View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001418 | libmicrohttpd | HTTPS (TLS) | public | 2008-08-25 20:57 | 2008-09-10 22:49 |
| Reporter | Christian Grothoff | Assigned To | Christian Grothoff | ||
| Priority | normal | Severity | major | Reproducibility | N/A |
| Status | closed | Resolution | fixed | ||
| Summary | 0001418: more broken PKCS7 code | ||||
| Description | I would really like to know how this code is supposed to work (starting at around line 383 in gnutls_x509.c): do { pcert_size = 0; ret = gnutls_pkcs7_get_crt_raw (pkcs7, j, NULL, &pcert_size); if (ret != GNUTLS_E_MEMORY_ERROR) { count--; continue; } pcert = gnutls_malloc (pcert_size); if (ret == GNUTLS_E_MEMORY_ERROR) { gnutls_assert (); count--; continue; } /* read the certificate */ /* lots of actual code here*/ So if ret is not E_MEMORY_ERROR and at the same time is E_MEMORY_ERROR, then we actually do the processing. Yeah, right. | ||||
| Tags | No tags attached. | ||||
|
|
Simon Josefsson <simon@josefsson.org> writes: You can definitely remove the code in your port. Nobody seem to have used it in GnuTLS either since it hasn't been working since at least around v1.0... And on ENABLE_PKI: Yes, ENABLE_PKI is normally always 1 in GnuTLS, but there is --disable-extra-pki to set it to 0. I'm not sure the code even builds with ENABLE_PKI set to 0 any more, I don't check for that. Originally the symbol was likely intended to strip GnuTLS of the larger X.509 parts which are normally not needed. But it is an old symbol, so Nikos will know what it was intended for. |
|
|
And on the PKCS7 code, Simon writes: Nikos Mavrogiannopoulos <nmav@gnutls.org> writes: > Please don't remove the code. It is perfectly correct. It seems at some > point the initialization of tmp was removed (or maybe was never commited > correctly?). Anyway I've corrected it and it can now parse pkcs7 structures. I looked at the history here, and the code was broken in a patch installed on 2003-02-09: http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=e25325c312e339bd1a3624de4b877c73960b58c7#patch17 That means it has been broken since v0.9.0 and nobody has missed it. I think we should remove the code, it seems nobody needs the feature and removing code decreases complexity. People can use 'certtool --p7-info' to convert PKCS#7 blobs into lists of PEM certificates. I tried it and it works fine on the OpenSSL file. /Simon |
|
|
Removed or fixed by now. |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2008-08-25 20:57 | Christian Grothoff | New Issue | |
| 2008-08-26 15:17 | Christian Grothoff | Note Added: 0003673 | |
| 2008-08-26 15:18 | Christian Grothoff | Note Added: 0003674 | |
| 2008-08-30 23:58 | Christian Grothoff | Status | new => resolved |
| 2008-08-30 23:58 | Christian Grothoff | Resolution | open => fixed |
| 2008-08-30 23:58 | Christian Grothoff | Assigned To | => Christian Grothoff |
| 2008-08-30 23:58 | Christian Grothoff | Note Added: 0003676 | |
| 2008-09-10 22:49 | Christian Grothoff | Status | resolved => closed |
| 2013-05-06 12:52 | Christian Grothoff | Category | SSL => HTTPS (SSL) |
| 2024-01-21 13:25 | Christian Grothoff | Category | HTTPS (SSL) => HTTPS (TLS) |
