The client certificate selection callback is no longer called twice. It is called...

diff --git a/lib/auth_cert.c b/lib/auth_cert.c
index 9d4d6899578b254e4e9f9c8f05874f352adfb2ca..614b6794be7466bb9baff146efe9aa46ac8d1f93 100644 (file)
--- a/lib/auth_cert.c
+++ b/lib/auth_cert.c
@@ -236,7 +236,7 @@ static int _gnutls_find_acceptable_client_cert(gnutls_session session,
        int result, size;
        int indx = -1;
        uint i, j;
-       int try = 0, *ij_map = NULL;
+       int *ij_map = NULL;
        const gnutls_certificate_credentials cred;
        opaque *data = _data;
        ssize_t data_size = _data_size;
@@ -248,19 +248,9 @@ static int _gnutls_find_acceptable_client_cert(gnutls_session session,
                return GNUTLS_E_INSUFICIENT_CREDENTIALS;
        }
 
-       if (session->internals.client_cert_callback != NULL) {
-               /* if try>=0 then the client wants automatic
-                * choose of certificate, otherwise (-1), he
-                * will be prompted to choose one.
-                */
-               try =
-                   session->internals.client_cert_callback(session,
-                                                           NULL, 0,
-                                                           NULL, 0);
-       }
-
-
-       if (try >= 0) {
+       /* If we have no callback.
+        */
+       if (session->internals.client_cert_callback == NULL) {
                result = 0;
 
                if (session->security_parameters.cert_type ==
@@ -281,12 +271,8 @@ static int _gnutls_find_acceptable_client_cert(gnutls_session session,
                        gnutls_assert();
                        return result;
                }
-       }
-
-
-       /* use the callback 
-        */
-       if (indx == -1 && session->internals.client_cert_callback != NULL && try == -1) {
+       } else /* If the callback is set, then use it. */
+       if (session->internals.client_cert_callback != NULL) {
                /* use a callback to get certificate 
                 */
                gnutls_datum *my_certs = NULL;

diff --git a/lib/gnutls_cert.c b/lib/gnutls_cert.c
index 5e0638a51b462fba7ceec79b6c4514d3855ca1ed..11b044246c2c5401a90abaa4391011930dc35e76 100644 (file)
--- a/lib/gnutls_cert.c
+++ b/lib/gnutls_cert.c
@@ -177,8 +177,8 @@ void gnutls_certificate_server_set_request(gnutls_session session,
   * @session: is a &gnutls_session structure.
   * @func: is the callback function
   *
-  * The callback's function form is:
-  * int (*callback)(gnutls_session, gnutls_datum *client_cert, int ncerts, gnutls_datum* req_ca_dn, int nreqs);
+  * The callback's function prototype is:
+  * int (*callback)(gnutls_session, const gnutls_datum *client_cert, int ncerts, const gnutls_datum* req_ca_dn, int nreqs);
   *
   * 'client_cert' contains 'ncerts' gnutls_datum structures which hold
   * the raw certificates (DER for X.509 or binary for OpenPGP), of the
@@ -197,17 +197,8 @@ void gnutls_certificate_server_set_request(gnutls_session session,
   * is chosen based on the CAs sent by the server, and the requested
   * public key algorithms.
   *
-  * If the callback function is provided then gnutls will call it
-  * once with NULL parameters (except for the sesion). If the callback function returns
-  * a positive or zero number then gnutls will attempt to automaticaly
-  * choose the appropriate certificate. If gnutls fails to find an appropriate
-  * certificate, then it will call the callback function again with the
-  * appropriate parameters.
-  *
-  * In case the callback returned a negative number then gnutls will
-  * not attempt to choose the appropriate certificate and will call again
-  * the callback function with the appropriate parameters, and rely
-  * only to the return value of the callback function.
+  * If the callback function is provided then gnutls will call it, in the
+  * handshake, after the certificate request message has been received.
   *
   * The callback function should return the index of the certificate
   * choosen by the user. The index is relative to the certificates in the

diff --git a/src/cli.c b/src/cli.c
index 3c2407dafbc008f1db866d4c064644afba21c8d9..585c59b086ba93bef3dd579f4594b190d3499da7 100644 (file)
--- a/src/cli.c
+++ b/src/cli.c
@@ -118,8 +118,6 @@ static int cert_callback( gnutls_session session, const gnutls_datum* client_cer
 char issuer_dn[256];
 int len, i, ret;
 
-       if (client_certs == NULL && req_ca_rdn == NULL) return -1;
-
        /* Print the server's trusted CAs
         */
        if (nreqs > 0)

diff --git a/src/tests.c b/src/tests.c
index ff969111fe423acfdba0528493a23f931dbb4cbe..9423ee4b1823c03eb5a62368fd57c1a706bf0635 100644 (file)
--- a/src/tests.c
+++ b/src/tests.c
@@ -597,8 +597,6 @@ static int cert_callback( gnutls_session session, const gnutls_datum* client_cer
 char issuer_dn[256];
 int len, i, ret;
 
-       if (client_certs == NULL && req_ca_rdn == NULL) return -1;
-
        /* Print the server's trusted CAs
         */
        printf("\n");