From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.emacs.gnus.general/67547 Path: news.gmane.org!not-for-mail From: arno@natisbad.org (Arnaud Ebalard) Newsgroups: gmane.emacs.gnus.general Subject: Re: Bug#499774: starttls is a joke Date: Wed, 08 Oct 2008 13:55:34 +0200 Message-ID: <87fxn7qp1l.fsf@natisbad.org> References: <871vzca7gp.fsf@natisbad.org> <87y71kpmq7.fsf@bubble.risko.hu> <87od2g31hf.fsf@natisbad.org> <87tzc8upgf.fsf@marauder.physik.uni-ulm.de> <87fxnsjfu3.fsf@mocca.josefsson.org> <87wsh4gjgi.fsf@natisbad.org> <87prmjjosn.fsf@mocca.josefsson.org> <87abdgt4dm.fsf@mocca.josefsson.org> <48EC8F3D.1080908@gmx.de> NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1223467118 1868 80.91.229.12 (8 Oct 2008 11:58:38 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Wed, 8 Oct 2008 11:58:38 +0000 (UTC) Cc: Simon Josefsson , Daiki Ueno , RISKO Gergely , ding@gnus.org To: Matthias Andree Original-X-From: ding-owner+M15998@lists.math.uh.edu Wed Oct 08 13:59:34 2008 Return-path: Envelope-to: ding-account@gmane.org Original-Received: from util0.math.uh.edu ([129.7.128.18]) by lo.gmane.org with esmtp (Exim 4.50) id 1KnXhT-0007nY-U5 for ding-account@gmane.org; Wed, 08 Oct 2008 13:59:32 +0200 Original-Received: from localhost ([127.0.0.1] helo=lists.math.uh.edu) by util0.math.uh.edu with smtp (Exim 4.63) (envelope-from ) id 1KnXfz-0003Xb-OC; Wed, 08 Oct 2008 06:57:59 -0500 Original-Received: from mx1.math.uh.edu ([129.7.128.32]) by util0.math.uh.edu with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1KnXfy-0003XE-6c for ding@lists.math.uh.edu; Wed, 08 Oct 2008 06:57:58 -0500 Original-Received: from quimby.gnus.org ([80.91.231.51]) by mx1.math.uh.edu with esmtp (Exim 4.69) (envelope-from ) id 1KnXft-0001jx-Ty for ding@lists.math.uh.edu; Wed, 08 Oct 2008 06:57:58 -0500 Original-Received: from moog.chdir.org ([88.191.42.160]) by quimby.gnus.org with esmtp (Exim 3.36 #1 (Debian)) id 1KnXfz-0006nX-00 for ; Wed, 08 Oct 2008 13:57:59 +0200 Original-Received: from [2001:7a8:78df:2:20d:93ff:fe55:8f78] (helo=localhost.localdomain) by moog.chdir.org with esmtpsa (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1KnXfN-00008u-2A; Wed, 08 Oct 2008 13:57:21 +0200 X-PGP-Key-URL: http://natisbad.org/arno@natisbad.org.asc X-Fingerprint: 47EB 85FE B99A AB85 FD09 46F3 0255 957C 047A 5026 X-Hashcash: 1:20:081008:risko@debian.org::PSJWn1E9q+TyLGZr:00pDp X-Hashcash: 1:20:081008:ding@gnus.org::NEAIfz3wE/u3rV40:00001ErT X-Hashcash: 1:20:081008:ueno@unixuser.org::hkY8/g/IWK93aVBN:000000000000000000000000000000000000000000002BeA X-Hashcash: 1:20:081008:matthias.andree@gmx.de::0fsY06G1fRcY6h+z:0000000000000000000000000000000000000003gNP X-Hashcash: 1:20:081008:simon@josefsson.org::dsAHMhaHEu2vk0LA:0000000000000000000000000000000000000000003mn2 In-Reply-To: <48EC8F3D.1080908@gmx.de> (Matthias Andree's message of "Wed, 08 Oct 2008 12:45:17 +0200") User-Agent: Gnus/5.110009 (No Gnus v0.9) Emacs/22.2 (gnu/linux) X-Spam-Score: -2.6 (--) List-ID: Precedence: bulk Xref: news.gmane.org gmane.emacs.gnus.general:67547 Archived-At: Hi, Matthias Andree writes: > Comments: > - the command line (l. 3) does not define trust anchors. > Particularly, there is no "--x509cafile /path/to/file.pem" option. > - gnutls-cli v2.4.1 figures that it doesn't trust the issuer, ll. 8 & 9. > - at that point in time, gnutls-cli should drop the connection. Instead, it > continues. > > Desired behaviour/Goals: > - gnutls-cli should drop the connect somewhen between lines 9 and 16, and > should NOT enter forwarding/simple client state. > - if clients want unsafe behaviour, they should be made to specify that in > some way, and the program defaults should be "safest possible" mode > - it may make sense that gnutls-cli doesn't even try to connect/handshake > if it has > * neither "trust anchors" such as the --x509cafile > * nor some --unsafely-skip-cert-validation command line option. > - man page, help output and manual should be consistent, example (2.4.1 > manpage of gnutls-cli): > > --x509cafile FILE > Certificate file to use. > > --x509certfile FILE > X.509 Certificate file to use. > > --x509fmtder > Use DER format for certificates > > --x509keyfile FILE > X.509 key file to use. > > This is pure crap^W^Wutterly unintelligible. What's the difference between > --x509cafile and --x509certfile? It should read something like > "--x509cafile: file that lists all Certification Authority (CA) > certificates that gnutls-cli is allowed to trust. If this option is > omitted, gnutls-cli will accept unsafe connections and trust any CA > certificate. For secure operation, be sure to specify this option." It would be better to have it fail when someone does not provide a set of trust anchors. Then adding something --verify-peer (is there something like that already?) with a default to "yes" that can be set to "no" or something else when someone _*explicitly*_ asks for an insecure behavior. I know for sure that GnuTLS internally support such a knob. > Further consideration: > - if the defaults are changed to "safe" mode, it may be sensible to rename > the tool to gnutls-safe-client or something better. Worst case scenario would that things would be safer. Cheers, a+