security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

gpgsm: New option --assert-signer

Browse source 
* sm/gpgsm.c (oAssertSigner, oNoop): New.
(opts): Add option --assert-signer.
(assert_signer_true): New var.
(main): Set new option.
(gpgsm_exit): Handle assert_signer_true.
* sm/gpgsm.h (opt): Add field assert_signer_list.
* sm/verify.c (is_x509_fingerprint): New.
(check_assert_signer_list): New.
(gpgsm_verify): Handle option.
--

GnuPG-bug-id: 7286
This commit is contained in:
Werner Koch 2024-09-11 14:24:58 +02:00
parent 2125f228d3
commit 33e571a74a
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
6 changed files with 184 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

25
sm/gpgsm.c
View file

@ -217,7 +217,10 @@ enum cmd_and_opt_values {
oCompatibilityFlags,
oKbxBufferSize,
oAlwaysTrust,
oNoAutostart
oNoAutostart,
oAssertSigner,
oNoop
};
@ -311,6 +314,7 @@ static gpgrt_opt_t opts[] = {
N_("|FILE|take policy information from FILE")),
ARGPARSE_s_s (oCompliance, "compliance", "@"),
ARGPARSE_p_u (oMinRSALength, "min-rsa-length", "@"),
ARGPARSE_s_s (oAssertSigner, "assert-signer", "@"),
ARGPARSE_s_n (oNoCommonCertsImport, "no-common-certs-import", "@"),
ARGPARSE_s_s (oIgnoreCertExtension, "ignore-cert-extension", "@"),
ARGPARSE_s_s (oIgnoreCertWithOID, "ignore-cert-with-oid", "@"),
@ -502,6 +506,9 @@ static struct compatibility_flags_s compatibility_flags [] =
/* Global variable to keep an error count. */
int gpgsm_errors_seen = 0;
/* If opt.assert_signer_list is used and this variable is not true
* gpg will be forced to return EXIT_FAILURE. */
int assert_signer_true = 0;
/* It is possible that we are currentlu running under setuid permissions */
static int maybe_setuid = 1;
@ -1518,6 +1525,12 @@ main ( int argc, char **argv)
keybox_set_buffersize (pargs.r.ret_ulong, 0);
break;
case oAssertSigner:
add_to_strlist (&opt.assert_signer_list, pargs.r.ret_str);
break;
case oNoop: break;
default:
if (configname)
pargs.err = ARGPARSE_PRINT_WARNING;
@ -2329,6 +2342,15 @@ emergency_cleanup (void)
void
gpgsm_exit (int rc)
{
if (rc)
;
else if (log_get_errorcount(0))
rc = 2;
else if (gpgsm_errors_seen)
rc = 1;
else if (opt.assert_signer_list && !assert_signer_true)
rc = 1;
gcry_control (GCRYCTL_UPDATE_RANDOM_SEED_FILE);
if (opt.debug & DBG_MEMSTAT_VALUE)
{
@ -2338,7 +2360,6 @@ gpgsm_exit (int rc)
if (opt.debug)
gcry_control (GCRYCTL_DUMP_SECMEM_STATS );
emergency_cleanup ();
rc = rc? rc : log_get_errorcount(0)? 2 : gpgsm_errors_seen? 1 : 0;
exit (rc);
}