helpGnuTLS - Support: sr #108550, It is impractical to call...

 
 

sr #108550: It is impractical to call dane_verify_session_crt() from the gnutls_certificate_set_verify_function()

Submitted by:  None
Submitted on:  Sat 19 Apr 2014 03:24:41 PM UTC  
 
Category: DANE libraryPriority: 5 - Normal
Severity: 4 - ImportantStatus: Done
Privacy: PublicAssigned to: None
Originator Email: -unavailable-Open/Closed: Closed
Operating System: GNU/Linux

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Fri 11 Jul 2014 03:49:09 PM UTC, comment #10:

It is now applied. This function also allows easier testing of dane_raw_tlsa(). I'll try to add a test case for both of these as soon as I'm back.

Nikos Mavrogiannopoulos <nmav>
Project Administrator
Thu 10 Jul 2014 10:35:00 AM UTC, comment #9:

Thank you. It looks reasonable. Would you like to send the DCO to the list (or at bugs@gnutls.org) and submit a git diff with the sign-off tag?
http://www.gnutls.org/devel.html

Nikos Mavrogiannopoulos <nmav>
Project Administrator
Wed 09 Jul 2014 09:22:17 PM UTC, comment #8:

This code allocates an unnecessary extra NULL entry for dane_data_len to avoid trying to malloc 0 bytes if q->data_entries is 0.

(file #31693)

Simon Arlott <s_a>
Sun 06 Jul 2014 09:11:45 PM UTC, comment #7:

I'll implement a copy of https://github.com/lp0/weechat/commit/6d69397b4fa3c947e1cc80b1b454a666232b1d1a#diff-8053959401d6693d38be5b1272ef40d7R158 directly in libdane/dane.c (I've added the number of entries as a return value because it simplifies duplicating the data if you don't have to iterate first to find this out).

It's a bit inconvenient having to obtain and provide the certificate chain manually when the non-raw session version of the function does this automatically: https://github.com/lp0/weechat/commit/e9d033abd9669315b73e3f8b707a592964ae932c#diff-e5707b6a1e5cfc1f92761719c83b3782R3748

Simon Arlott <s_a>
Sun 06 Jul 2014 12:17:03 PM UTC, comment #6:

Ok it seems I understand what do you need there and that seem reasonable. I'll add it to the todo list, but providing a patch for that would speed up the process.

Nikos Mavrogiannopoulos <nmav>
Project Administrator
Sat 05 Jul 2014 09:07:55 PM UTC, comment #5:

If I call dane_query_tlsa() (from a forked process to allow for it being blocking) there isn't an easy way to copy the dane_query_t data from one process to another and reuse it with dane_raw_tlsa(). I'll have to call dane_query_status(), dane_query_entries(), dane_query_data() and then put it all back together.

A function that converted a dane_query_t into the parameters needed for dane_raw_tlsa() would reduce the chance of implementation errors.

Anonymous
Wed 02 Jul 2014 11:51:58 AM UTC, comment #4:

You can do the following:
dane_state_init()
dane_raw_tlsa(): After you do the resolving you place the DANE there
dane_verify_crt_raw(): You use the result to verify the certificate

Nikos Mavrogiannopoulos <nmav>
Project Administrator
Sun 29 Jun 2014 07:10:05 PM UTC, comment #3:

Which lower level API?

The only correct place to do TLSA verification is in the callback for certificate verification (an asynchronous API). The only TLSA functionality provided is a synchronous API with no way to retrieve and cache the data in advance.

Anonymous
Mon 28 Apr 2014 09:39:27 AM UTC, comment #2:

I'm not sure we can solve that easily there are quite some assumptions that need to be made for the application that uses those functions. Maybe it would be better to assume that such application would take advantage of the lower level API?

Nikos Mavrogiannopoulos <nmav>
Project Administrator
Sat 19 Apr 2014 04:19:06 PM UTC, comment #1:

An alternative option would be for GnuTLS to allow the caller to provide an array of TLSA records to use for verification.

Anonymous
Sat 19 Apr 2014 03:24:41 PM UTC, original submission:

It is impractical to call dane_verify_session_crt() from the gnutls_certificate_set_verify_function() because the former does a synchronous DNS lookup.

There needs to be an asynchronous function in libdane to use ub_resolve_async instead of ub_resolve and store the TLSA records in the session.

There should be an option to request TLSA records using the above function prior to calling the certificate verification function. It would then be possible to perform DANE verification of the certificate using the TLSA records stored in the session without performing a synchronous DNS lookup.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #31693:  dane-108550.patch added by s_a (4kB - text/x-patch - Patch implementing dane_query_to_raw_tlsa())

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by s_a (Posted a comment)
  • -unavailable- added by nmav (Posted a comment)
  • -unavailable- added by None (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 11 Dec 2014 08:31:58 AM UTCnmavStatusNone=>Done
      Open/ClosedOpen=>Closed
    Thu 10 Jul 2014 09:14:35 PM UTCs_aAttached File-=>Added 0001-libdane-add-function-dane_query_to_raw_tlsa.patch, #31698
    Thu 10 Jul 2014 10:35:00 AM UTCnmavCategoryCore library=>DANE library
    Wed 09 Jul 2014 09:22:17 PM UTCs_aAttached File-=>Added dane-108550.patch, #31693

    Back to the top


    Powered by Savane 3.1-cleanup