Some fixes in the certificate handling.

diff --git a/lib/gnutls_alert.c b/lib/gnutls_alert.c
index 32fd597b818d9ffbecac2a07ddd554df0d826835..dde3c6a132852b1a0175070a267890dc51ea4519 100644 (file)
--- a/lib/gnutls_alert.c
+++ b/lib/gnutls_alert.c
@@ -181,7 +181,6 @@ int gnutls_error_to_alert(int err, int *level)
     case GNUTLS_E_ASN1_TYPE_ANY_ERROR:
     case GNUTLS_E_ASN1_SYNTAX_ERROR:
     case GNUTLS_E_ASN1_DER_OVERFLOW:
-    case GNUTLS_E_NO_CERTIFICATE_FOUND:
        ret = GNUTLS_A_BAD_CERTIFICATE;
        _level = GNUTLS_AL_FATAL;
        break;
@@ -229,6 +228,7 @@ int gnutls_error_to_alert(int err, int *level)
        _level = GNUTLS_AL_FATAL;
        break;
     case GNUTLS_E_DH_PRIME_UNACCEPTABLE:
+    case GNUTLS_E_NO_CERTIFICATE_FOUND:
        ret = GNUTLS_A_INSUFFICIENT_SECURITY;
        _level = GNUTLS_AL_FATAL;
        break;

diff --git a/lib/gnutls_kx.c b/lib/gnutls_kx.c
index ee545243e58245f326c292ccedb516013e5ad3e2..241c50804532da796c0db2d39301257a916ad98e 100644 (file)
--- a/lib/gnutls_kx.c
+++ b/lib/gnutls_kx.c
@@ -514,7 +514,12 @@ int _gnutls_recv_client_certificate(gnutls_session_t session)
            _gnutls_recv_handshake(session, &data,
                                   &datasize,
                                   GNUTLS_HANDSHAKE_CERTIFICATE_PKT, optional);
+
        if (ret < 0) {
+           /* Handle the case of old SSL3 clients who send
+            * a warning alert instead of an empty certificate to indicate
+            * no certificate.
+            */
            if (optional == OPTIONAL_PACKET &&
                ret == GNUTLS_E_WARNING_ALERT_RECEIVED &&
                gnutls_protocol_get_version(session) == GNUTLS_SSL3 &&
@@ -527,8 +532,11 @@ int _gnutls_recv_client_certificate(gnutls_session_t session)
                gnutls_assert();
                return 0;
            }
-           /* certificate was required */
-           if (optional == MANDATORY_PACKET) {
+
+           /* certificate was required 
+            */
+           if (ret == (GNUTLS_E_WARNING_ALERT_RECEIVED || ret == GNUTLS_E_FATAL_ALERT_RECEIVED) &&
+               optional == MANDATORY_PACKET) {
                gnutls_assert();
                return GNUTLS_E_NO_CERTIFICATE_FOUND;
            }
@@ -545,7 +553,6 @@ int _gnutls_recv_client_certificate(gnutls_session_t session)
            return 0;
        }
 
-
        ret =
            session->internals.auth_struct->
            gnutls_process_client_certificate(session, data, datasize);