Subject: bug#13877: closed (Re: bug#15792: 24.3; Builtin TLS support should enable certificate verification support by default)

From: [email-masked] (GNU bug Tracking System)
Date: Sat, 02 Nov 2013 21:08:03 +0000

Your bug report

#15792: 24.3; gnutls.el: Enable Certificate Checks

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
15792: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=15792
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#15792: 24.3; Builtin TLS support should enable certificate verification support by default
From: Vincent Bernat <[email-masked]>
To: Glenn Morris <[email-masked]>
Cc: [email-masked]
Date: Sat, 02 Nov 2013 22:07:16 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

 ❦  2 novembre 2013 19:48 CET, Glenn Morris <[email-masked]> :

> See http://debbugs.gnu.org/13374 and related discussion.

Thanks! Sorry for the duplicate, I didn't find this bug report.
-- 
printk("??? No FDIV bug? Lucky you...\n");
	2.2.16 /usr/src/linux/include/asm-i386/bugs.h

Subject: 24.3; gnutls.el: Enable Certificate Checks
From: Moritz Ulrich <[email-masked]>
To: [email-masked]
Date: Tue, 05 Mar 2013 11:40:09 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

Currently, gnutls.el doesn't check certificate signatures when used via
`open-network-stream' with :type 'tls or `open-gnutls-stream'.

This is caused by the following code from `open-gnutls-stream'
(gnutls.el:110):

--8<---------------cut here---------------start------------->8---
(gnutls-negotiate :process (open-network-stream name buffer host service)
                  :type 'gnutls-x509pki
                  :hostname host)
--8<---------------cut here---------------end--------------->8---

There is NO way to set :verify-host, :verify-flags, etc. for this call
to `gnutls-negotiate' when using gnutls via high-level functions like
`open-network-stream'.

I consider this a bug, as Emacs won't check any certificates and
therefore allow man in the middle attacks without even documenting this.

It should at least be possible to pass :verify-* from
`open-network-stream' down to `gnutls-negotiate'. That would be a simple
yet effective solution.

In GNU Emacs 24.3.1 (x86_64-apple-darwin11.4.2, NS apple-appkit-1138.51)
 of 2013-03-05 on Moritzs-MacBook-Air
Windowing system distributor `Apple', version 10.3.1138
Configured using:
 `configure '--prefix=/usr/local/Cellar/emacs/24.3-rc1' '--without-dbus'
 '--enable-locallisppath=/usr/local/share/emacs/site-lisp'
 '--infodir=/usr/local/Cellar/emacs/24.3-rc1/share/info/emacs'
 '--with-ns' '--disable-ns-self-contained' '--with-gnutls' '--with-jpeg'
 '--with-xml2' '--with-imagemagick' 'CC=cc''

<#secure method=pgpmime mode=sign>

-- 
Moritz Ulrich