diff options
| author | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2018-10-30 19:56:47 +0100 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2018-11-01 13:12:01 +0100 |
| commit | e515d4439f84067a6c956a890214848f722c621c (patch) | |
| tree | 6d3270bcd17e60b8486256f26a3e6dd941fe8509 | |
| parent | 0639f63a72a9b6ad26af87e539f1938940243f5a (diff) | |
| download | gnutls-tmp-ignore-ctypes.tar.gz | |
gnutls_priority_init: ignore CTYPE-OPENPGP optionstmp-ignore-ctypes
In GnuTLS 3.6.0 we dropped support for openpgp keys, however
the CTYPE-OPENPGP is often seen in applications, sometimes
as -CTYPE-OPENPGP to ensure it is not enabled. We simply
ignore this priority string when seen, to avoid preventing
these applications from running.
Resolves #593
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | lib/priority.c | 3 | ||||
| -rw-r--r-- | tests/Makefile.am | 2 | ||||
| -rwxr-xr-x | tests/cipher-listings.sh | 2 | ||||
| -rw-r--r-- | tests/data/listings-legacy3 | 4 | ||||
| -rw-r--r-- | tests/data/listings-legacy4 | 4 |
6 files changed, 17 insertions, 1 deletions
@@ -18,6 +18,9 @@ See the end for copying conditions. have incorrectly used CryptoPro-A S-BOX instead of proper (CryptoPro-B/-C/-D S-BOXes). They are fixed now. +** libgnutls: gnutls_priority_init() and friends, allow the CTYPE-OPENPGP keyword + in the priority string. It is only accepted as legacy option and is ignored. + ** p11tool: Fix initialization of security officer's PIN with the --initialize-so-pin option (#561) diff --git a/lib/priority.c b/lib/priority.c index 013e71bf74..11ff9ddce5 100644 --- a/lib/priority.c +++ b/lib/priority.c @@ -1810,6 +1810,9 @@ gnutls_priority_init(gnutls_priority_t * priority_cache, (&broken_list[i][7])) != GNUTLS_CRT_UNKNOWN) { fn(&(*priority_cache)->client_ctype, algo); fn(&(*priority_cache)->server_ctype, algo); + } else if (strncasecmp(&broken_list[i][1], "CTYPE-OPENPGP", 13) == 0) { + /* legacy openpgp option - ignore */ + continue; } else goto error; } } else if (strncasecmp diff --git a/tests/Makefile.am b/tests/Makefile.am index 4d40cc213a..021da722ae 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -61,7 +61,7 @@ EXTRA_DIST = suppressions.valgrind eagain-common.h cert-common.h test-chains.h \ ocsp-tests/certs/server_good.key ocsp-tests/certs/server_bad.key ocsp-tests/certs/server_good.template \ ocsp-tests/certs/server_bad.template ocsp-tests/certs/ocsp-staple-unrelated.der ocsp-tests/suppressions.valgrind \ data/listings-DTLS1.0 data/listings-SSL3.0 data/listings-TLS1.0 data/listings-TLS1.1 \ - data/listings-legacy1 data/listings-legacy2 \ + data/listings-legacy1 data/listings-legacy2 data/listings-legacy3 data/listings-legacy4 \ data/listings-SSL3.0-TLS1.1 p11-kit-trust-data/Example_Root_CA.p11-kit server-kx-neg-common.c \ p11-kit-trust-data/Example_Root_CA.pem data/test1.cat data/test2.cat \ data/test1.cat.data data/test2.cat.data data/test1.cat.out data/test2.cat.out \ diff --git a/tests/cipher-listings.sh b/tests/cipher-listings.sh index b8f3a602e3..ae20529ef2 100755 --- a/tests/cipher-listings.sh +++ b/tests/cipher-listings.sh @@ -85,6 +85,8 @@ check DTLS1.0 "NORMAL:-VERS-ALL:+VERS-DTLS1.0" # test whether these work as expected. check legacy1 "NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-GCM:+SIGN-ALL:+COMP-NULL" check legacy2 "NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+CAMELLIA-256-GCM:+SIGN-ALL:+COMP-NULL" +check legacy3 "NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+CAMELLIA-256-GCM:+SIGN-ALL:+COMP-NULL:+CTYPE-OPENPGP" +check legacy4 "NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+CAMELLIA-256-GCM:+SIGN-ALL:+COMP-NULL:-CTYPE-OPENPGP" rm -f ${TMPFILE} diff --git a/tests/data/listings-legacy3 b/tests/data/listings-legacy3 new file mode 100644 index 0000000000..cc932505b0 --- /dev/null +++ b/tests/data/listings-legacy3 @@ -0,0 +1,4 @@ +Cipher suites for NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+CAMELLIA-256-GCM:+SIGN-ALL:+COMP-NULL:+CTYPE-OPENPGP +TLS_RSA_CAMELLIA_256_GCM_SHA384 0xc0, 0x7b TLS1.2 + +Protocols: VERS-TLS1.2, VERS-TLS1.1, VERS-TLS1.0 diff --git a/tests/data/listings-legacy4 b/tests/data/listings-legacy4 new file mode 100644 index 0000000000..736692ef1e --- /dev/null +++ b/tests/data/listings-legacy4 @@ -0,0 +1,4 @@ +Cipher suites for NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+CAMELLIA-256-GCM:+SIGN-ALL:+COMP-NULL:-CTYPE-OPENPGP +TLS_RSA_CAMELLIA_256_GCM_SHA384 0xc0, 0x7b TLS1.2 + +Protocols: VERS-TLS1.2, VERS-TLS1.1, VERS-TLS1.0 |