chiark / gitweb /
gnupg2.git
9 months agogpg agent lockup fix: Interrupt main loop when active_connections_value==0 841143-bugfix
Ian Jackson [Sun, 8 Jan 2017 18:55:17 +0000 (18:55 +0000)]
gpg agent lockup fix: Interrupt main loop when active_connections_value==0

Otherwise, if this happens (in a parallel thread) after the main loop
found shutdown_pending and checked active_connections>=0, the main
loop could enter a select which would never wake up.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
MORE

9 months agogpg agent threading bugs: Add some `xxx' comments.
Ian Jackson [Sun, 8 Jan 2017 18:37:48 +0000 (18:37 +0000)]
gpg agent threading bugs: Add some `xxx' comments.

I don't intend to fix these now because I think they're not really in
my way for getting the gpg agent races out of the way of dgit
development.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
9 months agogpg-agent connection count: Introduce locking
Ian Jackson [Sun, 8 Jan 2017 18:12:21 +0000 (18:12 +0000)]
gpg-agent connection count: Introduce locking

This variable is incremented and decremented by each individual
thread.  It must therefore be protected by a lock.

Rename it to prove we have found all the references.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
9 months agogpg-agent connection count: Abstract away all direct accesses
Ian Jackson [Sun, 8 Jan 2017 18:03:07 +0000 (18:03 +0000)]
gpg-agent connection count: Abstract away all direct accesses

This variable needs to be protected with a mutex.  We don't want
anyone to access it directly.  So introduce a helper function
adjust_agent_active_connections to increment/decrement it, and replace
all direct accesses.

Also replace a couple of direct read-only accesses with calls to the
existing function get_agent_active_connection_count.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
9 months agoNOT FOR UPSTREAM - CHANGELOG VERSION
Ian Jackson [Sun, 8 Jan 2017 20:36:41 +0000 (20:36 +0000)]
NOT FOR UPSTREAM - CHANGELOG VERSION

9 months agodoc: Document summary values of TOFU_STATS dgit/sid
Andre Heinecke [Fri, 6 Jan 2017 11:26:01 +0000 (12:26 +0100)]
doc: Document summary values of TOFU_STATS

--

Signed-off-by: Andre Heinecke <aheinecke@intevation.de>
(cherry picked from commit e1f68337b979fe4b7c3bd095a83ea832e14efb74)

Gbp-Pq: Name 0025-doc-Document-summary-values-of-TOFU_STATS.patch

9 months agoSilence two -Wlogical-op warnings.
Werner Koch [Thu, 5 Jan 2017 19:42:55 +0000 (20:42 +0100)]
Silence two -Wlogical-op warnings.

* common/tlv.c (parse_ber_header): Avoid compiler warning about a
duplicate condition.
* tools/gpgtar-create.c (pattern_valid_p): Likewise.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 6170eb809033c9d144abf3b1f31f8b936878cdd4)

Gbp-Pq: Name 0024-Silence-two-Wlogical-op-warnings.patch

9 months agodoc: Mention gpgv in the description of gpg --verify.
Werner Koch [Thu, 5 Jan 2017 19:25:16 +0000 (20:25 +0100)]
doc: Mention gpgv in the description of gpg --verify.

--

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 353f6ff37646ad4c24d309a495e6c6f41e5235e3)

Gbp-Pq: Name 0023-doc-Mention-gpgv-in-the-description-of-gpg-verify.patch

9 months agog10: avoid warning when --disable-tofu
Daniel Kahn Gillmor [Wed, 4 Jan 2017 13:31:06 +0000 (08:31 -0500)]
g10: avoid warning when --disable-tofu

If configured with --disable-tofu, we see compiler warnings about an
unused variable.  This should remove those warnings.

(cherry picked from commit 38671cfe5a2a40bb991619f4cb992c42b5f1e8cd)

Gbp-Pq: Name 0022-g10-avoid-warning-when-disable-tofu.patch

9 months agodoc: Add release announcement pointers to NEWS entries.
Werner Koch [Wed, 4 Jan 2017 17:37:36 +0000 (18:37 +0100)]
doc: Add release announcement pointers to NEWS entries.

--

These are used by the website buider to link to the announcement
mails.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 588121c158384b05099388097053d8d1e8bdf143)

Gbp-Pq: Name 0021-doc-Add-release-announcement-pointers-to-NEWS-entrie.patch

9 months agodoc: Extend dirmngr's --allow-version-check description
Werner Koch [Tue, 3 Jan 2017 12:12:25 +0000 (13:12 +0100)]
doc: Extend dirmngr's --allow-version-check description

--

(cherry picked from commit 293a55bacdacec4501af3a396b14fd32e404e39e)

Gbp-Pq: Name 0020-doc-Extend-dirmngr-s-allow-version-check-description.patch

9 months agodirmngr: Make sure Tor mode is also set for DNS on SIGHUP.
Werner Koch [Tue, 3 Jan 2017 11:03:28 +0000 (12:03 +0100)]
dirmngr: Make sure Tor mode is also set for DNS on SIGHUP.

* dirmngr/dns-stuff.c (enable_dns_tormode): Always succeed.
(reload_dns_stuff): Reset tor port.
* dirmngr/dirmngr.c (set_tor_mode): Also enable Tor mode for DNS.
(main): Remove warning that Tor mode may not fully work.
* dirmngr/server.c (cmd_dns_cert): Remove explicit Tor for DNS
initialization.
* dirmngr/t-dns-stuff.c (main): Remove option --new-circuit and error
checking for enable_dns_tormode.
--

This patch also resets the port on SIGHUP so that after starting Tor
SIGHUP is sufficient to use Tor.  Without the SIGHUP and when not
using the Tor browser Dirmngr would keep on trying the Tor browser
port.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 969512401603639e4467ede7d892f1b02582c2c9)

Gbp-Pq: Name 0019-dirmngr-Make-sure-Tor-mode-is-also-set-for-DNS-on-SI.patch

9 months agodirmngr: New debug message on correctly initialized libdns.
Werner Koch [Mon, 2 Jan 2017 14:47:24 +0000 (15:47 +0100)]
dirmngr: New debug message on correctly initialized libdns.

* dirmngr/dns-stuff.c (libdns_init): Add debug level diagnostic on
success.
--

This output may help to avoid questions when evaluating an Assuan log.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 0004d52ba2f1245c84f95a151342ad99fd72ca3d)

Gbp-Pq: Name 0018-dirmngr-New-debug-message-on-correctly-initialized-l.patch

9 months agoReplace use of variable-length-arrays.
Werner Koch [Mon, 2 Jan 2017 12:29:18 +0000 (13:29 +0100)]
Replace use of variable-length-arrays.

* common/t-iobuf.c (main): Replace variable-length-array.
* g10/gpgcompose.c (mksubpkt_callback): Ditto.
(encrypted): Ditto.
* g10/t-stutter.c (log_hexdump): Ditto.
(oracle_test): Ditto.
* g10/tofu.c (get_policy): Ditto.  Use "%zu" for size_t.
* scd/app-openpgp.c (ecc_writekey): Replace variable-length-array.
Check for zero length OID_LEN.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 6b84ecbf312d98ac8cce9fe5facdc815bc742fa1)

Gbp-Pq: Name 0017-Replace-use-of-variable-length-arrays.patch

9 months agobuild: Enable gcc warnings to detect non-portable code.
Werner Koch [Mon, 2 Jan 2017 11:59:10 +0000 (12:59 +0100)]
build: Enable gcc warnings to detect non-portable code.

--

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit c52930d11fcc52515fcc09a1085bf118411566a8)

Gbp-Pq: Name 0016-build-Enable-gcc-warnings-to-detect-non-portable-cod.patch

9 months agodoc: Remove warning that DNS is not routed via Tor
Werner Koch [Mon, 2 Jan 2017 09:39:59 +0000 (10:39 +0100)]
doc: Remove warning that DNS is not routed via Tor

--

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 5a4a109354d53cf3673d0636731c67021d3f367a)

Gbp-Pq: Name 0015-doc-Remove-warning-that-DNS-is-not-routed-via-Tor.patch

9 months agodirmngr: Strip root zone suffix from libdns cname results.
Werner Koch [Mon, 2 Jan 2017 09:00:33 +0000 (10:00 +0100)]
dirmngr: Strip root zone suffix from libdns cname results.

* dirmngr/dns-stuff.c (resolve_name_libdns): Strip trailing dot.
(get_dns_cname_libdns): Ditto.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit b200e636ab20d2aa93d9f71f3789db5a04af0a56)

Gbp-Pq: Name 0014-dirmngr-Strip-root-zone-suffix-from-libdns-cname-res.patch

9 months agodirmngr: Fix for --disable-libdns usage.
NIIBE Yutaka [Fri, 23 Dec 2016 07:05:01 +0000 (16:05 +0900)]
dirmngr: Fix for --disable-libdns usage.

* dirmngr/dns-stuff.c (enable_recursive_resolver, set_dns_nameserver)
(reload_dns_stuff): Conditionalize with USE_LIBDNS.
(get_h_errno_as_gpg_error): Map HOST_NOT_FOUND to GPG_ERR_NO_NAME.

--

get_dns_srv assumes error code of GPG_ERR_NO_NAME when no SRV record
available.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
GnuPG-bug-id: 2889
(cherry picked from commit d26c51825e2255fe58305cbc1cd74fa43f80d93e)

Gbp-Pq: Name 0013-dirmngr-Fix-for-disable-libdns-usage.patch

9 months agogpgscm: Guard use of union member.
Justus Winter [Wed, 21 Dec 2016 15:14:45 +0000 (16:14 +0100)]
gpgscm: Guard use of union member.

* tests/gpgscm/scheme.c (opexe_5): Check that we have a file port
before accessing filename.  Fixes a crash on 32-bit architectures.

Fixes-commit: e7429b1ced0c69fa7901f888f8dc25f00fc346a4
Signed-off-by: Justus Winter <justus@g10code.com>
(cherry picked from commit 6e96cdd41a0e55b672309431062f37c4a4a9f485)

Gbp-Pq: Name 0012-gpgscm-Guard-use-of-union-member.patch

9 months agoagent: Avoid scheduled checks on socket when inotify is working.
Daniel Kahn Gillmor [Tue, 1 Nov 2016 04:57:44 +0000 (00:57 -0400)]
agent: Avoid scheduled checks on socket when inotify is working.

* agent/gpg-agent.c (handle_connections): When inotify is working, we
do not need to schedule a timer to evaluate whether we control our own
socket or not.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Gbp-Pq: Topic gpg-agent-idling
Gbp-Pq: Name 0004-agent-Avoid-scheduled-checks-on-socket-when-inotify-.patch

9 months agoagent: Avoid tight timer tick when possible.
Daniel Kahn Gillmor [Tue, 1 Nov 2016 04:14:10 +0000 (00:14 -0400)]
agent: Avoid tight timer tick when possible.

* agent/gpg-agent.c (need_tick): Evaluate whether the short-phase
handle_tick() is needed.
(handle_connections): On each cycle of the select loop, adjust whether
we should call handle_tick() or not.
* agent/call-scd.c (start_scd): Call interrupt_main_thread_loop() once
the scdaemon thread context has started up.

--

With this change, an idle gpg-agent that has no scdaemon running only
wakes up once a minute (to check_own_socket).

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Gbp-Pq: Topic gpg-agent-idling
Gbp-Pq: Name 0003-agent-Avoid-tight-timer-tick-when-possible.patch

9 months agoagent: Allow threads to interrupt main select loop with SIGCONT.
Daniel Kahn Gillmor [Tue, 1 Nov 2016 04:45:23 +0000 (00:45 -0400)]
agent: Allow threads to interrupt main select loop with SIGCONT.

* agent/gpg-agent.c (interrupt_main_thread_loop): New function on
non-windows platforms, allows other threads to interrupt the main loop
if there's something that the main loop might be interested in.

--

For example, the main loop might be interested in changes in program
state that affect the timers it expects to see.

I don't know how to do this on Windows platforms, but i welcome any
proposed improvements.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Gbp-Pq: Topic gpg-agent-idling
Gbp-Pq: Name 0002-agent-Allow-threads-to-interrupt-main-select-loop-wi.patch

9 months agoagent: Create framework of scheduled timers.
Daniel Kahn Gillmor [Tue, 1 Nov 2016 01:27:36 +0000 (21:27 -0400)]
agent: Create framework of scheduled timers.

agent/gpg-agent.c (handle_tick): Remove intermittent call to
check_own_socket.
(tv_is_set): Add inline helper function for readability.
(handle_connections) Create general table of pending scheduled
timeouts.

--

handle_tick() does fine-grained, rapid activity.  check_own_socket()
is supposed to happen at a different interval.

Mixing the two of them makes it a requirement that one interval be a
multiple of the other, which isn't ideal if there are different delay
strategies that we might want in the future.

Creating an extensible regular timer framework in handle_connections
should make it possible to have any number of cadenced timers fire
regularly, without requiring that they happen in cadences related to
each other.

It should also make it possible to dynamically change the cadence of
any regularly-scheduled timeout.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Gbp-Pq: Topic gpg-agent-idling
Gbp-Pq: Name 0001-agent-Create-framework-of-scheduled-timers.patch

9 months agodirmngr: Drop useless housekeeping.
Daniel Kahn Gillmor [Sat, 29 Oct 2016 06:15:08 +0000 (02:15 -0400)]
dirmngr: Drop useless housekeeping.

* dirmngr/dirmngr.c (handle_tick, time_for_housekeeping_p,
housekeeping_thread): Remove, no longer needed.
(handle_connections): Drop any attempt at a timeout, since no
housekeeping is necessary.

--

The housekeeping thread no longer does anything, and the main loop was
waking up every 60 seconds for no good reason.  The code is simpler
and the runtime is more efficient if we drop this.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Gbp-Pq: Topic dirmngr-idling
Gbp-Pq: Name 0005-dirmngr-Drop-useless-housekeeping.patch

9 months agodirmngr: Avoid automatically checking upstream swdb.
Daniel Kahn Gillmor [Mon, 21 Nov 2016 04:09:24 +0000 (23:09 -0500)]
dirmngr: Avoid automatically checking upstream swdb.

* dirmngr/dirmngr.c (housekeeping_thread): Avoid automatically
checking upstream's software database.  In Debian, software updates
should be handled by the distro mechanism, and additional upstream
checks only confuse the user.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Gbp-Pq: Topic dirmngr-idling
Gbp-Pq: Name 0004-dirmngr-Avoid-automatically-checking-upstream-swdb.patch

9 months agodimrngr: Avoid need for hkp housekeeping.
Daniel Kahn Gillmor [Sat, 29 Oct 2016 06:00:50 +0000 (02:00 -0400)]
dimrngr: Avoid need for hkp housekeeping.

* dirmngr/ks-engine-hkp.c (host_is_alive): New function.  Test whether
host is alive and resurrects it if it has been dead long enough.
(select_random_host, map_host, ks_hkp_mark_host): Use host_is_alive
instead of testing hostinfo_t->dead directly.
(ks_hkp_housekeeping): Remove function, no longer needed.
* dirmngr/dirmngr.c (housekeeping_thread): Remove call to
ks_hkp_housekeeping.

--

Rather than resurrecting hosts upon scheduled resurrection times, test
whether hosts should be resurrected as they're inspected for being
dead.  This removes the need for explicit housekeeping, and makes host
resurrections happen "just in time", rather than being clustered on
HOUSEKEEPING_INTERVAL seconds.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Gbp-Pq: Topic dirmngr-idling
Gbp-Pq: Name 0002-dimrngr-Avoid-need-for-hkp-housekeeping.patch

9 months agodirmngr: hkp: Avoid potential race condition when some hosts die.
Daniel Kahn Gillmor [Sat, 29 Oct 2016 05:25:05 +0000 (01:25 -0400)]
dirmngr: hkp: Avoid potential race condition when some hosts die.

* dirmngr/ks-engine-hkp.c (select_random_host): Use atomic pass
through the host table instead of risking out-of-bounds write.

--

Multiple threads may write to hosttable[x]->dead while
select_random_host() is running.  For example, a housekeeping thread
might clear the ->dead bit on some entries, or another connection to
dirmngr might manually mark a host as alive.

If one or more hosts are resurrected between the two loops over a
given table in select_random_host(), then the allocation of tbl might
not be large enough, resulting in a write past the end of tbl on the
second loop.

This change collapses the two loops into a single loop to avoid this
discrepancy: each host's "dead" bit is now only checked once.

As Werner points out, this isn't currently strictly necessary, since
npth will not switch threads unless a blocking system call is made,
and no blocking system call is made in these two loops.

However, in a subsequent change in this series, we will call a
function in this loop, and that function may sometimes write(2), or
call other functions, which may themselves block.  Keeping this as a
single-pass loop avoids the need to keep track of what might block and
what might not.

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Gbp-Pq: Topic dirmngr-idling
Gbp-Pq: Name 0001-dirmngr-hkp-Avoid-potential-race-condition-when-some.patch

9 months agoavoid regenerating defsincdate (use shipped file)
Daniel Kahn Gillmor [Mon, 29 Aug 2016 16:34:42 +0000 (12:34 -0400)]
avoid regenerating defsincdate (use shipped file)

upstream ships doc/defsincdate in its tarballs.  but doc/Makefile.am
tries to rewrite doc/defsincdate if it notices that any of the files
have been modified more recently, and it does so assuming that we're
running from a git repo.

However, we'd rather ship the documents cleanly without regenerating
defsincdate -- we don't have a git repo available (debian builds from
upstream tarballs) and any changes to the texinfo files (e.g. from
debian/patches/) might result in different dates on the files than we
expect after they're applied by dpkg or quilt or whatever, which makes
the datestamp unreproducible.

Gbp-Pq: Topic debian-packaging
Gbp-Pq: Name 0003-avoid-regenerating-defsincdate-use-shipped-file.patch

9 months agoAvoid simple memory dumps via ptrace
Daniel Kahn Gillmor [Wed, 12 Aug 2015 00:28:26 +0000 (20:28 -0400)]
Avoid simple memory dumps via ptrace

This avoids needing to setgid gpg-agent.  It probably doesn't defend
against all possible attacks, but it defends against one specific (and
easy) one.  If there are other protections we should do them too.

This will make it slightly harder to debug the agent because the
normal user won't be able to attach gdb to it directly while it runs.

The remaining options for debugging are:

 * launch the agent from gdb directly
 * connect gdb to a running agent as the superuser

Upstream bug: https://bugs.gnupg.org/gnupg/issue1211

Gbp-Pq: Topic block-ptrace-on-agent
Gbp-Pq: Name 0002-Avoid-simple-memory-dumps-via-ptrace.patch

9 months agoavoid-beta-warning
Debian GnuPG Maintainers [Tue, 14 Apr 2015 14:02:31 +0000 (10:02 -0400)]
avoid-beta-warning

avoid self-describing as a beta

Using autoreconf against the source as distributed in tarball form
invariably results in a package that thinks it's a "beta" package,
which produces the "THIS IS A DEVELOPMENT VERSION" warning string.

since we use dh_autoreconf, i need this patch to avoid producing
builds that announce themselves as DEVELOPMENT VERSIONs.

See discussion at:

 http://lists.gnupg.org/pipermail/gnupg-devel/2014-November/029065.html

Gbp-Pq: Topic debian-packaging
Gbp-Pq: Name 0001-avoid-beta-warning.patch

9 months agognupg2 (2.1.17-3) unstable; urgency=medium
Daniel Kahn Gillmor [Tue, 3 Jan 2017 20:39:52 +0000 (20:39 +0000)]
gnupg2 (2.1.17-3) unstable; urgency=medium

  * more bugfixes from upstream (improving but not yet closing: #849845)

[dgit import unpatched gnupg2 2.1.17-3]

9 months agoImport gnupg2_2.1.17-3.debian.tar.bz2
Daniel Kahn Gillmor [Tue, 3 Jan 2017 20:39:52 +0000 (20:39 +0000)]
Import gnupg2_2.1.17-3.debian.tar.bz2

[dgit import tarball gnupg2 2.1.17-3 gnupg2_2.1.17-3.debian.tar.bz2]

9 months agoImport gnupg2_2.1.17.orig.tar.bz2
Daniel Kahn Gillmor [Sat, 24 Dec 2016 20:39:04 +0000 (20:39 +0000)]
Import gnupg2_2.1.17.orig.tar.bz2

[dgit import orig gnupg2_2.1.17.orig.tar.bz2]