is_level_acceptable: no longer checks for broken algorithms

This is done at is_broken_allowed(), and in fact checking them in
is_level_acceptable() creates a conflict when overrides like flag
GNUTLS_VERIFY_ALLOW_BROKEN is used.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index 468714a61f25be82fe81e7d8fcbd910be10b560f..c4ea75144c7a77bd9a70141886216d601177e841 100644 (file)
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -373,7 +373,7 @@ int is_broken_allowed(gnutls_sign_algorithm_t sig, unsigned int flags)
                        _gnutls_debug_log(#level": certificate's signature hash is unknown\n"); \
                        return gnutls_assert_val(0); \
                } \
-               if (entry->secure == 0 || entry->output_size*8/2 < sym_bits) { \
+               if (entry->output_size*8/2 < sym_bits) { \
                        _gnutls_cert_log("cert", crt); \
                        _gnutls_debug_log(#level": certificate's signature hash strength is unacceptable (is %u bits, needed %u)\n", entry->output_size*8/2, sym_bits); \
                        return gnutls_assert_val(0); \