The library notifies the application on empty and illegal SRP usernames,

so that proper notification (via an alert) is sent to the peer. Currently when
the SRP ciphersuite is advertized but no username is sent by the peer, the
library returns GNUTLS_E_EMPTY_SRP_USERNAME, and the alert associated with
this is GNUTLS_A_ACCESS_DENIED (to be changed when the srp draft defines something
more appropriate).

1 files changed, 8 insertions, 10 deletions

diff --git a/src/cli.c b/src/cli.c
index f6f5f00997..2b888c0371 100644
--- a/src/cli.c
+++ b/src/cli.c
@@ -70,7 +70,7 @@ char *x509_cafile;
 char *x509_crlfile = NULL;
 static int x509ctype;
 
-static gnutls_srp_client_credentials cred;
+static gnutls_srp_client_credentials srp_cred;
 static gnutls_anon_client_credentials anon_cred;
 static gnutls_certificate_credentials xcred;
 
@@ -143,8 +143,7 @@ static gnutls_session init_tls_session( const char* hostname)
    gnutls_dh_set_prime_bits(session, 512);
 
    gnutls_credentials_set(session, GNUTLS_CRD_ANON, anon_cred);
-   if (srp_username != NULL)
-      gnutls_credentials_set(session, GNUTLS_CRD_SRP, cred);
+   gnutls_credentials_set(session, GNUTLS_CRD_SRP, srp_cred);
    gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
 
    /* send the fingerprint */
@@ -362,8 +361,7 @@ int main(int argc, char **argv)
       socket_bye(&hd);
 
 
-   if (srp_username != NULL)
-      gnutls_srp_free_client_credentials(cred);
+   gnutls_srp_free_client_credentials(srp_cred);
    gnutls_certificate_free_credentials(xcred);
    gnutls_anon_free_client_credentials(anon_cred);
 
@@ -642,12 +640,12 @@ int ret;
 /*	gnutls_certificate_client_callback_func( xcred, cert_callback); */
 
    /* SRP stuff */
-   if (srp_username != NULL) {
-      if (gnutls_srp_allocate_client_credentials(&cred) < 0) {
-	 fprintf(stderr, "SRP authentication error\n");
-      }
+   if (gnutls_srp_allocate_client_credentials(&srp_cred) < 0) {
+	fprintf(stderr, "SRP authentication error\n");
+   }
 
-      if ((ret=gnutls_srp_set_client_credentials(cred, srp_username, srp_passwd)) < 0) {
+   if (srp_username != NULL) {
+      if ((ret=gnutls_srp_set_client_credentials(srp_cred, srp_username, srp_passwd)) < 0) {
 	 fprintf(stderr, "SRP credentials set error [%d]\n", ret);
       }
    }