1 /* gpgsm.h - Global definitions for GpgSM
2 * Copyright (C) 2001, 2003, 2004, 2007, 2009,
3 * 2010 Free Software Foundation, Inc.
5 * This file is part of GnuPG.
7 * GnuPG is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
12 * GnuPG is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <https://www.gnu.org/licenses/>.
24 #ifdef GPG_ERR_SOURCE_DEFAULT
25 #error GPG_ERR_SOURCE_DEFAULT already defined
27 #define GPG_ERR_SOURCE_DEFAULT GPG_ERR_SOURCE_GPGSM
28 #include <gpg-error.h>
32 #include "../common/util.h"
33 #include "../common/status.h"
34 #include "../common/audit.h"
35 #include "../common/session-env.h"
36 #include "../common/ksba-io-support.h"
37 #include "../common/compliance.h"
39 /* The maximum length of a binary fingerprints. This is used to
40 * provide a static buffer and will be increased if we need to support
41 * longer fingerprints. */
42 #define MAX_FINGERPRINT_LEN 32
44 /* The maximum length of a binary digest. */
45 #define MAX_DIGEST_LEN 64 /* Fits for SHA-512 */
48 /* A large struct named "opt" to keep global flags. */
49 EXTERN_UNLESS_MAIN_MODULE
52 unsigned int debug; /* debug flags (DBG_foo_VALUE) */
53 int verbose; /* verbosity level */
54 int quiet; /* be as quiet as possible */
55 int batch; /* run in batch mode, i.e w/o any user interaction */
56 int answer_yes; /* assume yes on most questions */
57 int answer_no; /* assume no on most questions */
58 int dry_run; /* don't change any persistent data */
59 int no_homedir_creation;
60 int use_keyboxd; /* Use the external keyboxd as storage backend. */
62 const char *config_filename; /* Name of the used config file. */
63 const char *agent_program;
65 const char *keyboxd_program;
67 session_env_t session_env;
72 const char *dirmngr_program;
73 int disable_dirmngr; /* Do not do any dirmngr calls. */
74 const char *protect_tool_program;
75 char *outfile; /* name of output file */
77 int with_key_data;/* include raw key in the column delimited output */
79 int fingerprint; /* list fingerprints in all key listings */
81 int with_md5_fingerprint; /* Also print an MD5 fingerprint for
82 standard key listings. */
84 int with_keygrip; /* Option --with-keygrip active. */
86 int with_key_screening; /* Option --with-key-screening active. */
88 int no_pretty_dn; /* Option --no-pretty-dn */
93 int armor; /* force base64 armoring (see also ctrl.with_base64) */
94 int no_armor; /* don't try to figure out whether data is base64 armored*/
96 const char *p12_charset; /* Use this charset for encoding the
97 pkcs#12 passphrase. */
100 const char *def_cipher_algoid; /* cipher algorithm to use if
101 nothing else is specified */
103 int def_compress_algo; /* Ditto for compress algorithm */
105 int forced_digest_algo; /* User forced hash algorithm. */
107 int force_ecdh_sha1kdf; /* Only for debugging and testing. */
109 char *def_recipient; /* userID of the default recipient */
110 int def_recipient_self; /* The default recipient is the default key */
112 int no_encrypt_to; /* Ignore all as encrypt to marked recipients. */
114 char *local_user; /* NULL or argument to -u */
116 int extra_digest_algo; /* A digest algorithm also used for
117 verification of signatures. */
119 int always_trust; /* Trust the given keys even if there is no
120 valid certification chain */
121 int skip_verify; /* do not check signatures on data */
123 int lock_once; /* Keep lock once they are set */
125 int ignore_time_conflict; /* Ignore certain time conflicts */
127 int no_crl_check; /* Don't do a CRL check */
128 int no_trusted_cert_crl_check; /* Don't run a CRL check for trusted certs. */
129 int force_crl_refresh; /* Force refreshing the CRL. */
130 int enable_issuer_based_crl_check; /* Backward compatibility hack. */
131 int enable_ocsp; /* Default to use OCSP checks. */
133 char *policy_file; /* full pathname of policy file */
134 int no_policy_check; /* ignore certificate policies */
135 int no_chain_validation; /* Bypass all cert chain validity tests */
136 int ignore_expiration; /* Ignore the notAfter validity checks. */
138 int auto_issuer_key_retrieve; /* try to retrieve a missing issuer key. */
140 int qualsig_approval; /* Set to true if this software has
141 officially been approved to create an
142 verify qualified signatures. This is a
143 runtime option in case we want to check
144 the integrity of the software at
147 unsigned int min_rsa_length; /* Used for compliance checks. */
151 /* A list of certificate extension OIDs which are ignored so that
152 one can claim that a critical extension has been handled. One
154 strlist_t ignored_cert_extensions;
156 /* A list of OIDs which will be used to ignore certificates with
157 * sunch an OID during --learn-card. */
158 strlist_t ignore_cert_with_oid;
160 /* The current compliance mode. */
161 enum gnupg_compliance_mode compliance;
163 /* Fail if an operation can't be done in the requested compliance
165 int require_compliance;
167 /* Enable creation of authenticode signatures. */
170 /* A list of extra attributes put into a signed data object. For a
171 * signed each attribute each string has the format:
172 * <oid>:s:<hex_or_filename>
173 * and for an unsigned attribute
174 * <oid>:u:<hex_or_filename>
175 * The OID is in the usual dotted decimal for. The HEX_OR_FILENAME
176 * is either a list of hex digits or a filename with the DER encoded
177 * value. A filename is detected by the presence of a slash in the
178 * HEX_OR_FILENAME. The actual value needs to be encoded as a SET OF
179 * attribute values. */
180 strlist_t attributes;
182 /* Compatibility flags (COMPAT_FLAG_xxxx). */
183 unsigned int compat_flags;
186 /* Debug values and macros. */
187 #define DBG_X509_VALUE 1 /* debug x.509 data reading/writing */
188 #define DBG_MPI_VALUE 2 /* debug mpi details */
189 #define DBG_CRYPTO_VALUE 4 /* debug low level crypto */
190 #define DBG_MEMORY_VALUE 32 /* debug memory allocation stuff */
191 #define DBG_CACHE_VALUE 64 /* debug the caching */
192 #define DBG_MEMSTAT_VALUE 128 /* show memory statistics */
193 #define DBG_HASHING_VALUE 512 /* debug hashing operations */
194 #define DBG_IPC_VALUE 1024 /* debug assuan communication */
195 #define DBG_CLOCK_VALUE 4096
196 #define DBG_LOOKUP_VALUE 8192 /* debug the key lookup */
198 #define DBG_X509 (opt.debug & DBG_X509_VALUE)
199 #define DBG_CRYPTO (opt.debug & DBG_CRYPTO_VALUE)
200 #define DBG_MEMORY (opt.debug & DBG_MEMORY_VALUE)
201 #define DBG_CACHE (opt.debug & DBG_CACHE_VALUE)
202 #define DBG_HASHING (opt.debug & DBG_HASHING_VALUE)
203 #define DBG_IPC (opt.debug & DBG_IPC_VALUE)
204 #define DBG_CLOCK (opt.debug & DBG_CLOCK_VALUE)
205 #define DBG_LOOKUP (opt.debug & DBG_LOOKUP_VALUE)
208 /* Compatibility flags */
209 /* Telesec RSA cards produced for NRW in 2022 came with only the
210 * keyAgreement bit set. This flag allows there use for encryption
211 * anyway. Example cert:
212 * Issuer: /CN=DOI CA 10a/OU=DOI/O=PKI-1-Verwaltung/C=DE
213 * key usage: digitalSignature nonRepudiation keyAgreement
214 * policies: 1.3.6.1.4.1.7924.1.1:N:
216 #define COMPAT_ALLOW_KA_TO_ENCR 1
219 /* Forward declaration for an object defined in server.c */
220 struct server_local_s;
222 /* Object used to keep state locally in keydb.c */
223 struct keydb_local_s;
224 typedef struct keydb_local_s *keydb_local_t;
227 /* Session control object. This object is passed down to most
228 functions. Note that the default values for it are set by
229 gpgsm_init_default_ctrl(). */
230 struct server_control_s
232 int no_server; /* We are not running under server control */
233 int status_fd; /* Only for non-server mode */
234 struct server_local_s *server_local;
236 keydb_local_t keydb_local; /* Local data for call-keyboxd.c */
238 audit_ctx_t audit; /* NULL or a context for the audit subsystem. */
239 int agent_seen; /* Flag indicating that the gpg-agent has been
242 int with_colons; /* Use column delimited output format */
243 int with_secret; /* Mark secret keys in a public key listing. */
244 int with_chain; /* Include the certifying certs in a listing */
245 int with_validation;/* Validate each key while listing. */
246 int with_ephemeral_keys; /* Include ephemeral flagged keys in the
249 int autodetect_encoding; /* Try to detect the input encoding */
250 int is_pem; /* Is in PEM format */
251 int is_base64; /* is in plain base-64 format */
253 /* If > 0 a hint with the expected number of input data bytes. This
254 * is not necessary an exact number but intended to be used for
255 * progress info and to decide on how to allocate buffers. */
256 uint64_t input_size_hint;
258 int create_base64; /* Create base64 encoded output */
259 int create_pem; /* create PEM output */
260 const char *pem_name; /* PEM name to use */
262 int include_certs; /* -1 to send all certificates in the chain
263 along with a signature or the number of
264 certificates up the chain (0 = none, 1 = only
266 int use_ocsp; /* Set to true if OCSP should be used. */
267 int validation_model; /* 0 := standard model (shell),
270 int offline; /* If true gpgsm won't do any network access. */
272 /* The current time. Used as a helper in certchain.c. */
273 ksba_isotime_t current_time;
275 /* The revocation info. Used as a helper inc ertchain.c */
276 gnupg_isotime_t revoked_at;
277 char *revocation_reason;
281 /* An object to keep a list of certificates. */
284 struct certlist_s *next;
286 int is_encrypt_to; /* True if the certificate has been set through
287 the --encrypto-to option. */
288 int pk_algo; /* The PK_ALGO from CERT or 0 if not yet known. */
289 int hash_algo; /* Used to track the hash algorithm to use. */
290 const char *hash_algo_oid; /* And the corresponding OID. */
292 typedef struct certlist_s *certlist_t;
295 /* A structure carrying information about trusted root certificates. */
296 struct rootca_flags_s
298 unsigned int valid:1; /* The rest of the structure has valid
300 unsigned int relax:1; /* Relax checking of root certificates. */
301 unsigned int chain_model:1; /* Root requires the use of the chain model. */
302 unsigned int qualified:1; /* Root CA used for qualfied signatures. */
303 unsigned int de_vs:1; /* Root CA is de-vs compliant. */
309 extern int gpgsm_errors_seen;
311 void gpgsm_exit (int rc);
312 void gpgsm_init_default_ctrl (struct server_control_s *ctrl);
313 void gpgsm_deinit_default_ctrl (ctrl_t ctrl);
314 int gpgsm_parse_validation_model (const char *model);
317 void gpgsm_server (certlist_t default_recplist);
318 gpg_error_t gpgsm_status (ctrl_t ctrl, int no, const char *text);
319 gpg_error_t gpgsm_status2 (ctrl_t ctrl, int no, ...) GPGRT_ATTR_SENTINEL(0);
320 gpg_error_t gpgsm_status_with_err_code (ctrl_t ctrl, int no, const char *text,
322 gpg_error_t gpgsm_status_with_error (ctrl_t ctrl, int no, const char *text,
324 gpg_error_t gpgsm_progress_cb (ctrl_t ctrl, uint64_t current, uint64_t total);
325 gpg_error_t gpgsm_proxy_pinentry_notify (ctrl_t ctrl,
326 const unsigned char *line);
328 /*-- fingerprint --*/
329 unsigned char *gpgsm_get_fingerprint (ksba_cert_t cert, int algo,
330 unsigned char *array, int *r_len);
331 char *gpgsm_get_fingerprint_string (ksba_cert_t cert, int algo);
332 char *gpgsm_get_fingerprint_hexstring (ksba_cert_t cert, int algo);
333 unsigned long gpgsm_get_short_fingerprint (ksba_cert_t cert,
334 unsigned long *r_high);
335 unsigned char *gpgsm_get_keygrip (ksba_cert_t cert, unsigned char *array);
336 char *gpgsm_get_keygrip_hexstring (ksba_cert_t cert);
337 int gpgsm_get_key_algo_info (ksba_cert_t cert, unsigned int *nbits);
338 int gpgsm_get_key_algo_info2 (ksba_cert_t cert, unsigned int *nbits,
340 int gpgsm_is_ecc_key (ksba_cert_t cert);
341 char *gpgsm_pubkey_algo_string (ksba_cert_t cert, int *r_algoid);
342 gcry_mpi_t gpgsm_get_rsa_modulus (ksba_cert_t cert);
343 char *gpgsm_get_certid (ksba_cert_t cert);
347 const void *gpgsm_get_serial (ksba_const_sexp_t sn, size_t *r_length);
348 void gpgsm_print_serial (estream_t fp, ksba_const_sexp_t p);
349 void gpgsm_print_serial_decimal (estream_t fp, ksba_const_sexp_t sn);
350 void gpgsm_print_time (estream_t fp, ksba_isotime_t t);
351 void gpgsm_print_name2 (FILE *fp, const char *string, int translate);
352 void gpgsm_print_name (FILE *fp, const char *string);
353 void gpgsm_es_print_name (estream_t fp, const char *string);
354 void gpgsm_es_print_name2 (estream_t fp, const char *string, int translate);
356 void gpgsm_cert_log_name (const char *text, ksba_cert_t cert);
358 void gpgsm_dump_cert (const char *text, ksba_cert_t cert);
359 void gpgsm_dump_serial (ksba_const_sexp_t p);
360 void gpgsm_dump_time (ksba_isotime_t t);
361 void gpgsm_dump_string (const char *string);
363 char *gpgsm_format_serial (ksba_const_sexp_t p);
364 char *gpgsm_format_name2 (const char *name, int translate);
365 char *gpgsm_format_name (const char *name);
366 char *gpgsm_format_sn_issuer (ksba_sexp_t sn, const char *issuer);
368 char *gpgsm_fpr_and_name_for_status (ksba_cert_t cert);
370 char *gpgsm_format_keydesc (ksba_cert_t cert);
373 /*-- certcheck.c --*/
374 int gpgsm_check_cert_sig (ksba_cert_t issuer_cert, ksba_cert_t cert);
375 int gpgsm_check_cms_signature (ksba_cert_t cert, gcry_sexp_t sigval,
377 int hash_algo, unsigned int pkalgoflags,
379 /* fixme: move create functions to another file */
380 int gpgsm_create_cms_signature (ctrl_t ctrl,
381 ksba_cert_t cert, gcry_md_hd_t md, int mdalgo,
382 unsigned char **r_sigval);
385 /*-- certchain.c --*/
387 /* Flags used with gpgsm_validate_chain. */
388 #define VALIDATE_FLAG_NO_DIRMNGR 1
389 #define VALIDATE_FLAG_CHAIN_MODEL 2
390 #define VALIDATE_FLAG_STEED 4
392 gpg_error_t gpgsm_walk_cert_chain (ctrl_t ctrl,
393 ksba_cert_t start, ksba_cert_t *r_next);
394 int gpgsm_is_root_cert (ksba_cert_t cert);
395 int gpgsm_validate_chain (ctrl_t ctrl, ksba_cert_t cert,
396 ksba_isotime_t checktime,
397 ksba_isotime_t r_exptime,
398 int listmode, estream_t listfp,
399 unsigned int flags, unsigned int *retflags);
400 int gpgsm_basic_cert_check (ctrl_t ctrl, ksba_cert_t cert);
403 int gpgsm_cert_use_sign_p (ksba_cert_t cert, int silent);
404 int gpgsm_cert_use_encrypt_p (ksba_cert_t cert);
405 int gpgsm_cert_use_verify_p (ksba_cert_t cert);
406 int gpgsm_cert_use_decrypt_p (ksba_cert_t cert);
407 int gpgsm_cert_use_cert_p (ksba_cert_t cert);
408 int gpgsm_cert_use_ocsp_p (ksba_cert_t cert);
409 int gpgsm_cert_has_well_known_private_key (ksba_cert_t cert);
410 int gpgsm_certs_identical_p (ksba_cert_t cert_a, ksba_cert_t cert_b);
411 int gpgsm_add_cert_to_certlist (ctrl_t ctrl, ksba_cert_t cert,
412 certlist_t *listaddr, int is_encrypt_to);
413 int gpgsm_add_to_certlist (ctrl_t ctrl, const char *name, int secret,
414 certlist_t *listaddr, int is_encrypt_to);
415 void gpgsm_release_certlist (certlist_t list);
417 #define FIND_CERT_ALLOW_AMBIG 1
418 #define FIND_CERT_WITH_EPHEM 2
419 int gpgsm_find_cert (ctrl_t ctrl, const char *name, ksba_sexp_t keyid,
420 ksba_cert_t *r_cert, unsigned int flags);
423 gpg_error_t gpgsm_list_keys (ctrl_t ctrl, strlist_t names,
424 estream_t fp, unsigned int mode);
425 gpg_error_t gpgsm_show_certs (ctrl_t ctrl, int nfiles, char **files,
429 int gpgsm_import (ctrl_t ctrl, int in_fd, int reimport_mode);
430 int gpgsm_import_files (ctrl_t ctrl, int nfiles, char **files,
431 int (*of)(const char *fname));
434 void gpgsm_export (ctrl_t ctrl, strlist_t names, estream_t stream);
435 void gpgsm_p12_export (ctrl_t ctrl, const char *name, estream_t stream,
439 int gpgsm_delete (ctrl_t ctrl, strlist_t names);
442 int gpgsm_verify (ctrl_t ctrl, int in_fd, int data_fd, estream_t out_fp);
445 int gpgsm_get_default_cert (ctrl_t ctrl, ksba_cert_t *r_cert);
446 int gpgsm_sign (ctrl_t ctrl, certlist_t signerlist,
447 int data_fd, int detached, estream_t out_fp);
450 int gpgsm_encrypt (ctrl_t ctrl, certlist_t recplist,
451 int in_fd, estream_t out_fp);
454 gpg_error_t ecdh_derive_kek (unsigned char *key, unsigned int keylen,
455 int hash_algo, const char *wrap_algo_str,
456 const void *secret, unsigned int secretlen,
457 const void *ukm, unsigned int ukmlen);
458 int gpgsm_decrypt (ctrl_t ctrl, int in_fd, estream_t out_fp);
460 /*-- certreqgen.c --*/
461 int gpgsm_genkey (ctrl_t ctrl, estream_t in_stream, estream_t out_stream);
463 /*-- certreqgen-ui.c --*/
464 void gpgsm_gencertreq_tty (ctrl_t ctrl, estream_t out_stream);
467 /*-- qualified.c --*/
468 gpg_error_t gpgsm_is_in_qualified_list (ctrl_t ctrl, ksba_cert_t cert,
470 gpg_error_t gpgsm_qualified_consent (ctrl_t ctrl, ksba_cert_t cert);
471 gpg_error_t gpgsm_not_qualified_warning (ctrl_t ctrl, ksba_cert_t cert);
473 /*-- call-agent.c --*/
474 int gpgsm_agent_pksign (ctrl_t ctrl, const char *keygrip, const char *desc,
475 unsigned char *digest,
478 unsigned char **r_buf, size_t *r_buflen);
479 int gpgsm_scd_pksign (ctrl_t ctrl, const char *keyid, const char *desc,
480 unsigned char *digest, size_t digestlen, int digestalgo,
481 unsigned char **r_buf, size_t *r_buflen);
482 int gpgsm_agent_pkdecrypt (ctrl_t ctrl, const char *keygrip, const char *desc,
483 ksba_const_sexp_t ciphertext,
484 char **r_buf, size_t *r_buflen);
485 int gpgsm_agent_genkey (ctrl_t ctrl,
486 ksba_const_sexp_t keyparms, ksba_sexp_t *r_pubkey);
487 int gpgsm_agent_readkey (ctrl_t ctrl, int fromcard, const char *hexkeygrip,
488 ksba_sexp_t *r_pubkey);
489 int gpgsm_agent_scd_serialno (ctrl_t ctrl, char **r_serialno);
490 int gpgsm_agent_scd_keypairinfo (ctrl_t ctrl, strlist_t *r_list);
491 int gpgsm_agent_istrusted (ctrl_t ctrl, ksba_cert_t cert, const char *hexfpr,
492 struct rootca_flags_s *rootca_flags);
493 int gpgsm_agent_havekey (ctrl_t ctrl, const char *hexkeygrip);
494 int gpgsm_agent_marktrusted (ctrl_t ctrl, ksba_cert_t cert);
495 int gpgsm_agent_learn (ctrl_t ctrl);
496 int gpgsm_agent_passwd (ctrl_t ctrl, const char *hexkeygrip, const char *desc);
497 gpg_error_t gpgsm_agent_get_confirmation (ctrl_t ctrl, const char *desc);
498 gpg_error_t gpgsm_agent_send_nop (ctrl_t ctrl);
499 gpg_error_t gpgsm_agent_keyinfo (ctrl_t ctrl, const char *hexkeygrip,
501 gpg_error_t gpgsm_agent_ask_passphrase (ctrl_t ctrl, const char *desc_msg,
502 int repeat, char **r_passphrase);
503 gpg_error_t gpgsm_agent_keywrap_key (ctrl_t ctrl, int forexport,
504 void **r_kek, size_t *r_keklen);
505 gpg_error_t gpgsm_agent_import_key (ctrl_t ctrl,
506 const void *key, size_t keylen);
507 gpg_error_t gpgsm_agent_export_key (ctrl_t ctrl, const char *keygrip,
509 unsigned char **r_result,
510 size_t *r_resultlen);
512 /*-- call-dirmngr.c --*/
513 gpg_error_t gpgsm_dirmngr_isvalid (ctrl_t ctrl,
514 ksba_cert_t cert, ksba_cert_t issuer_cert,
516 gnupg_isotime_t r_revoked_at,
518 int gpgsm_dirmngr_lookup (ctrl_t ctrl, strlist_t names, const char *uri,
520 void (*cb)(void*, ksba_cert_t), void *cb_value);
521 int gpgsm_dirmngr_run_command (ctrl_t ctrl, const char *command,
522 int argc, char **argv);
526 void gpgsm_print_further_info (const char *format, ...) GPGRT_ATTR_PRINTF(1,2);
527 void setup_pinentry_env (void);
528 gpg_error_t transform_sigval (const unsigned char *sigval, size_t sigvallen,
530 unsigned char **r_newsigval,
531 size_t *r_newsigvallen);
532 gcry_sexp_t gpgsm_ksba_cms_get_sig_val (ksba_cms_t cms, int idx);
533 int gpgsm_get_hash_algo_from_sigval (gcry_sexp_t sigval,
534 unsigned int *r_pkalgo_flags);