From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Sat, 9 Apr 2016 11:31:54 +0000 (+0200)
Subject: x509 output: don't warn about insecure algorithm when unknown
X-Git-Tag: gnutls_3_5_0~183
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=63573ee97f331831ff7f2e490a275d422fd1e5dd;p=thirdparty%2Fgnutls.git

x509 output: don't warn about insecure algorithm when unknown
---

diff --git a/lib/x509/ocsp_output.c b/lib/x509/ocsp_output.c
index 16381fe7bd..7dbd4bde9a 100644
--- a/lib/x509/ocsp_output.c
+++ b/lib/x509/ocsp_output.c
@@ -530,7 +530,7 @@ print_resp(gnutls_buffer_st * str, gnutls_ocsp_resp_t resp,
 				name = _("unknown");
 			addf(str, _("\tSignature Algorithm: %s\n"), name);
 		}
-		if (gnutls_sign_is_secure(ret) == 0) {
+		if (ret != GNUTLS_SIGN_UNKNOWN && gnutls_sign_is_secure(ret) == 0) {
 			adds(str,
 			     _("warning: signed using a broken signature "
 			       "algorithm that can be forged.\n"));
diff --git a/lib/x509/output.c b/lib/x509/output.c
index 29a94df867..cf72019bc2 100644
--- a/lib/x509/output.c
+++ b/lib/x509/output.c
@@ -1453,7 +1453,7 @@ print_cert(gnutls_buffer_st * str, gnutls_x509_crt_t cert,
 				name = _("unknown");
 			addf(str, _("\tSignature Algorithm: %s\n"), name);
 		}
-		if (gnutls_sign_is_secure(err) == 0) {
+		if (err != GNUTLS_SIGN_UNKNOWN && gnutls_sign_is_secure(err) == 0) {
 			adds(str,
 			     _("warning: signed using a broken signature "
 			       "algorithm that can be forged.\n"));
@@ -2095,7 +2095,7 @@ print_crl(gnutls_buffer_st * str, gnutls_x509_crl_t crl, int notsigned)
 				name = _("unknown");
 			addf(str, _("\tSignature Algorithm: %s\n"), name);
 		}
-		if (gnutls_sign_is_secure(err) == 0) {
+		if (err != GNUTLS_SIGN_UNKNOWN && gnutls_sign_is_secure(err) == 0) {
 			adds(str,
 			     _("warning: signed using a broken signature "
 			       "algorithm that can be forged.\n"));