Permit V1 Certificate Authorities properly.

Before they were mistakenly rejected even though
GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or
GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied.  Reported by
"Douglas E. Engert" <deengert@anl.gov> in
<http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>.

diff --git a/NEWS b/NEWS
index 4345ad29b16daa47345d94f16a5fbcbfbee951e6..190767e59f1f8d92a67098b9157920922f3b7ec1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,13 @@ See the end for copying conditions.
 
 * Version 2.7.5 (unreleased)
 
+** libgnutls: Permit V1 Certificate Authorities properly.
+Before they were mistakenly rejected even though
+GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or
+GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied.  Reported by
+"Douglas E. Engert" <deengert@anl.gov> in
+<http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>.
+
 ** API and ABI modifications:
 No changes since last version.
 

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index c00b4bf4997890d967fb8a4a84e84e2e6dbadde2..c4fab1df3e14987f016f4a9aed52107f4ef8390c 100644 (file)
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation
  *
  * Author: Nikos Mavrogiannopoulos
  *
@@ -125,11 +125,23 @@ check_if_ca (gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
          }
       }
 
-  if (gnutls_x509_crt_get_ca_status (issuer, NULL) == 1)
+  result = gnutls_x509_crt_get_ca_status (issuer, NULL);
+  if (result == 1)
     {
       result = 1;
       goto cleanup;
     }
+  /* Handle V1 CAs that do not have a basicConstraint, but accept
+     these certs only if the appropriate flags are set. */
+  else if ((result == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) &&
+          ((flags & GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT) ||
+           ((flags & GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT) &&
+            (gnutls_x509_crt_check_issuer (issuer, issuer) == 1))))
+    {
+      gnutls_assert ();
+      result = 1;
+      goto cleanup;
+    }
   else
     gnutls_assert ();