(_gnutls_gen_cert_server_cert_req): For TLS 1.2, generate conforming

cert requests (i.e., include a empty list of supported hashes).
Report and tiny patch from ludovic.courtes@laas.fr (Ludovic Courtès).

diff --git a/lib/auth_cert.c b/lib/auth_cert.c
index b7f1f596c682d539967ca3c6e8426c08c0e06bcd..86dd3bdabe00b9ca4fcb1f4b34eb6924a043dd36 100644 (file)
--- a/lib/auth_cert.c
+++ b/lib/auth_cert.c
@@ -1403,6 +1403,7 @@ _gnutls_gen_cert_server_cert_req (gnutls_session_t session, opaque ** data)
   gnutls_certificate_credentials_t cred;
   int size;
   opaque *pdata;
+  gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 
   /* Now we need to generate the RDN sequence. This is
    * already in the CERTIFICATE_CRED structure, to improve
@@ -1439,6 +1440,13 @@ _gnutls_gen_cert_server_cert_req (gnutls_session_t session, opaque ** data)
   pdata[2] = DSA_SIGN;         /* only these for now */
   pdata += CERTTYPE_SIZE;
 
+  if (ver == GNUTLS_TLS1_2)
+    {
+      /* Supported hashes (nothing for now -- FIXME). */
+      *pdata = 0;
+      pdata++, size++;
+    }
+
   if (session->security_parameters.cert_type == GNUTLS_CRT_X509 &&
       session->internals.ignore_rdn_sequence == 0)
     {