certtool: Make --verify-chain use libgnutls verification algorithm.

diff --git a/NEWS b/NEWS
index 7acdd76fa5b95fb10723e757766bc77a3c586430..e3bd27229b4a9518e91fa74c66ce4f483f0f95e9 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,5 @@
 GNU TLS NEWS -- History of user-visible changes.                -*- outline -*-
-Copyright (C) 2004, 2005, 2006, 2007, 2008 Simon Josefsson
+Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Simon Josefsson
 Copyright (C) 2000, 2001, 2002, 2003, 2004 Nikos Mavrogiannopoulos
 See the end for copying conditions.
 
@@ -11,6 +11,13 @@ Patch from David Marín Carreño <davefx@gmail.com> in
 
 ** gnutls: gnutls_x509_crq_print will now also print public key id.
 
+** certtool: --verify-chain now prints results of using library verification.
+Earlier, certtool --verify-chain used its own validation algorithm
+which wasn't guaranteed to give the same result as the libgnutls
+internal validation algorithm.  Now this command print a new final
+line with header 'Chain verification output:' that contains the result
+from using the internal verification algorithm on the same chain.
+
 ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id.
 
 ** API and ABI modifications:

diff --git a/src/certtool.c b/src/certtool.c
index 65f244ec350b7f6a1daf8b4719062d99eb84891d..c8f4f375fc533bd9d7620aee25325f4d6c3fba49 100644 (file)
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation
  *
  * This file is part of GNUTLS.
  *
@@ -2184,6 +2184,52 @@ _verify_x509_mem (const void *cert, int cert_size)
 
   fprintf (outfile, ".\n\n");
 
+  /* Verify using internal algorithm too. */
+  {
+    int verify_status;
+    int comma;
+
+    ret = gnutls_x509_crt_list_verify (x509_cert_list, x509_ncerts,
+                                      &x509_cert_list[x509_ncerts - 1], 1,
+                                      x509_crl_list,
+                                      x509_ncrls,
+                                      0, &verify_status);
+    if (ret < 0)
+      error (EXIT_FAILURE, 0, "gnutls_x509_crt_list_verify: %s",
+            gnutls_strerror (ret));
+
+    fprintf (outfile, "Chain verification output: ");
+
+    if (verify_status & GNUTLS_CERT_INVALID)
+      {
+       fprintf (outfile, "Not verified");
+       comma = 1;
+      }
+    else
+      {
+       fprintf (outfile, "Verified");
+       comma = 1;
+      }
+
+    if (verify_status & GNUTLS_CERT_SIGNER_NOT_CA)
+      {
+       if (comma)
+         fprintf (outfile, ", ");
+       fprintf (outfile, "Issuer is not a CA");
+       comma = 1;
+      }
+
+    if (verify_status & GNUTLS_CERT_INSECURE_ALGORITHM)
+      {
+       if (comma)
+         fprintf (outfile, ", ");
+       fprintf (outfile, "Insecure algorithm");
+       comma = 1;
+      }
+
+    fprintf (outfile, ".\n");
+  }
+
   for (i = 0; i < x509_ncerts; i++)
     gnutls_x509_crt_deinit (x509_cert_list[i]);