diff options
author | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2016-12-19 21:35:53 +0100 |
---|---|---|
committer | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2016-12-20 09:26:17 +0100 |
commit | 5f578c41d8449da5487a1aa23615ebb0b99cedc2 (patch) | |
tree | a74a0e173b7cb57fba382354fc6978768771c5f9 | |
parent | cfb3279fc4ca55e82d1b7c50ed7d6d40a295ed16 (diff) | |
download | gnutls-5f578c41d8449da5487a1aa23615ebb0b99cedc2.tar.gz |
priorities: reset the profile flags when appending new flags
That is, to avoid causing issues to applications calling gnutls_*priority_set()
multiple times with different parameters. In that case if multiple profiles are
used the outcome could be undefined. Now, the last call will prevail.
-rw-r--r-- | lib/auto-verify.c | 5 | ||||
-rw-r--r-- | lib/gnutls_int.h | 10 | ||||
-rw-r--r-- | lib/priority.c | 2 |
3 files changed, 14 insertions, 3 deletions
diff --git a/lib/auto-verify.c b/lib/auto-verify.c index 1cf5f55dfa..179fb1066f 100644 --- a/lib/auto-verify.c +++ b/lib/auto-verify.c @@ -91,8 +91,9 @@ void gnutls_session_set_verify_cert(gnutls_session_t session, session->internals.vc_elements = 0; } - if (flags) - session->internals.additional_verify_flags |= flags; + if (flags) { + ADD_PROFILE_VFLAGS(session, flags); + } gnutls_session_set_verify_function(session, auto_verify_cb); } diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h index f9160fc7ca..a7d39d2495 100644 --- a/lib/gnutls_int.h +++ b/lib/gnutls_int.h @@ -1030,6 +1030,16 @@ typedef struct { unsigned vc_status; unsigned int additional_verify_flags; /* may be set by priorities or the vc functions */ + /* we append the verify flags because these can be set, + * either by this function or by gnutls_session_set_verify_cert(). + * However, we ensure that a single profile is set. */ +#define ADD_PROFILE_VFLAGS(session, vflags) do { \ + if ((session->internals.additional_verify_flags & GNUTLS_VFLAGS_PROFILE_MASK) && \ + (vflags & GNUTLS_VFLAGS_PROFILE_MASK)) \ + session->internals.additional_verify_flags &= ~GNUTLS_VFLAGS_PROFILE_MASK; \ + session->internals.additional_verify_flags |= vflags; \ + } while(0) + /* the SHA256 hash of the peer's certificate */ uint8_t cert_hash[32]; bool cert_hash_set; diff --git a/lib/priority.c b/lib/priority.c index 15de4b6883..94454f4981 100644 --- a/lib/priority.c +++ b/lib/priority.c @@ -575,7 +575,7 @@ gnutls_priority_set(gnutls_session_t session, gnutls_priority_t priority) session->internals.priorities.compression.algorithms == 0) return gnutls_assert_val(GNUTLS_E_NO_PRIORITIES_WERE_SET); - session->internals.additional_verify_flags |= priority->additional_verify_flags; + ADD_PROFILE_VFLAGS(session, priority->additional_verify_flags); return 0; } |