Patch for userSMIMECertificate

All,

The dirmngr component doesn't attempt to fetch or parse userSMIMECertificate 
attributes within entries while fetching from LDAP, so I've attached a diff 
against 0.9.0 which adds the capability [Our directory stores 
userSMIMECertificates to distinguish from our web client certificates].

Also - I think that line 680 in ldap_wrapper (ldap.c) which reads

 ctrl->refcount++

should read:

 if (ctrl) ctrl->refcount++

since ctrl is not guaranteed to be non-NULL when entering the ldap_wrapper 
routine (try loading a CRL whose issuer certificate is not available in the 
local store or via LDAP - I get a segfault).

Now the bad news: I can't get libksba (0.9.10) to parse the PKCS7 blob which 
makes up a userSMIMECertificate - I just get "unsupported encoding" after the 
first couple of calls to the PKCS7 parser. So, I had to use GnuTLS as the 
PKCS7 unwrapper, which imposes a partial dependency on GnuTLS. The configure 
script will continue if GnuTLS is not present, but the PKCS7 unwrapping will 
be #ifdef'ed out.

Also - the code only takes the first certificate from the PKCS7 blob - which 
is not necessarily the right thing to do (the chain may be presented root to 
leaf, instead of the other way round).

If anyone knows how to get ksba to parse the certs in the blob (I've attached 
a sample PKCS7 blob), then that would be a much better solution.

Cheers,

Neil

_______________________________________________
Gpa-dev mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gpa-dev

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.9.15 (GNU/Linux)

iD8DBQBB+jTAh/HfQ9LIJAIRAjhIAJsG1Ie3Otv+y/epOYSjdiNt+XklJgCfTC21
WtmMgq0/1SZEjmvRx3u7pns=
=Q7Le
-----END PGP SIGNATURE-----