Fix GnuTLS certvalid certificate validation

Author: rgerhards

src/tcp.c

@@ -2743,6 +2743,14 @@ relpTcpVerifyCertificateCallback(gnutls_session_t session)
 		r = relpTcpChkPeerFingerprint(pThis, cert);
 	} else if(pThis->authmode == eRelpAuthMode_Name){
 		r = relpTcpChkPeerName(pThis, (void*)cert);
+	} else if(pThis->authmode == eRelpAuthMode_CertValid) {
+		unsigned int status = 0;
+		r = gnutls_certificate_verify_peers2(pThis->session, &status);
+		if(r < 0 || status != 0) {
+			callOnAuthErr(pThis, "", "certificate validation failed",
+				RELP_RET_AUTH_CERT_INVL);
+			r = GNUTLS_E_CERTIFICATE_ERROR;
+		}
 	}
 
 	if(r != 0) goto done;

tests/Makefile.am

@@ -30,6 +30,7 @@ TLS_TESTS=  \
 	tls-basic-tlscommand.sh \
 	tls-basic-tlscommand-ciphers.sh \
 	tls-basic-certchain.sh \
+	tls-certvalid-untrusted.sh \
 	tls-basic-certvalid-mixed.sh \
 	tls-receiver-abort.sh \
 	tls-missing-param-sender.sh \

tests/tls-basic-certchain.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
 . ${srcdir:=$(pwd)}/test-framework.sh
 function actual_test() {
-	startup_receiver -l $TEST_TLS_LIB -T -a "certvalid" -y ${srcdir}/tls-certs/ossl-server-certchain.pem -z ${srcdir}/tls-certs/ossl-server-key.pem  -e error.out.log
+	startup_receiver -l $TEST_TLS_LIB -T -a "certvalid" -x ${srcdir}/tls-certs/ossl-ca.pem -y ${srcdir}/tls-certs/ossl-server-certchain.pem -z ${srcdir}/tls-certs/ossl-server-key.pem  -e error.out.log
 
 	echo 'Send Message...'
-	./send -l $TEST_TLS_LIB -t 127.0.0.1 -p $TESTPORT -m "testmessage" -T -a "certvalid" -y ${srcdir}/tls-certs/ossl-client-certchain.pem -z ${srcdir}/tls-certs/ossl-client-key.pem $OPT_VERBOSE 1>>${OUTFILE} 2>&1
+	./send -l $TEST_TLS_LIB -t 127.0.0.1 -p $TESTPORT -m "testmessage" -T -a "certvalid" -x ${srcdir}/tls-certs/ossl-ca.pem -y ${srcdir}/tls-certs/ossl-client-certchain.pem -z ${srcdir}/tls-certs/ossl-client-key.pem $OPT_VERBOSE 1>>${OUTFILE} 2>&1
 
 	stop_receiver
 	check_output "testmessage"

tests/tls-certvalid-untrusted.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+. ${srcdir:=$(pwd)}/test-framework.sh
+function actual_test() {
+	startup_receiver -l $TEST_TLS_LIB -T -a "certvalid" \
+		-x ${srcdir}/tls-certs/ossl-ca.pem \
+		-y ${srcdir}/tls-certs/ossl-server-cert.pem \
+		-z ${srcdir}/tls-certs/ossl-server-key.pem \
+		-e error.out.log
+
+	echo 'Send Message with expired client certificate...'
+	./send -l $TEST_TLS_LIB -t 127.0.0.1 -p $TESTPORT -m "testmessage" -T -a "certvalid" \
+		-x ${srcdir}/tls-certs/ossl-ca.pem \
+		-y ${srcdir}/tls-certs/ossl-clientbrok-cert.pem \
+		-z ${srcdir}/tls-certs/ossl-clientbrok-key.pem \
+		$OPT_VERBOSE 1>>${OUTFILE} 2>&1
+	if [ $? -eq 0 ]; then
+		printf 'FAIL: send succeeded with an invalid certificate in certvalid mode\n'
+		stop_receiver
+		exit 1
+	fi
+
+	stop_receiver
+	check_output "certificate validation failed" error.out.log
+}
+
+do_tls_subtests
+terminate