[gnutls-devel] GnuTLS | RFC7250 Raw public keys (!650)

[Development of GNU's TLS library]

Tom commented on a discussion on lib/auth/cert.c:

>  	 * then send that one.
>  	 */
>  	if (cred->ncerts == 1 &&
> -		(data_size == 0 || (session->internals.flags & GNUTLS_FORCE_CLIENT_CERT))) {
> +	    (data_size == 0
> +	     || (session->internals.flags & GNUTLS_FORCE_CLIENT_CERT))) {
> +		// Do a cert type check
> +		if (cred->certs[0].cert_list_length > 0 &&

I don't know. I can't oversee all possibilities. If we can not prove or guarantee this invariant then I would like to add an extra check just to be sure. How do you approach these kind of things?

Since we are writing security code I tend to be better safe than sorry. I don't know whether extra checks cause to much overhead?

If you want me to remove it I will.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/merge_requests/650#note_119646942
You're receiving this email because of your account on gitlab.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20181123/3b3c4e06/attachment.html>