mainGnuTLS - Support: sr #108689, gnutls_x509_crt_check_hostname()...

 
 

sr #108689: gnutls_x509_crt_check_hostname() and Internationalized Domain Names

Submitter:  - <_38407>
Submitted:  Wed 19 Nov 2014 11:50:24 AM UTC
   
 
Category:  Core library Priority:  5 - Normal
Severity:  1 - Wish Status:  Done
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 07 Mar 2015 10:47:16 PM UTC, comment #4: 

I'm closing the issue because the tracker is being moved. The issue will be resolved in the 3.4.0 release (most probably after nettle 3.1 is released by the end of march). If you think the issue should remain open please open it at:
https://gitlab.com/gnutls/gnutls/issues

Nikos Mavrogiannopoulos <nmav>
Group administrator
Mon 22 Dec 2014 09:12:45 PM UTC, comment #3: 

I set up IDN for my mail server, got a new certificate for it, and tested GnuTLS git snapshot from Nov 19 with both msmtp (SMTP client; server is postfix) and mpop (POP3 client; server is dovecot).

Works fine :)  Thank you very much!

I adjusted configure.ac of msmtp/mpop so that libidn is not required anymore when GnuTLS is >= 3.4.0 (and getaddrinfo() has AI_IDN).

Best regards,
Martin

- <_38407>
Wed 19 Nov 2014 07:22:36 PM UTC, comment #2: 

Great! I will try the current git version as soon as I find the time. Thank you.

Best regards,
Martin

- <_38407>
Wed 19 Nov 2014 02:11:58 PM UTC, comment #1: 

This is planned to be included in 3.4.0 and is in fact already present in the git repository. Unfortunately there is no timeline for 3.4.0 yet (what remains for a release is nettle 3.x supporting chacha20-poly and porting gnutls to it).

Nikos Mavrogiannopoulos <nmav>
Group administrator
Wed 19 Nov 2014 11:50:24 AM UTC, original submission:  

According to RFC 6125 section 6.4.2, host name checking must be performed on the ASCII representation of Internationalized Domain Names (IDN).

Therefore, a client program currently must call idna_to_ascii_lz() from libidn on the host name before passing it to gnutls_x509_crt_check_hostname().

It would be nice if gnutls_x509_crt_check_hostname() did this automatically instead of using dubious byte-for-byte comparison of non-ASCII characters.

As an alternative, a new GNUTLS_VERIFY_IDN flag could be added and taken into account by gnutls_x509_crt_check_hostname2().

This would result in easy support for IDN, in a similar way that the getaddrinfo() function provides easy support for IDN nowadays via the AI_IDN flag. Client programs would not have to deal with libidn at all in order to support IDN.

Best regards,
Martin

- <_38407>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by _38407 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-03-07 nmav StatusNone Done
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code