Changeset 5513f3e

Timestamp:

2011-12-24T14:52:35Z (12 years ago)

Author:

Wilmer van der Gaast <wilmer@…>

Branches:

master

Children:

96f954d

Parents:

200e151

Message:

Fix compatibility with old GnuTLS versions, but with a warning. See
​http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1417 for details.

Files:

• configure (modified) (1 diff)
• lib/ssl_gnutls.c (modified) (2 diffs)

configure

@@ -283 +283 @@
 EOF
                 ssl=gnutls
+                if ! pkg-config gnutls --atleast-version=2.8; then
+                        echo
+                        echo 'Warning: With GnuTLS versions <2.8, certificate expire dates are not verified.'
+                fi
                 ret=1
         elif libgnutls-config --version > /dev/null 2> /dev/null; then

lib/ssl_gnutls.c

@@ -166 +166 @@
                 verifyret |= VERIFY_CERT_INSECURE_ALGORITHM;
 
+#ifdef GNUTLS_CERT_NOT_ACTIVATED
+        /* Amusingly, the GnuTLS function used above didn't check for expiry
+           until GnuTLS 2.8 or so. (See CVE-2009-1417) */
         if( status & GNUTLS_CERT_NOT_ACTIVATED )
                 verifyret |= VERIFY_CERT_NOT_ACTIVATED;
@@ -171 +174 @@
         if( status & GNUTLS_CERT_EXPIRED )
                 verifyret |= VERIFY_CERT_EXPIRED;
+#endif
 
         /* The following check is already performed inside