From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Tue, 3 Sep 2002 14:33:06 +0000 (+0000)
Subject: corrected the cert_type extension. (bug pointed out by D. Taylor)
X-Git-Tag: gnutls_0_5_6~18
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=34a2b48cd84c8d1f16fe522715b472ee65d35653;p=thirdparty%2Fgnutls.git

corrected the cert_type extension. (bug pointed out by D. Taylor)
---

diff --git a/lib/ext_cert_type.c b/lib/ext_cert_type.c
index c2084f61b5..eec02ed4a1 100644
--- a/lib/ext_cert_type.c
+++ b/lib/ext_cert_type.c
@@ -28,6 +28,7 @@
 #include "gnutls_num.h"
 #include "ext_cert_type.h"
 #include <gnutls_state.h>
+#include <gnutls_num.h>
 
 /* 
  * In case of a server: if a CERT_TYPE extension type is received then it stores
@@ -65,15 +66,14 @@ int _gnutls_cert_type_recv_params( gnutls_session session, const opaque* data, i
 		}
 	} else { /* SERVER SIDE - we must check if the sent cert type is the right one 
 	          */
-		if (data_size > 0) {
+		if (data_size > 1) {
+			uint8 len;
 
-			if ( data_size <= 0) {
-				gnutls_assert();
-				return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
-			}
+			len = data[0];
+			DECR_LEN( data_size, len);
 
-			for (i=0;i<data_size;i++) {
-				new_type = _gnutls_num2cert_type(data[i]);
+			for (i=0;i<len;i++) {
+				new_type = _gnutls_num2cert_type(data[i+1]);
 
 				if (new_type < 0) continue;
 				
@@ -126,16 +126,20 @@ int _gnutls_cert_type_send_params( gnutls_session session, opaque* data, int dat
 				return 0;
 			}
 			
-			if (data_size < len) {
+			if (data_size < len + 1) {
 				gnutls_assert();
 				return GNUTLS_E_INVALID_REQUEST;
 			}
+			
+			/* this is a vector!
+			 */
+			data[0] = (uint8) len;
 
 			for (i=0;i<len;i++) {
-				data[i] = _gnutls_cert_type2num( session->internals.
+				data[i+1] = _gnutls_cert_type2num( session->internals.
 					cert_type_priority.priority[i]);
 			}
-			return len;
+			return len + 1;
 		}
 
 	} else { /* server side */
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index e32d48e0d7..437aa11490 100644
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -42,8 +42,6 @@
  */
 typedef int gnutls_transport_ptr;
 
-typedef const int* gnutls_list;
-
 #define MIN_BITS 767
 
 #define MAX32 4294967295
@@ -58,6 +56,9 @@ typedef const int* gnutls_list;
 #define TLS_RANDOM_SIZE 32
 #define TLS_MAX_SESSION_ID_SIZE 32
 #define TLS_MASTER_SIZE 48
+
+/* The maximum digest size of hash algorithms. 
+ */
 #define MAX_HASH_SIZE 20
 
 #define MAX_X509_CERT_SIZE 10*1024
diff --git a/lib/gnutls_x509.c b/lib/gnutls_x509.c
index 553e6ae6e0..dd815b7b8f 100644
--- a/lib/gnutls_x509.c
+++ b/lib/gnutls_x509.c
@@ -2172,8 +2172,8 @@ int _gnutls_x509_cert2gnutls_cert(gnutls_cert * gCert, gnutls_datum derCert,
 
 }
 
-/* Returns 0 if it's ok to use the gnutls_kx_algorithm with this cert
- * (using KeyUsage field). 
+/* Returns 0 if it's ok to use the gnutls_kx_algorithm with this 
+ * certificate (uses the KeyUsage field). 
  */
 int _gnutls_check_x509_key_usage(const gnutls_cert * cert,
 				    gnutls_kx_algorithm alg)
@@ -2193,6 +2193,7 @@ int _gnutls_check_x509_key_usage(const gnutls_cert * cert,
 			return 0;
 		case GNUTLS_KX_DHE_RSA:
 		case GNUTLS_KX_DHE_DSS:
+		case GNUTLS_KX_RSA_EXPORT:
 			if (cert->keyUsage != 0) {
 				if (!
 				    (cert->
@@ -2203,10 +2204,6 @@ int _gnutls_check_x509_key_usage(const gnutls_cert * cert,
 					return 0;
 			}
 			return 0;
-
-		case GNUTLS_KX_RSA_EXPORT:
-			return 0;
-
 		default:
 			gnutls_assert();
 			return GNUTLS_E_X509_KEY_USAGE_VIOLATION;