nemo
/
hn-classics
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
hn-classics/_stories/2008/7347500.md

2.9 KiB
Raw Permalink Blame History

created_at title url author points story_text comment_text num_comments story_id story_title story_url parent_id created_at_i _tags objectID year
2014-03-05T15:35:11.000Z GnuTLS considered harmful (2008) http://www.openldap.org/lists/openldap-devel/200802/msg00072.html calpaterson 167 116 1394033711
story
author_calpaterson
story_7347500
7347500 2008

Source

GnuTLS considered harmful

[Date Prev][Date Next] [Chronological] [Thread] [Top]

GnuTLS considered harmful

  • To: OpenLDAP Devel <openldap-devel@openldap.org>
  • Subject: GnuTLS considered harmful
  • From: Howard Chu <hyc@symas.com>
  • Date: Sat, 16 Feb 2008 13:12:31 -0800
  • User-agent: Mozilla/5.0 (X11; U; Linux i686; rv:1.9b3pre) Gecko/2008013117 SeaMonkey/2.0a1pre

The recent trouble in ITS#5361 prompted me to look into the GnuTLS code a little deeper. It turns out that their corresponding set_subject_alt_name() API only takes a char * pointer as input, without a corresponding length. As such, this API will only work for string-form alternative names, and will typically break with IP addresses and other alternatives.

Looking across more of their APIs, I see that the code makes liberal use of strlen and strcat, when it needs to be using counted-length data blobs everywhere. In short, the code is fundamentally broken; most of its external and internal APIs are incapable of passing binary data without mangling it. The code is completely unsafe for handling binary data, and yet the nature of TLS processing is almost entirely dependent on secure handling of binary data.

I strongly recommend that GnuTLS not be used. All of its APIs would need to be overhauled to correct its flaws and it's clear that the developers there are too naive and inexperienced to even understand that it's broken. \-- \-- Howard Chu Chief Architect, Symas Corp. <http://www.symas.com> Director, Highland Sun <http://highlandsun.com/hyc/> Chief Architect, OpenLDAP <http://www.openldap.org/project/>