security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

gpgsm: Print revocation date and reason in cert listings.

Browse source 
* dirmngr/ocsp.c (ocsp_isvalid): Add args r_revoked_at and
r_revocation_reason.
* dirmngr/server.c (cmd_isvalid): Emit a new REVOCATIONINFO status.
(cmd_checkocsp): Ditto.

* sm/call-dirmngr.c (struct isvalid_status_parm_s): Add new fields.
(isvalid_status_cb): Parse REVOCATIONINFO.
(gpgsm_dirmngr_isvalid): Add args r_revoked_at and
r_revocation_reason.

* sm/gpgsm.h (struct server_control_s): Add fields revoked_art and
revocation_reason.
* sm/keylist.c (list_cert_raw): Print revocation date.
(list_cert_std): Ditto.
--

Note that for now we do this only for OCSP because it is an important
piece of information when using the chain model.  For a sample key see
commit 7fa1d3cc82.
This commit is contained in:
Werner Koch 2022-12-05 16:42:08 +01:00
parent 4f1b9e3abb
commit b6abaed2b5
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
8 changed files with 158 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

22
dirmngr/server.c
View file

@ -1310,6 +1310,9 @@ cmd_isvalid (assuan_context_t ctx, char *line)
again:
if (ocsp_mode)
{
gnupg_isotime_t revoked_at;
const char *reason;
/* Note, that we currently ignore the supplied fingerprint FPR;
* instead ocsp_isvalid does an inquire to ask for the cert.
* The fingerprint may eventually be used to lookup the
@ -1317,7 +1320,12 @@ cmd_isvalid (assuan_context_t ctx, char *line)
if (!opt.allow_ocsp)
err = gpg_error (GPG_ERR_NOT_SUPPORTED);
else
err = ocsp_isvalid (ctrl, NULL, NULL, force_default_responder);
err = ocsp_isvalid (ctrl, NULL, NULL, force_default_responder,
revoked_at, &reason);
if (gpg_err_code (err) == GPG_ERR_CERT_REVOKED)
dirmngr_status_printf (ctrl, "REVOCATIONINFO", "%s %s",
revoked_at, reason);
if (gpg_err_code (err) == GPG_ERR_CONFIGURATION
&& gpg_err_source (err) == GPG_ERR_SOURCE_DIRMNGR)
@ -1512,6 +1520,8 @@ cmd_checkocsp (assuan_context_t ctx, char *line)
unsigned char fprbuffer[20], *fpr;
ksba_cert_t cert;
int force_default_responder;
gnupg_isotime_t revoked_at;
const char *reason;
force_default_responder = has_option (line, "--force-default-responder");
line = skip_options (line);
@ -1547,12 +1557,18 @@ cmd_checkocsp (assuan_context_t ctx, char *line)
goto leave;
}
assert (cert);
log_assert (cert);
if (!opt.allow_ocsp)
err = gpg_error (GPG_ERR_NOT_SUPPORTED);
else
err = ocsp_isvalid (ctrl, cert, NULL, force_default_responder);
err = ocsp_isvalid (ctrl, cert, NULL, force_default_responder,
revoked_at, &reason);
if (gpg_err_code (err) == GPG_ERR_CERT_REVOKED)
dirmngr_status_printf (ctrl, "REVOCATIONINFO", "%s %s",
revoked_at, reason);
leave:
ksba_cert_release (cert);