Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1197817

Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection

Show all headers | View raw

On 2024-05-18 Elliott Mitchell <ehem+debian@m5p.com> wrote:
> On Sat, May 18, 2024 at 07:40:13AM +0200, Andreas Metzler wrote:
>> On 2024-05-18 Elliott Mitchell <ehem+debian@m5p.com> wrote:
>>> On Sat, May 18, 2024 at 06:55:06AM +0200, Andreas Metzler wrote:
[...]
>>>> Afaict it is a short-cut to save more expensive processing for obvious
>>>> errors. gnutls_session_get_verify_cert_status() (with
>>>> gnutls_session_set_verify_cert() set correctly) or
>>>> gnutls_x509_crt_check_hostname()/gnutls_certificate_verify_peers3()
>>>> does more elaborate stuff on the data,
>>>> gnutls_certificate_verify_peers2() requires a separate
>>>> gnutls_x509_crt_check_hostname().

>>> Which seems to argue the more urgent issue is
>>> _gnutls_server_name_send_params() needs to do checking of the provided
>>> server hostname before sending it as SNI.

>> Why is this urgent or even relevant? Certificate checking (client-side)
>> will not accept IP adresses as SNI field.

> Not relevant.  If the certificate comes from a local file, it is assumed
> trusted.  If the certificate comes from the server, then it is only
> available *after* connection and the SNI has already been sent.
[...]

Hello,


You seem to argue that it is major problem for a gnutls client to *send*
e.g. "127.0.0.1" as SNI. My point is that this is not a problem but at
most uncomely since client-side certificate verification will fail.
Even for a trusted certificate name checking is done (if gnutls is
correctly used). And this will not succeed if the CN or SAN is an IP
address. (I have tried with test certificates and gnutls-cli/-serv. My
testing might be flawed of course.)

cu Andreas

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-04-29 04:20 +0200
  Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-04-30 06:00 +0200
    Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-04-30 07:40 +0200
      Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-05-01 13:50 +0200
        Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-14 03:20 +0200
          Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-05-14 18:30 +0200
            Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-17 04:10 +0200
              Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-17 19:00 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-05-18 07:00 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-18 07:30 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-05-18 07:50 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-18 08:10 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-05-18 08:30 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-18 09:00 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-05-18 11:00 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-18 22:20 +0200
  Bug#1071480: libldap: sends some IPv6 addresses as server name Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-20 02:10 +0200
    Bug#1071480: libldap: sends some IPv6 addresses as server name Ryan Tandy <ryan@nardis.ca> - 2024-05-20 22:00 +0200
  Bug#1071480: libldap: sends some IPv6 addresses as server name Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-20 23:50 +0200
  Bug#1071480: libldap: sends some IPv6 addresses as server name Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-21 07:00 +0200

csiph-web