-
-
Notifications
You must be signed in to change notification settings - Fork 6.7k
GnuTLS: Don't skip really long certificate fields #5271
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks!
size = sizeof(certbuf); | ||
gnutls_x509_crt_get_dn(x509_cert, certbuf, &size); | ||
infof(data, "\t subject: %s\n", certbuf); | ||
rc = gnutls_x509_crt_get_dn2(x509_cert, &certfields); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This function was added in GnuTLS 3.1.10 (Mar 22, 2013), meaning it is much newer than the oldest GnuTLS version we claim to support (2.11.3 is mentioned in docs/INTERNALS.md).
I don't think supporting version 2 is worth it, and perhaps a 7 years old version is enough as oldest legacy GnuTLS to support, but I think this detail should still be checked for so that we can warn users about out-of-age versions and the docs could state the new oldest version we support.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So should I upgrade the requirements to GnuTLS 3.1.10 or should I make this feature only available to newer versions?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll bump the requirement to 3.1.10 in a separate PR, so just leave this as is.
GnuTLS 3.1.10 added new functions we want to use. That version was released on Mar 22, 2013. Removing support for older versions also greatly simplifies the code. Ref: #5271
Thanks! |
This fixes 2.3 describes in
docs/KNOWN_BUGS
.It is fixed by using the
..._dn2
function equivalents which allocate the required length rather than filling it into the fixed one.The CN field was limited to 64 chars because that's the defined max amount in ASN.1