From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: =?utf-8?Q?Toke_H=C3=B8iland-J=C3=B8rgensen?= Newsgroups: gmane.emacs.devel Subject: Re: [PATCH RFC] GnuTLS: Support TOFU certificate checking. Date: Wed, 08 Oct 2014 18:09:25 +0200 Message-ID: <87tx3ezgp6.fsf@toke.dk> References: <1412716565-7786-1-git-send-email-toke@toke.dk> <87tx3emvwv.fsf@alrua-karlstad.karlstad.toke.dk> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1412784604 29721 80.91.229.3 (8 Oct 2014 16:10:04 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Wed, 8 Oct 2014 16:10:04 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Wed Oct 08 18:09:59 2014 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1XbtoM-0004Ig-GG for ged-emacs-devel@m.gmane.org; Wed, 08 Oct 2014 18:09:58 +0200 Original-Received: from localhost ([::1]:37215 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XbtoL-0003uE-UT for ged-emacs-devel@m.gmane.org; Wed, 08 Oct 2014 12:09:57 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:37369) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xbto2-0003rK-77 for emacs-devel@gnu.org; Wed, 08 Oct 2014 12:09:42 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Xbtny-000875-5q for emacs-devel@gnu.org; Wed, 08 Oct 2014 12:09:38 -0400 Original-Received: from mail2.tohojo.dk ([77.235.48.147]:51993) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xbtnx-000871-UB for emacs-devel@gnu.org; Wed, 08 Oct 2014 12:09:34 -0400 X-Virus-Scanned: amavisd-new at mail2.tohojo.dk Original-Received: by alrua-x1.borgediget.toke.dk (Postfix, from userid 1000) id C83C32E69C; Wed, 8 Oct 2014 18:09:25 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toke.dk; s=201310; t=1412784502; bh=iuVrwbRf8+SHe2Y3E0V9PNAb1Szmm9WEp91Ei52Po/8=; h=From:To:Subject:References:Date:In-Reply-To; b=PfHRZcm4gk+emaUHgp/RbLqxYz1Uvmr52gVDwKO7+fkdbxTQ2mwOo8UI/zzM+2Rh+ QMxQFZV5MQKXknkG2dbxp/1FKNlu24I2iHsSkYSfXl+QkMoEhvBkFoGDvCGjzzeBRb /4Uz2Tcyf9hG4q+dBvq/I08bfvITaTxacJ1KaIms= In-Reply-To: (Ted Zlatanov's message of "Wed, 08 Oct 2014 11:45:02 -0400") X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 77.235.48.147 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:175145 Archived-At: Ted Zlatanov writes: > Emacs has this function already, e.g. `(locate-user-emacs-file "certs")' > > I think it's better to make the store private than shared by default, so > I'd just give the user the choice to use nil (translated to NULL in > C). Ah, yes, this should come from the lisp side of course. Silly me, hadn't even thought of that. > That would be great, please see how far you get with the exploration. > Your contribution is already very useful so I am excited to see it > evolve. Well, gnutls-cli asks the user in a callback (set with gnutls_certificate_set_verify_function). The TOFU verification starts at line 461 of https://gitorious.org/gnutls/gnutls/source/ce47098eecba5fb3256b855f9674ee0ca458c60c:src/cli.c so it seems it's just pausing in the middle of the handshake. > OK; Lars and I will probably work on it as well as time allows in > order to get something into trunk. Oh, by all means. I didn't mean that as "don't touch it", more as "don't expect anything more too soon" :) Have updated the patch to use a configurable credentials file and put in the autoconf stuff. Will resend it once I have tested it :) -Toke