From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.emacs.gnus.general/74412 Path: news.gmane.org!not-for-mail From: Ted Zlatanov Newsgroups: gmane.emacs.gnus.general,gmane.emacs.devel Subject: Re: gnutls status Date: Fri, 26 Nov 2010 06:13:00 -0600 Organization: =?utf-8?B?0KLQtdC+0LTQvtGAINCX0LvQsNGC0LDQvdC+0LI=?= @ Cienfuegos Message-ID: <87ipzkmgfn.fsf@lifelogs.com> References: NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: dough.gmane.org 1290773620 16759 80.91.229.12 (26 Nov 2010 12:13:40 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Fri, 26 Nov 2010 12:13:40 +0000 (UTC) Cc: emacs-devel@gnu.org To: ding@gnus.org Original-X-From: ding-owner+M22776@lists.math.uh.edu Fri Nov 26 13:13:32 2010 Return-path: Envelope-to: ding-account@gmane.org Original-Received: from util0.math.uh.edu ([129.7.128.18]) by lo.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1PLxBE-0001Ez-9o for ding-account@gmane.org; Fri, 26 Nov 2010 13:13:32 +0100 Original-Received: from localhost ([127.0.0.1] helo=lists.math.uh.edu) by util0.math.uh.edu with smtp (Exim 4.63) (envelope-from ) id 1PLxB1-0006gi-LH; Fri, 26 Nov 2010 06:13:19 -0600 Original-Received: from mx2.math.uh.edu ([129.7.128.33]) by util0.math.uh.edu with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1PLxB0-0006ga-Ev for ding@lists.math.uh.edu; Fri, 26 Nov 2010 06:13:18 -0600 Original-Received: from quimby.gnus.org ([80.91.231.51]) by mx2.math.uh.edu with esmtp (Exim 4.72) (envelope-from ) id 1PLxAv-0000OQ-O6 for ding@lists.math.uh.edu; Fri, 26 Nov 2010 06:13:17 -0600 Original-Received: from lo.gmane.org ([80.91.229.12]) by quimby.gnus.org with esmtp (Exim 3.36 #1 (Debian)) id 1PLxAv-0008Ec-00 for ; Fri, 26 Nov 2010 13:13:13 +0100 Original-Received: from list by lo.gmane.org with local (Exim 4.69) (envelope-from ) id 1PLxAu-000155-9y for ding@gnus.org; Fri, 26 Nov 2010 13:13:12 +0100 Original-Received: from c-24-14-16-248.hsd1.il.comcast.net ([24.14.16.248]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Fri, 26 Nov 2010 13:13:12 +0100 Original-Received: from tzz by c-24-14-16-248.hsd1.il.comcast.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Fri, 26 Nov 2010 13:13:12 +0100 X-Injected-Via-Gmane: http://gmane.org/ Original-Lines: 87 Original-X-Complaints-To: usenet@dough.gmane.org X-Gmane-NNTP-Posting-Host: c-24-14-16-248.hsd1.il.comcast.net X-Face: bd.DQ~'29fIs`T_%O%C\g%6jW)yi[zuz6;d4V0`@y-~$#3P_Ng{@m+e4o<4P'#(_GJQ%TT= D}[Ep*b!\e,fBZ'j_+#"Ps?s2!4H2-Y"sx" User-Agent: Gnus/5.110011 (No Gnus v0.11) Emacs/24.0.50 (gnu/linux) Cancel-Lock: sha1:q9pG4jinY0YVzs8vlIp0eaWqjKo= X-Spam-Score: -1.9 (-) List-ID: Precedence: bulk Xref: news.gmane.org gmane.emacs.gnus.general:74412 gmane.emacs.devel:133159 Archived-At: On Fri, 26 Nov 2010 01:28:46 +0100 Lars Magne Ingebrigtsen wrote: LMI> Julien Danjou writes: >> gnutls support has been added to Emacs 24. What's the status of it? LMI> It seems to work. It's missing some features. See http://thread.gmane.org/gmane.emacs.devel/131441/focus=131551 and the rest of that thread for the details. The biggest one is callbacks. We need callbacks to implement host name verification and certificate chain checking, which are both IMO essential to making the Emacs GnuTLS support "official." In GnuTLS 2.8.x you can't set a callback function, so the C code would need (from doc/examples/ex-rfc2818.c): if (gnutls_x509_crt_get_expiration_time (cert) < time (0)) { printf ("The certificate has expired\n"); return; } if (gnutls_x509_crt_get_activation_time (cert) > time (0)) { printf ("The certificate is not yet activated\n"); return; } if (!gnutls_x509_crt_check_hostname (cert, hostname)) { printf ("The certificate's owner does not match hostname '%s'\n", hostname); return; } which is very inflexible compared to a callback function. We'd need to add custom API options for each of the three checks above plus another for the certificate chain verification; in addition it would be harder to interact with the user and store trusted certificates from C. 2.10.x and above let us set a callback function, which would make all of the above easier and more convenient from ELisp-land. The problem is that 2.10.x hasn't been widely adopted in Debian and thus won't work by default. So we'd need to either 1) require 2.10.x, or 2) complicate the C code and API using just 2.8.x features and maybe figure out how to set up our own callback mechanism, or 3) use the 2.10.x features only when it's available, using autoconf detection, which is twice as complicated as (2). (2) and (3) will require a lot of new code that is completely unnecessary under 2.10.x. This is essentially why I haven't worked on the GnuTLS support in a bit: I don't know the best way forward. If anyone can suggest a good way to do it, I'm all ears. I also don't know about 2.10.x's status in the major distros and whether Emacs can require that version or higher specifically. >> Could we use it in Gnus? Or is this still an Emacs side problem to >> resolve? LMI> nnimap has support for using it, but it's probably the wrong place to LMI> put the support. It should be put into tls.el, probably, so that all LMI> the users don't have to know about the stuff... I think every package should explicitly choose to support gnutls.el, it shouldn't be an Emacs-wide choice. There's too many configuration options that depend on the purpose. For instance IMAP and HTTPS have really different security needs. Also, GnuTLS is much more configurable than the older command-line interfaces so normalizing the API is not so easy. This is why I removed the old tls.el compatibility code from gnutls.el and it only has gnutls-* functions now (`open-gnutls-stream' and `gnutls-negotiate' being the main entry points from the ELisp side, while `gnutls-boot' is the main entry point from the C side). IMO tls.el and friends should be made deprecated as soon as gnutls.el is capable to verify a certificate chain, the expiration date, and the hostname. They are insecure and the cause of many bug reports over the years, especially on the W32 platform. As with the C issues above, if you have opinions or suggestions on how to do all this better, including Gnus but also for Emacs in general, tell me. I'm CC-ing to emacs-devel as well. Ted