search

letoams / hash-slinger

GNU General Public License v2.0
50 stars 15 forks source link

Fix non-deterministic TLSA verify exit status behavior #41

Closed jellekaufmann closed 2 years ago

jellekaufmann commented 2 years ago

Hi,

I believe this pull request fixes a bug that causes the exit status to be determined by the order in which the TLSA records are processed.

$ tlsa --verify <domain>
FAIL (Usage 3 [DANE-EE]): Certificate offered by the server does not match the TLSA record ()
SUCCESS (Usage 3 [DANE-EE]): Certificate offered by the server matches the TLSA record ()
$ echo $?
0
$ tlsa --verify <domain>
SUCCESS (Usage 3 [DANE-EE]): Certificate offered by the server matches the TLSA record ()
FAIL (Usage 3 [DANE-EE]): Certificate offered by the server does not match the TLSA record ()
$ echo $?
2