Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GnuTLS: Don't skip really long certificate fields #5271

Closed

Conversation

@emilengler
Copy link
Contributor

@emilengler emilengler commented Apr 20, 2020

This fixes 2.3 describes in docs/KNOWN_BUGS.
It is fixed by using the ..._dn2 function equivalents which allocate the required length rather than filling it into the fixed one.
The CN field was limited to 64 chars because that's the defined max amount in ASN.1

Copy link
Member

@bagder bagder left a comment

Thanks!

Loading

lib/vtls/gtls.c Outdated Show resolved Hide resolved
Loading
size = sizeof(certbuf);
gnutls_x509_crt_get_dn(x509_cert, certbuf, &size);
infof(data, "\t subject: %s\n", certbuf);
rc = gnutls_x509_crt_get_dn2(x509_cert, &certfields);
Copy link
Member

@bagder bagder Apr 20, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This function was added in GnuTLS 3.1.10 (Mar 22, 2013), meaning it is much newer than the oldest GnuTLS version we claim to support (2.11.3 is mentioned in docs/INTERNALS.md).

I don't think supporting version 2 is worth it, and perhaps a 7 years old version is enough as oldest legacy GnuTLS to support, but I think this detail should still be checked for so that we can warn users about out-of-age versions and the docs could state the new oldest version we support.

Loading

Copy link
Contributor Author

@emilengler emilengler Apr 20, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So should I upgrade the requirements to GnuTLS 3.1.10 or should I make this feature only available to newer versions?

Loading

Copy link
Member

@bagder bagder Apr 20, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll bump the requirement to 3.1.10 in a separate PR, so just leave this as is.

Loading

bagder added a commit that referenced this issue Apr 20, 2020
GnuTLS 3.1.10 added new functions we want to use. That version was
released on Mar 22, 2013. Removing support for older versions also
greatly simplifies the code.

Ref: #5271
@bagder bagder added the TLS label Apr 20, 2020
bagder added a commit that referenced this issue Apr 21, 2020
GnuTLS 3.1.10 added new functions we want to use. That version was
released on Mar 22, 2013. Removing support for older versions also
greatly simplifies the code.

Ref: #5271
Closes #5276
@bagder bagder closed this in 2d137de Apr 21, 2020
@bagder
Copy link
Member

@bagder bagder commented Apr 21, 2020

Thanks!

Loading

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants