/**
* gnutls_openpgp_crt_verify_ring:
* @key: the structure that holds the key.
* @keyring: holds the keyring to check against
* @flags: unused (should be 0)
* @verify: will hold the certificate verification output.
*
* Verify all signatures in the key, using the given set of keys
* (keyring).
*
* The key verification output will be put in @verify and will be one
* or more of the #gnutls_certificate_status_t enumerated elements
* bitwise or'd.
*
* %GNUTLS_CERT_INVALID: A signature on the key is invalid.
*
* %GNUTLS_CERT_REVOKED: The key has been revoked.
*
* Note that this function does not verify using any "web of trust".
* You may use GnuPG for that purpose, or any other external PGP
* application.
*
* Returns: %GNUTLS_E_SUCCESS on success, or an error code.
**/
int
gnutls_openpgp_crt_verify_ring (gnutls_openpgp_crt_t key,
gnutls_openpgp_keyring_t keyring,
unsigned int flags, unsigned int *verify)
{
gnutls_openpgp_keyid_t id;
cdk_error_t rc;
int status;
if (!key || !keyring)
{
gnutls_assert ();
return GNUTLS_E_NO_CERTIFICATE_FOUND;
}
*verify = 0;
rc = cdk_pk_check_sigs (key->knode, keyring->db, &status);
if (rc == CDK_Error_No_Key)
{
rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
gnutls_assert ();
return rc;
}
else if (rc != CDK_Success)
{
_gnutls_x509_log ("cdk_pk_check_sigs: error %d\n", rc);
rc = _gnutls_map_cdk_rc (rc);
gnutls_assert ();
return rc;
}
_gnutls_x509_log ("status: %x\n", status);
if (status & CDK_KEY_INVALID)
*verify |= GNUTLS_CERT_INVALID;
if (status & CDK_KEY_REVOKED)
*verify |= GNUTLS_CERT_REVOKED;
if (status & CDK_KEY_NOSIGNER)
*verify |= GNUTLS_CERT_SIGNER_NOT_FOUND;
/* Check if the key is included in the ring. */
if (!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_SAME))
{
rc = gnutls_openpgp_crt_get_key_id (key, id);
if (rc < 0)
{
gnutls_assert ();
return rc;
}
rc = gnutls_openpgp_keyring_check_id (keyring, id, 0);
/* If it exists in the keyring don't treat it as unknown. */
if (rc == 0 && *verify & GNUTLS_CERT_SIGNER_NOT_FOUND)
*verify ^= GNUTLS_CERT_SIGNER_NOT_FOUND;
}
return 0;
}
/* idx == -1 indicates main key
* otherwise the subkey.
*/
static void
print_key_id(gnutls_buffer_st * str, gnutls_openpgp_crt_t cert, int idx)
{
gnutls_openpgp_keyid_t id;
int err;
if (idx < 0)
err = gnutls_openpgp_crt_get_key_id(cert, id);
else
err = gnutls_openpgp_crt_get_subkey_id(cert, idx, id);
if (err < 0)
addf(str, "error: get_key_id: %s\n", gnutls_strerror(err));
else {
adds(str, _("\tID (hex): "));
_gnutls_buffer_hexprint(str, id, sizeof(id));
addf(str, "\n");
}
}
