From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Sun, 30 Oct 2005 16:52:05 +0000 (+0000)
Subject: Some fixes in the certificate handling.
X-Git-Tag: gnutls_1_2_9~28
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=eb435f6437dcfbbeecec78b9ca67af22290863f1;p=thirdparty%2Fgnutls.git

Some fixes in the certificate handling.
---

diff --git a/lib/gnutls_alert.c b/lib/gnutls_alert.c
index 32fd597b81..dde3c6a132 100644
--- a/lib/gnutls_alert.c
+++ b/lib/gnutls_alert.c
@@ -181,7 +181,6 @@ int gnutls_error_to_alert(int err, int *level)
     case GNUTLS_E_ASN1_TYPE_ANY_ERROR:
     case GNUTLS_E_ASN1_SYNTAX_ERROR:
     case GNUTLS_E_ASN1_DER_OVERFLOW:
-    case GNUTLS_E_NO_CERTIFICATE_FOUND:
 	ret = GNUTLS_A_BAD_CERTIFICATE;
 	_level = GNUTLS_AL_FATAL;
 	break;
@@ -229,6 +228,7 @@ int gnutls_error_to_alert(int err, int *level)
 	_level = GNUTLS_AL_FATAL;
 	break;
     case GNUTLS_E_DH_PRIME_UNACCEPTABLE:
+    case GNUTLS_E_NO_CERTIFICATE_FOUND:
 	ret = GNUTLS_A_INSUFFICIENT_SECURITY;
 	_level = GNUTLS_AL_FATAL;
 	break;
diff --git a/lib/gnutls_kx.c b/lib/gnutls_kx.c
index ee545243e5..241c508045 100644
--- a/lib/gnutls_kx.c
+++ b/lib/gnutls_kx.c
@@ -514,7 +514,12 @@ int _gnutls_recv_client_certificate(gnutls_session_t session)
 	    _gnutls_recv_handshake(session, &data,
 				   &datasize,
 				   GNUTLS_HANDSHAKE_CERTIFICATE_PKT, optional);
+
 	if (ret < 0) {
+	    /* Handle the case of old SSL3 clients who send
+	     * a warning alert instead of an empty certificate to indicate
+	     * no certificate.
+	     */
 	    if (optional == OPTIONAL_PACKET &&
 		ret == GNUTLS_E_WARNING_ALERT_RECEIVED &&
 		gnutls_protocol_get_version(session) == GNUTLS_SSL3 &&
@@ -527,8 +532,11 @@ int _gnutls_recv_client_certificate(gnutls_session_t session)
 		gnutls_assert();
 		return 0;
 	    }
-	    /* certificate was required */
-	    if (optional == MANDATORY_PACKET) {
+
+	    /* certificate was required 
+	     */
+	    if (ret == (GNUTLS_E_WARNING_ALERT_RECEIVED || ret == GNUTLS_E_FATAL_ALERT_RECEIVED) &&
+	        optional == MANDATORY_PACKET) {
 		gnutls_assert();
 		return GNUTLS_E_NO_CERTIFICATE_FOUND;
 	    }
@@ -545,7 +553,6 @@ int _gnutls_recv_client_certificate(gnutls_session_t session)
 	    return 0;
 	}
 
-
 	ret =
 	    session->internals.auth_struct->
 	    gnutls_process_client_certificate(session, data, datasize);