Re: Builtin GnuTLS support and certificate verification

[Katsumi Yamaoka <yamaoka@jpl.org>]

Ted Zlatanov wrote:
> I pushed this work to the Emacs trunk with the old behavior (connections
> never abort, just warn).  Please customize `gnutls-verify-error' to get
> the new behavior, erroring out on validation failures.  I encourage you
> to try it and report any issues.

One of my POP mail sources got to not work for today's Emacs build
from the trunk.

First, `mapcan' that `gnutls-negotiate' uses is a cl run-time
function, so I needed to load cl manually.

If `gnutls-verify-error' is nil, `mail-source-fetch-pop' fails
for the error: (wrong-type-argument listp nil)
This is what the built-in function `gnutls-boot' issues.
The arguments passed to it then are:
#<prosess POP>
gnutls-x509pki
(:priority "NORMAL" :hostname "my.pop.server" :loglevel 0
 :min-prime-bits 1024 :trustfiles ("/usr/ssl/certs/ca-bundle.crt")
 :crlfiles nil :keylist nil :verify-flags nil :verify-error nil
 :callbacks nil)

If I set `gnutls-verify-error' to t, `gnutls-boot' issues the error
(wrong-type-argument listp t) because :verify-error is t.

The mail-source for this case is:

(pop :server "my.pop.server"
     :user "User Name"
     :password "Password"
     :leave 7)

Server's response is:

+OK Dovecot ready.^M
+OK^M
CAPA^M
TOP^M
UIDL^M
RESP-CODES^M
PIPELINING^M
STLS^M
USER^M
SASL PLAIN LOGIN^M
.^M
+OK Begin TLS negotiation now.^M

And a workaround to make it work is:

(defadvice open-network-stream (before
				never-use-stls
				(name buffer host service &rest parameters)
				activate)
  "Never use starttls."
  (when (member name '("nntpd" "POP"))
    (setq parameters (copy-sequence parameters))
    (plist-put parameters :starttls-function nil)))

Thanks.