aboutsummaryrefslogtreecommitdiffstats
path: root/g10/pkclist.c
diff options
context:
space:
mode:
Diffstat (limited to 'g10/pkclist.c')
-rw-r--r--g10/pkclist.c158
1 files changed, 142 insertions, 16 deletions
diff --git a/g10/pkclist.c b/g10/pkclist.c
index fab2f13a7..bf93988ce 100644
--- a/g10/pkclist.c
+++ b/g10/pkclist.c
@@ -1,5 +1,5 @@
/* pkclist.c
- * Copyright (C) 1998 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000 Free Software Foundation, Inc.
*
* This file is part of GnuPG.
*
@@ -96,6 +96,112 @@ fpr_info( PKT_public_key *pk )
}
+/****************
+ * Show the revocation reason as it is stored with the given signature
+ */
+static void
+do_show_revocation_reason( PKT_signature *sig )
+{
+ size_t n, nn;
+ const byte *p, *pp;
+ int seq = 0;
+ const char *text;
+
+ while( (p = enum_sig_subpkt( sig->hashed_data, SIGSUBPKT_REVOC_REASON,
+ &n, &seq )) ) {
+ if( !n )
+ continue; /* invalid - just skip it */
+
+ if( *p == 0 )
+ text = _("No reason specified");
+ else if( *p == 0x01 )
+ text = _("Key is superseeded");
+ else if( *p == 0x02 )
+ text = _("Key has been compromised");
+ else if( *p == 0x03 )
+ text = _("Key is no longer used");
+ else if( *p == 0x20 )
+ text = _("User ID is no longer valid");
+ else
+ text = NULL;
+
+ log_info( _("Reason for revocation: ") );
+ if( text )
+ fputs( text, log_stream() );
+ else
+ fprintf( log_stream(), "code=%02x", *p );
+ putc( '\n', log_stream() );
+ n--; p++;
+ pp = NULL;
+ do {
+ /* We don't want any empty lines, so skip them */
+ while( n && *p == '\n' ) {
+ p++;
+ n--;
+ }
+ if( n ) {
+ pp = memchr( p, '\n', n );
+ nn = pp? pp - p : n;
+ log_info( _("Revocation comment: ") );
+ print_string( log_stream(), p, nn, 0 );
+ putc( '\n', log_stream() );
+ p += nn; n -= nn;
+ }
+ } while( pp );
+ }
+}
+
+
+static void
+show_revocation_reason( PKT_public_key *pk )
+{
+ /* Hmmm, this is not so easy becuase we have to duplicate the code
+ * used in the trustbd to calculate the keyflags. We need to find
+ * a clean way to check revocation certificates on keys and signatures.
+ * And there should be no duplicate code. Because we enter this function
+ * only when the trustdb toldus, taht we have a revoked key, we could
+ * simplylook for a revocation cert and display this one, when there is
+ * only one. Let's try to do this until we have a better solution.
+ */
+ KBNODE node, keyblock = NULL;
+ byte fingerprint[MAX_FINGERPRINT_LEN];
+ size_t fingerlen;
+ int rc;
+
+ /* get the keyblock */
+ fingerprint_from_pk( pk, fingerprint, &fingerlen );
+ rc = get_keyblock_byfprint( &keyblock, fingerprint, fingerlen );
+ if( rc ) { /* that should never happen */
+ log_debug( "failed to get the keyblock\n");
+ return;
+ }
+
+ for( node=keyblock; node; node = node->next ) {
+ if( ( node->pkt->pkttype == PKT_PUBLIC_KEY
+ || node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
+ && !cmp_public_keys( node->pkt->pkt.public_key, pk ) )
+ break;
+ }
+ if( !node ) {
+ log_debug("Oops, PK not in keyblock\n");
+ release_kbnode( keyblock );
+ return;
+ }
+ /* now find the revocation certificate */
+ for( node = node->next; node ; node = node->next ) {
+ if( node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
+ break;
+ if( node->pkt->pkttype == PKT_SIGNATURE
+ && (node->pkt->pkt.signature->sig_class == 0x20
+ || node->pkt->pkt.signature->sig_class == 0x28 ) ) {
+ /* FIXME: we should check the signature here */
+ do_show_revocation_reason ( node->pkt->pkt.signature );
+ }
+ }
+
+ release_kbnode( keyblock );
+}
+
static void
show_paths( ulong lid, int only_first )
@@ -149,7 +255,7 @@ show_paths( ulong lid, int only_first )
putchar(' ');
p = get_user_id( keyid, &n );
- tty_print_string( p, n ),
+ tty_print_utf8_string( p, n ),
m_free(p);
tty_printf("\"\n");
free_public_key( pk );
@@ -194,7 +300,7 @@ do_edit_ownertrust( ulong lid, int mode, unsigned *new_trust, int defer_help )
for(;;) {
/* a string with valid answers */
- char *ans = _("sSmMqQ");
+ const char *ans = _("sSmMqQ");
if( !did_help ) {
if( !mode ) {
@@ -203,7 +309,7 @@ do_edit_ownertrust( ulong lid, int mode, unsigned *new_trust, int defer_help )
nbits_from_pk( pk ), pubkey_letter( pk->pubkey_algo ),
(ulong)keyid[1], datestr_from_pk( pk ) );
p = get_user_id( keyid, &n );
- tty_print_string( p, n ),
+ tty_print_utf8_string( p, n ),
m_free(p);
tty_printf("\"\n");
print_fpr( pk );
@@ -337,38 +443,53 @@ _("Could not find a valid trust path to the key. Let's see whether we\n"
/****************
* Check whether we can trust this pk which has a trustlevel of TRUSTLEVEL
- * Returns: true if we trust.
+ * Returns: true if we trust. Might change the trustlevel
*/
static int
-do_we_trust( PKT_public_key *pk, int trustlevel )
+do_we_trust( PKT_public_key *pk, int *trustlevel )
{
int rc;
int did_add = 0;
+ int trustmask = 0;
retry:
- if( (trustlevel & TRUST_FLAG_REVOKED) ) {
+ if( (*trustlevel & TRUST_FLAG_REVOKED) ) {
log_info(_("key %08lX: key has been revoked!\n"),
(ulong)keyid_from_pk( pk, NULL) );
+ show_revocation_reason( pk );
if( opt.batch )
return 0;
if( !cpr_get_answer_is_yes("revoked_key.override",
_("Use this key anyway? ")) )
return 0;
+ trustmask |= TRUST_FLAG_REVOKED;
}
- else if( (trustlevel & TRUST_FLAG_SUB_REVOKED) ) {
+ else if( (*trustlevel & TRUST_FLAG_SUB_REVOKED) ) {
log_info(_("key %08lX: subkey has been revoked!\n"),
(ulong)keyid_from_pk( pk, NULL) );
+ show_revocation_reason( pk );
if( opt.batch )
return 0;
if( !cpr_get_answer_is_yes("revoked_key.override",
_("Use this key anyway? ")) )
return 0;
+ trustmask |= TRUST_FLAG_SUB_REVOKED;
}
+ *trustlevel &= ~trustmask;
+ if( opt.always_trust) {
+ if( opt.verbose )
+ log_info("No trust check due to --always-trust option\n");
+ /* The problem with this, is that EXPIRE can't be checked as
+ * this needs to insert a ne key into the trustdb first and
+ * we don't want that */
+ return 1;
+ }
- switch( (trustlevel & TRUST_MASK) ) {
+
+ switch( (*trustlevel & TRUST_MASK) ) {
case TRUST_UNKNOWN: /* No pubkey in trustDB: Insert and check again */
rc = insert_trust_record_by_pk( pk );
if( rc ) {
@@ -376,11 +497,12 @@ do_we_trust( PKT_public_key *pk, int trustlevel )
g10_errstr(rc) );
return 0; /* no */
}
- rc = check_trust( pk, &trustlevel, NULL, NULL, NULL );
+ rc = check_trust( pk, trustlevel, NULL, NULL, NULL );
+ *trustlevel &= ~trustmask;
if( rc )
log_fatal("trust check after insert failed: %s\n",
g10_errstr(rc) );
- if( trustlevel == TRUST_UNKNOWN || trustlevel == TRUST_EXPIRED ) {
+ if( *trustlevel == TRUST_UNKNOWN || *trustlevel == TRUST_EXPIRED ) {
log_debug("do_we_trust: oops at %d\n", __LINE__ );
return 0;
}
@@ -398,7 +520,8 @@ do_we_trust( PKT_public_key *pk, int trustlevel )
else {
int quit;
- rc = add_ownertrust( pk, &quit, &trustlevel );
+ rc = add_ownertrust( pk, &quit, trustlevel );
+ *trustlevel &= ~trustmask;
if( !rc && !did_add && !quit ) {
did_add = 1;
goto retry;
@@ -444,7 +567,7 @@ do_we_trust_pre( PKT_public_key *pk, int trustlevel )
{
int rc;
- rc = do_we_trust( pk, trustlevel );
+ rc = do_we_trust( pk, &trustlevel );
if( (trustlevel & TRUST_FLAG_REVOKED) && !rc )
return 0;
@@ -460,7 +583,7 @@ do_we_trust_pre( PKT_public_key *pk, int trustlevel )
nbits_from_pk( pk ), pubkey_letter( pk->pubkey_algo ),
(ulong)keyid[1], datestr_from_pk( pk ) );
p = get_user_id( keyid, &n );
- tty_print_string( p, n ),
+ tty_print_utf8_string( p, n ),
m_free(p);
tty_printf("\"\n");
print_fpr( pk );
@@ -527,10 +650,12 @@ check_signatures_trust( PKT_signature *sig )
write_status( STATUS_KEYREVOKED );
log_info(_("WARNING: This key has been revoked by its owner!\n"));
log_info(_(" This could mean that the signature is forgery.\n"));
+ show_revocation_reason( pk );
}
else if( (trustlevel & TRUST_FLAG_SUB_REVOKED) ) {
write_status( STATUS_KEYREVOKED );
log_info(_("WARNING: This subkey has been revoked by its owner!\n"));
+ show_revocation_reason( pk );
}
@@ -769,7 +894,8 @@ build_pk_list( STRLIST remusr, PK_LIST *ret_pk_list, unsigned use )
else {
int trustlevel;
- rc = check_trust( pk, &trustlevel, NULL, NULL, NULL );
+ rc = check_trust( pk, &trustlevel, pk->namehash,
+ NULL, NULL );
if( rc ) {
log_error("error checking pk of `%s': %s\n",
answer, g10_errstr(rc) );
@@ -843,7 +969,7 @@ build_pk_list( STRLIST remusr, PK_LIST *ret_pk_list, unsigned use )
else if( !(rc=check_pubkey_algo2(pk->pubkey_algo, use )) ) {
int trustlevel;
- rc = check_trust( pk, &trustlevel, NULL, NULL, NULL );
+ rc = check_trust( pk, &trustlevel, pk->namehash, NULL, NULL );
if( rc ) {
free_public_key( pk ); pk = NULL;
log_error(_("%s: error checking key: %s\n"),
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-14 07:30:31 +0000