From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Tue, 6 Jan 2009 15:46:01 +0000 (-0500)
Subject: actually deprecate MD5 and MD2 signatures during X.509 verification by treating them... 
X-Git-Tag: gnutls_2_7_4~11
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ebbd1b6feedb6bfb5651da73ee064738d3d2264f;p=thirdparty%2Fgnutls.git

actually deprecate MD5 and MD2 signatures during X.509 verification by treating them as invalid unless the GNUTLS_VERIFY_ALLOW_SIGN_RSA_{MD5,MD2} flags are present.
---

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index 02964bafc8..c00b4bf499 100644
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -320,6 +320,7 @@ _gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
 	{
 	  if (output)
 	    *output |= GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID;
+	  ret = 0;
 	}
     }
 
@@ -1036,6 +1037,7 @@ _gnutls_verify_crl2 (gnutls_x509_crl_t crl,
       {
 	if (output)
 	  *output |= GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID;
+	ret = 0;
       }
   }