[exim-cvs] Pull Andreas Metzler's fix for gnutls_certificate…

Gitweb: http://git.exim.org/exim.git/commitdiff/89f897c3fdb4c1342b3e9b9f6cb33cd0f869e2aa

Commit:     89f897c3fdb4c1342b3e9b9f6cb33cd0f869e2aa
Parent:     c566dd90401a8b20b873644e3cdab175f1e86ede
Author:     Phil Pennock <pdp@???>
AuthorDate: Sat Sep 24 03:09:44 2011 -0400
Committer:  Phil Pennock <pdp@???>
CommitDate: Sat Sep 24 03:09:44 2011 -0400

    Pull Andreas Metzler's fix for gnutls_certificate_verify_peers (bug 1095)
---
 doc/doc-txt/ChangeLog |    2 ++
 src/src/tls-gnu.c     |    8 ++++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index c1362b1..e581360 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -114,6 +114,8 @@ PP/09 Handle IPv6 addresses with SPF.

 PP/10 GnuTLS: support TLS 1.2 & 1.1.
       Bugzilla 1156.
+      Use gnutls_certificate_verify_peers2() [patch from Andreas Metzler].
+      Bugzilla 1095.

 Exim version 4.76
diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index 4de9d4f..6b80637 100644
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -235,10 +235,10 @@ Returns:     TRUE/FALSE
 static BOOL
 verify_certificate(gnutls_session session, const char **error)
 {
-int verify;
+int rc;
 uschar *dn_string = US"";
 const gnutls_datum *cert;
-unsigned int cert_size = 0;
+unsigned int verify, cert_size = 0;

*error = NULL;

@@ -262,7 +262,7 @@ if (cert != NULL)
       dn_string = string_copy_malloc(buff);
     }

- verify = gnutls_certificate_verify_peers(session);
+ rc = gnutls_certificate_verify_peers2(session, &verify);
}
else
{
@@ -274,7 +274,7 @@ else
/* Handle the result of verification. INVALID seems to be set as well
as REVOKED, but leave the test for both. */

-if ((verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
+if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
{
tls_certificate_verified = FALSE;
if (*error == NULL) *error = ((verify & GNUTLS_CERT_REVOKED) != 0)?