From: Simon Josefsson <simon@josefsson.org>
Date: Fri, 6 Feb 2009 19:13:45 +0000 (+0100)
Subject: Move down revocation check to revert code to how it looked before.
X-Git-Tag: gnutls_2_7_5~4
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d456fbf67448f25dfb9494e7a1308caed69db86a;p=thirdparty%2Fgnutls.git

Move down revocation check to revert code to how it looked before.
The idea is that if you have marked a cert as trusted, you may want to trust
it even though some authority has revoked it.  This changes back how
this code used to work.
---

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index ee66060227..af97f4b0a3 100644
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -415,22 +415,6 @@ _gnutls_x509_verify_certificate (const gnutls_x509_crt_t * certificate_list,
   int i = 0, ret;
   unsigned int status = 0, output;
 
-  /* Check for revoked certificates in the chain
-   */
-#ifdef ENABLE_PKI
-  for (i = 0; i < clist_size; i++)
-    {
-      ret = gnutls_x509_crt_check_revocation (certificate_list[i],
-					      CRLs, crls_size);
-      if (ret == 1)
-	{			/* revoked */
-	  status |= GNUTLS_CERT_REVOKED;
-	  status |= GNUTLS_CERT_INVALID;
-	  return status;
-	}
-    }
-#endif
-
   if (clist_size > 1)
     {
       /* Check if the last certificate in the path is self signed.
@@ -493,6 +477,22 @@ _gnutls_x509_verify_certificate (const gnutls_x509_crt_t * certificate_list,
       return status;
     }
 
+  /* Check for revoked certificates in the chain
+   */
+#ifdef ENABLE_PKI
+  for (i = 0; i < clist_size; i++)
+    {
+      ret = gnutls_x509_crt_check_revocation (certificate_list[i],
+					      CRLs, crls_size);
+      if (ret == 1)
+	{			/* revoked */
+	  status |= GNUTLS_CERT_REVOKED;
+	  status |= GNUTLS_CERT_INVALID;
+	  return status;
+	}
+    }
+#endif
+
   /* Verify the certificate path (chain)
    */
   for (i = clist_size - 1; i > 0; i--)