dirmngr: Add special treatment for the standard hkps pool to ntbtls.
authorWerner Koch <wk@gnupg.org>
Tue, 21 Feb 2017 13:55:04 +0000 (14:55 +0100)
committerWerner Koch <wk@gnupg.org>
Tue, 21 Feb 2017 13:55:04 +0000 (14:55 +0100)
commit831d014550863026dfefa774c961a21bd20c1e48
treea7ab8eb014de4a48375a4f3242e61aa7bfcef9b2
parentd1625a9a82b1e5d96bbbf2132c49c53108565ae1
dirmngr: Add special treatment for the standard hkps pool to ntbtls.

* dirmngr/validate.h (VALIDATE_FLAG_SYSTRUST): Remove
(VALIDATE_FLAG_EXTRATRUST): Remove
(VALIDATE_FLAG_TRUST_SYSTEM): New.
(VALIDATE_FLAG_TRUST_CONFIG): New.
(VALIDATE_FLAG_TRUST_HKP): New.
(VALIDATE_FLAG_TRUST_HKPSPOOL): New.
(VALIDATE_FLAG_MASK_TRUST): New.
* dirmngr/validate.c (check_header_constants): New.
(validate_cert_chain): Call new function.  Simplify call to
is_trusted_cert.
* dirmngr/crlcache.c (crl_parse_insert): Pass
VALIDATE_FLAG_TRUST_CONFIG to validate_cert_chain
* dirmngr/server.c (cmd_validate): Use VALDIATE_FLAG_TRUST_SYSTEM and
VALIDATE_FLAG_TRUST_CONFIG.
* dirmngr/http-ntbtls.c (gnupg_http_tls_verify_cb): Check provided TLS
context.  Set trustclass flags using the new VALIDATE_FLAG_TRUST
values.

* dirmngr/certcache.c (cert_cache_init): Load the standard pool
certificate prior to the --hkp-cacerts.
--

Note that this changes the way the standard cert is used: We require
that it is installed at /usr/share/gnupg and we do not allow to change
it.  If this is not desired, the the standard cert can be removed or
replaced by a newer one.

Signed-off-by: Werner Koch <wk@gnupg.org>
dirmngr/certcache.c
dirmngr/crlcache.c
dirmngr/http-ntbtls.c
dirmngr/http.h
dirmngr/server.c
dirmngr/validate.c
dirmngr/validate.h