Re: Builtin GnuTLS support and certificate verification

[Vincent Bernat <bernat@luffy.cx>]

 ❦ 11 novembre 2013 16:45 CET, Ted Zlatanov <tzz@lifelogs.com> :

> VB> But I suppose you would have to implement a "confirm on error"
> VB> option. I cannot propose myself to implement that since I have
> VB> absolutely no clue on how Emacs Lisp interface with C.
>
> I'm interested in your opinion.  How would you expect Emacs (on the
> GnuTLS C level or on the Gnus level) to handle these cases, and how
> would you control them with customizable variables?
>
> - expired cert
> - hostname mismatch
> - self-signed cert, first time seen
> - cert mismatch
>
> In general we have the problem of asking questions in the middle of
> establishing a network connection.  This is not easy with Emacs, whose
> interactive ELisp layer is too complicated to be reliably called from
> the C layer.  So all of the above have to work without user
> interaction.

Not being able to interact with the user is not a big problem I think:
we can still output messages to tell her what to do, right?

By default, I would see that all checks are enabled by default: the
certificate has not expired, the hostname matches and the certificate is
signed by a known authority (certificates in `gnutls-trustfiles`).

When something goes wrong, we get a buffer with the certificate in
"clear text" (like openssl x509 -in ... -noout -text). If needed, this
is something that I can dig and provide C code for GNU TLS. This output
contains the certificate fingerprint.

A user has the possibility to whitelist the fingerprint and bypass any
test. We should have both `gnutls-whitelist-certificates` variable and
an option to override this whitelist when using gnutls-negotiate. The
rationale is that we can't expect all gnutls-negotiate users to
implement whitelisting.

I think that whitelisting by fingerprint is an improvement over what is
currently done by browsers which whitelist a whole domain without
pinning the certificate.

In the same way as for whitelisting, default verification options should
be a variable with possibility to override it by using the appropriate
option of `gnutls-negotiate`.

Verification options could be:

 - `expired-certificate`
 - `revoked-certificate`
 - `untrusted-certificate`
 - `hostname-mismatch`
-- 
Let the machine do the dirty work.
            - The Elements of Programming Style (Kernighan & Plauger)