end > value && (end[-1] == ' ' || end[-1] == '\t'))
2158 /* Look up the option in the component and install the
2159 configuration data. */
2160 option = find_option (component, line, backend);
2165 if (gc_arg_type[option->arg_type].fallback == GC_ARG_TYPE_NONE)
2169 "warning: ignoring argument %s for option %s",
2171 opt_value = xstrdup ("1");
2173 else if (gc_arg_type[option->arg_type].fallback
2174 == GC_ARG_TYPE_STRING)
2175 opt_value = xasprintf ("\"%s", gc_percent_escape (value));
2178 /* FIXME: Verify that the number is sane. */
2179 opt_value = xstrdup (value);
2182 /* Now enter the option into the table. */
2183 if (!(option->flags & GC_OPT_FLAG_LIST))
2186 free (option->value);
2187 option->value = opt_value;
2192 option->value = opt_value;
2195 char *opt_val = opt_value;
2197 option->value = xasprintf ("%s,%s", option->value,
2205 if (length < 0 || es_ferror (config))
2206 gc_error (1, errno, "error reading from %s", config_filename);
2207 if (es_fclose (config))
2208 gc_error (1, errno, "error closing %s", config_filename);
2215 /* Retrieve the options for the component COMPONENT from backend
2216 BACKEND, which we already know is of type file list. */
2218 retrieve_options_from_file (gc_component_t component, gc_backend_t backend)
2220 gc_option_t *list_option;
2221 gc_option_t *config_option;
2222 char *list_filename;
2225 size_t line_len = 0;
2229 list_option = find_option (component,
2230 gc_backend[backend].option_name, GC_BACKEND_ANY);
2231 assert (list_option);
2232 assert (!list_option->active);
2234 list_filename = get_config_filename (component, backend);
2235 list_file = fopen (list_filename, "r");
2237 gc_error (0, errno, "warning: can not open list file %s", list_filename);
2241 while ((length = read_line (list_file, &line, &line_len, NULL)) > 0)
2248 while (*start == ' ' || *start == '\t')
2250 if (!*start || *start == '#' || *start == '\r' || *start == '\n')
2254 while (*end && *end != '#' && *end != '\r' && *end != '\n')
2256 /* Walk back to skip trailing white spaces. Looks evil, but
2257 works because of the conditions on START and END imposed
2258 at this point (END is at least START + 1, and START is
2259 not a whitespace character). */
2260 while (*(end - 1) == ' ' || *(end - 1) == '\t')
2263 /* FIXME: Oh, no! This is so lame! Should use realloc and
2267 new_list = xasprintf ("%s,\"%s", list, gc_percent_escape (start));
2272 list = xasprintf ("\"%s", gc_percent_escape (start));
2274 if (length < 0 || ferror (list_file))
2275 gc_error (1, errno, "can not read list file %s", list_filename);
2278 list_option->active = 1;
2279 list_option->value = list;
2281 /* Fix up the read-only flag. */
2282 config_option = find_option
2283 (component, gc_backend[backend].option_config_filename, GC_BACKEND_ANY);
2284 if (config_option->flags & GC_OPT_FLAG_NO_CHANGE)
2285 list_option->flags |= GC_OPT_FLAG_NO_CHANGE;
2287 if (list_file && fclose (list_file))
2288 gc_error (1, errno, "error closing %s", list_filename);
2293 /* Retrieve the currently active options and their defaults from all
2294 involved backends for this component. Using -1 for component will
2295 retrieve all options from all components. */
2297 gc_component_retrieve_options (int component)
2299 int process_all = 0;
2300 int backend_seen[GC_BACKEND_NR];
2301 gc_backend_t backend;
2302 gc_option_t *option;
2304 for (backend = 0; backend < GC_BACKEND_NR; backend++)
2305 backend_seen[backend] = 0;
2307 if (component == -1)
2311 assert (component < GC_COMPONENT_NR);
2316 if (component == GC_COMPONENT_PINENTRY)
2317 continue; /* Skip this dummy component. */
2319 option = gc_component[component].options;
2321 while (option && option->name)
2323 if (!(option->flags & GC_OPT_FLAG_GROUP))
2325 backend = option->backend;
2327 if (backend_seen[backend])
2332 backend_seen[backend] = 1;
2334 assert (backend != GC_BACKEND_ANY);
2336 if (gc_backend[backend].program)
2337 retrieve_options_from_program (component, backend);
2339 retrieve_options_from_file (component, backend);
2344 while (process_all && ++component < GC_COMPONENT_NR);
2350 /* Perform a simple validity check based on the type. Return in
2351 * NEW_VALUE_NR the value of the number in NEW_VALUE if OPTION is of
2352 * type GC_ARG_TYPE_NONE. If VERBATIM is set the profile parsing mode
2355 option_check_validity (gc_option_t *option, unsigned long flags,
2356 char *new_value, unsigned long *new_value_nr,
2361 if (!option->active)
2362 gc_error (1, 0, "option %s not supported by backend %s",
2363 option->name, gc_backend[option->backend].name);
2365 if (option->new_flags || option->new_value)
2366 gc_error (1, 0, "option %s already changed", option->name);
2368 if (flags & GC_OPT_FLAG_DEFAULT)
2371 gc_error (1, 0, "argument %s provided for deleted option %s",
2372 new_value, option->name);
2377 /* GC_ARG_TYPE_NONE options have special list treatment. */
2378 if (gc_arg_type[option->arg_type].fallback == GC_ARG_TYPE_NONE)
2382 gpg_err_set_errno (0);
2383 *new_value_nr = strtoul (new_value, &tail, 0);
2386 gc_error (1, errno, "invalid argument for option %s",
2389 gc_error (1, 0, "garbage after argument for option %s",
2392 if (!(option->flags & GC_OPT_FLAG_LIST))
2394 if (*new_value_nr != 1)
2395 gc_error (1, 0, "argument for non-list option %s of type 0 "
2396 "(none) must be 1", option->name);
2400 if (*new_value_nr == 0)
2401 gc_error (1, 0, "argument for option %s of type 0 (none) "
2402 "must be positive", option->name);
2411 if (*arg == '\0' || (*arg == ',' && !verbatim))
2413 if (!(option->flags & GC_OPT_FLAG_ARG_OPT))
2414 gc_error (1, 0, "argument required for option %s", option->name);
2416 if (*arg == ',' && !verbatim && !(option->flags & GC_OPT_FLAG_LIST))
2417 gc_error (1, 0, "list found for non-list option %s", option->name);
2419 else if (gc_arg_type[option->arg_type].fallback == GC_ARG_TYPE_STRING)
2421 if (*arg != '"' && !verbatim)
2422 gc_error (1, 0, "string argument for option %s must begin "
2423 "with a quote (\") character", option->name);
2425 /* FIXME: We do not allow empty string arguments for now, as
2426 we do not quote arguments in configuration files, and
2427 thus no argument is indistinguishable from the empty
2429 if (arg[1] == '\0' || (arg[1] == ',' && !verbatim))
2430 gc_error (1, 0, "empty string argument for option %s is "
2431 "currently not allowed. Please report this!",
2434 else if (gc_arg_type[option->arg_type].fallback == GC_ARG_TYPE_INT32)
2438 gpg_err_set_errno (0);
2439 res = strtol (arg, &arg, 0);
2443 gc_error (1, errno, "invalid argument for option %s",
2446 if (*arg != '\0' && (*arg != ',' || verbatim))
2447 gc_error (1, 0, "garbage after argument for option %s",
2450 else if (gc_arg_type[option->arg_type].fallback == GC_ARG_TYPE_UINT32)
2454 gpg_err_set_errno (0);
2455 res = strtoul (arg, &arg, 0);
2459 gc_error (1, errno, "invalid argument for option %s",
2462 if (*arg != '\0' && (*arg != ',' || verbatim))
2463 gc_error (1, 0, "garbage after argument for option %s",
2466 arg = verbatim? strchr (arg, ',') : NULL;
2470 while (arg && *arg);
2474 #ifdef HAVE_W32_SYSTEM
2476 copy_file (const char *src_name, const char *dst_name)
2478 #define BUF_LEN 4096
2479 char buffer[BUF_LEN];
2484 src = fopen (src_name, "r");
2488 dst = fopen (dst_name, "w");
2491 int saved_err = errno;
2493 gpg_err_set_errno (saved_err);
2501 len = fread (buffer, 1, BUF_LEN, src);
2504 written = fwrite (buffer, 1, len, dst);
2508 while (!feof (src) && !ferror (src) && !ferror (dst));
2510 if (ferror (src) || ferror (dst) || !feof (src))
2512 int saved_errno = errno;
2516 gpg_err_set_errno (saved_errno);
2521 gc_error (1, errno, "error closing %s", dst_name);
2523 gc_error (1, errno, "error closing %s", src_name);
2527 #endif /* HAVE_W32_SYSTEM */
2530 /* Create and verify the new configuration file for the specified
2531 backend and component. Returns 0 on success and -1 on error. */
2533 change_options_file (gc_component_t component, gc_backend_t backend,
2534 char **src_filenamep, char **dest_filenamep,
2535 char **orig_filenamep)
2537 static const char marker[] = "###+++--- " GPGCONF_DISP_NAME " ---+++###";
2538 /* True if we are within the marker in the config file. */
2540 gc_option_t *option;
2546 FILE *src_file = NULL;
2547 FILE *dest_file = NULL;
2549 char *dest_filename;
2550 char *orig_filename;
2552 char *cur_arg = NULL;
2554 option = find_option (component,
2555 gc_backend[backend].option_name, GC_BACKEND_ANY);
2557 assert (option->active);
2558 assert (gc_arg_type[option->arg_type].fallback != GC_ARG_TYPE_NONE);
2560 /* FIXME. Throughout the function, do better error reporting. */
2561 /* Note that get_config_filename() calls percent_deescape(), so we
2562 call this before processing the arguments. */
2563 dest_filename = xstrdup (get_config_filename (component, backend));
2564 src_filename = xasprintf ("%s.%s.%i.new",
2565 dest_filename, GPGCONF_NAME, (int)getpid ());
2566 orig_filename = xasprintf ("%s.%s.%i.bak",
2567 dest_filename, GPGCONF_NAME, (int)getpid ());
2569 arg = option->new_value;
2570 if (arg && arg[0] == '\0')
2577 end = strchr (arg, ',');
2581 cur_arg = percent_deescape (arg);
2591 #ifdef HAVE_W32_SYSTEM
2592 res = copy_file (dest_filename, orig_filename);
2594 res = link (dest_filename, orig_filename);
2596 if (res < 0 && errno != ENOENT)
2598 xfree (dest_filename);
2603 xfree (orig_filename);
2604 orig_filename = NULL;
2607 /* We now initialize the return strings, so the caller can do the
2609 *src_filenamep = src_filename;
2610 *dest_filenamep = dest_filename;
2611 *orig_filenamep = orig_filename;
2613 /* Use open() so that we can use O_EXCL. */
2614 fd = open (src_filename, O_CREAT | O_EXCL | O_WRONLY, 0644);
2617 src_file = fdopen (fd, "w");
2621 gpg_err_set_errno (res);
2625 /* Only if ORIG_FILENAME is not NULL did the configuration file
2626 exist already. In this case, we will copy its content into the
2627 new configuration file, changing it to our liking in the
2631 dest_file = fopen (dest_filename, "r");
2633 goto change_file_one_err;
2635 while ((length = read_line (dest_file, &line, &line_len, NULL)) > 0)
2640 if (!strncmp (marker, line, sizeof (marker) - 1))
2649 while (*start == ' ' || *start == '\t')
2651 if (*start && *start != '\r' && *start != '\n' && *start != '#')
2660 /* Search for the end of the line. */
2661 while (*endp && *endp != '#' && *endp != '\r' && *endp != '\n')
2664 if (*endp && *endp != ' ' && *endp != '\t'
2665 && *endp != '\r' && *endp != '\n' && *endp != '#')
2671 if ((option->new_flags & GC_OPT_FLAG_DEFAULT)
2672 || !cur_arg || strcmp (start, cur_arg))
2676 /* Find next argument. */
2682 arg_end = strchr (arg, ',');
2686 cur_arg = percent_deescape (arg);
2707 "# %s disabled this option here at %s\n",
2708 GPGCONF_DISP_NAME, asctimestamp (gnupg_get_time ()));
2709 if (ferror (src_file))
2710 goto change_file_one_err;
2711 fprintf (src_file, "# %s", line);
2712 if (ferror (src_file))
2713 goto change_file_one_err;
2718 fprintf (src_file, "%s", line);
2719 if (ferror (src_file))
2720 goto change_file_one_err;
2723 if (length < 0 || ferror (dest_file))
2724 goto change_file_one_err;
2729 /* There was no marker. This is the first time we edit the
2730 file. We add our own marker at the end of the file and
2731 proceed. Note that we first write a newline, this guards us
2732 against files which lack the newline at the end of the last
2733 line, while it doesn't hurt us in all other cases. */
2734 fprintf (src_file, "\n%s\n", marker);
2735 if (ferror (src_file))
2736 goto change_file_one_err;
2739 /* At this point, we have copied everything up to the end marker
2740 into the new file, except for the arguments we are going to add.
2741 Now, dump the new arguments and write the end marker, possibly
2742 followed by the rest of the original file. */
2745 fprintf (src_file, "%s\n", cur_arg);
2747 /* Find next argument. */
2753 end = strchr (arg, ',');
2757 cur_arg = percent_deescape (arg);
2770 fprintf (src_file, "%s %s\n", marker, asctimestamp (gnupg_get_time ()));
2771 if (ferror (src_file))
2772 goto change_file_one_err;
2776 fprintf (src_file, "# %s edited this configuration file.\n",
2778 if (ferror (src_file))
2779 goto change_file_one_err;
2780 fprintf (src_file, "# It will disable options before this marked "
2781 "block, but it will\n");
2782 if (ferror (src_file))
2783 goto change_file_one_err;
2784 fprintf (src_file, "# never change anything below these lines.\n");
2785 if (ferror (src_file))
2786 goto change_file_one_err;
2790 while ((length = read_line (dest_file, &line, &line_len, NULL)) > 0)
2792 fprintf (src_file, "%s", line);
2793 if (ferror (src_file))
2794 goto change_file_one_err;
2796 if (length < 0 || ferror (dest_file))
2797 goto change_file_one_err;
2802 res = fclose (src_file);
2809 gpg_err_set_errno (res);
2815 res = fclose (dest_file);
2821 change_file_one_err:
2831 gpg_err_set_errno (res);
2836 /* Create and verify the new configuration file for the specified
2837 * backend and component. Returns 0 on success and -1 on error. If
2838 * VERBATIM is set the profile mode is used. */
2840 change_options_program (gc_component_t component, gc_backend_t backend,
2841 char **src_filenamep, char **dest_filenamep,
2842 char **orig_filenamep,
2845 static const char marker[] = "###+++--- " GPGCONF_DISP_NAME " ---+++###";
2846 /* True if we are within the marker in the config file. */
2848 gc_option_t *option;
2854 FILE *src_file = NULL;
2855 FILE *dest_file = NULL;
2857 char *dest_filename;
2858 char *orig_filename;
2859 /* Special hack for gpg, see below. */
2860 int utf8strings_seen = 0;
2862 /* FIXME. Throughout the function, do better error reporting. */
2863 dest_filename = xstrdup (get_config_filename (component, backend));
2864 src_filename = xasprintf ("%s.%s.%i.new",
2865 dest_filename, GPGCONF_NAME, (int)getpid ());
2866 orig_filename = xasprintf ("%s.%s.%i.bak",
2867 dest_filename, GPGCONF_NAME, (int)getpid ());
2869 #ifdef HAVE_W32_SYSTEM
2870 res = copy_file (dest_filename, orig_filename);
2872 res = link (dest_filename, orig_filename);
2874 if (res < 0 && errno != ENOENT)
2878 xfree (orig_filename);
2879 orig_filename = NULL;
2882 /* We now initialize the return strings, so the caller can do the
2884 *src_filenamep = src_filename;
2885 *dest_filenamep = dest_filename;
2886 *orig_filenamep = orig_filename;
2888 /* Use open() so that we can use O_EXCL. */
2889 fd = open (src_filename, O_CREAT | O_EXCL | O_WRONLY, 0644);
2892 src_file = fdopen (fd, "w");
2896 gpg_err_set_errno (res);
2900 /* Only if ORIG_FILENAME is not NULL did the configuration file
2901 exist already. In this case, we will copy its content into the
2902 new configuration file, changing it to our liking in the
2906 dest_file = fopen (dest_filename, "r");
2908 goto change_one_err;
2910 while ((length = read_line (dest_file, &line, &line_len, NULL)) > 0)
2915 if (!strncmp (marker, line, sizeof (marker) - 1))
2922 else if (backend == GC_BACKEND_GPG && in_marker
2923 && ! strcmp ("utf8-strings\n", line))
2925 /* Strip duplicated entries. */
2926 if (utf8strings_seen)
2929 utf8strings_seen = 1;
2933 while (*start == ' ' || *start == '\t')
2935 if (*start && *start != '\r' && *start != '\n' && *start != '#')
2941 while (*end && *end != ' ' && *end != '\t'
2942 && *end != '\r' && *end != '\n' && *end != '#')
2947 option = find_option (component, start, backend);
2949 if (option && ((option->new_flags & GC_OPT_FLAG_DEFAULT)
2950 || option->new_value))
2958 "# %s disabled this option here at %s\n",
2959 GPGCONF_DISP_NAME, asctimestamp (gnupg_get_time ()));
2960 if (ferror (src_file))
2961 goto change_one_err;
2962 fprintf (src_file, "# %s", line);
2963 if (ferror (src_file))
2964 goto change_one_err;
2969 fprintf (src_file, "%s", line);
2970 if (ferror (src_file))
2971 goto change_one_err;
2974 if (length < 0 || ferror (dest_file))
2975 goto change_one_err;
2980 /* There was no marker. This is the first time we edit the
2981 file. We add our own marker at the end of the file and
2982 proceed. Note that we first write a newline, this guards us
2983 against files which lack the newline at the end of the last
2984 line, while it doesn't hurt us in all other cases. */
2985 fprintf (src_file, "\n%s\n", marker);
2986 if (ferror (src_file))
2987 goto change_one_err;
2989 /* At this point, we have copied everything up to the end marker
2990 into the new file, except for the options we are going to change.
2991 Now, dump the changed options (except for those we are going to
2992 revert to their default), and write the end marker, possibly
2993 followed by the rest of the original file. */
2995 /* We have to turn on UTF8 strings for GnuPG. */
2996 if (backend == GC_BACKEND_GPG && ! utf8strings_seen)
2997 fprintf (src_file, "utf8-strings\n");
2999 option = gc_component[component].options;
3000 while (option->name)
3002 if (!(option->flags & GC_OPT_FLAG_GROUP)
3003 && option->backend == backend
3004 && option->new_value)
3006 char *arg = option->new_value;
3010 if (*arg == '\0' || *arg == ',')
3012 fprintf (src_file, "%s\n", option->name);
3013 if (ferror (src_file))
3014 goto change_one_err;
3016 else if (gc_arg_type[option->arg_type].fallback
3017 == GC_ARG_TYPE_NONE)
3019 assert (*arg == '1');
3020 fprintf (src_file, "%s\n", option->name);
3021 if (ferror (src_file))
3022 goto change_one_err;
3026 else if (gc_arg_type[option->arg_type].fallback
3027 == GC_ARG_TYPE_STRING)
3033 log_assert (*arg == '"');
3036 end = strchr (arg, ',');
3043 fprintf (src_file, "%s %s\n", option->name,
3044 verbatim? arg : percent_deescape (arg));
3045 if (ferror (src_file))
3046 goto change_one_err;
3056 end = strchr (arg, ',');
3060 fprintf (src_file, "%s %s\n", option->name, arg);
3061 if (ferror (src_file))
3062 goto change_one_err;
3069 assert (arg == NULL || *arg == '\0' || *arg == ',');
3070 if (arg && *arg == ',')
3073 while (arg && *arg);
3078 fprintf (src_file, "%s %s\n", marker, asctimestamp (gnupg_get_time ()));
3079 if (ferror (src_file))
3080 goto change_one_err;
3084 fprintf (src_file, "# %s edited this configuration file.\n",
3086 if (ferror (src_file))
3087 goto change_one_err;
3088 fprintf (src_file, "# It will disable options before this marked "
3089 "block, but it will\n");
3090 if (ferror (src_file))
3091 goto change_one_err;
3092 fprintf (src_file, "# never change anything below these lines.\n");
3093 if (ferror (src_file))
3094 goto change_one_err;
3098 while ((length = read_line (dest_file, &line, &line_len, NULL)) > 0)
3100 fprintf (src_file, "%s", line);
3101 if (ferror (src_file))
3102 goto change_one_err;
3104 if (length < 0 || ferror (dest_file))
3105 goto change_one_err;
3110 res = fclose (src_file);
3117 gpg_err_set_errno (res);
3123 res = fclose (dest_file);
3139 gpg_err_set_errno (res);
3144 /* Common code for gc_component_change_options and
3145 * gc_process_gpgconf_conf. If VERBATIM is set the profile parsing
3148 change_one_value (gc_option_t *option, int *runtime,
3149 unsigned long flags, char *new_value, int verbatim)
3151 unsigned long new_value_nr = 0;
3153 option_check_validity (option, flags, new_value, &new_value_nr, verbatim);
3155 if (option->flags & GC_OPT_FLAG_RUNTIME)
3156 runtime[option->backend] = 1;
3158 option->new_flags = flags;
3159 if (!(flags & GC_OPT_FLAG_DEFAULT))
3161 if (gc_arg_type[option->arg_type].fallback == GC_ARG_TYPE_NONE
3162 && (option->flags & GC_OPT_FLAG_LIST))
3166 /* We convert the number to a list of 1's for convenient
3168 assert (new_value_nr > 0);
3169 option->new_value = xmalloc ((2 * (new_value_nr - 1) + 1) + 1);
3170 str = option->new_value;
3172 while (--new_value_nr > 0)
3180 option->new_value = xstrdup (new_value);
3185 /* Read the modifications from IN and apply them. If IN is NULL the
3186 modifications are expected to already have been set to the global
3187 table. If VERBATIM is set the profile mode is used. */
3189 gc_component_change_options (int component, estream_t in, estream_t out,
3193 int runtime[GC_BACKEND_NR];
3194 char *src_filename[GC_BACKEND_NR];
3195 char *dest_filename[GC_BACKEND_NR];
3196 char *orig_filename[GC_BACKEND_NR];
3197 gc_backend_t backend;
3198 gc_option_t *option;
3200 size_t line_len = 0;
3203 if (component == GC_COMPONENT_PINENTRY)
3204 return; /* Dummy component for now. */
3206 for (backend = 0; backend < GC_BACKEND_NR; backend++)
3208 runtime[backend] = 0;
3209 src_filename[backend] = NULL;
3210 dest_filename[backend] = NULL;
3211 orig_filename[backend] = NULL;
3216 /* Read options from the file IN. */
3217 while ((length = es_read_line (in, &line, &line_len, NULL)) > 0)
3220 unsigned long flags = 0;
3221 char *new_value = "";
3223 /* Strip newline and carriage return, if present. */
3225 && (line[length - 1] == '\n' || line[length - 1] == '\r'))
3226 line[--length] = '\0';
3228 linep = strchr (line, ':');
3232 /* Extract additional flags. Default to none. */
3238 end = strchr (linep, ':');
3242 gpg_err_set_errno (0);
3243 flags = strtoul (linep, &tail, 0);
3245 gc_error (1, errno, "malformed flags in option %s", line);
3246 if (!(*tail == '\0' || *tail == ':' || *tail == ' '))
3247 gc_error (1, 0, "garbage after flags in option %s", line);
3252 /* Don't allow setting of the no change flag. */
3253 flags &= ~GC_OPT_FLAG_NO_CHANGE;
3255 /* Extract default value, if present. Default to empty if not. */
3259 end = strchr (linep, ':');
3266 option = find_option (component, line, GC_BACKEND_ANY);
3268 gc_error (1, 0, "unknown option %s", line);
3270 if ((option->flags & GC_OPT_FLAG_NO_CHANGE))
3272 gc_error (0, 0, "ignoring new value for option %s",
3277 change_one_value (option, runtime, flags, new_value, 0);
3281 /* Now that we have collected and locally verified the changes,
3282 write them out to new configuration files, verify them
3283 externally, and then commit them. */
3284 option = gc_component[component].options;
3285 while (option && option->name)
3287 /* Go on if we have already seen this backend, or if there is
3289 if (src_filename[option->backend]
3290 || !(option->new_flags || option->new_value))
3296 if (gc_backend[option->backend].program)
3298 err = change_options_program (component, option->backend,
3299 &src_filename[option->backend],
3300 &dest_filename[option->backend],
3301 &orig_filename[option->backend],
3305 /* External verification. */
3306 err = gc_component_check_options (component, out,
3307 src_filename[option->backend]);
3311 _("External verification of component %s failed"),
3312 gc_component[component].name);
3313 gpg_err_set_errno (EINVAL);
3319 err = change_options_file (component, option->backend,
3320 &src_filename[option->backend],
3321 &dest_filename[option->backend],
3322 &orig_filename[option->backend]);
3330 if (! err && ! opt.dry_run)
3334 for (i = 0; i < GC_BACKEND_NR; i++)
3336 if (src_filename[i])
3338 /* FIXME: Make a verification here. */
3340 assert (dest_filename[i]);
3342 if (orig_filename[i])
3344 #ifdef HAVE_W32_SYSTEM
3345 /* There is no atomic update on W32. */
3346 err = unlink (dest_filename[i]);
3347 #endif /* HAVE_W32_SYSTEM */
3349 err = rename (src_filename[i], dest_filename[i]);
3353 #ifdef HAVE_W32_SYSTEM
3354 /* We skip the unlink if we expect the file not to
3356 err = rename (src_filename[i], dest_filename[i]);
3357 #else /* HAVE_W32_SYSTEM */
3358 /* This is a bit safer than rename() because we
3359 expect DEST_FILENAME not to be there. If it
3360 happens to be there, this will fail. */
3361 err = link (src_filename[i], dest_filename[i]);
3363 err = unlink (src_filename[i]);
3364 #endif /* !HAVE_W32_SYSTEM */
3368 src_filename[i] = NULL;
3373 if (err || opt.dry_run)
3376 int saved_errno = errno;
3378 /* An error occurred or a dry-run is requested. */
3379 for (i = 0; i < GC_BACKEND_NR; i++)
3381 if (src_filename[i])
3383 /* The change was not yet committed. */
3384 unlink (src_filename[i]);
3385 if (orig_filename[i])
3386 unlink (orig_filename[i]);
3390 /* The changes were already committed. FIXME: This is a
3391 tad dangerous, as we don't know if we don't overwrite
3392 a version of the file that is even newer than the one
3393 we just installed. */
3394 if (orig_filename[i])
3396 #ifdef HAVE_W32_SYSTEM
3397 /* There is no atomic update on W32. */
3398 unlink (dest_filename[i]);
3399 #endif /* HAVE_W32_SYSTEM */
3400 rename (orig_filename[i], dest_filename[i]);
3403 unlink (dest_filename[i]);
3407 gc_error (1, saved_errno, "could not commit changes");
3409 /* Fall-through for dry run. */
3413 /* If it all worked, notify the daemons of the changes. */
3415 for (backend = 0; backend < GC_BACKEND_NR; backend++)
3417 if (runtime[backend] && gc_backend[backend].runtime_change)
3418 (*gc_backend[backend].runtime_change) (0);
3421 /* Move the per-process backup file into its place. */
3422 for (backend = 0; backend < GC_BACKEND_NR; backend++)
3423 if (orig_filename[backend])
3425 char *backup_filename;
3427 assert (dest_filename[backend]);
3429 backup_filename = xasprintf ("%s.%s.bak",
3430 dest_filename[backend], GPGCONF_NAME);
3432 #ifdef HAVE_W32_SYSTEM
3433 /* There is no atomic update on W32. */
3434 unlink (backup_filename);
3435 #endif /* HAVE_W32_SYSTEM */
3436 rename (orig_filename[backend], backup_filename);
3444 /* Check whether USER matches the current user of one of its group.
3445 This function may change USER. Returns true is there is a
3448 key_matches_user_or_group (char *user)
3452 if (*user == '*' && user[1] == 0)
3453 return 1; /* A single asterisk matches all users. */
3455 group = strchr (user, ':');
3459 #ifdef HAVE_W32_SYSTEM
3460 /* Under Windows we don't support groups. */
3461 if (group && *group)
3462 gc_error (0, 0, _("Note that group specifications are ignored\n"));
3463 #ifndef HAVE_W32CE_SYSTEM
3466 static char *my_name;
3473 GetUserNameA (tmp, &size);
3474 my_name = xmalloc (size);
3475 if (!GetUserNameA (my_name, &size))
3476 gc_error (1,0, "error getting current user name: %s",
3480 if (!strcmp (user, my_name))
3481 return 1; /* Found. */
3483 #endif /*HAVE_W32CE_SYSTEM*/
3484 #else /*!HAVE_W32_SYSTEM*/
3485 /* First check whether the user matches. */
3488 static char *my_name;
3492 struct passwd *pw = getpwuid ( getuid () );
3494 gc_error (1, errno, "getpwuid failed for current user");
3495 my_name = xstrdup (pw->pw_name);
3497 if (!strcmp (user, my_name))
3498 return 1; /* Found. */
3501 /* If that failed, check whether a group matches. */
3502 if (group && *group)
3504 static char *my_group;
3505 static char **my_supgroups;
3510 struct group *gr = getgrgid ( getgid () );
3512 gc_error (1, errno, "getgrgid failed for current user");
3513 my_group = xstrdup (gr->gr_name);
3515 if (!strcmp (group, my_group))
3516 return 1; /* Found. */
3523 ngids = getgroups (0, NULL);
3524 gids = xcalloc (ngids+1, sizeof *gids);
3525 ngids = getgroups (ngids, gids);
3527 gc_error (1, errno, "getgroups failed for current user");
3528 my_supgroups = xcalloc (ngids+1, sizeof *my_supgroups);
3529 for (n=0; n < ngids; n++)
3531 struct group *gr = getgrgid ( gids[n] );
3533 gc_error (1, errno, "getgrgid failed for supplementary group");
3534 my_supgroups[n] = xstrdup (gr->gr_name);
3539 for (n=0; my_supgroups[n]; n++)
3540 if (!strcmp (group, my_supgroups[n]))
3541 return 1; /* Found. */
3543 #endif /*!HAVE_W32_SYSTEM*/
3544 return 0; /* No match. */
3549 /* Read and process the global configuration file for gpgconf. This
3550 optional file is used to update our internal tables at runtime and
3551 may also be used to set new default values. If FNAME is NULL the
3552 default name will be used. With UPDATE set to true the internal
3553 tables are actually updated; if not set, only a syntax check is
3554 done. If DEFAULTS is true the global options are written to the
3555 configuration files. If LISTFP is set, no changes are done but the
3556 configuration file is printed to LISTFP in a colon separated format.
3558 Returns 0 on success or if the config file is not present; -1 is
3559 returned on error. */
3561 gc_process_gpgconf_conf (const char *fname_arg, int update, int defaults,
3566 size_t line_len = 0;
3572 int runtime[GC_BACKEND_NR];
3573 int backend_id, component_id;
3577 fname = xstrdup (fname_arg);
3579 fname = make_filename (gnupg_sysconfdir (), GPGCONF_NAME EXTSEP_S "conf",
3582 for (backend_id = 0; backend_id < GC_BACKEND_NR; backend_id++)
3583 runtime[backend_id] = 0;
3585 config = fopen (fname, "r");
3588 /* Do not print an error if the file is not available, except
3589 when running in syntax check mode. */
3590 if (errno != ENOENT || !update)
3592 gc_error (0, errno, "can not open global config file '%s'", fname);
3599 while ((length = read_line (config, &line, &line_len, NULL)) > 0)
3601 char *key, *component, *option, *flags, *value;
3603 gc_option_t *option_info = NULL;
3605 int is_continuation;
3609 while (*key == ' ' || *key == '\t')
3611 if (!*key || *key == '#' || *key == '\r' || *key == '\n')
3614 is_continuation = (key != line);
3616 /* Parse the key field. */
3617 if (!is_continuation && got_match)
3618 break; /* Finish after the first match. */
3619 else if (!is_continuation)
3622 for (p=key+1; *p && !strchr (" \t\r\n", *p); p++)
3626 gc_error (0, 0, "missing rule at '%s', line %d", fname, lineno);
3635 gc_error (0, 0, "continuation but no rule at '%s', line %d",
3648 /* Parse the component. */
3649 while (*component == ' ' || *component == '\t')
3651 for (p=component; *p && !strchr (" \t\r\n", *p); p++)
3655 gc_error (0, 0, "missing component at '%s', line %d",
3663 component_id = gc_component_find (component);
3664 if (component_id < 0)
3666 gc_error (0, 0, "unknown component at '%s', line %d",
3671 /* Parse the option name. */
3672 while (*option == ' ' || *option == '\t')
3674 for (p=option; *p && !strchr (" \t\r\n", *p); p++)
3678 gc_error (0, 0, "missing option at '%s', line %d",
3685 if ( component_id != -1)
3687 option_info = find_option (component_id, option, GC_BACKEND_ANY);
3690 gc_error (0, 0, "unknown option at '%s', line %d",
3697 /* Parse the optional flags. */
3698 while (*flags == ' ' || *flags == '\t')
3703 p = strchr (flags, ']');
3706 gc_error (0, 0, "syntax error in rule at '%s', line %d",
3714 else /* No flags given. */
3720 /* Parse the optional value. */
3721 while (*value == ' ' || *value == '\t')
3723 for (p=value; *p && !strchr ("\r\n", *p); p++)
3726 value = empty; /* No value given; let it point to an empty string. */
3729 /* Strip trailing white space. */
3731 for (p--; p > value && (*p == ' ' || *p == '\t'); p--)
3735 /* Check flag combinations. */
3738 else if (!strcmp (flags, "default"))
3742 gc_error (0, 0, "flag \"default\" may not be combined "
3743 "with a value at '%s', line %d",
3748 else if (!strcmp (flags, "change"))
3750 else if (!strcmp (flags, "no-change"))
3754 gc_error (0, 0, "unknown flag at '%s', line %d",
3759 /* In list mode we print out all records. */
3760 if (listfp && !result)
3762 /* If this is a new ruleset, print a key record. */
3763 if (!is_continuation)
3765 char *group = strchr (key, ':');
3769 if ((p = strchr (group, ':')))
3770 *p = 0; /* We better strip any extra stuff. */
3773 es_fprintf (listfp, "k:%s:", gc_percent_escape (key));
3774 es_fprintf (listfp, "%s\n", group? gc_percent_escape (group):"");
3777 /* All other lines are rule records. */
3778 es_fprintf (listfp, "r:::%s:%s:%s:",
3779 gc_component[component_id].name,
3780 option_info->name? option_info->name : "",
3783 es_fprintf (listfp, "\"%s", gc_percent_escape (value));
3785 es_putc ('\n', listfp);
3788 /* Check whether the key matches but do this only if we are not
3789 running in syntax check mode. */
3791 && !result && !listfp
3792 && (got_match || (key && key_matches_user_or_group (key))) )
3798 /* Apply the flags from gpgconf.conf. */
3801 else if (!strcmp (flags, "default"))
3802 newflags |= GC_OPT_FLAG_DEFAULT;
3803 else if (!strcmp (flags, "no-change"))
3804 option_info->flags |= GC_OPT_FLAG_NO_CHANGE;
3805 else if (!strcmp (flags, "change"))
3806 option_info->flags &= ~GC_OPT_FLAG_NO_CHANGE;
3810 /* Here we explicitly allow updating the value again. */
3813 option_info->new_flags = 0;
3817 xfree (option_info->new_value);
3818 option_info->new_value = NULL;
3820 change_one_value (option_info, runtime, newflags, value, 0);
3825 if (length < 0 || ferror (config))
3827 gc_error (0, errno, "error reading from '%s'", fname);
3830 if (fclose (config))
3831 gc_error (0, errno, "error closing '%s'", fname);
3835 /* If it all worked, process the options. */
3836 if (!result && update && defaults && !listfp)
3838 /* We need to switch off the runtime update, so that we can do
3839 it later all at once. */
3840 int save_opt_runtime = opt.runtime;
3843 for (component_id = 0; component_id < GC_COMPONENT_NR; component_id++)
3845 gc_component_change_options (component_id, NULL, NULL, 0);
3847 opt.runtime = save_opt_runtime;
3851 for (backend_id = 0; backend_id < GC_BACKEND_NR; backend_id++)
3852 if (runtime[backend_id] && gc_backend[backend_id].runtime_change)
3853 (*gc_backend[backend_id].runtime_change) (0);
3863 * Apply the profile FNAME to all known configure files.
3866 gc_apply_profile (const char *fname)
3869 char *fname_buffer = NULL;
3871 size_t line_len = 0;
3875 int runtime[GC_BACKEND_NR];
3877 int component_id = -1;
3878 int skip_section = 0;
3879 int error_count = 0;
3885 for (backend_id = 0; backend_id < GC_BACKEND_NR; backend_id++)
3886 runtime[backend_id] = 0;
3889 if (!(!strcmp (fname, "-")
3890 || strchr (fname, '/')
3891 #ifdef HAVE_W32_SYSTEM
3892 || strchr (fname, '\\')
3894 || strchr (fname, '.')))
3896 /* FNAME looks like a standard profile name. Check whether one
3897 * is installed and use that instead of the given file name. */
3898 fname_buffer = xstrconcat (gnupg_datadir (), DIRSEP_S,
3899 fname, ".prf", NULL);
3900 if (!access (fname_buffer, F_OK))
3901 fname = fname_buffer;
3904 fp = !strcmp (fname, "-")? es_stdin : es_fopen (fname, "r");
3907 err = gpg_error_from_syserror ();
3908 log_error ("can't open '%s': %s\n", fname, gpg_strerror (err));
3913 log_info ("applying profile '%s'\n", fname);
3916 while ((length = es_read_line (fp, &line, &line_len, NULL)) > 0)
3918 char *name, *flags, *value;
3919 gc_option_t *option_info = NULL;
3924 while (*name == ' ' || *name == '\t')
3926 if (!*name || *name == '#' || *name == '\r' || *name == '\n')
3928 trim_trailing_spaces (name);
3930 /* Check whether this is a new section. */
3935 /* New section: Get the name of the component. */
3936 p = strchr (name, ']');
3940 log_info ("%s:%d:%d: error: syntax error in section tag\n",
3941 fname, lineno, (int)(name - line));
3947 log_info ("%s:%d:%d: warning: garbage after section tag\n",
3948 fname, lineno, (int)(p - line));
3951 component_id = gc_component_find (name);
3952 if (component_id < 0)
3954 log_info ("%s:%d:%d: warning: skipping unknown section '%s'\n",
3955 fname, lineno, (int)(name - line), name );
3963 if (component_id < 0)
3966 log_info ("%s:%d:%d: error: not in a valid section\n",
3967 fname, lineno, (int)(name - line));
3972 /* Parse the option name. */
3973 for (p = name; *p && !spacep (p); p++)
3978 option_info = find_option (component_id, name, GC_BACKEND_ANY);
3982 log_info ("%s:%d:%d: error: unknown option '%s' in section '%s'\n",
3983 fname, lineno, (int)(name - line),
3984 name, gc_component[component_id].name);
3988 /* Parse the optional flags. */
3989 trim_spaces (value);
3994 p = strchr (flags, ']');
3997 log_info ("%s:%d:%d: warning: invalid flag specification\n",
3998 fname, lineno, (int)(p - line));
4003 trim_spaces (value);
4005 else /* No flags given. */
4008 /* Set required defaults. */
4009 if (gc_arg_type[option_info->arg_type].fallback == GC_ARG_TYPE_NONE
4013 /* Check and save this option. */
4015 if (flags && !strcmp (flags, "default"))
4016 newflags |= GC_OPT_FLAG_DEFAULT;
4019 option_info->new_flags = 0;
4022 xfree (option_info->new_value);
4023 option_info->new_value = NULL;
4025 change_one_value (option_info, runtime, newflags, value, 1);
4028 if (length < 0 || es_ferror (fp))
4030 err = gpg_error_from_syserror ();
4032 log_error (_("%s:%u: read error: %s\n"),
4033 fname, lineno, gpg_strerror (err));
4036 log_error (_("error closing '%s'\n"), fname);
4038 log_error (_("error parsing '%s'\n"), fname);
4042 /* If it all worked, process the options. */
4045 /* We need to switch off the runtime update, so that we can do
4046 it later all at once. */
4047 int save_opt_runtime = opt.runtime;
4050 for (component_id = 0; component_id < GC_COMPONENT_NR; component_id++)
4052 gc_component_change_options (component_id, NULL, NULL, 1);
4054 opt.runtime = save_opt_runtime;
4058 for (backend_id = 0; backend_id < GC_BACKEND_NR; backend_id++)
4059 if (runtime[backend_id] && gc_backend[backend_id].runtime_change)
4060 (*gc_backend[backend_id].runtime_change) (0);
4064 xfree (fname_buffer);