Re: Builtin GnuTLS support and certificate verification

[Vincent Bernat <bernat@luffy.cx>]

 ❦  3 novembre 2013 12:53 CET, Ted Zlatanov <tzz@lifelogs.com> :

> `verify-error', however, is missing from the docstring of
> gnutls.c:gnutls-boot and there's just a commented-out line in the
> function:
>
>   /* Lisp_Object verify_error; */
>
> and the verification code, as you observed, does all the peer
> verification based on `verify-hostname-error'.  I think this is my
> error; this code:
>
>   if (peer_verification != 0)
>     {
>       if (NILP (verify_hostname_error))
> 	GNUTLS_LOG2 (1, max_log_level, "certificate validation failed:",
> 		     c_hostname);
>       else
> 	{
> 	  emacs_gnutls_deinit (proc);
> 	  error ("Certificate validation failed %s, verification code %d",
> 		 c_hostname, peer_verification);
> 	}
>     }
>
> should have been using `verify_error' instead.
>
> Could you double-check my investigation and confirm?  If you agree, I
> will make the change and update the bug report.

I agree with you but I find odd to have two verification algorithms. I
don't see the point of verifying the hostname if the certificate is
invalid on some other points and I don't see the point of not verifying
the hostname.

I mean, if you accept any valid certificate, it is trivial for me to
present you with the certificate of my website. If you accept any
invalid certificate with the right hostname, it is also trivial for me
to build a self-signed certificate with the right hostname.

Now, if `:trustfiles` is set to a non standard location, the first case
may makes sense: I don't check the hostname but the certificate should
only be valid if signed by some other certificate that I specify
exactly. However, in which case could this be useful? Either you have
signed yourself the certificate and it is trivial to set the appropriate
name or you bought it and I could buy a certificate from the same shop
with another name.

So, for me, there should be only one verification algorithm. We are not
in the ideal case for this because we only have one algorithm but its
name does not exactly describe it.

Maybe you could just alias verify-error and verify-hostname-error and
say in the documentation that they do the same and that
verify-hostname-error will be removed at some point?
-- 
printk("Illegal format on cdrom.  Pester manufacturer.\n"); 
	2.2.16 /usr/src/linux/fs/isofs/inode.c