security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-11-10 21:38:50 +01:00
Code Activity

Fixes pertaining to revocation creation with subkey-only exported card keys

Browse Source
This commit is contained in:
Werner Koch 2005-08-04 09:53:21 +00:00
parent 1990aacce0
commit cd4c621017
6 changed files with 44 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
g10/ChangeLog
View File

@ -1,3 +1,17 @@
2005-08-04 Werner Koch <wk@g10code.com>
* export.c (do_export_stream): Skip on-card keys when only subkeys
are to be exported. It does not make sense to replace the on-card
key stub by a no-key stub.
* revoke.c (gen_revoke): Check for non-online keys.
* seckey-cert.c (is_secret_key_protected): Return -3 for
non-online key stubs. The old code assumes that a protection
algorithm is still set but in some cases this one is 0 and thus it
won't be possible to decide whether it is unprotected or
protected.
2005-07-28 Werner Koch <wk@g10code.com> 2005-07-28 Werner Koch <wk@g10code.com>
* Makefile.am (other_libs): Add SRVLIBS. * Makefile.am (other_libs): Add SRVLIBS.

2
g10/cardglue.c
View File

@ -533,7 +533,7 @@ check_card_serialno (app_t app, const char *serialno)
const char *s; const char *s;
int ask = 0; int ask = 0;
int n; int n;
for (s = serialno, n=0; *s != '/' && hexdigitp (s); s++, n++) for (s = serialno, n=0; *s != '/' && hexdigitp (s); s++, n++)
; ;
if (n != 32) if (n != 32)

11
g10/export.c
View File

@ -230,6 +230,17 @@ do_export_stream( IOBUF out, STRLIST users, int secret,
keystr(sk_keyid)); keystr(sk_keyid));
continue; continue;
} }
/* It does not make sense to export a key with a primary
key on card using a non-key stub. We simply skip those
keys when used with --export-secret-subkeys. */
if (secret == 2 && sk->is_protected
&& sk->protect.s2k.mode == 1002 )
{
log_info(_("key %s: key material on-card - skipped\n"),
keystr(sk_keyid));
continue;
}
} }
else else
{ {

13
g10/pkclist.c
View File

@ -540,7 +540,6 @@ check_signatures_trust( PKT_signature *sig )
size_t fprlen; size_t fprlen;
int okay; int okay;
log_info (_("Note: Verified address is `%s'\n"), sig->pka_info->email);
primary_pk = xmalloc_clear (sizeof *primary_pk); primary_pk = xmalloc_clear (sizeof *primary_pk);
get_pubkey (primary_pk, pk->main_keyid); get_pubkey (primary_pk, pk->main_keyid);
@ -548,9 +547,17 @@ check_signatures_trust( PKT_signature *sig )
free_public_key (primary_pk); free_public_key (primary_pk);
if ( fprlen == 20 && !memcmp (sig->pka_info->fpr, fpr, 20) ) if ( fprlen == 20 && !memcmp (sig->pka_info->fpr, fpr, 20) )
okay = 1; {
okay = 1;
log_info (_("Note: Verified signer's address is `%s'\n"),
sig->pka_info->email);
}
else else
okay = 0; {
okay = 0;
log_info (_("Note: Signer's address `%s' "
"does not match DNS entry\n"), sig->pka_info->email);
}
switch ( (trustlevel & TRUST_MASK) ) switch ( (trustlevel & TRUST_MASK) )
{ {

6
g10/revoke.c
View File

@ -497,11 +497,15 @@ gen_revoke( const char *uname )
log_error(_("unknown protection algorithm\n")); log_error(_("unknown protection algorithm\n"));
rc = G10ERR_PUBKEY_ALGO; rc = G10ERR_PUBKEY_ALGO;
break; break;
case -3:
tty_printf (_("Secret parts of primary key are not available.\n"));
rc = G10ERR_NO_SECKEY;
break;
case 0: case 0:
tty_printf(_("NOTE: This key is not protected!\n")); tty_printf(_("NOTE: This key is not protected!\n"));
break; break;
default: default:
rc = check_secret_key( sk, 0 ); rc = check_secret_key( sk, 0 );
break; break;
} }
if( rc ) if( rc )

5
g10/seckey-cert.c
View File

@ -289,13 +289,14 @@ check_secret_key( PKT_secret_key *sk, int n )
* check whether the secret key is protected. * check whether the secret key is protected.
* Returns: 0 not protected, -1 on error or the protection algorithm * Returns: 0 not protected, -1 on error or the protection algorithm
* -2 indicates a card stub. * -2 indicates a card stub.
* -3 indicates a not-online stub.
*/ */
int int
is_secret_key_protected( PKT_secret_key *sk ) is_secret_key_protected( PKT_secret_key *sk )
{ {
return sk->is_protected? return sk->is_protected?
sk->protect.s2k.mode == 1002? -2 sk->protect.s2k.mode == 1002? -2 :
: sk->protect.algo : 0; sk->protect.s2k.mode == 1001? -3 : sk->protect.algo : 0;
} }