security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

sm: Always allow authorityInfoAccess lookup if CRLs are also enabled.

Browse source 
* sm/certchain.c (find_up): Disable external lookups in offline mode.
Always allow AKI lookup if CRLs are also enabled.
--

GnuPG-bug-id: 4898
Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2020-04-16 19:05:49 +02:00
parent f5efbd5a11
commit bbb7edb880
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
2 changed files with 19 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

17
sm/certchain.c
View file

@ -929,15 +929,19 @@ find_up (ctrl_t ctrl, KEYDB_HANDLE kh,
}
/* If we still didn't found it, try an external lookup. */
if (rc == -1 && opt.auto_issuer_key_retrieve && !find_next)
if (rc == -1 && !find_next && !ctrl->offline)
{
if (!find_up_via_auth_info_access (ctrl, kh, cert))
/* We allow AIA also if CRLs are enabled; both can be used
* as a web bug so it does not make sense to not use AIA if
* CRL checks are enabled. */
if ((opt.auto_issuer_key_retrieve || !opt.no_crl_check)
&& !find_up_via_auth_info_access (ctrl, kh, cert))
{
if (DBG_X509)
log_debug (" found via authorityInfoAccess.caIssuers\n");
rc = 0;
}
else
else if (opt.auto_issuer_key_retrieve)
{
rc = find_up_external (ctrl, kh, issuer, keyid);
if (!rc && DBG_X509)
@ -1001,15 +1005,16 @@ find_up (ctrl_t ctrl, KEYDB_HANDLE kh,
}
/* Still not found. If enabled, try an external lookup. */
if (rc == -1 && opt.auto_issuer_key_retrieve && !find_next)
if (rc == -1 && !find_next && !ctrl->offline)
{
if (!find_up_via_auth_info_access (ctrl, kh, cert))
if ((opt.auto_issuer_key_retrieve || !opt.no_crl_check)
&& !find_up_via_auth_info_access (ctrl, kh, cert))
{
if (DBG_X509)
log_debug (" found via authorityInfoAccess.caIssuers\n");
rc = 0;
}
else
else if (opt.auto_issuer_key_retrieve)
{
rc = find_up_external (ctrl, kh, issuer, NULL);
if (!rc && DBG_X509)