security-and-privacy/gnupg
security-and-privacy
/
gnupg
mirror of git://git.gnupg.org/gnupg.git
1
0
Fork 0
Code Releases Activity

better reporting of bad DNs

This commit is contained in:
Werner Koch 2006-07-03 13:26:19 +00:00
parent 640d5a8c53
commit 4954c5f1c3
5 changed files with 37 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -1,3 +1,7 @@
2006-07-03 Werner Koch <wk@g10code.com>
* configure.ac: Test for ksba_dn_teststr.
2006-06-30 Werner Koch <wk@g10code.com> 2006-06-30 Werner Koch <wk@g10code.com>
* keyserver/: New. Taken from 1.4.4 * keyserver/: New. Taken from 1.4.4

4
TODO
View File

@ -13,10 +13,6 @@ We should always use valid S-Exp and not just parts.
might want to have an agent context for each service request might want to have an agent context for each service request
(i.e. Assuan context). (i.e. Assuan context).
* sm/certreqgen.c
** Improve error reporting
** Do some basic checks on the supplied DNs
* sm/certchain.c * sm/certchain.c
** When a certificate chain was sucessfully verified, make ephemeral certs used in this chain permanent. ** When a certificate chain was sucessfully verified, make ephemeral certs used in this chain permanent.
** Try to keep certificate references somewhere ** Try to keep certificate references somewhere

5
configure.ac
View File

@ -512,6 +512,11 @@ AM_PATH_LIBASSUAN("$NEED_LIBASSUAN_VERSION",
# libksba is our X.509 support library # libksba is our X.509 support library
# #
AM_PATH_KSBA("$NEED_KSBA_VERSION",have_ksba=yes,have_ksba=no) AM_PATH_KSBA("$NEED_KSBA_VERSION",have_ksba=yes,have_ksba=no)
# fixme: Remove the following test and require newer libksba instead.
_ksba_save_libs=$LIBS
LIBS=$KSBA_LIBS
AC_CHECK_FUNCS(ksba_dn_teststr)
LIBS=$_ksba_save_libs
# #
# libusb allows us to use the integrated CCID smartcard reader driver. # libusb allows us to use the integrated CCID smartcard reader driver.

5
sm/ChangeLog
View File

@ -1,3 +1,8 @@
2006-07-03 Werner Koch <wk@g10code.com>
* certreqgen.c (proc_parameters): Print the component label of a
faulty DN.
2006-06-26 Werner Koch <wk@g10code.com> 2006-06-26 Werner Koch <wk@g10code.com>
* certdump.c (gpgsm_cert_log_name): New. * certdump.c (gpgsm_cert_log_name): New.

30
sm/certreqgen.c
View File

@ -441,6 +441,7 @@ static int
proc_parameters (ctrl_t ctrl, proc_parameters (ctrl_t ctrl,
struct para_data_s *para, struct reqgen_ctrl_s *outctrl) struct para_data_s *para, struct reqgen_ctrl_s *outctrl)
{ {
gpg_error_t err;
struct para_data_s *r; struct para_data_s *r;
const char *s; const char *s;
int i; int i;
@ -450,8 +451,9 @@ proc_parameters (ctrl_t ctrl,
int rc; int rc;
ksba_sexp_t public; ksba_sexp_t public;
int seq; int seq;
size_t erroff, errlen;
/* check that we have all required parameters */
/* Check that we have all required parameters; */
assert (get_parameter (para, pKEYTYPE, 0)); assert (get_parameter (para, pKEYTYPE, 0));
/* We can only use RSA for now. There is a with pkcs-10 on how to /* We can only use RSA for now. There is a with pkcs-10 on how to
@ -483,17 +485,31 @@ proc_parameters (ctrl_t ctrl,
if (parse_parameter_usage (para, pKEYUSAGE)) if (parse_parameter_usage (para, pKEYUSAGE))
return gpg_error (GPG_ERR_INV_PARAMETER); return gpg_error (GPG_ERR_INV_PARAMETER);
/* check that there is a subject name and that this DN fits our /* Check that there is a subject name and that this DN fits our
requirements */ requirements. */
if (!(s=get_parameter_value (para, pNAMEDN, 0))) if (!(s=get_parameter_value (para, pNAMEDN, 0)))
{ {
r = get_parameter (para, pKEYTYPE, 0); r = get_parameter (para, pNAMEDN, 0);
log_error (_("line %d: no subject name given\n"), r->lnr); log_error (_("line %d: no subject name given\n"), r->lnr);
return gpg_error (GPG_ERR_INV_PARAMETER); return gpg_error (GPG_ERR_INV_PARAMETER);
} }
/* fixme check s */ #if HAVE_KSBA_DN_TESTSTR
err = ksba_dn_teststr (s, 0, &erroff, &errlen);
if (err)
{
r = get_parameter (para, pNAMEDN, 0);
if (gpg_err_code (err) == GPG_ERR_UNKNOWN_NAME)
log_error (_("line %d: invalid subject name label `%.*s'\n"),
r->lnr, (int)errlen, s+erroff);
else
log_error (_("line %d: invalid subject name `%s' at pos %d\n"),
r->lnr, s, erroff);
/* check that the optional email address is okay */ return gpg_error (GPG_ERR_INV_PARAMETER);
}
#endif /*HAVE_KSBA_DN_TESTSTR*/
/* Check that the optional email address is okay. */
for (seq=0; (s=get_parameter_value (para, pNAMEEMAIL, seq)); seq++) for (seq=0; (s=get_parameter_value (para, pNAMEEMAIL, seq)); seq++)
{ {
if (has_invalid_email_chars (s) if (has_invalid_email_chars (s)