corrected the cert_type extension. (bug pointed out by D. Taylor)

diff --git a/lib/ext_cert_type.c b/lib/ext_cert_type.c
index c2084f61b59257cb3a1eb6c1d99ae917318ba8e9..eec02ed4a10da1d438ccca68551e64bd40aa9614 100644 (file)
--- a/lib/ext_cert_type.c
+++ b/lib/ext_cert_type.c
@@ -28,6 +28,7 @@
 #include "gnutls_num.h"
 #include "ext_cert_type.h"
 #include <gnutls_state.h>
+#include <gnutls_num.h>
 
 /* 
  * In case of a server: if a CERT_TYPE extension type is received then it stores
@@ -65,15 +66,14 @@ int _gnutls_cert_type_recv_params( gnutls_session session, const opaque* data, i
                }
        } else { /* SERVER SIDE - we must check if the sent cert type is the right one 
                  */
-               if (data_size > 0) {
+               if (data_size > 1) {
+                       uint8 len;
 
-                       if ( data_size <= 0) {
-                               gnutls_assert();
-                               return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
-                       }
+                       len = data[0];
+                       DECR_LEN( data_size, len);
 
-                       for (i=0;i<data_size;i++) {
-                               new_type = _gnutls_num2cert_type(data[i]);
+                       for (i=0;i<len;i++) {
+                               new_type = _gnutls_num2cert_type(data[i+1]);
 
                                if (new_type < 0) continue;
                                
@@ -126,16 +126,20 @@ int _gnutls_cert_type_send_params( gnutls_session session, opaque* data, int dat
                                return 0;
                        }
                        
-                       if (data_size < len) {
+                       if (data_size < len + 1) {
                                gnutls_assert();
                                return GNUTLS_E_INVALID_REQUEST;
                        }
+                       
+                       /* this is a vector!
+                        */
+                       data[0] = (uint8) len;
 
                        for (i=0;i<len;i++) {
-                               data[i] = _gnutls_cert_type2num( session->internals.
+                               data[i+1] = _gnutls_cert_type2num( session->internals.
                                        cert_type_priority.priority[i]);
                        }
-                       return len;
+                       return len + 1;
                }
 
        } else { /* server side */

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index e32d48e0d78759346bdd981e12e0756ac98697ce..437aa1149029aed65e391613894cd233ca4bec16 100644 (file)
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -42,8 +42,6 @@
  */
 typedef int gnutls_transport_ptr;
 
-typedef const int* gnutls_list;
-
 #define MIN_BITS 767
 
 #define MAX32 4294967295
@@ -58,6 +56,9 @@ typedef const int* gnutls_list;
 #define TLS_RANDOM_SIZE 32
 #define TLS_MAX_SESSION_ID_SIZE 32
 #define TLS_MASTER_SIZE 48
+
+/* The maximum digest size of hash algorithms. 
+ */
 #define MAX_HASH_SIZE 20
 
 #define MAX_X509_CERT_SIZE 10*1024

diff --git a/lib/gnutls_x509.c b/lib/gnutls_x509.c
index 553e6ae6e017e180f518579cd6ea511fb7a27cdd..dd815b7b8f9fd59913cdf0acfd697f7582bf0a84 100644 (file)
--- a/lib/gnutls_x509.c
+++ b/lib/gnutls_x509.c
@@ -2172,8 +2172,8 @@ int _gnutls_x509_cert2gnutls_cert(gnutls_cert * gCert, gnutls_datum derCert,
 
 }
 
-/* Returns 0 if it's ok to use the gnutls_kx_algorithm with this cert
- * (using KeyUsage field). 
+/* Returns 0 if it's ok to use the gnutls_kx_algorithm with this 
+ * certificate (uses the KeyUsage field). 
  */
 int _gnutls_check_x509_key_usage(const gnutls_cert * cert,
                                    gnutls_kx_algorithm alg)
@@ -2193,6 +2193,7 @@ int _gnutls_check_x509_key_usage(const gnutls_cert * cert,
                        return 0;
                case GNUTLS_KX_DHE_RSA:
                case GNUTLS_KX_DHE_DSS:
+               case GNUTLS_KX_RSA_EXPORT:
                        if (cert->keyUsage != 0) {
                                if (!
                                    (cert->
@@ -2203,10 +2204,6 @@ int _gnutls_check_x509_key_usage(const gnutls_cert * cert,
                                        return 0;
                        }
                        return 0;
-
-               case GNUTLS_KX_RSA_EXPORT:
-                       return 0;
-
                default:
                        gnutls_assert();
                        return GNUTLS_E_X509_KEY_USAGE_VIOLATION;