Re: [PATCH RFC] GnuTLS: Support TOFU certificate checking.

[Eli Zaretskii]

> From: Lars Magne Ingebrigtsen <address@hidden>
> Date: Wed, 08 Oct 2014 14:18:27 +0200
> MailScanner-NULL-Check: address@hidden
> Cc: Ted Zlatanov <address@hidden>, address@hidden
> 
> Toke Høiland-Jørgensen <address@hidden> writes:
> 
> > Right, so (just to make sure I'm understanding you right), what you
> > propose is to get rid of all the current validation logic in C (i.e the
> > erroring out) and just return something like (<cert hash> <cert
> > hostname> <CA validity status>) -- and then make the lisp code work out
> > the rest?
> 
> Yup, I think that would be more flexible.

I don't see how this could be done: the initialization of TLS network
stream creates a descriptor and adds it to the descriptors we watch in
wait_reading_process_output.  If that descriptor is invalid, we will
likely crash.