|
 |
127c81 |
From 43ad7b2ad231489b7ada46e2f34deb82d64dd54d Mon Sep 17 00:00:00 2001
|
|
|
127c81 |
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
|
|
|
127c81 |
Date: Wed, 19 Feb 2014 11:10:26 +0100
|
|
|
127c81 |
Subject: [PATCH] corrected return codes.
|
|
|
127c81 |
|
|
|
127c81 |
---
|
|
|
127c81 |
lib/x509/verify.c | 22 ++++++++++++++--------
|
|
|
127c81 |
1 file changed, 14 insertions(+), 8 deletions(-)
|
|
|
127c81 |
|
|
|
127c81 |
diff --git a/lib/x509/verify.c b/lib/x509/verify.c
|
|
|
127c81 |
index 86a901e..d3f349b 100644
|
|
|
127c81 |
--- a/lib/x509/verify.c
|
|
|
127c81 |
+++ b/lib/x509/verify.c
|
|
|
127c81 |
@@ -106,7 +106,7 @@ check_if_ca (gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
|
|
|
127c81 |
if (result < 0)
|
|
|
127c81 |
{
|
|
|
127c81 |
gnutls_assert ();
|
|
|
127c81 |
- goto cleanup;
|
|
|
127c81 |
+ goto fail;
|
|
|
127c81 |
}
|
|
|
127c81 |
|
|
|
127c81 |
result =
|
|
|
127c81 |
@@ -115,7 +115,7 @@ check_if_ca (gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
|
|
|
127c81 |
if (result < 0)
|
|
|
127c81 |
{
|
|
|
127c81 |
gnutls_assert ();
|
|
|
127c81 |
- goto cleanup;
|
|
|
127c81 |
+ goto fail;
|
|
|
127c81 |
}
|
|
|
127c81 |
|
|
|
127c81 |
result =
|
|
|
127c81 |
@@ -123,7 +123,7 @@ check_if_ca (gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
|
|
|
127c81 |
if (result < 0)
|
|
|
127c81 |
{
|
|
|
127c81 |
gnutls_assert ();
|
|
|
127c81 |
- goto cleanup;
|
|
|
127c81 |
+ goto fail;
|
|
|
127c81 |
}
|
|
|
127c81 |
|
|
|
127c81 |
result =
|
|
|
127c81 |
@@ -131,7 +131,7 @@ check_if_ca (gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
|
|
|
127c81 |
if (result < 0)
|
|
|
127c81 |
{
|
|
|
127c81 |
gnutls_assert ();
|
|
|
127c81 |
- goto cleanup;
|
|
|
127c81 |
+ goto fail;
|
|
|
127c81 |
}
|
|
|
127c81 |
|
|
|
127c81 |
/* If the subject certificate is the same as the issuer
|
|
|
127c81 |
@@ -183,6 +183,7 @@ check_if_ca (gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
|
|
|
127c81 |
else
|
|
|
127c81 |
gnutls_assert ();
|
|
|
127c81 |
|
|
|
127c81 |
+fail:
|
|
|
127c81 |
result = 0;
|
|
|
127c81 |
|
|
|
127c81 |
cleanup:
|
|
|
127c81 |
@@ -408,14 +409,15 @@ _gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
|
|
|
127c81 |
if (issuer_version < 0)
|
|
|
127c81 |
{
|
|
|
127c81 |
gnutls_assert ();
|
|
|
127c81 |
- return issuer_version;
|
|
|
127c81 |
+ result = 0;
|
|
|
127c81 |
+ goto cleanup;
|
|
|
127c81 |
}
|
|
|
127c81 |
|
|
|
127c81 |
if (!(flags & GNUTLS_VERIFY_DISABLE_CA_SIGN) &&
|
|
|
127c81 |
((flags & GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT)
|
|
|
127c81 |
|| issuer_version != 1))
|
|
|
127c81 |
{
|
|
|
127c81 |
- if (check_if_ca (cert, issuer, max_path, flags) == 0)
|
|
|
127c81 |
+ if (check_if_ca (cert, issuer, max_path, flags) != 1)
|
|
|
127c81 |
{
|
|
|
127c81 |
gnutls_assert ();
|
|
|
127c81 |
out = GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID;
|
|
|
127c81 |
@@ -446,6 +448,7 @@ _gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
|
|
|
127c81 |
if (result < 0)
|
|
|
127c81 |
{
|
|
|
127c81 |
gnutls_assert ();
|
|
|
127c81 |
+ result = 0;
|
|
|
127c81 |
goto cleanup;
|
|
|
127c81 |
}
|
|
|
127c81 |
|
|
|
127c81 |
@@ -454,6 +457,7 @@ _gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
|
|
|
127c81 |
if (result < 0)
|
|
|
127c81 |
{
|
|
|
127c81 |
gnutls_assert ();
|
|
|
127c81 |
+ result = 0;
|
|
|
127c81 |
goto cleanup;
|
|
|
127c81 |
}
|
|
|
127c81 |
|
|
|
127c81 |
@@ -461,6 +465,7 @@ _gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
|
|
|
127c81 |
if (result < 0)
|
|
|
127c81 |
{
|
|
|
127c81 |
gnutls_assert ();
|
|
|
127c81 |
+ result = 0;
|
|
|
127c81 |
goto cleanup;
|
|
|
127c81 |
}
|
|
|
127c81 |
|
|
|
127c81 |
@@ -481,6 +486,7 @@ _gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
|
|
|
127c81 |
else if (result < 0)
|
|
|
127c81 |
{
|
|
|
127c81 |
gnutls_assert();
|
|
|
127c81 |
+ result = 0;
|
|
|
127c81 |
goto cleanup;
|
|
|
127c81 |
}
|
|
|
127c81 |
|
|
|
127c81 |
@@ -650,7 +656,7 @@ _gnutls_x509_verify_certificate (const gnutls_x509_crt_t * certificate_list,
|
|
|
127c81 |
ret = _gnutls_verify_certificate2 (certificate_list[clist_size - 1],
|
|
|
127c81 |
trusted_cas, tcas_size, flags, &output,
|
|
|
127c81 |
&issuer, now, &max_path, func);
|
|
|
127c81 |
- if (ret == 0)
|
|
|
127c81 |
+ if (ret != 1)
|
|
|
127c81 |
{
|
|
|
127c81 |
/* if the last certificate in the certificate
|
|
|
127c81 |
* list is invalid, then the certificate is not
|
|
|
127c81 |
@@ -681,7 +687,7 @@ _gnutls_x509_verify_certificate (const gnutls_x509_crt_t * certificate_list,
|
|
|
127c81 |
if ((ret =
|
|
|
127c81 |
_gnutls_verify_certificate2 (certificate_list[i - 1],
|
|
|
127c81 |
&certificate_list[i], 1, flags,
|
|
|
127c81 |
- &output, NULL, now, &max_path, func)) == 0)
|
|
|
127c81 |
+ &output, NULL, now, &max_path, func)) != 1)
|
|
|
127c81 |
{
|
|
|
127c81 |
status |= output;
|
|
|
127c81 |
status |= GNUTLS_CERT_INVALID;
|
|
|
127c81 |
--
|
|
|
127c81 |
1.8.5.3
|
|
|
127c81 |
|