Description of problem:
If the client hello message includes more than 32 extensions, GnuTLS will completely ignore presence of those extensions.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
openssl req -x509 -newkey rsa:2048 -keyout localhost.key -out localhost.crt -subj /CN=localhost -nodes -batch
gnutls-serv --http -p 4433 --x509keyfile localhost.key --x509certfile localhost.crt --disable-client-cert
In another console:
git clone https://github.com/tomato42/tlsfuzzer.git
git clone https://github.com/tomato42/tlslite-ng.git .tlslite-ng
ln -s .tlslite-ng/tlslite tlslite
git clone https://github.com/warner/python-ecdsa.git .python-ecdsa
ln -s .python-ecdsa/ecdsa ecdsa
PYTHONPATH=. python scripts/test-large-number-of-extensions.py
63 extensions ...
Error encountered while processing node <tlsfuzzer.expect.ExpectServerHello object at 0x7f451d1c0150> (child: <tlsfuzzer.expect.ExpectCertificate object at 0x7f451d1c0190>) with last message being: <tlslite.messages.Message object at 0x7f451be366d0>
Error while processing
Traceback (most recent call last):
File "scripts/test-large-number-of-extensions.py", line 168, in main
File "/tmp/tlsfuzzer/tlsfuzzer/runner.py", line 168, in run
File "/tmp/tlsfuzzer/tlsfuzzer/expect.py", line 174, in process
assert ext is not None
Fixed upstream: https://gitlab.com/gnutls/gnutls/issues/136
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.