From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.bugs Subject: bug#26835: 26.0.50; url-retrieve no longer raises certificate errors Date: Tue, 09 May 2017 20:51:48 +0300 Message-ID: <83lgq5c40b.fsf@gnu.org> References: <8337cfcgr2.fsf@gnu.org> Reply-To: Eli Zaretskii NNTP-Posting-Host: blaine.gmane.org X-Trace: blaine.gmane.org 1494352489 3492 195.159.176.226 (9 May 2017 17:54:49 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Tue, 9 May 2017 17:54:49 +0000 (UTC) Cc: 26835@debbugs.gnu.org To: Aaron Jensen , Lars Ingebrigtsen Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Tue May 09 19:54:38 2017 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d89LI-0000bC-NW for geb-bug-gnu-emacs@m.gmane.org; Tue, 09 May 2017 19:54:36 +0200 Original-Received: from localhost ([::1]:38719 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1d89LM-0005iS-KL for geb-bug-gnu-emacs@m.gmane.org; Tue, 09 May 2017 13:54:40 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:50400) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1d89Jq-0004Q0-6M for bug-gnu-emacs@gnu.org; Tue, 09 May 2017 13:53:07 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d89Jm-0002Yl-9e for bug-gnu-emacs@gnu.org; Tue, 09 May 2017 13:53:06 -0400 Original-Received: from debbugs.gnu.org ([208.118.235.43]:59976) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1d89Jm-0002Yc-5a for bug-gnu-emacs@gnu.org; Tue, 09 May 2017 13:53:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1d89Jl-0001QA-TZ for bug-gnu-emacs@gnu.org; Tue, 09 May 2017 13:53:01 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Eli Zaretskii Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Tue, 09 May 2017 17:53:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 26835 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: security Original-Received: via spool by 26835-submit@debbugs.gnu.org id=B26835.14943523765448 (code B ref 26835); Tue, 09 May 2017 17:53:01 +0000 Original-Received: (at 26835) by debbugs.gnu.org; 9 May 2017 17:52:56 +0000 Original-Received: from localhost ([127.0.0.1]:34420 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d89Jf-0001Po-Od for submit@debbugs.gnu.org; Tue, 09 May 2017 13:52:55 -0400 Original-Received: from eggs.gnu.org ([208.118.235.92]:59289) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d89Je-0001Pa-30 for 26835@debbugs.gnu.org; Tue, 09 May 2017 13:52:54 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d89JU-0002Ro-D7 for 26835@debbugs.gnu.org; Tue, 09 May 2017 13:52:48 -0400 Original-Received: from fencepost.gnu.org ([2001:4830:134:3::e]:44086) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1d89JU-0002Re-AV; Tue, 09 May 2017 13:52:44 -0400 Original-Received: from 84.94.185.246.cable.012.net.il ([84.94.185.246]:3544 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1d89JH-0003OL-Q6; Tue, 09 May 2017 13:52:43 -0400 In-reply-to: (message from Aaron Jensen on Mon, 8 May 2017 12:44:52 -0700) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 208.118.235.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.org gmane.emacs.bugs:132400 Archived-At: [Resending, as I messed up the previous message. Apologies.] > From: Aaron Jensen > Date: Mon, 8 May 2017 12:44:52 -0700 > Cc: 26835@debbugs.gnu.org > > It repros in `emacs -Q', just set: > > (setq gnutls-verify-error t) > (url-retrieve-synchronously "https://wrong.host.badssl.com/") > > In Emacs 25.2, this causes an error to be thrown when you use > url-retrieve, in 26, it silently proceeds. That's because we now perform GnuTLS negotiation asynchronously, without blocking. When the certificate matching fails, gnutls.c faithfully stores the error message in the process's status by calling boot_error: boot_error (p, "The x509 certificate does not match \"%s\"", c_hostname); and boot_error does: static void ATTRIBUTE_FORMAT_PRINTF (2, 3) boot_error (struct Lisp_Process *p, const char *m, ...) { va_list ap; va_start (ap, m); if (p->is_non_blocking_client) pset_status (p, list2 (Qfailed, vformat_string (m, ap))); So the process status becomes the list (failed "error message"). But when url-retrieve-synchronously accesses the status, by calling process-status, we do this: status = p->status; if (CONSP (status)) status = XCAR (status); which loses the error message, leaving just 'failed'. So url-retrieve-synchronously silently exits, and doesn't even have the info that could cause it to signal an error. IOW, the problem is not that the connection proceeds -- it does not. The problem is that it fails silently without telling the caller what caused the failure. I'll CC Lars, who introduced the non-blocking connections.