www.gitorious.org Git - gnutls:gnutls.git/blob

1 /*

3 *

4 * Author: Timo Schulz, Nikos Mavrogiannopoulos

5 *

6 * This file is part of GNUTLS.

7 *

8 * The GNUTLS library is free software; you can redistribute it and/or

9 * modify it under the terms of the GNU Lesser General Public License

10 * as published by the Free Software Foundation; either version 2.1 of

11 * the License, or (at your option) any later version.

12 *

13 * This library is distributed in the hope that it will be useful, but

14 * WITHOUT ANY WARRANTY; without even the implied warranty of

15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

16 * Lesser General Public License for more details.

17 *

18 * You should have received a copy of the GNU Lesser General Public

19 * License along with this library; if not, write to the Free Software

20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

21 * 02110-1301, USA

22 *

23 */

25 /* Functions on OpenPGP key parsing

26 */

28 #include <gnutls_int.h>

29 #include <openpgp_int.h>

30 #include <gnutls_errors.h>

31 #include <gnutls_openpgp.h>

32 #include <gnutls_num.h>

34 /**

35 * gnutls_openpgp_crt_verify_ring - Verify all signatures in the key

36 * @key: the structure that holds the key.

37 * @keyring: holds the keyring to check against

38 * @flags: unused (should be 0)

39 * @verify: will hold the certificate verification output.

40 *

41 * Verify all signatures in the key, using the given set of keys

42 * (keyring).

43 *

44 * The key verification output will be put in @verify and will be one

45 * or more of the #gnutls_certificate_status_t enumerated elements

46 * bitwise or'd.

47 *

48 * %GNUTLS_CERT_INVALID: A signature on the key is invalid.

49 *

50 * %GNUTLS_CERT_REVOKED: The key has been revoked.

51 *

52 * Note that this function does not verify using any "web of trust".

53 * You may use GnuPG for that purpose, or any other external PGP

54 * application.

55 *

56 * Returns: %GNUTLS_E_SUCCESS on success, or an error code.

57 **/

58 int

59 gnutls_openpgp_crt_verify_ring (gnutls_openpgp_crt_t key,

60 gnutls_openpgp_keyring_t keyring,

61 unsigned int flags, unsigned int *verify)

62 {

63 gnutls_openpgp_keyid_t id;

64 cdk_error_t rc;

65 int status;

67 if (!key || !keyring)

68 {

69 gnutls_assert ();

70 return GNUTLS_E_NO_CERTIFICATE_FOUND;

71 }

73 *verify = 0;

75 rc = cdk_pk_check_sigs (key->knode, keyring->db, &status);

76 if (rc == CDK_Error_No_Key)

77 {

78 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;

79 gnutls_assert ();

80 return rc;

81 }

82 else if (rc != CDK_Success)

83 {

84 _gnutls_x509_log("cdk_pk_check_sigs: error %d\n", rc);

85 rc = _gnutls_map_cdk_rc (rc);

86 gnutls_assert ();

87 return rc;

88 }

89 _gnutls_x509_log("status: %x\n", status);

91 if (status & CDK_KEY_INVALID)

92 *verify |= GNUTLS_CERT_INVALID;

93 if (status & CDK_KEY_REVOKED)

94 *verify |= GNUTLS_CERT_REVOKED;

95 if (status & CDK_KEY_NOSIGNER)

96 *verify |= GNUTLS_CERT_SIGNER_NOT_FOUND;

98 /* Check if the key is included in the ring. */

99 if (!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_SAME))

100 {

101 rc = gnutls_openpgp_crt_get_key_id (key, id);

102 if (rc < 0)

103 {

104 gnutls_assert ();

105 return rc;

106 }

107

108 rc = gnutls_openpgp_keyring_check_id (keyring, id, 0);

109 /* If it exists in the keyring don't treat it as unknown. */

110 if (rc == 0 && *verify & GNUTLS_CERT_SIGNER_NOT_FOUND)

111 *verify ^= GNUTLS_CERT_SIGNER_NOT_FOUND;

112 }

113

114 return 0;

115 }

116

117

118 /**

119 * gnutls_openpgp_crt_verify_self - Verify the self signature on the key

120 * @key: the structure that holds the key.

121 * @flags: unused (should be 0)

122 * @verify: will hold the key verification output.

123 *

124 * Verifies the self signature in the key. The key verification

125 * output will be put in @verify and will be one or more of the

126 * gnutls_certificate_status_t enumerated elements bitwise or'd.

127 *

128 * %GNUTLS_CERT_INVALID: The self signature on the key is invalid.

129 *

130 * Returns: %GNUTLS_E_SUCCESS on success, or an error code.

131 **/

132 int

133 gnutls_openpgp_crt_verify_self (gnutls_openpgp_crt_t key,

134 unsigned int flags, unsigned int *verify)

135 {

136 int status;

137 cdk_error_t rc;

138

139 rc = cdk_pk_check_self_sig (key->knode, &status);

140 if (rc || status != CDK_KEY_VALID)

141 *verify |= GNUTLS_CERT_INVALID;

142 else

143 *verify = 0;

144

145 return 0;

146 }

147