Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN

The default is now GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN, and
removed gnutls_certificate_update_verify_flags().

diff --git a/NEWS b/NEWS
index 72ea41a6f181bf19f9e3fa6f00c0ffc1aaabd6f4..ef4f7035e99fc940866653ade75d26ea59c57b04 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -22,6 +22,9 @@ if check fails.
 ** libgnutls: gnutls_x509_crl_verify() includes the time
 checks.
 
+** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN
+and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default.
+
 ** gnutls-cli: Added --local-dns option.
 
 ** danetool: Corrected bug that prevented loading PEM files.
@@ -33,7 +36,6 @@ a site's DANE data.
 
 ** API and ABI modifications:
 gnutls_session_get_id2: Added
-gnutls_certificate_update_verify_flags: Added
 gnutls_certificate_verify_peers3: Added
 gnutls_certificate_verification_status_print: Added
 gnutls_srtp_set_profile: Added
@@ -50,6 +52,7 @@ dane_verification_status_print: Added
 GNUTLS_CERT_REVOCATION_DATA_TOO_OLD: Added
 GNUTLS_CERT_REVOCATION_DATA_INVALID: Added
 GNUTLS_CERT_UNEXPECTED_OWNER: Added
+GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added
 
 * Version 3.1.3 (released 2012-10-12)
 

diff --git a/lib/gnutls_cert.c b/lib/gnutls_cert.c
index 21a3a5d860dbf472709b14b96f5c306296f1c824..8c2d27d4275f4527ab4feda836d65b3244a7e2f6 100644 (file)
--- a/lib/gnutls_cert.c
+++ b/lib/gnutls_cert.c
@@ -234,7 +234,6 @@ int ret;
     }
   (*res)->verify_bits = DEFAULT_MAX_VERIFY_BITS;
   (*res)->verify_depth = DEFAULT_MAX_VERIFY_DEPTH;
-  (*res)->verify_flags = GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN;
 
   return 0;
 }

diff --git a/lib/gnutls_ui.c b/lib/gnutls_ui.c
index 71888d405c2fda1b7b58da7da92c8e4a6425e84c..110ebae818b12143773c060c07d3ff5f823f2f9b 100644 (file)
--- a/lib/gnutls_ui.c
+++ b/lib/gnutls_ui.c
@@ -696,25 +696,6 @@ gnutls_certificate_set_verify_flags (gnutls_certificate_credentials_t
   res->verify_flags = flags;
 }
 
-/**
- * gnutls_certificate_update_verify_flags:
- * @res: is a gnutls_certificate_credentials_t structure
- * @flags: are the new flags
- *
- * This function will update the default flags to be used for verification 
- * of certificates.  The provided flags must be an OR of the
- * #gnutls_certificate_verify_flags enumerations. The default
- * for TLS sessions is GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN.
- *
- * Since: 3.1.4
- **/
-void
-gnutls_certificate_update_verify_flags (gnutls_certificate_credentials_t
-                                     res, unsigned int flags)
-{
-  res->verify_flags |= flags;
-}
-
 /**
  * gnutls_certificate_set_verify_limits:
  * @res: is a gnutls_certificate_credentials structure

diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index 5cd3850e3826a2f5d58cc9cc6c6f4f4c55677e7d..505b9929b5fa10d1c599e6083bb65e1d91c30895 100644 (file)
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -1197,8 +1197,6 @@ gnutls_ecc_curve_t gnutls_ecc_curve_get(gnutls_session_t session);
                                          gnutls_dh_params_t dh_params);
   void gnutls_certificate_set_verify_flags (gnutls_certificate_credentials_t
                                             res, unsigned int flags);
-  void gnutls_certificate_update_verify_flags (gnutls_certificate_credentials_t
-                                            res, unsigned int flags);
   void gnutls_certificate_set_verify_limits (gnutls_certificate_credentials_t
                                              res, unsigned int max_bits,
                                              unsigned int max_depth);

diff --git a/lib/includes/gnutls/x509.h b/lib/includes/gnutls/x509.h
index 8fd32eb07f0222be0d5744f415492b91991bb932..a3cf7257548df772390a53ed47c74a1d88ff0d18 100644 (file)
--- a/lib/includes/gnutls/x509.h
+++ b/lib/includes/gnutls/x509.h
@@ -632,7 +632,10 @@ extern "C"
  *   anyone trusted but exists in the trusted CA list do not treat it
  *   as trusted.
  * @GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN: A certificate chain is tolerated
- *   if unsorted (the case with many TLS servers out there).
+ *   if unsorted (the case with many TLS servers out there). This is the
+ *   default since GnuTLS 3.1.4.
+ * @GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Do not tolerate an unsorted
+ *   certificate chain.
  * @GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT: Allow CA certificates that
  *   have version 1 (both root and intermediate). This might be
  *   dangerous since those haven't the basicConstraints
@@ -652,17 +655,18 @@ extern "C"
  */
   typedef enum gnutls_certificate_verify_flags
   {
-    GNUTLS_VERIFY_DISABLE_CA_SIGN = 1,
-    GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT = 2,
-    GNUTLS_VERIFY_DO_NOT_ALLOW_SAME = 4,
-    GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT = 8,
-    GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 = 16,
-    GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5 = 32,
-    GNUTLS_VERIFY_DISABLE_TIME_CHECKS = 64,
-    GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS = 128,
-    GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT = 256,
-    GNUTLS_VERIFY_DISABLE_CRL_CHECKS = 512,
-    GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN = 1024,
+    GNUTLS_VERIFY_DISABLE_CA_SIGN = 1<<0,
+    GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT = 1<<1,
+    GNUTLS_VERIFY_DO_NOT_ALLOW_SAME = 1<<2,
+    GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT = 1<<3,
+    GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 = 1<<4,
+    GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5 = 1<<5,
+    GNUTLS_VERIFY_DISABLE_TIME_CHECKS = 1<<6,
+    GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS = 1<<7,
+    GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT = 1<<8,
+    GNUTLS_VERIFY_DISABLE_CRL_CHECKS = 1<<9,
+    GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN = 1<<10,
+    GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN = 1<<11,
   } gnutls_certificate_verify_flags;
 
   int gnutls_x509_crt_check_issuer (gnutls_x509_crt_t cert,

diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c
index cf603a269c1dd191d0370d2cd23beea210414761..ffc97303671db426b3492abd94c3a67f186e95ed 100644 (file)
--- a/lib/x509/verify-high.c
+++ b/lib/x509/verify-high.c
@@ -553,7 +553,7 @@ gnutls_x509_trust_list_verify_crt(gnutls_x509_trust_list_t list,
     if (cert_list == NULL || cert_list_size < 1)
         return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
 
-    if (flags & GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN)
+    if (!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN))
       cert_list = sort_clist(sorted, cert_list, &cert_list_size);
 
     cert_list_size = shorten_clist(list, cert_list, cert_list_size);

diff --git a/tests/chainverify-unsorted.c b/tests/chainverify-unsorted.c
index 716fbd20db30fd041ad4db5559b981805ed8245d..354c16bd49f1bfc0c551a0a309e6a5bc534f9bcb 100644 (file)
--- a/tests/chainverify-unsorted.c
+++ b/tests/chainverify-unsorted.c
@@ -614,6 +614,7 @@ doit (void)
   unsigned int crts_size, i;
   gnutls_x509_trust_list_t tl;
   unsigned int status, flags = GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN;
+  unsigned int not_flags = GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN;
 
   /* this must be called once in the program
    */
@@ -728,7 +729,7 @@ doit (void)
       exit(1);
     }
   
-  ret = gnutls_x509_trust_list_verify_crt(tl, crts, crts_size, 0, &status, NULL);
+  ret = gnutls_x509_trust_list_verify_crt(tl, crts, crts_size, not_flags, &status, NULL);
   if (ret < 0 || status == 0)
     {
       fail("gnutls_x509_trust_list_verify_crt - 5\n");