helpGnuTLS - Support: sr #108612, Both verify_ca() and verify_ee()...


sr #108612: Both verify_ca() and verify_ee() abort DANE processing with DANE_E_UNKNOWN_DANE_DATA for unrecognised types

Submitted by:  None
Submitted on:  Sun 06 Jul 2014 07:39:05 PM UTC  
Category: DANE libraryPriority: 5 - Normal
Severity: 6 - SecurityStatus: Done
Privacy: PublicAssigned to: Nikos Mavrogiannopoulos <nmav>
Originator Email: -unavailable-Open/Closed: Closed
Operating System: None

Add a New Comment (Rich MarkupRich Markup):

You are not logged in

Please log in, so followups can be emailed to you.


Sun 06 Jul 2014 09:13:14 PM UTC, comment #1:

I've added a check that skips those entries. I don't think that an UNKNOWN_DANE_INFO verify flag is needed. Having it may cause similar failures at the application layer, and wouldn't provide any significant information that the application can act on.

Nikos Mavrogiannopoulos <nmav>
Project AdministratorIn charge of this item.
Sun 06 Jul 2014 07:39:05 PM UTC, original submission:

Both verify_ca() and verify_ee() abort DANE processing with DANE_E_UNKNOWN_DANE_DATA for unrecognised types. The correct response is to ignore that TLSA record.

If a new TLSA type is introduced then DANE checking will return an error and be ignored by clients. Instead, the clients may have been able to verify the certificate with another TLSA record or they should have rejected it when there are no more recognised records.

These functions should return 0 and set *verify |= DANE_VERIFY_UNKNOWN_DANE_INFO.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by nmav (Posted a comment)
  • -unavailable- added by None (Submitted the item)

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 20 Sep 2014 11:22:48 PM UTCnmavStatusReady For Test=>Done
    Sun 06 Jul 2014 09:13:14 PM UTCnmavCategoryExtra library=>DANE library
      StatusNone=>Ready For Test
      Assigned toNone=>nmav

    Back to the top

    Powered by Savane 3.1-cleanup