Changeset 99f8375 in mod_gnutls

Timestamp:

Aug 9, 2015, 5:49:12 PM (4 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, master, upstream

Children:

efd3cfe

Parents:

dbec528

Message:

Ensure safe defaults during client verification

Initialize the validation status to "invalid". Two error codepaths do
not set status, though it might be read later. They should never be hit
(invalid verification modes should be rejected during server config),
but this adds another line of defense.

Also, the error paths now set the "rv" variable to an error code, which
means client verification fails without checking of the status variable.

File:

• src/gnutls_hooks.c (modified) (4 diffs)

src/gnutls_hooks.c

@@ -1204 +1204 @@
 static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt) {
     const gnutls_datum_t *cert_list;
-    unsigned int cert_list_size, status;
+    unsigned int cert_list_size;
+    /* assume the certificate is invalid unless explicitly set
+     * otherwise */
+    unsigned int status = GNUTLS_CERT_INVALID;
     int rv = GNUTLS_E_NO_CERTIFICATE_FOUND, ret;
     unsigned int ch_size = 0;
@@ -1338 +1341 @@
 #endif
         default:
+            /* If this block is reached, that indicates a
+             * configuration error or bug in mod_gnutls (invalid value
+             * of ctxt->sc->client_verify_method). */
             ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
                           "GnuTLS: Failed to Verify X.509 Peer: method '%s' is not supported",
                           mgs_readable_cvm(ctxt->sc->client_verify_method));
+            rv = GNUTLS_E_UNIMPLEMENTED_FEATURE;
         }
 
@@ -1356 +1363 @@
 #ifdef ENABLE_MSVA
         case mgs_cvm_msva:
-            /* need to set status and rv */
             ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
                           "GnuTLS:  OpenPGP verification via MSVA is not yet implemented");
@@ -1363 +1369 @@
 #endif
         default:
+            /* If this block is reached, that indicates a
+             * configuration error or bug in mod_gnutls (invalid value
+             * of ctxt->sc->client_verify_method). */
             ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
                           "GnuTLS: Failed to Verify OpenPGP Peer: method '%s' is not supported",
                           mgs_readable_cvm(ctxt->sc->client_verify_method));
-        }
-    }
-
+            rv = GNUTLS_E_UNIMPLEMENTED_FEATURE;
+        }
+    }
+
+    /* "goto exit" at the end of this block skips evaluation of the
+     * "status" variable */
     if (rv < 0) {
         ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,