mainGnuTLS - Support: sr #108612, Both verify_ca() and verify_ee()...

 
 

sr #108612: Both verify_ca() and verify_ee() abort DANE processing with DANE_E_UNKNOWN_DANE_DATA for unrecognised types

Submitter:  None
Submitted:  Sun 06 Jul 2014 07:39:05 PM UTC
   
 
Category:  DANE library Priority:  5 - Normal
Severity:  6 - Security Status:  Done
Privacy:  Public Assigned to:  nmav
Originator Email:  -email is unavailable- Open/Closed:  Closed
Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 06 Jul 2014 09:13:14 PM UTC, comment #1: 

I've added a check that skips those entries. I don't think that an UNKNOWN_DANE_INFO verify flag is needed. Having it may cause similar failures at the application layer, and wouldn't provide any significant information that the application can act on.

Nikos Mavrogiannopoulos <nmav>
Group administrator
Sun 06 Jul 2014 07:39:05 PM UTC, original submission:  

Both verify_ca() and verify_ee() abort DANE processing with DANE_E_UNKNOWN_DANE_DATA for unrecognised types. The correct response is to ignore that TLSA record.

If a new TLSA type is introduced then DANE checking will return an error and be ignored by clients. Instead, the clients may have been able to verify the certificate with another TLSA record or they should have rejected it when there are no more recognised records.

These functions should return 0 and set *verify |= DANE_VERIFY_UNKNOWN_DANE_INFO.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-09-20 nmav StatusReady For Test Done
        Open/ClosedOpen Closed
    2014-07-06 nmav CategoryExtra library DANE library
        StatusNone Ready For Test
        Assigned toNone nmav

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code