[libvirt] [PATCH] Fix TLS tests with gnutls 3

Eric Blake eblake at redhat.com
Mon Mar 4 17:34:33 UTC 2013


> When given a CA cert with basic constraints to set non-critical,
> and key usage of 'key signing', this should be rejected. Version
> of GNUTLS < 3 do not rejecte it though, so we never noticed the
> test case was broken
> 
> Signed-off-by: Daniel P. Berrange <berrange at redhat.com>
> ---

> +    /* Technically a CA cert with basic constraints
> +     * key purpose == key signing + non-critical should
> +     * be rejected. GNUTLS < 3 does not reject it and
> +     * we don't anticipate them changing this behaviour
> +     */
> +# if GNUTLS_VERSION_MAJOR >= 3
> +    DO_CTX_TEST(true, cacert5req, servercertreq, true);
> +# else
> +    DO_CTX_TEST(true, cacert5req, servercertreq, false);
> +# endif

To avoid the #if, you could write this as:

    DO_CTX_TEST(true, cacert5req, servercertreq,
                GNUTLS_VERSION_MAJOR >= 3);

ACK with that tweak.

-- 
Eric Blake   eblake at redhat.com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org




More information about the libvir-list mailing list