From: Simon Josefsson <simon@josefsson.org>
Date: Wed, 27 Dec 2006 18:52:10 +0000 (+0000)
Subject: (_gnutls_gen_cert_server_cert_req): For TLS 1.2, generate conforming
X-Git-Tag: gnutls_1_6_1~11
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d98793f0cb75cdff9b29d174a776ec14629ef403;p=thirdparty%2Fgnutls.git

(_gnutls_gen_cert_server_cert_req): For TLS 1.2, generate conforming
cert requests (i.e., include a empty list of supported hashes).
Report and tiny patch from ludovic.courtes@laas.fr (Ludovic Courtès).
---

diff --git a/lib/auth_cert.c b/lib/auth_cert.c
index b7f1f596c6..86dd3bdabe 100644
--- a/lib/auth_cert.c
+++ b/lib/auth_cert.c
@@ -1403,6 +1403,7 @@ _gnutls_gen_cert_server_cert_req (gnutls_session_t session, opaque ** data)
   gnutls_certificate_credentials_t cred;
   int size;
   opaque *pdata;
+  gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 
   /* Now we need to generate the RDN sequence. This is
    * already in the CERTIFICATE_CRED structure, to improve
@@ -1439,6 +1440,13 @@ _gnutls_gen_cert_server_cert_req (gnutls_session_t session, opaque ** data)
   pdata[2] = DSA_SIGN;		/* only these for now */
   pdata += CERTTYPE_SIZE;
 
+  if (ver == GNUTLS_TLS1_2)
+    {
+      /* Supported hashes (nothing for now -- FIXME). */
+      *pdata = 0;
+      pdata++, size++;
+    }
+
   if (session->security_parameters.cert_type == GNUTLS_CRT_X509 &&
       session->internals.ignore_rdn_sequence == 0)
     {