1 /* dirmngr.h - Common definitions for the dirmngr 2 * Copyright (C) 2002 Klarälvdalens Datakonsult AB 3 * Copyright (C) 2004, 2015 g10 Code GmbH 4 * Copyright (C) 2014 Werner Koch 5 * 6 * This file is part of GnuPG. 7 * 8 * GnuPG is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 3 of the License, or 11 * (at your option) any later version. 12 * 13 * GnuPG is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, see <https://www.gnu.org/licenses/>. 20 * 21 * SPDX-License-Identifier: GPL-3.0+ 22 */ 23 24 #ifndef DIRMNGR_H 25 #define DIRMNGR_H 26 27 #include "./dirmngr-err.h" 28 #define map_assuan_err(a) \ 29 map_assuan_err_with_source (GPG_ERR_SOURCE_DEFAULT, (a)) 30 #include <errno.h> 31 #include <gcrypt.h> 32 #include <ksba.h> 33 34 #include "../common/util.h" 35 #include "../common/membuf.h" 36 #include "../common/sysutils.h" /* (gnupg_fd_t) */ 37 #include "../common/asshelp.h" /* (assuan_context_t) */ 38 #include "../common/i18n.h" 39 #include "dirmngr-status.h" 40 #include "http.h" /* (parsed_uri_t) */ 41 42 /* This objects keeps information about a particular LDAP server and 43 is used as item of a single linked list of servers. */ 44 struct ldap_server_s 45 { 46 struct ldap_server_s* next; 47 48 char *host; 49 int port; 50 char *user; 51 char *pass; 52 char *base; 53 unsigned int starttls:1; /* Use STARTTLS. */ 54 unsigned int ldap_over_tls:1; /* Use LDAP over an TLS tunnel */ 55 unsigned int ntds:1; /* Use Active Directory authentication. */ 56 }; 57 typedef struct ldap_server_s *ldap_server_t; 58 59 60 /* This objects is used to build a list of URI consisting of the 61 original and the parsed URI. */ 62 struct uri_item_s 63 { 64 struct uri_item_s *next; 65 parsed_uri_t parsed_uri; /* The broken down URI. */ 66 char uri[1]; /* The original URI. */ 67 }; 68 typedef struct uri_item_s *uri_item_t; 69 70 71 /* A list of fingerprints. */ 72 struct fingerprint_list_s; 73 typedef struct fingerprint_list_s *fingerprint_list_t; 74 struct fingerprint_list_s 75 { 76 fingerprint_list_t next; 77 char binlen; /* If this is not 0 hexfpr actually carries a binary fpr. */ 78 char hexfpr[20+20+1]; 79 }; 80 81 82 /* A large struct named "opt" to keep global flags. */ 83 EXTERN_UNLESS_MAIN_MODULE 84 struct 85 { 86 unsigned int debug; /* debug flags (DBG_foo_VALUE) */ 87 int verbose; /* verbosity level */ 88 int quiet; /* be as quiet as possible */ 89 int dry_run; /* don't change any persistent data */ 90 int batch; /* batch mode */ 91 const char *homedir_cache; /* Dir for cache files (/var/cache/dirmngr). */ 92 93 char *config_filename; /* Name of a config file, which will be 94 reread on a HUP if it is not NULL. */ 95 96 char *ldap_wrapper_program; /* Override value for the LDAP wrapper 97 program. */ 98 char *http_wrapper_program; /* Override value for the HTTP wrapper 99 program. */ 100 101 int running_detached; /* We are running in detached mode. */ 102 int allow_version_check; /* --allow-version-check is active. */ 103 104 int force; /* Force loading outdated CRLs. */ 105 106 107 unsigned int connect_timeout; /* Timeout for connect. */ 108 unsigned int connect_quick_timeout; /* Shorter timeout for connect. */ 109 110 int disable_http; /* Do not use HTTP at all. */ 111 int disable_ldap; /* Do not use LDAP at all. */ 112 int disable_ipv4; /* Do not use legacy IP addresses. */ 113 int disable_ipv6; /* Do not use standard IP addresses. */ 114 int honor_http_proxy; /* Honor the http_proxy env variable. */ 115 const char *http_proxy; /* The default HTTP proxy. */ 116 const char *ldap_proxy; /* Use given LDAP proxy. */ 117 int only_ldap_proxy; /* Only use the LDAP proxy; no fallback. */ 118 int ignore_http_dp; /* Ignore HTTP CRL distribution points. */ 119 int ignore_ldap_dp; /* Ignore LDAP CRL distribution points. */ 120 int ignore_ocsp_service_url; /* Ignore OCSP service URLs as given in 121 the certificate. */ 122 123 /* A list of fingerprints of certififcates we should completely 124 * ignore. These are all stored in binary format. */ 125 fingerprint_list_t ignored_certs; 126 127 /* A list of certificate extension OIDs which are ignored so that 128 one can claim that a critical extension has been handled. One 129 OID per string. */ 130 strlist_t ignored_cert_extensions; 131 132 int allow_ocsp; /* Allow using OCSP. */ 133 134 int max_replies; 135 unsigned int ldaptimeout; 136 137 ldap_server_t ldapservers; 138 int add_new_ldapservers; 139 140 const char *ocsp_responder; /* Standard OCSP responder's URL. */ 141 fingerprint_list_t ocsp_signer; /* The list of fingerprints with allowed 142 standard OCSP signer certificates. */ 143 144 unsigned int ocsp_max_clock_skew; /* Allowed seconds of clocks skew. */ 145 unsigned int ocsp_max_period; /* Seconds a response is at maximum 146 considered valid after thisUpdate. */ 147 unsigned int ocsp_current_period; /* Seconds a response is considered 148 current after nextUpdate. */ 149 150 strlist_t keyserver; /* List of default keyservers. */ 151 } opt; 152 153 154 #define DBG_X509_VALUE 1 /* debug x.509 parsing */ 155 #define DBG_CRYPTO_VALUE 4 /* debug low level crypto */ 156 #define DBG_DNS_VALUE 16 /* debug DNS calls. */ 157 #define DBG_MEMORY_VALUE 32 /* debug memory allocation stuff */ 158 #define DBG_CACHE_VALUE 64 /* debug the caching */ 159 #define DBG_MEMSTAT_VALUE 128 /* show memory statistics */ 160 #define DBG_HASHING_VALUE 512 /* debug hashing operations */ 161 #define DBG_IPC_VALUE 1024 /* debug assuan communication */ 162 #define DBG_NETWORK_VALUE 2048 /* debug network I/O. */ 163 #define DBG_LOOKUP_VALUE 8192 /* debug lookup details */ 164 #define DBG_EXTPROG_VALUE 16384 /* debug external program calls */ 165 166 #define DBG_X509 (opt.debug & DBG_X509_VALUE) 167 #define DBG_CRYPTO (opt.debug & DBG_CRYPTO_VALUE) 168 #define DBG_DNS (opt.debug & DBG_DNS_VALUE) 169 #define DBG_MEMORY (opt.debug & DBG_MEMORY_VALUE) 170 #define DBG_CACHE (opt.debug & DBG_CACHE_VALUE) 171 #define DBG_HASHING (opt.debug & DBG_HASHING_VALUE) 172 #define DBG_IPC (opt.debug & DBG_IPC_VALUE) 173 #define DBG_NETWORK (opt.debug & DBG_NETWORK_VALUE) 174 #define DBG_LOOKUP (opt.debug & DBG_LOOKUP_VALUE) 175 #define DBG_EXTPROG (opt.debug & DBG_EXTPROG_VALUE) 176 177 /* A simple list of certificate references. FIXME: Better use 178 certlist_t also for references (Store NULL at .cert) */ 179 struct cert_ref_s 180 { 181 struct cert_ref_s *next; 182 unsigned char fpr[20]; 183 }; 184 typedef struct cert_ref_s *cert_ref_t; 185 186 187 /* Forward references; access only through server.c. */ 188 struct server_local_s; 189 190 #if SIZEOF_UNSIGNED_LONG == 8 191 # define SERVER_CONTROL_MAGIC 0x6469726d6e677220 192 #else 193 # define SERVER_CONTROL_MAGIC 0x6469726d 194 #endif 195 196 /* Connection control structure. */ 197 struct server_control_s 198 { 199 unsigned long magic;/* Always has SERVER_CONTROL_MAGIC. */ 200 int refcount; /* Count additional references to this object. */ 201 int no_server; /* We are not running under server control. */ 202 int status_fd; /* Only for non-server mode. */ 203 struct server_local_s *server_local; 204 int force_crl_refresh; /* Always load a fresh CRL. */ 205 206 int check_revocations_nest_level; /* Internal to check_revovations. */ 207 cert_ref_t ocsp_certs; /* Certificates from the current OCSP 208 response. */ 209 210 int audit_events; /* Send audit events to client. */ 211 char *http_proxy; /* The used http_proxy or NULL. */ 212 213 unsigned int timeout; /* Timeout for connect calls in ms. */ 214 215 unsigned int http_no_crl:1; /* Do not check CRLs for https. */ 216 }; 217 218 219 /*-- dirmngr.c --*/ 220 void dirmngr_exit( int ); /* Wrapper for exit() */ 221 void dirmngr_init_default_ctrl (ctrl_t ctrl); 222 void dirmngr_deinit_default_ctrl (ctrl_t ctrl); 223 void dirmngr_sighup_action (void); 224 const char* dirmngr_get_current_socket_name (void); 225 int dirmngr_use_tor (void); 226 227 /*-- Various housekeeping functions. --*/ 228 void ks_hkp_housekeeping (time_t curtime); 229 void ks_hkp_reload (void); 230 void ks_hkp_init (void); 231 232 /*-- server.c --*/ 233 ldap_server_t get_ldapservers_from_ctrl (ctrl_t ctrl); 234 ksba_cert_t get_cert_local (ctrl_t ctrl, const char *issuer); 235 ksba_cert_t get_issuing_cert_local (ctrl_t ctrl, const char *issuer); 236 ksba_cert_t get_cert_local_ski (ctrl_t ctrl, 237 const char *name, ksba_sexp_t keyid); 238 gpg_error_t get_istrusted_from_client (ctrl_t ctrl, const char *hexfpr); 239 int dirmngr_assuan_log_monitor (assuan_context_t ctx, unsigned int cat, 240 const char *msg); 241 void start_command_handler (gnupg_fd_t fd, unsigned int session_id); 242 gpg_error_t dirmngr_tick (ctrl_t ctrl); 243 244 /*-- http-ntbtls.c --*/ 245 /* Note that we don't use a callback for gnutls. */ 246 247 gpg_error_t gnupg_http_tls_verify_cb (void *opaque, 248 http_t http, 249 http_session_t session, 250 unsigned int flags, 251 void *tls_context); 252 253 254 /*-- loadswdb.c --*/ 255 gpg_error_t dirmngr_load_swdb (ctrl_t ctrl, int force); 256 257 258 /*-- domaininfo.c --*/ 259 void domaininfo_print_stats (void); 260 int domaininfo_is_wkd_not_supported (const char *domain); 261 void domaininfo_set_no_name (const char *domain); 262 void domaininfo_set_wkd_supported (const char *domain); 263 void domaininfo_set_wkd_not_supported (const char *domain); 264 void domaininfo_set_wkd_not_found (const char *domain); 265 266 /*-- workqueue.c --*/ 267 typedef const char *(*wqtask_t)(ctrl_t ctrl, const char *args); 268 269 void workqueue_dump_queue (ctrl_t ctrl); 270 gpg_error_t workqueue_add_task (wqtask_t func, const char *args, 271 unsigned int session_id, int need_network); 272 void workqueue_run_global_tasks (ctrl_t ctrl, int with_network); 273 void workqueue_run_post_session_tasks (unsigned int session_id); 274 275 276 277 #endif /*DIRMNGR_H*/ 278