<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<p class="details" style="font-style: italic; color: #626168;">
<a href="https://gitlab.com/mamednet">ma ma</a> created an issue: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1767">#1767</a>
</p>
<div class="md" style="position: relative; z-index: 1; color: #3a383f; word-wrap: break-word;">
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Summary When connecting with gnutls-cli on macOS to a server whose X.509 certificate uses an EC public key with the Brainpool curve (brainpoolP256r1, OID 1.3.36.3.3.2.8.1.1.7), gnutls fails while parsing the certificate. The client prints "Curve ... is not supported" and a chain of ASSERTs, then aborts the handshake with a fatal certificate error.</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Expected behavior gnutls-cli should either successfully import the certificate (if brainpool is supported) or return a clear, non‑assertive error such as "unsupported curve OID". It should not hit internal ASSERTs and crash/abort.</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Actual behavior gnutls aborts the handshake. Relevant log excerpts:</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">|<2>| Curve 1.3.36.3.3.2.8.1.1.7 is not supported</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">|<3>| ASSERT: key_decode.c[_gnutls_x509_read_ecc_params]:274</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">|<3>| ASSERT: mpi.c[_gnutls_get_asn_mpis]:155 ... *** Fatal error: Fehler im Zertifikat.</p>
<figure style="margin-bottom: 0;">
<p style="color: #3a383f; margin: 0 0 1rem;">Reproduction steps</p>
<ol style="margin: 0 0 1rem; padding: 0;">
<li style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Run (example on macOS): gnutls-cli -p 443 -d 25 --x509certfile=pki/server.crt.pem --x509keyfile=pki/server.key.pem 192.168.165.101</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Observe the debug output; the certificate parsing fails with the messages shown above.</li>
</ol>
<p style="color: #3a383f; margin: 0 0 1rem;">Technical notes / hypothesis</p>
<ul style="margin: 0 0 1rem; padding: 0;">
<li style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">The logs indicate gnutls does not recognize the brainpool OID and therefore cannot decode the ECC parameters from the certificate. This leads to unexpected NULL/invalid values while parsing MPIs and triggers internal ASSERTs.</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Likely causes:
<ul style="margin: 0; padding: 0;">
<li style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">The crypto backend (nettle/libgcrypt) used by this gnutls build does not expose the Brainpool curve OID/parameters.</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">The macOS build may be missing OID-to-curve mapping or configuration to register brainpool curves.</li>
</ul>
</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Request: even if brainpool support is not desired, the library should handle unsupported curves gracefully (return a proper error), instead of aborting with assertions.</li>
</ul>
<p style="color: #3a383f; margin: 0 0 1rem;">Requested assistance</p>
<ol style="margin: 0 0 1rem; padding: 0;">
<li style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Can maintainers confirm whether gnutls (which versions) is expected to support RFC‑5639 Brainpool curves?</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">If yes: what exact build dependencies and configure flags are required to enable brainpool support on macOS?</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">If this is a bug: please consider a patch to avoid ASSERTs and return a clean error path when encountering unknown curve OIDs in certificates.</li>
</ol>
</figure>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1767">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/sent_notifications/1-27fl2tk54am7otxet1jo26j1i/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/issues/1767 at 1763970944
</span>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1767"}}</script>
</p>
</div>
</body>
</html>