From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.emacs.gnus.general/74460 Path: news.gmane.org!not-for-mail From: Lars Magne Ingebrigtsen Newsgroups: gmane.emacs.gnus.general Subject: Automatic STARTTLS upgrades (was: gnutls status) Date: Sun, 28 Nov 2010 03:36:20 +0100 Organization: Programmerer Ingebrigtsen Message-ID: References: <87ipzkmgfn.fsf@lifelogs.com> NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: dough.gmane.org 1290911812 25443 80.91.229.12 (28 Nov 2010 02:36:52 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Sun, 28 Nov 2010 02:36:52 +0000 (UTC) To: ding@gnus.org Original-X-From: ding-owner+M22820@lists.math.uh.edu Sun Nov 28 03:36:45 2010 Return-path: Envelope-to: ding-account@gmane.org Original-Received: from util0.math.uh.edu ([129.7.128.18]) by lo.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1PMX89-0004cZ-4e for ding-account@gmane.org; Sun, 28 Nov 2010 03:36:45 +0100 Original-Received: from localhost ([127.0.0.1] helo=lists.math.uh.edu) by util0.math.uh.edu with smtp (Exim 4.63) (envelope-from ) id 1PMX81-0008Gt-LM; Sat, 27 Nov 2010 20:36:37 -0600 Original-Received: from mx2.math.uh.edu ([129.7.128.33]) by util0.math.uh.edu with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1PMX80-0008Gd-4B for ding@lists.math.uh.edu; Sat, 27 Nov 2010 20:36:36 -0600 Original-Received: from quimby.gnus.org ([80.91.231.51]) by mx2.math.uh.edu with esmtp (Exim 4.72) (envelope-from ) id 1PMX7v-0006IU-N0 for ding@lists.math.uh.edu; Sat, 27 Nov 2010 20:36:36 -0600 Original-Received: from lo.gmane.org ([80.91.229.12]) by quimby.gnus.org with esmtp (Exim 3.36 #1 (Debian)) id 1PMX7u-0002qJ-00 for ; Sun, 28 Nov 2010 03:36:30 +0100 Original-Received: from list by lo.gmane.org with local (Exim 4.69) (envelope-from ) id 1PMX7u-0004ZT-Mc for ding@gnus.org; Sun, 28 Nov 2010 03:36:30 +0100 Original-Received: from cm-84.215.34.171.getinternet.no ([84.215.34.171]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sun, 28 Nov 2010 03:36:30 +0100 Original-Received: from larsi by cm-84.215.34.171.getinternet.no with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sun, 28 Nov 2010 03:36:30 +0100 X-Injected-Via-Gmane: http://gmane.org/ Mail-Followup-To: ding@gnus.org Original-Lines: 51 Original-X-Complaints-To: usenet@dough.gmane.org X-Gmane-NNTP-Posting-Host: cm-84.215.34.171.getinternet.no Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAHlBMVEXr4d4hHR737Onz6OXD ubzc0tSTiYm7sLPx5ePMwsW6d0oIAAACKklEQVQ4jXXSMYvbMBQHcAWaq8dqOGUNMrQZg0VL1gOT kC2FCyFbzDVyujXgs/AmLm3ReuD00Le9957kOASqQIb38/+9J2P2vGLXZ7herfFs2S/GbiQc9hwL SS9kbNcVEvc/sIyBDVfDG8AlLFvFQAfwqIYy+3h/Gb6jwZYlxb1lw+ITVf2ZABZKEvfAE3bHd1T3 /hxaWevsAIqvfB/BA1joA4kBb/ScYBsSiXVwB+cGe85Hr/tQxwQUmTud3PQv5/ynj522CIk7qZmT BcCo9eGsKeGUchmBADj7OOM0UwgTjpA3IQHgoBH85BcEbq5AOQAlPxOU1dLHrWAjeD7rwORB2AEm zzKZpVfQUgLaKCllhNEFDnAHJYG+RaiqHLshnDICrWtdXAEGEAYd5HAIFAQyOQEoRCEW1VuAJyjK DOC7KDiAqdoIUFcI8DgM1ya/gEoxNC64RoBan0glgdCYaLZxq0ymeMHxke4hzLJpO8BOchoA3olZ xnUD2IcAusQrLgNIhLoHQ5AFYPMAAhYOIFPsJD/UUMO1dBlB0YjJnYaaxj8YH1pRp8mmFmVlNK9r HYECcvxYC5MvTGF6SAkWAFVuitLcJPJawAeSH3vIELJxOxeV9+1Rm274C8HU/wPYAsBWed/q5ev6 jRu/bo/iAtRK/mEbXi47iG+XYPrIdQMAL4s+E/YkaYadbrhofFuLDg74HaaZZW9c/PALfTUcpqfy 9x7ebrmsL/AOK90/qfg6iZ8AAAAASUVORK5CYII= Mail-Copies-To: never X-Now-Playing: David Sylvian's _Sleepwalkers_: "Money For All" User-Agent: Gnus/5.110011 (No Gnus v0.11) Emacs/24.0.50 (gnu/linux) Cancel-Lock: sha1:jFh9+XtjeYlX5q9VVS38bWZn0Tc= X-Spam-Score: -1.9 (-) List-ID: Precedence: bulk Xref: news.gmane.org gmane.emacs.gnus.general:74460 Archived-At: Lars Magne Ingebrigtsen writes: > What the hey. I've now altered NNTP to use proto-stream, and it'll > switch on STARTTLS now if the server supports it. But I'm wondering about the defaults a bit. This could be brittle and slow if things don't actually work. So let's take the worst-case scenarios: * First we open a normal network connection, and we say "CAPABILITY" in one way or another. This should be safe, but it's one extra round trip. * If the server says that it supports STARTTLS, we enable either: ** If Emacs has gnutls support, we just enable STARTTLS. One extra round trip. ** If Emacs doesn't, we sever the connection, and start it again with starttls.el, which defaults to gnutls-cli. This may fail because of a faulty gnutls-cli installation, in which case we error out. But it it's successful, then it's a close, an open, and an STARTTLS enablement. So that's at least a ... big handful of extra round trips. * We then do the TLS negotiation. This is at least one round trip, but it's probably more. It may fail for any number of reasons. For instance, inn may be compiled with TLS support, but not have the certificates. Or they may be grossly invalid. In that case, we error out. * On success, we do CAPABILITY again, since they have a tendency to change after STARTTLS in some protocols. * We're done! So, as you can see, this introduces many new, interesting failure modes, which have to be mitigated somehow. First of all, I've now switched off opportunistic STARTTLS upgrades if we don't have an Emacs with built-in gnutls support. Secondly, I think if the STARTTLS stuff fails for any reason, the connection should go back to being a plain network connection. Is that possible with the built-in gnutls stuff, Ted? Otherwise, proto-stream has to reopen the connection... -- (domestic pets only, the antidote for overdose, milk.) larsi@gnus.org * Lars Magne Ingebrigtsen