* call-agent.c (learn_cb): Special treatment when the issuer

certificate is missing.

12 files changed, 69 insertions, 58 deletions

diff --git a/sm/ChangeLog b/sm/ChangeLog
index 230922aaf..930af70ea 100644
--- a/sm/ChangeLog
+++ b/sm/ChangeLog
@@ -1,3 +1,10 @@
+2002-08-16  Werner Koch  <wk@gnupg.org>
+
+	Renamed all all usages of "path" with certificates to "chain"
+
+	* call-agent.c (learn_cb): Special treatment when the issuer
+	certificate is missing.
+
 2002-08-10  Werner Koch  <wk@gnupg.org>
 
 	* Makefile.am (INCLUDES): Add definition for localedir.
diff --git a/sm/Makefile.am b/sm/Makefile.am
index 3e00270fa..7d2705319 100644
--- a/sm/Makefile.am
+++ b/sm/Makefile.am
@@ -24,7 +24,7 @@ INCLUDES = -I../intl -DLOCALEDIR=\"$(localedir)\"
 bin_PROGRAMS = gpgsm
 
 AM_CPPFLAGS = -I$(top_srcdir)/common -I$(top_srcdir)/intl \
-	       $(LIBGCRYPT_CFLAGS) $(LIBKSBA_CFLAGS)
+	       $(LIBGCRYPT_CFLAGS) $(KSBA_CFLAGS)
 LDFLAGS = @LDFLAGS@ 
 
 gpgsm_SOURCES = \
@@ -52,6 +52,6 @@ gpgsm_SOURCES = \
 
 
 gpgsm_LDADD = ../jnlib/libjnlib.a ../assuan/libassuan.a ../kbx/libkeybox.a \
-              ../common/libcommon.a $(LIBGCRYPT_LIBS) $(LIBKSBA_LIBS)
+              ../common/libcommon.a $(LIBGCRYPT_LIBS) $(KSBA_LIBS)
 
 
diff --git a/sm/call-agent.c b/sm/call-agent.c
index 3a0d0763e..6cb2fb505 100644
--- a/sm/call-agent.c
+++ b/sm/call-agent.c
@@ -698,7 +698,12 @@ learn_cb (void *opaque, const void *buffer, size_t length)
     }
 
   rc = gpgsm_basic_cert_check (cert);
-  if (rc)
+  if (rc == GNUPG_Missing_Certificate)
+    { /* For later use we store it in the ephemeral database. */
+      log_info ("issuer certificate missing - storing as ephemeral\n");
+      keydb_store_cert (cert, 1, NULL);
+    }
+  else if (rc)
     log_error ("invalid certificate: %s\n", gnupg_strerror (rc));
   else
     {
diff --git a/sm/certchain.c b/sm/certchain.c
index 39fd0adfd..d1fca2bf3 100644
--- a/sm/certchain.c
+++ b/sm/certchain.c
@@ -1,5 +1,5 @@
-/* certpath.c - path validation
- *	Copyright (C) 2001 Free Software Foundation, Inc.
+/* certpath.c - certificate chain validation
+ *	Copyright (C) 2001, 2002 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -68,12 +68,12 @@ unknown_criticals (KsbaCert cert)
 }
 
 static int
-allowed_ca (KsbaCert cert, int *pathlen)
+allowed_ca (KsbaCert cert, int *chainlen)
 {
   KsbaError err;
   int flag;
 
-  err = ksba_cert_is_ca (cert, &flag, pathlen);
+  err = ksba_cert_is_ca (cert, &flag, chainlen);
   if (err)
     return map_ksba_err (err);
   if (!flag)
@@ -388,10 +388,10 @@ gpgsm_is_root_cert (KsbaCert cert)
 }
 
 
-/* Validate a path and optionally return the nearest expiration time
+/* Validate a chain and optionally return the nearest expiration time
    in R_EXPTIME */
 int
-gpgsm_validate_path (CTRL ctrl, KsbaCert cert, time_t *r_exptime)
+gpgsm_validate_chain (CTRL ctrl, KsbaCert cert, time_t *r_exptime)
 {
   int rc = 0, depth = 0, maxdepth;
   char *issuer = NULL;
@@ -409,9 +409,9 @@ gpgsm_validate_path (CTRL ctrl, KsbaCert cert, time_t *r_exptime)
   if (r_exptime)
     *r_exptime = 0;
 
-  if (opt.no_path_validation)
+  if (opt.no_chain_validation)
     {
-      log_info ("WARNING: bypassing path validation\n");
+      log_info ("WARNING: bypassing certificate chain validation\n");
       return 0;
     }
   
@@ -576,7 +576,7 @@ gpgsm_validate_path (CTRL ctrl, KsbaCert cert, time_t *r_exptime)
       depth++;
       if (depth > maxdepth)
         {
-          log_error (_("certificate path too long\n"));
+          log_error (_("certificate chain too long\n"));
           rc = GNUPG_Bad_Certificate_Path;
           goto leave;
         }
@@ -621,15 +621,15 @@ gpgsm_validate_path (CTRL ctrl, KsbaCert cert, time_t *r_exptime)
         }
 
       {
-        int pathlen;
-        rc = allowed_ca (issuer_cert, &pathlen);
+        int chainlen;
+        rc = allowed_ca (issuer_cert, &chainlen);
         if (rc)
           goto leave;
-        if (pathlen >= 0 && (depth - 1) > pathlen)
+        if (chainlen >= 0 && (depth - 1) > chainlen)
           {
-            log_error (_("certificate path longer than allowed by CA (%d)\n"),
-                       pathlen);
-            rc = GNUPG_Bad_Certificate_Path;
+            log_error (_("certificate chain longer than allowed by CA (%d)\n"),
+                       chainlen);
+            rc = GNUPG_Bad_Certificate_Chain;
             goto leave;
           }
       }
@@ -695,7 +695,7 @@ gpgsm_basic_cert_check (KsbaCert cert)
   KEYDB_HANDLE kh = keydb_new (0);
   KsbaCert issuer_cert = NULL;
 
-  if (opt.no_path_validation)
+  if (opt.no_chain_validation)
     {
       log_info ("WARNING: bypassing basic certificate checks\n");
       return 0;
diff --git a/sm/certlist.c b/sm/certlist.c
index 8a8570fdf..f31e6ee2b 100644
--- a/sm/certlist.c
+++ b/sm/certlist.c
@@ -236,7 +236,7 @@ gpgsm_add_to_certlist (CTRL ctrl, const char *name, int secret,
                 }
             }
           if (!rc)
-            rc = gpgsm_validate_path (ctrl, cert, NULL);
+            rc = gpgsm_validate_chain (ctrl, cert, NULL);
           if (!rc)
             {
               CERTLIST cl = xtrycalloc (1, sizeof *cl);
@@ -271,7 +271,7 @@ gpgsm_release_certlist (CERTLIST list)
 
 
 /* Like gpgsm_add_to_certlist, but look only for one certificate.  No
-   path validation is done */
+   chain validation is done */
 int
 gpgsm_find_cert (const char *name, KsbaCert *r_cert)
 {
diff --git a/sm/certpath.c b/sm/certpath.c
index 39fd0adfd..d1fca2bf3 100644
--- a/sm/certpath.c
+++ b/sm/certpath.c
@@ -1,5 +1,5 @@
-/* certpath.c - path validation
- *	Copyright (C) 2001 Free Software Foundation, Inc.
+/* certpath.c - certificate chain validation
+ *	Copyright (C) 2001, 2002 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -68,12 +68,12 @@ unknown_criticals (KsbaCert cert)
 }
 
 static int
-allowed_ca (KsbaCert cert, int *pathlen)
+allowed_ca (KsbaCert cert, int *chainlen)
 {
   KsbaError err;
   int flag;
 
-  err = ksba_cert_is_ca (cert, &flag, pathlen);
+  err = ksba_cert_is_ca (cert, &flag, chainlen);
   if (err)
     return map_ksba_err (err);
   if (!flag)
@@ -388,10 +388,10 @@ gpgsm_is_root_cert (KsbaCert cert)
 }
 
 
-/* Validate a path and optionally return the nearest expiration time
+/* Validate a chain and optionally return the nearest expiration time
    in R_EXPTIME */
 int
-gpgsm_validate_path (CTRL ctrl, KsbaCert cert, time_t *r_exptime)
+gpgsm_validate_chain (CTRL ctrl, KsbaCert cert, time_t *r_exptime)
 {
   int rc = 0, depth = 0, maxdepth;
   char *issuer = NULL;
@@ -409,9 +409,9 @@ gpgsm_validate_path (CTRL ctrl, KsbaCert cert, time_t *r_exptime)
   if (r_exptime)
     *r_exptime = 0;
 
-  if (opt.no_path_validation)
+  if (opt.no_chain_validation)
     {
-      log_info ("WARNING: bypassing path validation\n");
+      log_info ("WARNING: bypassing certificate chain validation\n");
       return 0;
     }
   
@@ -576,7 +576,7 @@ gpgsm_validate_path (CTRL ctrl, KsbaCert cert, time_t *r_exptime)
       depth++;
       if (depth > maxdepth)
         {
-          log_error (_("certificate path too long\n"));
+          log_error (_("certificate chain too long\n"));
           rc = GNUPG_Bad_Certificate_Path;
           goto leave;
         }
@@ -621,15 +621,15 @@ gpgsm_validate_path (CTRL ctrl, KsbaCert cert, time_t *r_exptime)
         }
 
       {
-        int pathlen;
-        rc = allowed_ca (issuer_cert, &pathlen);
+        int chainlen;
+        rc = allowed_ca (issuer_cert, &chainlen);
         if (rc)
           goto leave;
-        if (pathlen >= 0 && (depth - 1) > pathlen)
+        if (chainlen >= 0 && (depth - 1) > chainlen)
           {
-            log_error (_("certificate path longer than allowed by CA (%d)\n"),
-                       pathlen);
-            rc = GNUPG_Bad_Certificate_Path;
+            log_error (_("certificate chain longer than allowed by CA (%d)\n"),
+                       chainlen);
+            rc = GNUPG_Bad_Certificate_Chain;
             goto leave;
           }
       }
@@ -695,7 +695,7 @@ gpgsm_basic_cert_check (KsbaCert cert)
   KEYDB_HANDLE kh = keydb_new (0);
   KsbaCert issuer_cert = NULL;
 
-  if (opt.no_path_validation)
+  if (opt.no_chain_validation)
     {
       log_info ("WARNING: bypassing basic certificate checks\n");
       return 0;
diff --git a/sm/gpgsm.c b/sm/gpgsm.c
index c1cef005b..28c4cca16 100644
--- a/sm/gpgsm.c
+++ b/sm/gpgsm.c
@@ -82,7 +82,7 @@ enum cmd_and_opt_values {
   oDebug,
   oDebugAll,
   oDebugWait,
-  oDebugNoPathValidation,
+  oDebugNoChainValidation,
   oLogFile,
 
   oEnableSpecialFilenames,
@@ -305,7 +305,7 @@ static ARGPARSE_OPTS opts[] = {
     { oDebug, "debug"     ,4|16, "@"},
     { oDebugAll, "debug-all" ,0, "@"},
     { oDebugWait, "debug-wait" ,1, "@"},
-    { oDebugNoPathValidation, "debug-no-path-validation" ,0, "@"},
+    { oDebugNoChainValidation, "debug-no-chain-validation" ,0, "@"},
     { oStatusFD, "status-fd" ,1, N_("|FD|write status info to this FD") },
     { aDummy, "no-comment", 0,   "@"},
     { aDummy, "completes-needed", 1, "@"},
@@ -618,10 +618,10 @@ main ( int argc, char **argv)
       log_fatal( _("libgcrypt is too old (need %s, have %s)\n"),
                  NEED_LIBGCRYPT_VERSION, gcry_check_version (NULL) );
     }
-  if (!ksba_check_version (NEED_LIBKSBA_VERSION) )
+  if (!ksba_check_version (NEED_KSBA_VERSION) )
     {
       log_fatal( _("libksba is too old (need %s, have %s)\n"),
-                 NEED_LIBKSBA_VERSION, ksba_check_version (NULL) );
+                 NEED_KSBA_VERSION, ksba_check_version (NULL) );
     }
 
   gcry_control (GCRYCTL_USE_SECURE_RNDPOOL);
@@ -851,8 +851,7 @@ main ( int argc, char **argv)
         case oDebug: opt.debug |= pargs.r.ret_ulong; break;
         case oDebugAll: opt.debug = ~0; break;
         case oDebugWait: debug_wait = pargs.r.ret_int; break;
-        case oDebugNoPathValidation: opt.no_path_validation = 1; break;
-
+        case oDebugNoChainValidation: opt.no_chain_validation = 1; break;
 
         case oStatusFD: ctrl.status_fd = pargs.r.ret_int; break;
         case oLoggerFD: log_set_fd (pargs.r.ret_int ); break;
diff --git a/sm/gpgsm.h b/sm/gpgsm.h
index 702b343c0..f50e5086a 100644
--- a/sm/gpgsm.h
+++ b/sm/gpgsm.h
@@ -67,7 +67,7 @@ struct {
   char *local_user;       /* NULL or argument to -u */
 
   int always_trust;       /* Trust the given keys even if there is no
-                             valid certification path */
+                             valid certification chain */
   int skip_verify;        /* do not check signatures on data */
 
   int lock_once;          /* Keep lock once they are set */
@@ -78,7 +78,7 @@ struct {
 
   char *policy_file;        /* full pathname of policy file */
   int no_policy_check;      /* ignore certificate policies */
-  int no_path_validation;   /* Bypass all cert path validity tests */
+  int no_chain_validation;  /* Bypass all cert chain validity tests */
 
   int auto_issuer_key_retrieve; /* try to retrieve a missing issuer key. */
 } opt;
@@ -189,7 +189,7 @@ int gpgsm_create_cms_signature (KsbaCert cert, GCRY_MD_HD md, int mdalgo,
 /*-- certpath.c --*/
 int gpgsm_walk_cert_chain (KsbaCert start, KsbaCert *r_next);
 int gpgsm_is_root_cert (KsbaCert cert);
-int gpgsm_validate_path (CTRL ctrl, KsbaCert cert, time_t *r_exptime);
+int gpgsm_validate_chain (CTRL ctrl, KsbaCert cert, time_t *r_exptime);
 int gpgsm_basic_cert_check (KsbaCert cert);
 
 /*-- certlist.c --*/
diff --git a/sm/import.c b/sm/import.c
index b0e312740..6b3e60f8b 100644
--- a/sm/import.c
+++ b/sm/import.c
@@ -75,7 +75,7 @@ check_and_store (CTRL ctrl, KsbaCert cert, int depth)
           /* Now lets walk up the chain and import all certificates up
              the chain.*/
           if ( depth >= 50 )
-            log_error (_("certificate path too long\n"));
+            log_error (_("certificate chain too long\n"));
           else if (!gpgsm_walk_cert_chain (cert, &next))
             {
               check_and_store (ctrl, next, depth+1);
diff --git a/sm/keylist.c b/sm/keylist.c
index e73eb1f3a..96a8469ba 100644
--- a/sm/keylist.c
+++ b/sm/keylist.c
@@ -281,7 +281,7 @@ list_cert_std (KsbaCert cert, FILE *fp, int have_secret)
   char *dn;
   time_t t;
   int idx;
-  int is_ca, pathlen;
+  int is_ca, chainlen;
   unsigned int kusage;
   char *string, *p;
 
@@ -340,7 +340,7 @@ list_cert_std (KsbaCert cert, FILE *fp, int have_secret)
           if ( (kusage & KSBA_KEYUSAGE_KEY_ENCIPHERMENT)) 
             fputs (" keyEncipherment", fp);
           if ( (kusage & KSBA_KEYUSAGE_DATA_ENCIPHERMENT))
-            fputs (" dataEncripherment", fp);
+            fputs (" dataEncipherment", fp);
           if ( (kusage & KSBA_KEYUSAGE_KEY_AGREEMENT))    
             fputs (" keyAgreement", fp);
           if ( (kusage & KSBA_KEYUSAGE_KEY_CERT_SIGN))
@@ -374,16 +374,16 @@ list_cert_std (KsbaCert cert, FILE *fp, int have_secret)
       putc ('\n', fp);
     }
 
-  kerr = ksba_cert_is_ca (cert, &is_ca, &pathlen);
+  kerr = ksba_cert_is_ca (cert, &is_ca, &chainlen);
   if (kerr || is_ca)
     {
-      fputs ("  path length: ", fp);
+      fputs (" chain length: ", fp);
       if (kerr)
         fprintf (fp, "[error: %s]", ksba_strerror (kerr));
-      else if (pathlen == -1)
+      else if (chainlen == -1)
         fputs ("unlimited", fp);
       else
-        fprintf (fp, "%d", pathlen);
+        fprintf (fp, "%d", chainlen);
       putc ('\n', fp);
     }
 
diff --git a/sm/server.c b/sm/server.c
index 71b6194c7..8d73a10cd 100644
--- a/sm/server.c
+++ b/sm/server.c
@@ -470,8 +470,8 @@ cmd_sign (ASSUAN_CONTEXT ctx, char *line)
 
   Import the certificates read form the input-fd, return status
   message for each imported one.  The import checks the validity of
-  the certificate but not of the path.  It is possible to import
-  expired certificates.  */
+  the certificate but not of the entire chain.  It is possible to
+  import expired certificates.  */
 static int 
 cmd_import (ASSUAN_CONTEXT ctx, char *line)
 {
diff --git a/sm/verify.c b/sm/verify.c
index 27a187ca4..524e7b227 100644
--- a/sm/verify.c
+++ b/sm/verify.c
@@ -417,7 +417,7 @@ gpgsm_verify (CTRL ctrl, int in_fd, int data_fd, FILE *out_fp)
 
       if (DBG_X509)
         log_debug ("signature okay - checking certs\n");
-      rc = gpgsm_validate_path (ctrl, cert, &keyexptime);
+      rc = gpgsm_validate_chain (ctrl, cert, &keyexptime);
       if (rc == GNUPG_Certificate_Expired)
         {
           gpgsm_status (ctrl, STATUS_EXPKEYSIG, NULL);
@@ -440,9 +440,9 @@ gpgsm_verify (CTRL ctrl, int in_fd, int data_fd, FILE *out_fp)
         xfree (buf);
       }
 
-      if (rc) /* of validate_path */
+      if (rc) /* of validate_chain */
         {
-          log_error ("invalid certification path: %s\n", gnupg_strerror (rc));
+          log_error ("invalid certification chain: %s\n", gnupg_strerror (rc));
           if (rc == GNUPG_Bad_Certificate_Path
               || rc == GNUPG_Bad_Certificate
               || rc == GNUPG_Bad_CA_Certificate