diff options
| author | Łukasz Stelmach <stlman@poczta.fm> | 2018-02-27 15:44:55 +0100 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2018-03-01 16:07:44 +0100 |
| commit | 70213445fe3add019f2cff2669fd2439581922f1 (patch) | |
| tree | f45016e8e033e35da7fee51013496085cfad2ad1 /src | |
| parent | 6bc06b9bda7b437fa784b814aecdc0b736fb0757 (diff) | |
| download | gnutls-70213445fe3add019f2cff2669fd2439581922f1.tar.gz | |
gnutls-cli: do not ask any questions with --strict-tofu
Signed-off-by: Łukasz Stelmach <stlman@poczta.fm>
Diffstat (limited to 'src')
| -rw-r--r-- | src/cli-args.def | 5 | ||||
| -rw-r--r-- | src/cli.c | 15 |
2 files changed, 12 insertions, 8 deletions
diff --git a/src/cli-args.def b/src/cli-args.def index 9a067ce78b..8ad9a98ed3 100644 --- a/src/cli-args.def +++ b/src/cli-args.def @@ -25,10 +25,11 @@ process."; flag = { name = strict-tofu; - descrip = "Fail to connect if a known certificate has changed"; + descrip = "Fail to connect if a certificate is unknown or a known certificate has changed"; disabled; disable = "no"; - doc = "This option will perform authentication as with option --tofu; however, while --tofu asks whether to trust a changed public key, this option will fail in case of public key changes."; + doc = "This option will perform authentication as with option --tofu; however, no questions shall be asked whatsoever, neither to accept an unknown certificate nor a changed one."; + }; flag = { @@ -448,6 +448,9 @@ static int cert_verify_callback(gnutls_session_t session) "Its certificate is valid for %s.\n", hostname); + if (strictssh) + return -1; + rc = read_yesno ("Are you sure you want to trust it? (y/N): "); if (rc == 0) @@ -463,13 +466,13 @@ static int cert_verify_callback(gnutls_session_t session) "Its certificate is valid for %s.\n", hostname); - if (strictssh == 0) { - rc = read_yesno - ("Do you trust the received key? (y/N): "); - if (rc == 0) - return -1; - } else return -1; + if (strictssh) + return -1; + rc = read_yesno + ("Do you trust the received key? (y/N): "); + if (rc == 0) + return -1; } else if (rc < 0) { fprintf(stderr, "gnutls_verify_stored_pubkey: %s\n", |