From: Ted Zlatanov <tzz@lifelogs.com>
To: gnutls-devel@gnu.org
Cc: emacs-devel@gnu.org
Subject: Re: Emacs core TLS support
Date: Sun, 26 Sep 2010 01:12:13 -0500 [thread overview]
Message-ID: <87k4m92fuq.fsf@lifelogs.com> (raw)
In-Reply-To: 87eicn2upl.fsf@mocca.josefsson.org
On Tue, 21 Sep 2010 13:37:42 +0200 Simon Josefsson <simon@josefsson.org> wrote:
SJ> Ted Zlatanov <tzz@lifelogs.com> writes:
>> +(defconst gnutls-version "0.3.1")
>> + "/tmp/ca.pem"
SJ> This should be removed.
Done.
>> + (priority-string (or priority-string
>> + (cond
>> + ((eq credentials 'gnutls-anon)
>> + "PERFORMANCE:+ANON-DH:!ARCFOUR-128")
>> + ((eq credentials 'gnutls-x509pki)
>> + "PERFORMANCE"))))
SJ> I think NORMAL should be used instead of PERFORMANCE here.
Done.
>> +(defun open-ssl-stream (name buffer host service)
>> + "Open a SSL connection for a service to a host.
SJ> I suggest using 'TLS' or possibly 'SSL/TLS' consistently in
SJ> documentation.
OK, but let's get the code working first.
SJ> Is 'open-ssl-stream' for backwards compatibility? Otherwise I
SJ> suggest 'open-tls-stream'.
Yes, it's trying to be compatible. I'd rather get rid of the
compatibility but we'll see.
>> +;; (open-ssl-stream "tls" "tls-buffer" "yourserver.com" "https")
SJ> Looks like debug code that should be removed?
Please let it be for now. It's useful for quick testing.
>> +PRIORITY-STRING is as per the GnuTLS docs.
SJ> Maybe there could be an info hyperlink here?
Sorry, you mean to the GnuTLS webserver? I don't know if that's
necessary.
>> + (gnutls-message-maybe
>> + (setq ret (gnutls-boot proc priority-string credentials credentials-file))
>> + "boot: %s")
SJ> How much debug code do we want to retain? I'm not sure.
For now, as much as possible. We can always turn it down later.
>> +DEFUN ("gnutls-global-init", Fgnutls_global_init,
>> + Sgnutls_global_init, 0, 0, 0,
>> + doc: /* Initializes global GNU TLS state to defaults.
>> +Call `gnutls-global-deinit' when GNU TLS usage is no longer needed.
>> +Returns zero on success. */)
SJ> ...
>> +DEFUN ("gnutls-global-deinit", Fgnutls_global_deinit,
>> + Sgnutls_global_deinit, 0, 0, 0,
>> + doc: /* Deinitializes global GNU TLS state.
>> +See also `gnutls-global-init'. */)
SJ> I think this shouldn't be exposed to Elisp, Emacs startup code could
SJ> initialize GnuTLS directly.
OK, done.
>> +DEFUN ("gnutls-boot", Fgnutls_boot, Sgnutls_boot, 3, 6, 0,
>> + doc: /* Initializes client-mode GnuTLS for process PROC.
>> +Currently only client mode is supported. Returns a success/failure
>> +value you can check with `gnutls-errorp'.
>> +
>> +PRIORITY_STRING is a string describing the priority.
>> +TYPE is either `gnutls-anon' or `gnutls-x509pki'.
>> +TRUSTFILE is a PEM encoded trust file for `gnutls-x509pki'.
>> +KEYFILE is ... for `gnutls-x509pki' (TODO).
>> +CALLBACK is ... for `gnutls-x509pki' (TODO).
SJ> Two comments here: 1) The name is a bit generic..?
Well, "init" is taken and I have a small vocabulary :)
SJ> 2) The design makes it a bit difficult to support multiple
SJ> credentials. The GnuTLS API allows clients to have several
SJ> credentials (X.509, OpenPGP, etc). Perhaps copying the GnuTLS API
SJ> further is more flexible.
I thought of making it more flexible but I really want to get the basic
case working. As I mentioned earlier I think GnuTLS should consider
further extending the idea of priority strings to a full configuration
(credentials especially) in a single string or file. That would make
using it so much easier from Emacs Lisp.
I tried to figure out the TLS handshake problem but it has stumped me.
It's taken me many hours and I still don't know what I'm missing so, as
I mentioned in my other message, I've checked in my current state to let
others take a look. If you or other GnuTLS developers can help, it
would be greatly appreciated. Once the handshake works I will work on
the other improvements you mentioned and on getting the GnuTLS support
into Gnus and other parts of Emacs.
Thanks
Ted
next prev parent reply other threads:[~2010-09-26 6:12 UTC|newest]
Thread overview: 93+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-01-13 21:53 Emacs core TLS support Ted Zlatanov
2010-01-13 23:46 ` Chong Yidong
2010-01-14 14:09 ` Ted Zlatanov
2010-01-14 15:44 ` Stefan Monnier
2010-01-14 16:38 ` Ted Zlatanov
2010-01-29 19:59 ` Ted Zlatanov
2010-08-12 23:00 ` Ted Zlatanov
2010-08-13 11:04 ` James Cloos
2010-08-13 15:07 ` Ted Zlatanov
2010-08-13 15:51 ` Julien Danjou
2010-08-13 16:11 ` Eli Zaretskii
2010-08-13 15:53 ` David Kastrup
2010-08-13 16:11 ` Julien Danjou
2010-08-13 15:57 ` Chong Yidong
2010-08-13 17:25 ` Ted Zlatanov
2010-08-14 0:15 ` Chong Yidong
2010-09-05 4:57 ` Ted Zlatanov
2010-09-05 8:06 ` Andreas Schwab
2010-09-05 22:47 ` Stefan Monnier
2010-09-06 7:47 ` Andreas Schwab
2010-09-06 14:31 ` Ted Zlatanov
2010-09-06 15:53 ` Andreas Schwab
2010-09-06 17:18 ` Andreas Schwab
2010-09-09 15:12 ` Ted Zlatanov
2010-09-09 22:00 ` Lars Magne Ingebrigtsen
2010-09-10 8:33 ` Andreas Schwab
2010-09-10 10:59 ` Lars Magne Ingebrigtsen
2010-09-10 14:06 ` Ted Zlatanov
2010-09-11 12:45 ` Stefan Monnier
2010-09-14 15:34 ` Ted Zlatanov
2010-09-06 21:00 ` Stefan Monnier
2010-09-06 23:13 ` Ted Zlatanov
2010-09-11 14:59 ` Ted Zlatanov
2010-09-11 15:00 ` Ted Zlatanov
2010-09-12 10:58 ` Stefan Monnier
2010-09-14 15:45 ` Ted Zlatanov
2010-09-13 7:49 ` Nikos Mavrogiannopoulos
2010-09-14 18:30 ` Ted Zlatanov
2010-09-14 18:55 ` Nikos Mavrogiannopoulos
2010-09-14 19:10 ` Lars Magne Ingebrigtsen
2010-09-15 11:20 ` Ted Zlatanov
2010-09-15 1:25 ` Ted Zlatanov
2010-09-15 11:01 ` Ted Zlatanov
2010-09-15 12:13 ` Nikos Mavrogiannopoulos
2010-09-15 15:40 ` Ted Zlatanov
2010-09-26 6:09 ` Ted Zlatanov
2010-09-26 15:32 ` Lars Magne Ingebrigtsen
2010-09-26 21:50 ` James Cloos
2010-09-27 13:37 ` Lars Magne Ingebrigtsen
2010-09-27 13:56 ` Lars Magne Ingebrigtsen
2010-09-27 14:03 ` Lars Magne Ingebrigtsen
2010-09-27 14:11 ` Lars Magne Ingebrigtsen
2010-09-27 14:21 ` Lars Magne Ingebrigtsen
2010-09-27 14:40 ` Lars Magne Ingebrigtsen
2010-09-27 14:56 ` Ted Zlatanov
2010-09-27 15:13 ` Lars Magne Ingebrigtsen
2010-09-27 15:02 ` Bruce Stephens
2010-09-27 15:07 ` Lars Magne Ingebrigtsen
2010-09-27 15:18 ` Lars Magne Ingebrigtsen
2010-09-27 15:11 ` Ted Zlatanov
2010-09-27 15:14 ` Lars Magne Ingebrigtsen
2010-09-27 14:42 ` Ted Zlatanov
2010-09-29 12:53 ` Lars Magne Ingebrigtsen
2010-09-29 13:25 ` Lars Magne Ingebrigtsen
2010-09-29 18:36 ` Jason Earl
2010-09-29 20:05 ` Ted Zlatanov
2010-09-29 20:32 ` Jason Earl
2010-09-29 20:35 ` Lars Magne Ingebrigtsen
2010-09-29 21:33 ` Jason Earl
2010-09-29 17:06 ` Ted Zlatanov
2010-09-29 17:44 ` Ted Zlatanov
2010-09-29 18:43 ` Lars Magne Ingebrigtsen
2010-09-29 18:43 ` Lars Magne Ingebrigtsen
2010-10-03 14:21 ` Ted Zlatanov
2010-10-03 14:48 ` Ted Zlatanov
2010-10-03 22:37 ` Lars Magne Ingebrigtsen
2010-10-04 1:23 ` final GnuTLS API! (was: Emacs core TLS support) Ted Zlatanov
2010-10-04 10:49 ` final GnuTLS API! Lars Magne Ingebrigtsen
2010-10-04 14:44 ` Ted Zlatanov
2010-09-27 14:36 ` Emacs core TLS support Ted Zlatanov
2010-09-27 18:25 ` James Cloos
2010-09-27 18:45 ` Ted Zlatanov
2010-09-27 19:07 ` Lars Magne Ingebrigtsen
2010-09-27 19:38 ` Lars Magne Ingebrigtsen
2010-09-21 11:37 ` Simon Josefsson
2010-09-26 6:12 ` Ted Zlatanov [this message]
2010-09-30 10:10 ` Simon Josefsson
2010-10-04 3:42 ` Ted Zlatanov
2010-10-04 6:24 ` Nikos Mavrogiannopoulos
2010-08-13 13:54 ` Leo
2010-08-13 14:50 ` Ted Zlatanov
2010-08-14 19:20 ` Leo
-- strict thread matches above, loose matches on Subject: below --
2010-01-14 1:37 MON KEY
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87k4m92fuq.fsf@lifelogs.com \
--to=tzz@lifelogs.com \
--cc=emacs-devel@gnu.org \
--cc=gnutls-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.