#include <gnutls/x509.h>
+/* Compatibility for older GnuTLS versions. Define the constants in a way
+ * which doesn't affect the status check below. */
+#ifndef GNUTLS_CERT_SIGNER_NOT_CA
+# define GNUTLS_CERT_SIGNER_NOT_CA 0
+#endif
+#ifndef GNUTLS_CERT_SIGNATURE_FAILURE
+# define GNUTLS_CERT_SIGNATURE_FAILURE 0
+#endif
+#ifndef GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED
+# define GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED 0
+#endif
+#ifndef GNUTLS_CERT_UNEXPECTED_OWNER
+# define GNUTLS_CERT_UNEXPECTED_OWNER 0
+#endif
+#ifndef GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE
+# define GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE 0
+#endif
+#ifndef GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE
+# define GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE 0
+#endif
+#ifndef GNUTLS_CERT_MISMATCH
+# define GNUTLS_CERT_MISMATCH 0
+#endif
+
+
static int get_certificate_path(const char *format,
const char *hostname, char *buffer, size_t size);
gnutls_strerror(result));
return -1;
}
- /* Definitely an invalid certificate, abort. */
- if (status & GNUTLS_CERT_EXPIRED
- || status & GNUTLS_CERT_REVOKED
+ /* Definitely an invalid certificate, abort. We don't perform any CA
+ * verification so don't check for GNUTLS_CERT_INVALID. */
+ if (status & GNUTLS_CERT_REVOKED
+ || status & GNUTLS_CERT_SIGNER_NOT_CA
+ || status & GNUTLS_CERT_INSECURE_ALGORITHM
|| status & GNUTLS_CERT_NOT_ACTIVATED
- || status & GNUTLS_CERT_INSECURE_ALGORITHM) {
+ || status & GNUTLS_CERT_EXPIRED
+ || status & GNUTLS_CERT_SIGNATURE_FAILURE
+ || status & GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED
+ || status & GNUTLS_CERT_UNEXPECTED_OWNER
+ || status & GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE
+ || status & GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE
+ || status & GNUTLS_CERT_MISMATCH) {
LOG(WARNING, "verify_tls_connection(): invalid server certificate");
return -1;
}
/* Open stored server certificate file. */
if (server_certificate_file(&file, hostname, path, sizeof(path)) != 0) {
- LOG(DEBUG, "server certificate:\n%s", server_cert);
+ LOG(DEBUG1, "server certificate:\n%s", server_cert);
return -1;
}
LOG(WARNING, "verify_tls_connection(): '%s' too big", path);
fclose(file);
- LOG(DEBUG, "server certificate:\n%s", server_cert);
+ LOG(DEBUG1, "server certificate:\n%s", server_cert);
return -1;
}
path, strerror(errno));
fclose(file);
- LOG(DEBUG, "server certificate:\n%s", server_cert);
+ LOG(DEBUG1, "server certificate:\n%s", server_cert);
return -1;
}
fclose(file);
*file = fopen(path, "rb");
if (*file == NULL) {
if (global_passthrough_unknown) {
- LOG(DEBUG, "server_certificate_file(): failed to open '%s': %s",
- path, strerror(errno));
+ LOG(DEBUG1, "server_certificate_file(): failed to open '%s': %s",
+ path, strerror(errno));
} else {
LOG(WARNING, "server_certificate_file(): failed to open '%s': %s",
path, strerror(errno));