From: Simon Josefsson Date: Fri, 9 Jan 2009 09:55:01 +0000 (+0100) Subject: Permit V1 Certificate Authorities properly. X-Git-Tag: gnutls_2_7_5~20 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ab6b6365fb5347da9bb89d95268d496b5f4195a2;p=thirdparty%2Fgnutls.git Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" in . --- diff --git a/NEWS b/NEWS index 4345ad29b1..190767e59f 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,13 @@ See the end for copying conditions. * Version 2.7.5 (unreleased) +** libgnutls: Permit V1 Certificate Authorities properly. +Before they were mistakenly rejected even though +GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or +GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by +"Douglas E. Engert" in +. + ** API and ABI modifications: No changes since last version. diff --git a/lib/x509/verify.c b/lib/x509/verify.c index c00b4bf499..c4fab1df3e 100644 --- a/lib/x509/verify.c +++ b/lib/x509/verify.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation + * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation * * Author: Nikos Mavrogiannopoulos * @@ -125,11 +125,23 @@ check_if_ca (gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer, } } - if (gnutls_x509_crt_get_ca_status (issuer, NULL) == 1) + result = gnutls_x509_crt_get_ca_status (issuer, NULL); + if (result == 1) { result = 1; goto cleanup; } + /* Handle V1 CAs that do not have a basicConstraint, but accept + these certs only if the appropriate flags are set. */ + else if ((result == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) && + ((flags & GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT) || + ((flags & GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT) && + (gnutls_x509_crt_check_issuer (issuer, issuer) == 1)))) + { + gnutls_assert (); + result = 1; + goto cleanup; + } else gnutls_assert ();