From: Robert Pluim <rpluim@gmail.com>
To: Eli Zaretskii <eliz@gnu.org>
Cc: emacs-devel@gnu.org
Subject: Re: The netsec thread
Date: Mon, 23 Jul 2018 22:51:21 +0200 [thread overview]
Message-ID: <877ell8yly.fsf@gmail.com> (raw)
In-Reply-To: <836015x2fs.fsf@gnu.org> (Eli Zaretskii's message of "Mon, 23 Jul 2018 20:54:47 +0300")
Eli Zaretskii <eliz@gnu.org> writes:
>> From: Robert Pluim <rpluim@gmail.com>
>> Cc: Emacs-Devel devel <emacs-devel@gnu.org>, Eli Zaretskii <eliz@gnu.org>
>> Date: Mon, 23 Jul 2018 19:25:48 +0200
>>
>> I still fail to see the real need for it, but I guess Eli has a
>> use-case.
>
> All the computers on my home network is my use case.
You regularly make connections from one machine running emacs to a
different machine on the same subnet using TLS? And you donʼt want to
answer 'a' once per target machine? Iʼll allow it, even if I donʼt
understand it. :-)
Trial implementation attached, based off the netsec branch. I got rid
of all the RFC 1918 stuff, and it allows localhost connections
regardless of the value of nsm-trust-local-network, which Iʼm also not
convinced about.
I do wonder if checking all of the target host's addresses is
overkill, but we can always take that out.
diff --git i/lisp/net/nsm.el w/lisp/net/nsm.el
index b59ea07d8a..682a238cc1 100644
--- i/lisp/net/nsm.el
+++ w/lisp/net/nsm.el
@@ -70,9 +70,15 @@ nsm-trust-local-network
such as attempting to connect to an email server that do not
follow these practices inside a school or corporate network, NSM
may produce warnings for such occasions. Setting this option to
-a non-nil value, or a zero-argument function that returns non-nil
-tells NSM to skip checking for potential TLS vulnerabilities when
-connecting to hosts on a local network.
+a non-nil value tells NSM to skip checking for potential TLS
+vulnerabilities when connecting to hosts on a local network,
+which is determined by inspecting the network addresses of the
+local machine.
+
+This option can be set to a function taking one argument, in
+which case that function will be called once for each IP address
+that is found for the target host. It should return t if TLS
+checks should not be performed for that address.
Make sure you know what you are doing before enabling this
option."
@@ -204,54 +210,74 @@ nsm-tls-post-check-functions
RESULTS is an alist where the keys are the checks run and the
values the results of the checks.")
+(defun network-same-subnet-p (local-ip mask ip)
+ "Returns t if IP is in the same subnet as LOCAL-IP/MASK.
+LOCAL-IP, MASK, and IP are specified as vectors of integers, and
+are expected to have the same length. Works for both IPv4 and
+IPv6 addresses."
+ (let ((matches t)
+ (length (length local-ip)))
+ (unless (memq length '(4 5 8 9))
+ (error "Unexpected length of IP address %S" local-ip))
+ (dotimes (i length)
+ (setq matches (and matches
+ (=
+ (logand (aref local-ip i)
+ (aref mask i))
+ (logand (aref ip i)
+ (aref mask i))))))
+ matches))
+
(defun nsm-should-check (host)
"Determines whether NSM should check for TLS problems for HOST.
-If `nsm-trust-local-network' is or returns non-nil, and if the
-host address is a localhost address, a machine address, a direct
-link or a private network address, this function returns
-nil. Non-nil otherwise."
- (let* ((address (or (nslookup-host-ipv4 host nil 'vector)
- (nslookup-host-ipv6 host nil 'vector)))
- (ipv4? (eq (length address) 4)))
+If one of HOST's addresses is a localhost address this returns
+nil.
+
+If `nsm-trust-local-network' is t this function will check if any
+of HOST's addresses are in the same subnet as any directly
+connected interfaces, and will return nil if so.
+
+If `nsm-trust-local-network' is a function it will be called once
+for each address of HOST. If one of those calls returns t then
+`nsm-should-check' will return nil immediately, and processing of
+the HOST's addresses will stop.
+
+Otherwise returns t."
+ (let ((addresses (network-lookup-address-info host)))
(not
- (or (if ipv4?
- (or
- ;; (0.x.x.x) this machine
- (eq (aref address 0) 0)
- ;; (127.x.x.x) localhost
- (eq (aref address 0) 0))
- (or
- ;; (::) IPv6 this machine
- (not (cl-mismatch address [0 0 0 0 0 0 0 0]))
- ;; (::1) IPv6 localhost
- (not (cl-mismatch address [0 0 0 0 0 0 0 1]))))
- (and (or (and (functionp nsm-trust-local-network)
- (funcall nsm-trust-local-network))
- nsm-trust-local-network)
- (if ipv4?
- (or
- ;; (10.x.x.x) private
- (eq (aref address 0) 10)
- ;; (172.16.x.x) private
- (and (eq (aref address 0) 172)
- (eq (aref address 0) 16))
- ;; (192.168.x.x) private
- (and (eq (aref address 0) 192)
- (eq (aref address 0) 168))
- ;; (198.18.x.x) private
- (and (eq (aref address 0) 198)
- (eq (aref address 0) 18))
- ;; (169.254.x.x) link-local
- (and (eq (aref address 0) 169)
- (eq (aref address 0) 254)))
- (memq (aref address 0)
- '(
- 64512 ;; (fc00::) IPv6 unique local address
- 64768 ;; (fd00::) IPv6 unique local address
- 65152 ;; (fe80::) IPv6 link-local
- )
- )))))))
+ (catch 'trust
+ (dolist (address addresses)
+ (let* ((length (length address))
+ (ipv4? (eq length 4)))
+ (if ipv4?
+ ;; (127.x.x.x) localhost
+ (and (eq (aref address 0) 127)
+ (throw 'trust t))
+ ;; (::) IPv6 this machine and (::1) IPv6 localhost
+ (and (or (not (cl-mismatch address [0 0 0 0 0 0 0 0]))
+ (not (cl-mismatch address [0 0 0 0 0 0 0 1]))
+ (memq (aref address 0)
+ '(
+ 64512 ;; (fc00::) IPv6 unique local address
+ 64768 ;; (fd00::) IPv6 unique local address
+ 65152 ;; (fe80::) IPv6 link-local
+ )))
+ (throw 'trust t)))
+ (cond
+ ((functionp nsm-trust-local-network)
+ (and (funcall nsm-trust-local-network address)
+ (throw 'trust t)))
+ (nsm-trust-local-network
+ (and
+ (cl-find-if #'(lambda (x)
+ (network-same-subnet-p (subseq (car x) 0 length)
+ (subseq (caddr x) 0 length)
+ address))
+ (map-apply (lambda (a b)
+ (network-interface-info a))
+ (network-interface-list)))
+ (throw 'trust t))))))))))
(defun nsm-check-tls-connection (process host port status settings)
"Check TLS connection against potential security problems.
next prev parent reply other threads:[~2018-07-23 20:51 UTC|newest]
Thread overview: 104+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-20 11:33 The netsec thread Lars Ingebrigtsen
2018-07-20 12:24 ` Eli Zaretskii
2018-07-20 12:33 ` Lars Ingebrigtsen
2018-07-20 12:36 ` Lars Ingebrigtsen
2018-07-20 12:41 ` Eli Zaretskii
2018-07-20 12:45 ` Lars Ingebrigtsen
2018-07-23 1:52 ` Jimmy Yuen Ho Wong
2018-07-23 1:55 ` Brett Gilio
2018-07-23 2:32 ` Eli Zaretskii
2018-07-23 12:46 ` Lars Ingebrigtsen
2018-07-23 13:31 ` Andy Moreton
2018-07-23 14:43 ` Jimmy Yuen Ho Wong
2018-07-23 14:46 ` Andy Moreton
2018-07-23 15:48 ` Lars Ingebrigtsen
2018-07-23 16:54 ` Andy Moreton
2018-07-23 19:34 ` Andy Moreton
2018-07-24 8:24 ` Lars Ingebrigtsen
2018-07-24 9:34 ` Andy Moreton
2018-07-24 11:54 ` Andy Moreton
2018-07-24 12:09 ` Noam Postavsky
2018-07-24 13:59 ` Jimmy Yuen Ho Wong
2018-07-24 14:11 ` Lars Ingebrigtsen
2018-07-24 18:21 ` Andy Moreton
2019-07-28 18:18 ` Lars Ingebrigtsen
2019-07-28 18:27 ` Eli Zaretskii
2019-07-28 18:33 ` Lars Ingebrigtsen
2019-07-28 18:34 ` Lars Ingebrigtsen
2019-07-28 19:08 ` Lars Ingebrigtsen
2019-07-28 19:12 ` Eli Zaretskii
2019-07-29 11:12 ` Lars Ingebrigtsen
2019-07-29 7:50 ` Robert Pluim
2019-07-29 8:11 ` Robert Pluim
2019-07-29 11:18 ` Lars Ingebrigtsen
2019-07-29 11:14 ` Lars Ingebrigtsen
2019-07-29 14:02 ` Robert Pluim
2019-07-30 11:30 ` Lars Ingebrigtsen
2019-07-30 13:12 ` Robert Pluim
2019-07-30 13:32 ` Lars Ingebrigtsen
2019-07-30 15:05 ` Robert Pluim
2019-08-07 12:27 ` Robert Pluim
2019-08-07 18:41 ` Lars Ingebrigtsen
2019-08-23 2:58 ` Lars Ingebrigtsen
2019-08-23 8:19 ` Paul Eggert
2019-08-23 8:52 ` Lars Ingebrigtsen
2019-08-23 9:01 ` Lars Ingebrigtsen
2019-08-23 19:03 ` Paul Eggert
2019-08-25 5:33 ` Lars Ingebrigtsen
2019-09-03 9:49 ` Robert Pluim
2019-09-03 13:30 ` Paul Eggert
2019-09-03 15:37 ` Robert Pluim
2019-09-03 19:20 ` Paul Eggert
2019-09-03 20:02 ` Robert Pluim
2019-09-04 13:12 ` Lars Ingebrigtsen
2019-09-04 19:34 ` Robert Pluim
2019-09-04 21:35 ` Paul Eggert
2019-09-04 21:54 ` Robert Pluim
2019-09-05 12:12 ` Robert Pluim
2019-09-05 18:50 ` Paul Eggert
2019-09-05 19:34 ` Robert Pluim
2019-09-04 13:10 ` Lars Ingebrigtsen
2019-08-23 9:09 ` Eli Zaretskii
2019-08-23 9:40 ` Robert Pluim
2019-08-23 12:18 ` Eli Zaretskii
2019-08-23 12:39 ` Robert Pluim
2019-08-23 13:03 ` Eli Zaretskii
2019-08-23 13:20 ` Robert Pluim
2019-08-23 14:15 ` Eli Zaretskii
2019-08-23 14:27 ` Robert Pluim
2019-08-23 14:40 ` Eli Zaretskii
2019-08-23 14:58 ` Robert Pluim
2019-08-23 15:04 ` Eli Zaretskii
2019-08-23 9:58 ` Lars Ingebrigtsen
2019-08-23 12:43 ` Eli Zaretskii
2019-08-25 5:32 ` Lars Ingebrigtsen
2019-08-25 22:29 ` Richard Stallman
2019-08-26 4:16 ` Lars Ingebrigtsen
2018-07-23 15:22 ` Eli Zaretskii
2018-07-22 14:48 ` Lars Ingebrigtsen
2018-07-23 0:12 ` Jimmy Yuen Ho Wong
2018-07-23 8:17 ` Robert Pluim
2018-07-23 14:58 ` Jimmy Yuen Ho Wong
2018-07-23 15:06 ` Robert Pluim
2018-07-23 15:37 ` Lars Ingebrigtsen
2018-07-23 15:51 ` Jimmy Yuen Ho Wong
2018-07-23 16:06 ` Noam Postavsky
2018-07-23 16:11 ` Lars Ingebrigtsen
2018-07-23 15:04 ` Eli Zaretskii
2018-07-23 15:24 ` Jimmy Yuen Ho Wong
2018-07-23 15:34 ` Robert Pluim
2018-07-23 16:38 ` Jimmy Yuen Ho Wong
2018-07-23 17:25 ` Robert Pluim
2018-07-23 17:54 ` Eli Zaretskii
2018-07-23 20:51 ` Robert Pluim [this message]
2018-07-23 9:55 ` Lars Ingebrigtsen
2018-07-23 15:22 ` Jimmy Yuen Ho Wong
2018-07-23 15:46 ` Lars Ingebrigtsen
2018-07-23 15:48 ` Jimmy Yuen Ho Wong
2018-07-23 15:49 ` Noam Postavsky
2018-07-23 16:13 ` Lars Ingebrigtsen
2018-07-23 10:23 ` Andreas Schwab
2018-07-20 12:55 ` Jimmy Yuen Ho Wong
2018-07-20 12:59 ` Jimmy Yuen Ho Wong
2018-07-20 13:00 ` Lars Ingebrigtsen
2018-07-20 13:11 ` Jimmy Yuen Ho Wong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=877ell8yly.fsf@gmail.com \
--to=rpluim@gmail.com \
--cc=eliz@gnu.org \
--cc=emacs-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.