From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.emacs.gnus.general/65774 Path: news.gmane.org!not-for-mail From: Reiner Steib Newsgroups: gmane.emacs.devel,gmane.emacs.gnus.general Subject: Re: [Patch] Make tls.el support certificate verification Date: Sun, 25 Nov 2007 15:18:31 +0100 Message-ID: References: <877imqtdhb.fsf@denkblock.local> <87zlzc35bh.fsf@mocca.josefsson.org> <87ps063ixd.fsf@mocca.josefsson.org> <87zlxo4lwr.fsf@denkblock.local> <87d4uaksur.fsf@denkblock.local> <877ikhlrgs.fsf@denkblock.local> <87r6iff9hf.fsf@denkblock.local> Reply-To: Reiner Steib NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1196000376 25951 80.91.229.12 (25 Nov 2007 14:19:36 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sun, 25 Nov 2007 14:19:36 +0000 (UTC) Cc: Simon Josefsson , ding@gnus.org, emacs-devel@gnu.org To: Elias Oltmanns Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Sun Nov 25 15:19:42 2007 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([199.232.76.165]) by lo.gmane.org with esmtp (Exim 4.50) id 1IwIKj-0004za-17 for ged-emacs-devel@m.gmane.org; Sun, 25 Nov 2007 15:19:41 +0100 Original-Received: from localhost ([127.0.0.1] helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1IwIKT-0000z7-OP for ged-emacs-devel@m.gmane.org; Sun, 25 Nov 2007 09:19:25 -0500 Original-Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1IwIKQ-0000yf-FE for emacs-devel@gnu.org; Sun, 25 Nov 2007 09:19:22 -0500 Original-Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1IwIKP-0000y9-7N for emacs-devel@gnu.org; Sun, 25 Nov 2007 09:19:21 -0500 Original-Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1IwIKO-0000xq-Sr for emacs-devel@gnu.org; Sun, 25 Nov 2007 09:19:21 -0500 Original-Received: from mail.uni-ulm.de ([134.60.1.11]) by monty-python.gnu.org with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1IwIKN-0001wZ-To for emacs-devel@gnu.org; Sun, 25 Nov 2007 09:19:20 -0500 Original-Received: from bridgekeeper.physik.uni-ulm.de (bridgekeeper.physik.uni-ulm.de [134.60.41.37]) by mail.uni-ulm.de (8.14.1/8.14.1) with ESMTP id lAPEItT7015861; Sun, 25 Nov 2007 15:18:57 +0100 (MET) Original-Received: from localhost (bridgekeeper.physik.uni-ulm.de [134.60.41.37]) by bridgekeeper.physik.uni-ulm.de (Postfix) with ESMTP id C21EA1C4D6; Sun, 25 Nov 2007 15:18:55 +0100 (CET) X-Face: .*T0'iU(sujq_j9\J>-d4fg; N/1++U#U$_5ii6k.=|"-n'?5O:Hyz&wi'-!I~,}7~GgT=0S /&-R5sbkNy5+Xo1y{Tw2KKxi@Xh"g@]Qc|.U<*]WDd)qvGowFDvfU1F]{EDho:7P0@|oOD=Bc{K4?> WP68K[Mx:}=`ZT'6g4'f+g?;`vri2!)xGy}3:=l'(/Cea0l4lo^H5#@/Z3ev Mail-Followup-To: Elias Oltmanns , emacs-devel@gnu.org, ding@gnus.org, Simon Josefsson In-Reply-To: <87r6iff9hf.fsf@denkblock.local> (Elias Oltmanns's message of "Sun, 25 Nov 2007 01:35:08 +0100") User-Agent: Gnus/5.110007 (No Gnus v0.7) Emacs/22.1.50 (gnu/linux) X-DCC-URT-Metrics: poseidon 1060; Body=4 Fuz1=4 Fuz2=4 X-Virus-Scanned: by amavisd-new X-detected-kernel: by monty-python.gnu.org: Genre and OS details not recognized. X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:84112 gmane.emacs.gnus.general:65774 Archived-At: On Sun, Nov 25 2007, Elias Oltmanns wrote: > Reiner Steib wrote: >> See http://article.gmane.org/gmane.emacs.gnus.commits/5529 for my >> cosmetic/style changes. > > Unfortunately, this link seems to be a dead end. The web interface has some problems at the moment. I'm sure it will work again soon (i.e. when Lars fixes the problem). In Gnus you may use these , (cf. `gnus-refer-article-method'). >> Would it be useful to add the strings suggested in the doc string of >> `tls-checktrust' to `tls-program'? Or provide them as custom options >> for `tls-program'? > > Well, I wasn't quite sure about it at the time and I'm not any wiser > yet. I'm using the examples given in the doc string in a Debian > environment but they need not work properly for other distributions or > OSes. On openSUSE, I have the directory, but no file ca-certificates.crt: $ cat /etc/SuSE-release openSUSE 10.2 (i586) VERSION = 10.2 $ ls -F /etc/ssl/certs/ 1e49180d.0@ 843b6c51.0@ d4e39186.0@ Equifax-root1.pem vsign1.pem 2edf7016.0@ 878cf4c6.0@ ddc328ff.0@ expired/ vsign3.pem 56e607f4.0@ a3c60019.0@ demo/ f73e89fd.0@ vsignss.pem 594f1775.0@ aad3d04d.0@ eng1.pem ICP-Brasil.pem wellsfgo.pem 6adf0799.0@ argena.pem eng2.pem RegTP-5R.pem 6f5d9899.0@ argeng.pem eng3.pem RegTP-6R.pem 7651b327.0@ c33a80d4.0@ eng4.pem thawteCb.pem 7a9820c1.0@ cdd7aee7.0@ eng5.pem thawteCp.pem > In fact, I think it is so hard to come up with sensible default > values that are actually worth making the effort that the best GNU > developers can do is to provide the facilities and sufficient > documentation to make use of them. Distributors may or may not > tweak the default settings and give further advice to their users > but even they shouldn't enable tls-checktrust by default as this > really should be a decision consciously taken by the end user. I think it makes sense to add them as customize choices (committed to Gnus trunk): ;; FIXME: add brief `:tag "..."' descriptions. ;; See `tls-checktrust': (const "gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p %p %h") (const "gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p %p %h --protocols ssl3") (const "openssl s_client -connect %h:%p -CAfile /etc/ssl/certs/ca-certificates.crt -no_ssl2") ;; No trust check: (const "gnutls-cli -p %p %h") (const "gnutls-cli -p %p %h --protocols ssl3") (const "openssl s_client -connect %h:%p -no_ssl2")) Is this the right order? Would someone like to add brief `:tag "..."' descriptions for each entry? > After all, the mail server needn't have a certificate signed by one > of the well known CAs and may still be valid. Besides, users might > want to specify the set of trusted root certificates depending on > the server emacs is connecting to. All this seems to make proper > documentation more important than presetting any defaults. Do you > think the provided doc strings can serve this purpose or should I > squeeze in a few sentences somewhere else? As tls.el is not specific to Gnus (it is in lisp/net in Emacs 22), it should probably not be documented in gnus.texi, maybe in smtpmail.texi, e.g. (info "(smtpmail)Authentication"). If there's no suitable manual, probably the best places are the doc strings of `tls-program' and/or `tls-checktrust'. Simon, any suggestion? Opinions? Bye, Reiner. -- ,,, (o o) ---ooO-(_)-Ooo--- | PGP key available | http://rsteib.home.pages.de/