security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

sm: Optmize clearing of the ephemeral flag.

Browse source 
* kbx/keybox-search.c (keybox_get_cert): Store the blob clags in the
cert object.
* sm/certchain.c (do_validate_chain): Skip clearing of the ephemeral
flag if we know that it is not set.
--

GnuPG-bug-id: 7308
This commit is contained in:
Werner Koch 2024-09-27 15:50:46 +02:00
parent ca953ae5f7
commit cb6c506e4e
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
2 changed files with 25 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
sm/certchain.c
View file

@ -2085,9 +2085,22 @@ do_validate_chain (ctrl_t ctrl, ksba_cert_t cert, ksba_isotime_t checktime_arg,
{
gpg_error_t err;
chain_item_t ci;
unsigned int blobflags;
size_t userdatalen;
for (ci = chain; ci; ci = ci->next)
{
/* First do a quick check by looking at the blob flags to
* see whether the certificate is flagged ephemeral. This
* avoids the overhead of looking up the certificate again
* just to decide that there is no need to clear it. */
if (!ksba_cert_get_user_data (cert, "keydb.blobflags",
&blobflags, sizeof (blobflags),
&userdatalen)
&& userdatalen == sizeof blobflags
&& !(blobflags & KEYBOX_FLAG_BLOB_EPHEMERAL))
continue;
/* Note that it is possible for the last certificate in the
chain (i.e. our target certificate) that it has not yet
been stored in the keybox and thus the flag can't be set.