willi.junga/simple-wkd
0
0
Fork 0
mirror of https://git.verdigado.com/NB-Public/simple-wkd.git synced 2024-12-06 14:52:41 +01:00
Code Activity

Check subkeys

Browse source
This commit is contained in:
RisingOpsNinja 2024-09-04 11:37:31 +02:00
parent 4166e02773
commit f046cd0fca
2 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
backend/src/errors.rs
View file

@ -44,7 +44,7 @@ pub enum SpecialErrors {
ExpiredRequest, ExpiredRequest,
#[error("The key for the requested user does not exist!")] #[error("The key for the requested user does not exist!")]
InexistingUser, InexistingUser,
#[error("The key is either expired or uses an obsolete cipher!")] #[error("The primary key is either expired or uses an obsolete cipher!")]
InvalidCert, InvalidCert,
#[error("Error while sending email")] #[error("Error while sending email")]
MailErr, MailErr,
@ -60,6 +60,8 @@ pub enum SpecialErrors {
KeyNonExpiring, KeyNonExpiring,
#[error("The primary keys or a subkeys validity is too long")] #[error("The primary keys or a subkeys validity is too long")]
KeyValidityTooLong, KeyValidityTooLong,
#[error("A subkey is either expired or uses an obsolete cipher!")]
KeyPolicyViolation,
} }
#[derive(Debug)] #[derive(Debug)]
@ -110,6 +112,7 @@ impl ResponseError for CompatErr {
SpecialErrors::UnallowedDomain => StatusCode::UNAUTHORIZED, SpecialErrors::UnallowedDomain => StatusCode::UNAUTHORIZED,
SpecialErrors::KeyNonExpiring => StatusCode::BAD_REQUEST, SpecialErrors::KeyNonExpiring => StatusCode::BAD_REQUEST,
SpecialErrors::KeyValidityTooLong => StatusCode::BAD_REQUEST, SpecialErrors::KeyValidityTooLong => StatusCode::BAD_REQUEST,
SpecialErrors::KeyPolicyViolation => StatusCode::BAD_REQUEST,
}, },
} }
} }

8
backend/src/utils.rs
View file

@ -17,6 +17,7 @@ use log::debug;
use log::error; use log::error;
use rand::{distributions::Alphanumeric, thread_rng, Rng}; use rand::{distributions::Alphanumeric, thread_rng, Rng};
use sequoia_openpgp::cert::ValidCert; use sequoia_openpgp::cert::ValidCert;
use sequoia_openpgp::cert::amalgamation::ValidateAmalgamation;
use sequoia_openpgp::serialize::Marshal; use sequoia_openpgp::serialize::Marshal;
use sequoia_openpgp::types::HashAlgorithm; use sequoia_openpgp::types::HashAlgorithm;
use sequoia_openpgp::{parse::Parse, Cert}; use sequoia_openpgp::{parse::Parse, Cert};
@ -32,6 +33,13 @@ pub fn validate_cert(cert: &Cert) -> Result<ValidCert> {
Err(_) => Err(SpecialErrors::InvalidCert)?, Err(_) => Err(SpecialErrors::InvalidCert)?,
}; };
for key in cert.keys().subkeys() {
match log_err!(key.with_policy(&*POLICY, None), debug) {
Ok(_) => continue,
Err(_) => Err(SpecialErrors::KeyPolicyViolation)?,
}
}
if let Some(policy_settings) = &SETTINGS.policy { if let Some(policy_settings) = &SETTINGS.policy {
if let Some(max_validity_setting) = policy_settings.key_max_validity { if let Some(max_validity_setting) = policy_settings.key_max_validity {
let max_validity = Duration::from_secs(max_validity_setting); let max_validity = Duration::from_secs(max_validity_setting);