helpGnuTLS - Support: sr #108612, Both verify_ca() and verify_ee()...


sr #108612: Both verify_ca() and verify_ee() abort DANE processing with DANE_E_UNKNOWN_DANE_DATA for unrecognised types

Submitted by:  None
Submitted on:  Sun 06 Jul 2014 07:39:05 PM UTC
Category:  DANE library Priority:  5 - Normal
Severity:  6 - Security Status:  Done
Privacy:  Public Assigned to:  nmav
Originator Email:  -email is unavailable- Open/Closed:  Closed
Operating System:  None
* Mandatory Fields

Add a New Comment (Rich Markup)

Comment Type & Canned Response:


Sun 06 Jul 2014 09:13:14 PM UTC, comment #1: 

I've added a check that skips those entries. I don't think that an UNKNOWN_DANE_INFO verify flag is needed. Having it may cause similar failures at the application layer, and wouldn't provide any significant information that the application can act on.

Nikos Mavrogiannopoulos <nmav>
Project Administrator
Sun 06 Jul 2014 07:39:05 PM UTC, original submission:  

Both verify_ca() and verify_ee() abort DANE processing with DANE_E_UNKNOWN_DANE_DATA for unrecognised types. The correct response is to ignore that TLSA record.

If a new TLSA type is introduced then DANE checking will return an error and be ignored by clients. Instead, the clients may have been able to verify the certificate with another TLSA record or they should have rejected it when there are no more recognised records.

These functions should return 0 and set *verify |= DANE_VERIFY_UNKNOWN_DANE_INFO.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.





    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-09-20 nmav StatusReady For Test => Done
        Open/ClosedOpen => Closed
    2014-07-06 nmav CategoryExtra library => DANE library
        StatusNone => Ready For Test
        Assigned toNone => nmav

    Back to the top

    Powered by Savane 3.9