mainGnuTLS - Support: sr #108550, It is impractical to call...

 
 

sr #108550: It is impractical to call dane_verify_session_crt() from the gnutls_certificate_set_verify_function()

Submitter:  None
Submitted:  Sat 19 Apr 2014 03:24:41 PM UTC
   
 
Category:  DANE library Priority:  5 - Normal
Severity:  4 - Important Status:  Done
Privacy:  Public Assigned to:  None
Originator Email:  -email is unavailable- Open/Closed:  Closed
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Fri 11 Jul 2014 03:49:09 PM UTC, comment #10: 

It is now applied. This function also allows easier testing of dane_raw_tlsa(). I'll try to add a test case for both of these as soon as I'm back.

Nikos Mavrogiannopoulos <nmav>
Group administrator
Thu 10 Jul 2014 10:35:00 AM UTC, comment #9: 

Thank you. It looks reasonable. Would you like to send the DCO to the list (or at bugs@gnutls.org) and submit a git diff with the sign-off tag?
http://www.gnutls.org/devel.html


Nikos Mavrogiannopoulos <nmav>
Group administrator
Wed 09 Jul 2014 09:22:17 PM UTC, comment #8: 

This code allocates an unnecessary extra NULL entry for dane_data_len to avoid trying to malloc 0 bytes if q->data_entries is 0.

(file #31693)

Simon Arlott <s_a>
Sun 06 Jul 2014 09:11:45 PM UTC, comment #7: 

I'll implement a copy of https://github.com/lp0/weechat/commit/6d69397b4fa3c947e1cc80b1b454a666232b1d1a#diff-8053959401d6693d38be5b1272ef40d7R158 directly in libdane/dane.c (I've added the number of entries as a return value because it simplifies duplicating the data if you don't have to iterate first to find this out).

It's a bit inconvenient having to obtain and provide the certificate chain manually when the non-raw session version of the function does this automatically: https://github.com/lp0/weechat/commit/e9d033abd9669315b73e3f8b707a592964ae932c#diff-e5707b6a1e5cfc1f92761719c83b3782R3748

Simon Arlott <s_a>
Sun 06 Jul 2014 12:17:03 PM UTC, comment #6: 

Ok it seems I understand what do you need there and that seem reasonable. I'll add it to the todo list, but providing a patch for that would speed up the process.

Nikos Mavrogiannopoulos <nmav>
Group administrator
Sat 05 Jul 2014 09:07:55 PM UTC, comment #5: 

If I call dane_query_tlsa() (from a forked process to allow for it being blocking) there isn't an easy way to copy the dane_query_t data from one process to another and reuse it with dane_raw_tlsa(). I'll have to call dane_query_status(), dane_query_entries(), dane_query_data() and then put it all back together.

A function that converted a dane_query_t into the parameters needed for dane_raw_tlsa() would reduce the chance of implementation errors.

Anonymous
Wed 02 Jul 2014 11:51:58 AM UTC, comment #4: 

You can do the following:
dane_state_init()
dane_raw_tlsa(): After you do the resolving you place the DANE there
dane_verify_crt_raw(): You use the result to verify the certificate



Nikos Mavrogiannopoulos <nmav>
Group administrator
Sun 29 Jun 2014 07:10:05 PM UTC, comment #3: 

Which lower level API?

The only correct place to do TLSA verification is in the callback for certificate verification (an asynchronous API). The only TLSA functionality provided is a synchronous API with no way to retrieve and cache the data in advance.

Anonymous
Mon 28 Apr 2014 09:39:27 AM UTC, comment #2: 

I'm not sure we can solve that easily there are quite some assumptions that need to be made for the application that uses those functions. Maybe it would be better to assume that such application would take advantage of the lower level API?

Nikos Mavrogiannopoulos <nmav>
Group administrator
Sat 19 Apr 2014 04:19:06 PM UTC, comment #1: 

An alternative option would be for GnuTLS to allow the caller to provide an array of TLSA records to use for verification.

Anonymous
Sat 19 Apr 2014 03:24:41 PM UTC, original submission:  

It is impractical to call dane_verify_session_crt() from the gnutls_certificate_set_verify_function() because the former does a synchronous DNS lookup.

There needs to be an asynchronous function in libdane to use ub_resolve_async instead of ub_resolve and store the TLSA records in the session.

There should be an option to request TLSA records using the above function prior to calling the certificate verification function. It would then be possible to perform DANE verification of the certificate using the TLSA records stored in the session without performing a synchronous DNS lookup.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #31693:  dane-108550.patch added by s_a (4KiB - text/x-patch - Patch implementing dane_query_to_raw_tlsa())

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by s_a (Posted a comment)
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-12-11 nmav StatusNone Done
        Open/ClosedOpen Closed
    2014-07-10 s_a Attached File- Added 0001-libdane-add-function-dane_query_to_raw_tlsa.patch, #31698
    2014-07-10 nmav CategoryCore library DANE library
    2014-07-09 s_a Attached File- Added dane-108550.patch, #31693

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code