x509: Omit empty sequences of policyQualifiers.

When a certificate has a policy attached but no policyQualifiers,
`certtool` should omit the policyQualifiers sequence entirely, rather
than emitting an empty sequence.

Closes: #1238
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

diff --git a/lib/x509/x509_ext.c b/lib/x509/x509_ext.c
index df2eadd3b4f71e01d29e457b6024940c58f9c2d7..62cf02ce0679c502afcd1175d9f9d22dd73a352c 100644 (file)
--- a/lib/x509/x509_ext.c
+++ b/lib/x509/x509_ext.c
@@ -2161,6 +2161,16 @@ int gnutls_x509_ext_export_policies(gnutls_x509_policies_t policies,
                        goto cleanup;
                }
 
+                if (policies->policy[j].qualifiers == 0) {
+                        /* remove the optional policyQualifiers if none are present. */
+                        result = asn1_write_value(c2, "?LAST.policyQualifiers", NULL, 0); 
+                        if (result != ASN1_SUCCESS) {
+                                gnutls_assert();
+                                result = _gnutls_asn2err(result);
+                                goto cleanup;
+                        }
+                }
+
                for (i = 0;
                     i < MIN(policies->policy[j].qualifiers,
                             GNUTLS_MAX_QUALIFIERS); i++) {