From: David Bremner <david@tethera.net>
To: notmuch@notmuchmail.org
Subject: [Patch v3 6/8] cli: crypto: S/MIME verification support
Date: Mon, 14 Dec 2015 09:38:55 -0400 [thread overview]
Message-ID: <1450100337-31655-7-git-send-email-david@tethera.net> (raw)
In-Reply-To: <1450100337-31655-1-git-send-email-david@tethera.net>
From: Jani Nikula <jani@nikula.org>
notmuch-show --verify will now also process S/MIME multiparts if
encountered. Requires gmime-2.6 and gpgsm.
Based on work by Jameson Graef Rollins <jrollins@finestructure.net>.
---
crypto.c | 35 +++++++++++++++++++++++++++++++++++
notmuch-client.h | 7 +++++--
test/T355-smime.sh | 1 -
3 files changed, 40 insertions(+), 3 deletions(-)
diff --git a/crypto.c b/crypto.c
index feae949..3dabc97 100644
--- a/crypto.c
+++ b/crypto.c
@@ -43,6 +43,28 @@ create_gpg_context (notmuch_crypto_t *crypto)
return gpgctx;
}
+/* Create a PKCS7 context (GMime 2.6) */
+static notmuch_crypto_context_t *
+create_pkcs7_context (notmuch_crypto_t *crypto)
+{
+ notmuch_crypto_context_t *pkcs7ctx;
+
+ if (crypto->pkcs7ctx)
+ return crypto->pkcs7ctx;
+
+ /* TODO: GMimePasswordRequestFunc */
+ pkcs7ctx = g_mime_pkcs7_context_new (NULL);
+ if (! pkcs7ctx) {
+ fprintf (stderr, "Failed to construct pkcs7 context.\n");
+ return NULL;
+ }
+ crypto->pkcs7ctx = pkcs7ctx;
+
+ g_mime_pkcs7_context_set_always_trust ((GMimePkcs7Context *) pkcs7ctx,
+ FALSE);
+
+ return pkcs7ctx;
+}
static const struct {
const char *protocol;
notmuch_crypto_context_t *(*get_context) (notmuch_crypto_t *crypto);
@@ -55,6 +77,14 @@ static const struct {
.protocol = "application/pgp-encrypted",
.get_context = create_gpg_context,
},
+ {
+ .protocol = "application/pkcs7-signature",
+ .get_context = create_pkcs7_context,
+ },
+ {
+ .protocol = "application/x-pkcs7-signature",
+ .get_context = create_pkcs7_context,
+ },
};
/* for the specified protocol return the context pointer (initializing
@@ -95,5 +125,10 @@ notmuch_crypto_cleanup (notmuch_crypto_t *crypto)
crypto->gpgctx = NULL;
}
+ if (crypto->pkcs7ctx) {
+ g_object_unref (crypto->pkcs7ctx);
+ crypto->pkcs7ctx = NULL;
+ }
+
return 0;
}
diff --git a/notmuch-client.h b/notmuch-client.h
index 3bd2903..18e6c60 100644
--- a/notmuch-client.h
+++ b/notmuch-client.h
@@ -31,6 +31,8 @@
#include <gmime/gmime.h>
typedef GMimeCryptoContext notmuch_crypto_context_t;
+/* This is automatically included only since gmime 2.6.10 */
+#include <gmime/gmime-pkcs7-context.h>
#include "notmuch.h"
@@ -70,6 +72,7 @@ typedef struct notmuch_show_format {
typedef struct notmuch_crypto {
notmuch_crypto_context_t* gpgctx;
+ notmuch_crypto_context_t* pkcs7ctx;
notmuch_bool_t verify;
notmuch_bool_t decrypt;
const char *gpgpath;
@@ -407,8 +410,8 @@ struct mime_node {
/* Construct a new MIME node pointing to the root message part of
* message. If crypto->verify is true, signed child parts will be
* verified. If crypto->decrypt is true, encrypted child parts will be
- * decrypted. If crypto->gpgctx is NULL, it will be lazily
- * initialized.
+ * decrypted. If the crypto contexts (crypto->gpgctx or
+ * crypto->pkcs7) are NULL, they will be lazily initialized.
*
* Return value:
*
diff --git a/test/T355-smime.sh b/test/T355-smime.sh
index 70a8287..47e3e94 100755
--- a/test/T355-smime.sh
+++ b/test/T355-smime.sh
@@ -44,7 +44,6 @@ EOF
test_expect_equal_file EXPECTED OUTPUT
test_begin_subtest "signature verification (notmuch CLI)"
-test_subtest_known_broken
output=$(notmuch show --format=json --verify subject:"test signed message 001" \
| notmuch_json_show_sanitize \
| sed -e 's|"created": [-1234567890]*|"created": 946728000|' \
--
2.6.2
next prev parent reply other threads:[~2015-12-14 13:39 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-12-14 13:38 David Bremner
2015-12-14 13:38 ` [Patch v3 1/8] crypto: refactor context creation to facilitate further work David Bremner
2015-12-14 13:38 ` [Patch v3 2/8] crypto: make crypto ctx initialization an array David Bremner
2015-12-14 13:38 ` [Patch v3 3/8] cli: let the user know which protocol is unknown or unsupported David Bremner
2015-12-30 15:30 ` David Bremner
2015-12-14 13:38 ` [Patch v3 4/8] test: initial tests for S/MIME and notmuch-emacs David Bremner
2015-12-14 20:03 ` David Bremner
2015-12-14 21:27 ` Tomi Ollila
2015-12-14 23:37 ` David Bremner
2015-12-14 13:38 ` [Patch v3 5/8] test: add broken S/MIME signature verification test for notmuch CLI David Bremner
2015-12-14 13:38 ` David Bremner [this message]
2015-12-14 13:38 ` [Patch v3 7/8] debian: Recommend gpgsm for S/MIME support David Bremner
2015-12-14 13:38 ` [Patch v3 8/8] debian: add gpgsm as build dependency David Bremner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://notmuchmail.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1450100337-31655-7-git-send-email-david@tethera.net \
--to=david@tethera.net \
--cc=notmuch@notmuchmail.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://yhetil.org/notmuch.git/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).