GnuTLS: Don't skip really long certificate fields #5271
Conversation
| size = sizeof(certbuf); | ||
| gnutls_x509_crt_get_dn(x509_cert, certbuf, &size); | ||
| infof(data, "\t subject: %s\n", certbuf); | ||
| rc = gnutls_x509_crt_get_dn2(x509_cert, &certfields); |
There was a problem hiding this comment.
This function was added in GnuTLS 3.1.10 (Mar 22, 2013), meaning it is much newer than the oldest GnuTLS version we claim to support (2.11.3 is mentioned in docs/INTERNALS.md).
I don't think supporting version 2 is worth it, and perhaps a 7 years old version is enough as oldest legacy GnuTLS to support, but I think this detail should still be checked for so that we can warn users about out-of-age versions and the docs could state the new oldest version we support.
There was a problem hiding this comment.
So should I upgrade the requirements to GnuTLS 3.1.10 or should I make this feature only available to newer versions?
There was a problem hiding this comment.
I'll bump the requirement to 3.1.10 in a separate PR, so just leave this as is.
GnuTLS 3.1.10 added new functions we want to use. That version was released on Mar 22, 2013. Removing support for older versions also greatly simplifies the code. Ref: #5271
|
Thanks! |
This fixes 2.3 describes in
docs/KNOWN_BUGS.It is fixed by using the
..._dn2function equivalents which allocate the required length rather than filling it into the fixed one.The CN field was limited to 64 chars because that's the defined max amount in ASN.1