Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GnuTLS: Don't skip really long certificate fields #5271

Closed

Conversation

@emilengler
Copy link
Contributor

emilengler commented Apr 20, 2020

This fixes 2.3 describes in docs/KNOWN_BUGS.
It is fixed by using the ..._dn2 function equivalents which allocate the required length rather than filling it into the fixed one.
The CN field was limited to 64 chars because that's the defined max amount in ASN.1

Copy link
Member

bagder left a comment

Thanks!

lib/vtls/gtls.c Outdated Show resolved Hide resolved
size = sizeof(certbuf);
gnutls_x509_crt_get_dn(x509_cert, certbuf, &size);
infof(data, "\t subject: %s\n", certbuf);
rc = gnutls_x509_crt_get_dn2(x509_cert, &certfields);

This comment has been minimized.

Copy link
@bagder

bagder Apr 20, 2020

Member

This function was added in GnuTLS 3.1.10 (Mar 22, 2013), meaning it is much newer than the oldest GnuTLS version we claim to support (2.11.3 is mentioned in docs/INTERNALS.md).

I don't think supporting version 2 is worth it, and perhaps a 7 years old version is enough as oldest legacy GnuTLS to support, but I think this detail should still be checked for so that we can warn users about out-of-age versions and the docs could state the new oldest version we support.

This comment has been minimized.

Copy link
@emilengler

emilengler Apr 20, 2020

Author Contributor

So should I upgrade the requirements to GnuTLS 3.1.10 or should I make this feature only available to newer versions?

This comment has been minimized.

Copy link
@bagder

bagder Apr 20, 2020

Member

I'll bump the requirement to 3.1.10 in a separate PR, so just leave this as is.

bagder added a commit that referenced this pull request Apr 20, 2020
GnuTLS 3.1.10 added new functions we want to use. That version was
released on Mar 22, 2013. Removing support for older versions also
greatly simplifies the code.

Ref: #5271
@bagder bagder added the SSL/TLS label Apr 20, 2020
bagder added a commit that referenced this pull request Apr 21, 2020
GnuTLS 3.1.10 added new functions we want to use. That version was
released on Mar 22, 2013. Removing support for older versions also
greatly simplifies the code.

Ref: #5271
Closes #5276
@bagder bagder closed this in 2d137de Apr 21, 2020
@bagder
Copy link
Member

bagder commented Apr 21, 2020

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants
You can’t perform that action at this time.