Re: [exim/exim] [Bug]: GNUTLS certificate validation incompatible with certificates lacking a commonName attribute (Issue #3215)

Good to hear it's not the EC-ness.

So, this might work as a patch. I don't know yet if there will be follow-on effects from the lack of DN though.

diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index 5c840edc5..c29395ac7 100644
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -2517,17 +2517,24 @@ exim_gnutls_peer_err(US"cert 0");
state->tlsp->peercert = state->peercert = crt;

sz = 0;
-rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
-if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
+if ((rc = gnutls_x509_crt_get_dn(crt, NULL, &sz)))
  {
-  exim_gnutls_peer_err(US"getting size for cert DN failed");
-  return FAIL; /* should not happen */
-  }
-dn_buf = store_get_perm(sz, GET_TAINTED);
-rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
-exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
+  if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
+    {
+    exim_gnutls_peer_err(US"getting size for cert DN failed");
+    return FAIL; /* should not happen */
+    }
+  dn_buf = store_get_perm(sz, GET_TAINTED);
+  rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
+  exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");

-state->peerdn = dn_buf;
+  state->peerdn = dn_buf;
+  }
+else
+  {
+  DEBUG(tls) debug_printf_indent("TLS: zero-length DN\n");
+  state->peerdn = US"";
+  }

return OK;
#undef exim_gnutls_peer_err

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/3215#issuecomment-239532 ) or reply to this email directly.