[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH RFC] GnuTLS: Support TOFU certificate checking.

From: Eli Zaretskii
Subject: Re: [PATCH RFC] GnuTLS: Support TOFU certificate checking.
Date: Wed, 08 Oct 2014 16:03:48 +0300

> From: Lars Magne Ingebrigtsen <address@hidden>
> Cc: address@hidden,  address@hidden,  address@hidden
> Date: Wed, 08 Oct 2014 14:56:42 +0200
> Eli Zaretskii <address@hidden> writes:
> >> > Right, so (just to make sure I'm understanding you right), what you
> >> > propose is to get rid of all the current validation logic in C (i.e the
> >> > erroring out) and just return something like (<cert hash> <cert
> >> > hostname> <CA validity status>) -- and then make the lisp code work out
> >> > the rest?
> >> 
> >> Yup, I think that would be more flexible.
> >
> > I don't see how this could be done: the initialization of TLS network
> > stream creates a descriptor and adds it to the descriptors we watch in
> > wait_reading_process_output.  If that descriptor is invalid, we will
> > likely crash.
> It would still need to return a file descriptor, but would have extra
> accessors for accessing the certificate stuff.

How can it return a valid descriptor without all the validations it
does before that, which (AFAIU) you want to delegate to Lisp now?

Apologies if I misunderstand your plan.

reply via email to

[Prev in Thread] Current Thread [Next in Thread]