From: Simon Josefsson <simon@josefsson.org>
Date: Wed, 10 Dec 2008 11:57:19 +0000 (+0100)
Subject: Revert Nikos revert, and fix verification hopefully better.
X-Git-Tag: gnutls_2_7_3~19
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=071beb6e8038bf5ffc1d63eb0b249a37ffa80ed3;p=thirdparty%2Fgnutls.git

Revert Nikos revert, and fix verification hopefully better.
The new logic is to include the CA cert in validation,
but short-cut full validation of trusted certificates.
---

diff --git a/NEWS b/NEWS
index 0b93c8dcdc..021af4e2e8 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,12 @@ See the end for copying conditions.
 
 * Version 2.7.3 (unreleased)
 
+** gnutls: Fix chain verification for chains that ends with RSA-MD2 CAs.
+Reported by Michael Kiefer <Michael-Kiefer@web.de> in
+<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by
+Andreas Metzler <ametzler@downhill.at.eu.org> in
+<http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>.
+
 ** gnutls: Libgcrypt initialization changed.
 If libgcrypt has not already been initialized, GnuTLS will now
 initialize libgcrypt with disabled secure memory.  Initialize
diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index 00e2422ce2..6fc635a4d3 100644
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -226,6 +226,7 @@ _gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
   gnutls_datum_t cert_signature = { NULL, 0 };
   gnutls_x509_crt_t issuer;
   int ret, issuer_version, result;
+  int sigalg;
 
   if (output)
     *output = 0;
@@ -251,6 +252,11 @@ _gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
       return 0;
     }
 
+  /* If self-issued, it is one of our trusted certs.  Don't bother
+     testing an explicitly trusted cert further. */
+  if (is_issuer (cert, cert))
+    return 1;
+
   issuer_version = gnutls_x509_crt_get_version (issuer);
   if (issuer_version < 0)
     {
@@ -303,24 +309,15 @@ _gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
       ret = 0;
     }
 
-  /* If the certificate is not self signed check if the algorithms
-   * used are secure. If the certificate is self signed it doesn't
-   * really matter.
-   */
-  if (is_issuer (cert, cert) == 0)
-    {
-      int sigalg;
-
-      sigalg = gnutls_x509_crt_get_signature_algorithm (cert);
+  sigalg = gnutls_x509_crt_get_signature_algorithm (cert);
 
-      if (((sigalg == GNUTLS_SIGN_RSA_MD2) &&
-	   !(flags & GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2)) ||
-	  ((sigalg == GNUTLS_SIGN_RSA_MD5) &&
-	   !(flags & GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5)))
-	{
-	  if (output)
-	    *output |= GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID;
-	}
+  if (((sigalg == GNUTLS_SIGN_RSA_MD2) &&
+       !(flags & GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2)) ||
+      ((sigalg == GNUTLS_SIGN_RSA_MD5) &&
+       !(flags & GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5)))
+    {
+      if (output)
+	*output |= GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID;
     }
 
   result = ret;
@@ -374,24 +371,6 @@ _gnutls_x509_verify_certificate (const gnutls_x509_crt_t * certificate_list,
   int i = 0, ret;
   unsigned int status = 0, output;
 
-  if (clist_size > 1) 
-    {
-      /* Check if the last certificate in the path is self signed.
-       * In that case ignore it (a certificate is trusted only if it
-       * leads to a trusted party by us, not the server's).
-       *
-       * This in addition prevents from verifying self signed certificates
-       * against themselves. This although not bad caused verification
-       * failures on some root self signed certificates that use the MD2
-       * algorithm.
-       */
-      if (gnutls_x509_crt_check_issuer (certificate_list[clist_size - 1],
-  				    certificate_list[clist_size - 1]) > 0)
-        {
-          clist_size--;
-        }
-    }
-
   /* Verify the last certificate in the certificate path
    * against the trusted CA certificate list.
    *