Re: [PATCH RFC] GnuTLS: Support TOFU certificate checking.

[Eli Zaretskii <eliz@gnu.org>]

> From: Lars Magne Ingebrigtsen <larsi@gnus.org>
> Cc: toke@toke.dk,  tzz@lifelogs.com,  emacs-devel@gnu.org
> Date: Wed, 08 Oct 2014 15:25:43 +0200
> 
> Eli Zaretskii <eliz@gnu.org> writes:
> 
> > So you want to return a descriptor for a connection that failed
> > certificate validation, and let the application handle that?
> 
> The other option is to have the C layer close the connection, signal an
> error, have `open-network-stream' query the user about the invalid
> certificate, the user says "connect anyway", and then we'd reconnect
> with other options.
> 
> That seems less ... convenient.
> 
> > That could work, but I don't know what security-wary people here will
> > tell about keeping such connections.
> 
> I think I know.  >"?

What happens if some stuff comes out of the stream that failed to be
validated, while Emacs negotiates with the user about what to do?
Normally, we would pass this stuff to whatever sentinel was defined,
or insert it into a buffer.  Is that what you want?

> We're just moving the certificate handling up to the Lisp level --
> nothing more.

If what you want is to cause gnutls-boot call out to Lisp for
validation as part of its normal path, then that's fine, I think.  But
it does mean that we have no stream until the entire validation
completes.  My understanding of what was being suggested here was that
this is not what you have in mind:

> Right, so (just to make sure I'm understanding you right), what you
> propose is to get rid of all the current validation logic in C (i.e the
> erroring out) and just return something like (<cert hash> <cert
> hostname> <CA validity status>) -- and then make the lisp code work out
> the rest?
> 
> Right now it seems the C code refuses to even return the opened network
> stream object if validation fails; with this, that would have to change,
> and the C code wouldn't make any policy decisions?

That doesn't sound to me like "just moving the certificate handling up
to the Lisp level".