From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Moritz Ulrich Newsgroups: gmane.emacs.bugs Subject: bug#13877: 24.3; gnutls.el: Enable Certificate Checks Date: Tue, 05 Mar 2013 11:40:09 +0100 Message-ID: NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1362502010 15944 80.91.229.3 (5 Mar 2013 16:46:50 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Tue, 5 Mar 2013 16:46:50 +0000 (UTC) To: 13877@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Tue Mar 05 17:47:13 2013 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1UCv1E-0002Vn-UI for geb-bug-gnu-emacs@m.gmane.org; Tue, 05 Mar 2013 17:47:13 +0100 Original-Received: from localhost ([::1]:48846 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UCv0t-0004dw-Bs for geb-bug-gnu-emacs@m.gmane.org; Tue, 05 Mar 2013 11:46:51 -0500 Original-Received: from eggs.gnu.org ([208.118.235.92]:52317) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UCv0o-0004bv-OO for bug-gnu-emacs@gnu.org; Tue, 05 Mar 2013 11:46:49 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UCv0l-0001VL-01 for bug-gnu-emacs@gnu.org; Tue, 05 Mar 2013 11:46:46 -0500 Original-Received: from debbugs.gnu.org ([140.186.70.43]:56772) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UCv0k-0001VH-TZ for bug-gnu-emacs@gnu.org; Tue, 05 Mar 2013 11:46:42 -0500 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.72) (envelope-from ) id 1UCv15-0004xC-Lp for bug-gnu-emacs@gnu.org; Tue, 05 Mar 2013 11:47:03 -0500 X-Loop: help-debbugs@gnu.org Resent-From: Moritz Ulrich Original-Sender: debbugs-submit-bounces@debbugs.gnu.org Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Tue, 05 Mar 2013 16:47:03 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 13877 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: X-Debbugs-Original-To: bug-gnu-emacs@gnu.org Original-Received: via spool by submit@debbugs.gnu.org id=B.136250200419001 (code B ref -1); Tue, 05 Mar 2013 16:47:03 +0000 Original-Received: (at submit) by debbugs.gnu.org; 5 Mar 2013 16:46:44 +0000 Original-Received: from localhost ([127.0.0.1]:60879 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.72) (envelope-from ) id 1UCv0i-0004wM-Qk for submit@debbugs.gnu.org; Tue, 05 Mar 2013 11:46:44 -0500 Original-Received: from eggs.gnu.org ([208.118.235.92]:36985) by debbugs.gnu.org with esmtp (Exim 4.72) (envelope-from ) id 1UCpIY-0002qo-LG for submit@debbugs.gnu.org; Tue, 05 Mar 2013 05:40:44 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UCpI9-0004HM-4J for submit@debbugs.gnu.org; Tue, 05 Mar 2013 05:40:18 -0500 Original-Received: from lists.gnu.org ([208.118.235.17]:36592) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UCpI9-0004HI-22 for submit@debbugs.gnu.org; Tue, 05 Mar 2013 05:40:17 -0500 Original-Received: from eggs.gnu.org ([208.118.235.92]:48343) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UCpI7-0004TX-Vn for bug-gnu-emacs@gnu.org; Tue, 05 Mar 2013 05:40:16 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UCpI6-0004G7-Ot for bug-gnu-emacs@gnu.org; Tue, 05 Mar 2013 05:40:15 -0500 Original-Received: from mail-wg0-f53.google.com ([74.125.82.53]:56983) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UCpI6-0004Fy-JB for bug-gnu-emacs@gnu.org; Tue, 05 Mar 2013 05:40:14 -0500 Original-Received: by mail-wg0-f53.google.com with SMTP id fn15so5593391wgb.32 for ; Tue, 05 Mar 2013 02:40:13 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:from:to:subject:user-agent:date:message-id:mime-version :content-type:x-gm-message-state; bh=DiJ1UCA48Hrn92o/iLmDmhOVfhL3lisoZYc6EnL5zMs=; b=o4JQ0KbU8kuCYyo5u5y5rUKsThXnibO1xgfHIwPdFr8Lomg8kjyqweNkFLQ65I0uLA kAUmpumYeXBk11lPt4B3OgQWpTWf3AkDB9Vy7vERvUyez9Wyfy7/7CXIJZm4RRZ4YZna LuJnZlG+zrpyOOsXUmvtBZEkP4ecvDoU8dCAxhv1xadLUV5maoqMzE9yzUi7bfviA3LW FGp6euy0ml19MC+m7b3Q7UyF5ORAXmhJXfQTZhK3NdXssZxqbB+IzOXb4l4KJ6kAG8lT lkD3VuyD9XKN/0DLpCUYFAe/T4K5I5ko2GwojNR+TajHf4gh8SV60ZOGdXWE22vCGGus P3Yg== X-Received: by 10.205.139.71 with SMTP id iv7mr9015948bkc.86.1362480013118; Tue, 05 Mar 2013 02:40:13 -0800 (PST) Original-Received: from Moritzs-MacBook-Air (pd956ba09.dip0.t-ipconnect.de. [217.86.186.9]) by mx.google.com with ESMTPS id g28sm6859705bkv.17.2013.03.05.02.40.11 (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Tue, 05 Mar 2013 02:40:12 -0800 (PST) User-agent: mu4e 0.9.9; emacs 24.3.1 X-Gm-Message-State: ALoCoQk3ERlHHjAG5jBCw7JGFwwZUoy4ebdMvYcw7lppbXSn/ECGAnjXFRawAkcELOCBpGiSGE5Y X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Mailman-Approved-At: Tue, 05 Mar 2013 11:46:39 -0500 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.13 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:72112 Archived-At: Currently, gnutls.el doesn't check certificate signatures when used via `open-network-stream' with :type 'tls or `open-gnutls-stream'. This is caused by the following code from `open-gnutls-stream' (gnutls.el:110): --8<---------------cut here---------------start------------->8--- (gnutls-negotiate :process (open-network-stream name buffer host service) :type 'gnutls-x509pki :hostname host) --8<---------------cut here---------------end--------------->8--- There is NO way to set :verify-host, :verify-flags, etc. for this call to `gnutls-negotiate' when using gnutls via high-level functions like `open-network-stream'. I consider this a bug, as Emacs won't check any certificates and therefore allow man in the middle attacks without even documenting this. It should at least be possible to pass :verify-* from `open-network-stream' down to `gnutls-negotiate'. That would be a simple yet effective solution. In GNU Emacs 24.3.1 (x86_64-apple-darwin11.4.2, NS apple-appkit-1138.51) of 2013-03-05 on Moritzs-MacBook-Air Windowing system distributor `Apple', version 10.3.1138 Configured using: `configure '--prefix=/usr/local/Cellar/emacs/24.3-rc1' '--without-dbus' '--enable-locallisppath=/usr/local/share/emacs/site-lisp' '--infodir=/usr/local/Cellar/emacs/24.3-rc1/share/info/emacs' '--with-ns' '--disable-ns-self-contained' '--with-gnutls' '--with-jpeg' '--with-xml2' '--with-imagemagick' 'CC=cc'' <#secure method=pgpmime mode=sign> -- Moritz Ulrich