Re: The netsec thread

[Paul Eggert <eggert@cs.ucla.edu>]

[-- Attachment #1: Type: text/plain, Size: 1106 bytes --]

Lars Ingebrigtsen wrote:

> I don't have access to a Fedora system to test on

"make check" works for me on Fedora 30 again; thanks.

> Hm...  Since GnuTLS no longer supports compression at all, I would have
> assumed that on newer OS versions this would be a NOOP.

Yes, the newer GnuTLS implementations are stub functions that are marked 
obsolescent, which causes GCC to warn when you compile code calling them, and if 
--enable-gcc-warnings is used this caused the Emacs build to fail. The fix I 
installed was to call these obsolescent functions only in older GnuTLS versions, 
where they are not obsolescent.

Come to think of it, Emacs shouldn't make the :compression feature visible on 
newer-GnuTLS systems, since the feature is obsolescent and just clutters up the 
runtime and data. So I installed the attached patch, which causes this feature 
(and the :encrypt-then-mac feature) to be exported to the Lisp level only if the 
underlying GnuTLS library supports the feature. This gives a bit more info to 
the Lisp code (if it wants it) and simplifies the data and the low-level code 
slightly.

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-Tweak-gnutls-peer-status-reporting.patch --]
[-- Type: text/x-patch; name="0001-Tweak-gnutls-peer-status-reporting.patch", Size: 2565 bytes --]

From 80376945952943888bb34c7d4ea06972e422eca7 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Fri, 23 Aug 2019 11:50:40 -0700
Subject: [PATCH] Tweak gnutls-peer-status reporting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* src/gnutls.c (Fgnutls_peer_status): Report :compression and
:encrypt-then-mac only if the underlying GnuTLS library has
the corresponding features.  This give the Elisp caller a bit
more information about the peer status.
* lisp/net/nsm.el (nsm-protocol-check--compression):
Don’t worry about compression in newer GnuTLS versions
that do not support compression.
---
 lisp/net/nsm.el |  3 ++-
 src/gnutls.c    | 16 +++++++---------
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/lisp/net/nsm.el b/lisp/net/nsm.el
index ed700bc9b5..5e8381075b 100644
--- a/lisp/net/nsm.el
+++ b/lisp/net/nsm.el
@@ -692,7 +692,8 @@ nsm-protocol-check--compression
 Use of Transport Layer Security (TLS) and Datagram Transport Layer
 Security (DTLS)\", `https://tools.ietf.org/html/rfc7525'"
   (let ((compression (plist-get status :compression)))
-    (and (string-match "^\\bDEFLATE\\b" compression)
+    (and compression
+	 (string-match "^\\bDEFLATE\\b" compression)
          (format-message
           "compression method (%s) may lead to leakage of sensitive information"
           compression))))
diff --git a/src/gnutls.c b/src/gnutls.c
index 51536b1463..a7ef59ab91 100644
--- a/src/gnutls.c
+++ b/src/gnutls.c
@@ -1493,20 +1493,18 @@ returned as the :certificate entry.  */)
 
   /* Compression name. */
 #ifdef HAVE_GNUTLS_COMPRESSION_GET
-  Lisp_Object compression = build_string (gnutls_compression_get_name
-					  (gnutls_compression_get (state)));
-#else
-  Lisp_Object compression = build_string ("NULL");
+  result = nconc2
+    (result, list2 (intern (":compression"),
+		    build_string (gnutls_compression_get_name
+				  (gnutls_compression_get (state)))));
 #endif
-  result = nconc2 (result, list2 (intern (":compression"), compression));
 
   /* Encrypt-then-MAC. */
-  Lisp_Object etm_status = Qnil;
 #ifdef HAVE_GNUTLS_ETM_STATUS
-  if (gnutls_session_etm_status (state))
-    etm_status = Qt;
+  result = nconc2
+    (result, list2 (intern (":encrypt-then-mac"),
+		    gnutls_session_etm_status (state) ? Qt : Qnil));
 #endif
-  result = nconc2 (result, list2 (intern (":encrypt-then-mac"), etm_status));
 
   /* Renegotiation Indication */
   result = nconc2
-- 
2.17.1