card: Allow "yubikey disable" only for Yubikey-5 and later.

* tools/card-yubikey.c (yubikey_commands): Add new arg INFO and test
for Yubikey-5.
* tools/gpg-card.c (cmd_yubikey): Pass info to yubikey_commands.
--

The configuration can be read from a Yubikey-4 but not be written.
The mode command is also not useful because it allows only the
selection of transports.  It does not allow to disable single
applications based on one transport (like OPGP and PIV).  Thsi patch
shows an appropriate error message.

Signed-off-by: Werner Koch <wk@gnupg.org>

1 files changed, 9 insertions, 1 deletions

diff --git a/tools/card-yubikey.c b/tools/card-yubikey.c
index f9d130988..fff669cc0 100644
--- a/tools/card-yubikey.c
+++ b/tools/card-yubikey.c
@@ -310,7 +310,7 @@ yk_enable_disable (struct ykapps_s *yk, struct iface_s *iface,
  * stream to output information.  This function must only be called on
  * Yubikeys. */
 gpg_error_t
-yubikey_commands (estream_t fp, int argc, char *argv[])
+yubikey_commands (card_info_t info, estream_t fp, int argc, char *argv[])
 {
   gpg_error_t err;
   enum {ykLIST, ykENABLE, ykDISABLE } cmd;
@@ -336,6 +336,14 @@ yubikey_commands (estream_t fp, int argc, char *argv[])
       goto leave;
     }
 
+  if (info->cardversion < 0x050000 && cmd != ykLIST)
+    {
+      log_info ("Sub-command '%s' is only support by Yubikey-5 and later\n",
+                argv[0]);
+      err = gpg_error (GPG_ERR_NOT_SUPPORTED);
+      goto leave;
+    }
+
   /* Parse interface if needed.  */
   if (cmd == ykLIST)
     iface.usb = iface.nfc = 1;