New option --stricttofu for gnutls-cli

With option --tofu, gnutls-cli waits with a yes-no-question upon
certificate changes.  I added the option --stricttofu that omits the
question and fails instead.

The contribution is in accordance to the "Developer's Certificate of
Origin" as found in the file doc/DCO.txt.

Best wishes
Jens

Signed-off-by: Jens Lechtenbörger <jens.lechtenboerger@fsfe.org>

diff --git a/src/cli-args.def b/src/cli-args.def
index 6f9c722bab1dae414642e0b06fd44a4fde2a8a2b..252d6ad0e5e2628516d764f3143dba014e78328d 100644 (file)
--- a/src/cli-args.def
+++ b/src/cli-args.def
@@ -20,6 +20,14 @@ flag = {
     doc       = "This option will, in addition to certificate authentication, perform authentication based on previously seen public keys, a model similar to SSH authentication.";
 };
 
+flag = {
+    name      = strict-tofu;
+    descrip   = "Fail to connect if a known certificate has changed";
+    disabled;
+    disable   = "no";
+    doc       = "This option will perform authentication as with option --tofu; however, while --tofu asks whether to trust a changed certificate, this option will fail in case of certificate changes.";
+};
+
 flag = {
     name      = dane;
     descrip   = "Enable DANE certificate verification (DNSSEC)";
@@ -421,4 +429,3 @@ $ gnutls-cli www.example.com --x509keyfile $MYKEY --x509certfile MYCERT
 Notice that the private key only differs from the certificate in the object-type.
 _EOF_;
 };
-

diff --git a/src/cli.c b/src/cli.c
index 68004aa756417ce5e045d5e5ac1e10a2a16d3a62..c92d7ee04beb35db075c6fcb8177eadc88c2b8df 100644 (file)
--- a/src/cli.c
+++ b/src/cli.c
@@ -421,6 +421,11 @@ static int cert_verify_callback(gnutls_session_t session)
        int rc;
        unsigned int status = 0;
        int ssh = ENABLED_OPT(TOFU);
+       int strictssh = ENABLED_OPT(STRICT_TOFU);
+       if (strictssh) {
+               ssh = strictssh;
+       }
+
 #ifdef HAVE_DANE
        int dane = ENABLED_OPT(DANE);
 #endif
@@ -490,10 +495,13 @@ static int cert_verify_callback(gnutls_session_t session)
                                        "Its certificate is valid for %s.\n",
                                        hostname);
 
-                       rc = read_yesno
-                           ("Do you trust the received key? (y/N): ");
-                       if (rc == 0)
-                               return -1;
+                       if (strictssh == 0) {
+                               rc = read_yesno
+                                       ("Do you trust the received key? (y/N): ");
+                               if (rc == 0)
+                                       return -1;
+                       } else return -1;
+
                } else if (rc < 0) {
                        fprintf(stderr,
                                "gnutls_verify_stored_pubkey: %s\n",