From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Lars Magne Ingebrigtsen Newsgroups: gmane.emacs.devel Subject: Re: [PATCH RFC] GnuTLS: Support TOFU certificate checking. Date: Wed, 08 Oct 2014 16:05:44 +0200 Message-ID: References: <1412716565-7786-1-git-send-email-toke@toke.dk> <87a957o87z.fsf@alrua-karlstad.karlstad.toke.dk> <87bnpm2249.fsf@toke.dk> <83eguik9ip.fsf@gnu.org> <83d2a2k91n.fsf@gnu.org> <83bnpmk8fd.fsf@gnu.org> <838ukqk7gd.fsf@gnu.org> <87y4sqy84u.fsf@toke.dk> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable X-Trace: ger.gmane.org 1412777191 11329 80.91.229.3 (8 Oct 2014 14:06:31 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Wed, 8 Oct 2014 14:06:31 +0000 (UTC) Cc: Eli Zaretskii , tzz@lifelogs.com, emacs-devel@gnu.org To: Toke =?iso-8859-1?Q?H=F8iland-J=F8rgensen?= Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Wed Oct 08 16:06:24 2014 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1Xbrsm-0005SI-55 for ged-emacs-devel@m.gmane.org; Wed, 08 Oct 2014 16:06:24 +0200 Original-Received: from localhost ([::1]:36402 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xbrsl-00066P-Mn for ged-emacs-devel@m.gmane.org; Wed, 08 Oct 2014 10:06:23 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:39264) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xbrsd-00065x-Hs for emacs-devel@gnu.org; Wed, 08 Oct 2014 10:06:20 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XbrsY-0002jk-1I for emacs-devel@gnu.org; Wed, 08 Oct 2014 10:06:15 -0400 Original-Received: from hermes.netfonds.no ([80.91.224.195]:35468) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XbrsX-0002jY-Ox; Wed, 08 Oct 2014 10:06:09 -0400 Original-Received: from cm-84.215.51.58.getinternet.no ([84.215.51.58] helo=stories.gnus.org) by hermes.netfonds.no with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.72) (envelope-from ) id 1Xbrs8-0003Z9-TT; Wed, 08 Oct 2014 16:05:44 +0200 Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAD1BMVEVKUlSux88mJiWZs7pu f4QxwGGwAAACT0lEQVQ4jW2UgY3kIAxFvUAByzkFIEIBEFOAA+6/pvuQzJ5OWqTdmcnDxv/bhOxd 8v+qJMLxl3WQtPcrtkXp8g989nT10TT8gIaIbjajJh81l/XDrDGtTJUIDyf+3B07EYUHsMshsApA iZwA9AG1SA/iJEQNdvnIsQKsgFuO0E82VqKEndJbBDhKtOnH5DlyRgWRTTdg5PY9ifQcVk6kofsD zpHIRlA1R42DxQ/oOWdKPHJYAOl+gGmZ4SgQU9vxggOFN5TGYUipvrfr6wUO4LuIUBk+xSopPuCC BXEQTUQOeHX5BzAkNcbhqwDUNrPZvcDlGa3AgzHXJ7m0ZABoO+AzkeGBas6wZX6Ay8Vlh0QV/3TG 42sDsWAz6G4cW6gAO8KuMCM0RIn4zRPSH4AqwoSGp9VWc2jfO1VNMM6jp6sR3+qmNoevBAXB5ZNs R/xJQayfSyBEdC+YgD1fx4QghylZlqzqrkQBSJHzVbiB5yzQCPFL0GrNzQ+4zuU99UQTmjDSt2ww 81Kf/fAKsxaYG/BVpnnRnm4VR3BOXwCjycscOlVCh4v0gGufR730adcpmXKWBSRJEyA3AfK8itWy wWolhjOo9IkPxDqcT8LLGV7VknqkdBm2bLBvAjlIhugJf2SDJvsmwAZsLrqNeyJEcSmfrDgjWMA0 wdgN5EIZsnYrGfK9ADucrHbL8K7gjuTzAXDpXOcbemmS6oQ8AEaE7SZhDDCjvo5zg7bmcL0euOaU M+7pCgCILPy8V1ZlWMO/IL7vm109lr1vn8jy26p/AXpElUoFje1TAAAAAElFTkSuQmCC X-Now-Playing: Various's _The Wire Tapper 29_: "Icarus - Colour Field v500 (Wire Tapper edit)" X-Hashcash: 1:23:141008:tzz@lifelogs.com::JkwUCFziebSY+cdZ:00tS0 X-Hashcash: 1:23:141008:eliz@gnu.org::jFf7W7cUSvyIVXVx:00000TJZz X-Hashcash: 1:23:141008:emacs-devel@gnu.org::IFiGq4lv37bHtEgT:000000000000000000000000000000000000000000hE0v X-Hashcash: 1:23:141008:toke@toke.dk::YouLD91AkPJPhxfe:00001pBGw In-Reply-To: <87y4sqy84u.fsf@toke.dk> ("Toke \=\?iso-8859-1\?Q\?H\=F8iland-J\=F8\?\= \=\?iso-8859-1\?Q\?rgensen\=22's\?\= message of "Wed, 08 Oct 2014 15:59:45 +0200") User-Agent: Gnus/5.130012 (Ma Gnus v0.12) Emacs/24.4.50 (gnu/linux) X-MailScanner-ID: 1Xbrs8-0003Z9-TT MailScanner-NULL-Check: 1413381945.0571@kkdbsSJcDubVtUpep3rV9g X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 80.91.224.195 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:175133 Archived-At: Toke H=F8iland-J=F8rgensen writes: > Lars Magne Ingebrigtsen writes: > >> However, I was hoping to get the "bug out if the stream isn't encrypted >> and you wanted that" into the same code, so it would be nice to have it >> all in the same code path. > > So a generic callback from C to lisp that includes the encryption > status? However, doesn't open-network-stream use separate functions > depending on the encryption mode? I.e. the same C code is not run for > all of them? I've just had a fresh look at `open-network-stream'. Looks to me like it all happens way before sentinels are attached. And if the buffer is a problem (and I don't think it is), then we can attach the buffer at a later point. So I don't think this really is a problem. The `open-gnutls-stream' function can just return a descriptor, and `open-network-stream' can then query the descriptor and then decide what to do with it (which would be closing it and raising an error if the certificate is invalid or self-signed, and the user confirms that no connection should happen). I think. Unless there's something subtle here I'm missing... --=20 (domestic pets only, the antidote for overdose, milk.) bloggy blog: http://lars.ingebrigtsen.no