8:29 p.m.
I've been working on TLS support for a little while, and now have what
seems to be working nss, openssl, and gnutls lstream implementations.
The next challenge is making those available via the Emacs interface,
since that is what consuming packages expect. I thought I'd give you
a snapshot of what I've done so far (attached), just in case I get
abducted by aliens who need some operating system work done.
If you see anything that seems wrong or wrong-headed, let me know.
It's still early enough to change direction if I'm doing something
gratuitously stupid.
--
Jerry James
http://www.jamezone.org/
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
8:53 a.m.
This is great. (Somewhat belatedly - sorry ...)
I'm a little uncomfortable with SSL sitting so deep and pervasively
inside the lstream code, but I'd also have been surprised if it had been
possible to do it more modularly. The code is readable, so I'm not
worried.
What's the plan with this - GNU-compatible gnutls.el eventually?
My suggestion would be to push what you have, do enable further development.
--
Regards,
Mike
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
9:18 p.m.
On Fri, May 30, 2014 at 1:53 AM, Michael Sperber
<sperber(a)deinprogramm.de> wrote:
This is great. (Somewhat belatedly - sorry ...)
I'm a little uncomfortable with SSL sitting so deep and pervasively
inside the lstream code, but I'd also have been surprised if it had been
possible to do it more modularly. The code is readable, so I'm not
worried.
Yes, I don't see how to do it in a more modular fashion. I think this
approach is better than the one taken by the Emacs developers,
frankly.
What's the plan with this - GNU-compatible gnutls.el eventually?
Yes, eventually.
My suggestion would be to push what you have, do enable further
development.
I will soon. I think I have the Lisp side mostly worked out, except
for STARTTLS support. If I can't figure out how to do that soon, I
will submit what I have and keep working on STARTTLS afterwards.
--
Jerry James
http://www.jamezone.org/
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
9:38 a.m.
Jerry James <james(a)xemacs.org> writes:
> What's the plan with this - GNU-compatible gnutls.el
eventually?
Yes, eventually.
> My suggestion would be to push what you have, do enable further development.
I will soon. I think I have the Lisp side mostly worked out, except
for STARTTLS support. If I can't figure out how to do that soon, I
will submit what I have and keep working on STARTTLS afterwards.
Excellent!
--
Regards,
Mike
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
10:35 p.m.
On Sat, Jun 7, 2014 at 2:38 AM, Michael Sperber <sperber(a)deinprogramm.de> wrote:
Jerry James <james(a)xemacs.org> writes:
>> What's the plan with this - GNU-compatible gnutls.el eventually?
>
> Yes, eventually.
>
>> My suggestion would be to push what you have, do enable further development.
>
> I will soon. I think I have the Lisp side mostly worked out, except
> for STARTTLS support. If I can't figure out how to do that soon, I
> will submit what I have and keep working on STARTTLS afterwards.
Excellent!
A month goes by ....
Try this version. This has STARTTLS support, and more of the Lisp
bits. I'm sure there are still plenty of bugs, so please speak up if
something doesn't work right.
--
Jerry James
http://www.jamezone.org/
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
9:22 a.m.
Ar an t-ochtú lá de mí Iúil, scríobh Jerry James:
On Sat, Jun 7, 2014 at 2:38 AM, Michael Sperber
<sperber(a)deinprogramm.de> wrote:
>
> Jerry James <james(a)xemacs.org> writes:
>
>>> What's the plan with this - GNU-compatible gnutls.el eventually?
>>
>> Yes, eventually.
>>
>>> My suggestion would be to push what you have, do enable further
development.
>>
>> I will soon. I think I have the Lisp side mostly worked out, except
>> for STARTTLS support. If I can't figure out how to do that soon, I
>> will submit what I have and keep working on STARTTLS afterwards.
>
> Excellent!
A month goes by ....
Try this version. This has STARTTLS support, and more of the Lisp
bits. I'm sure there are still plenty of bugs, so please speak up if
something doesn't work right.
I get this error:
clang -c -Wall -Wno-switch -Wundef -Wsign-compare -Wno-char-subscripts -Wpacked
-Wpointer-arith -Wshadow -Wmissing-declarations -Wmissing-prototypes -Wstrict-prototypes
-Wdeclaration-after-statement -Wunused-parameter -g -O3 -fno-strict-aliasing
-I/opt/local/include -Demacs -I. -I/Sources/xemacs-21.5-jerry-tls/src -DHAVE_CONFIG_H
-I/opt/local/include -I/usr/X11R6/include -I/usr/X11/include lstream.c
In file included from lstream.c:31:
./tls.h:67:3: error: redefinition of typedef 'tls_state_t' is invalid in C
[-Wtypedef-redefinition]
} tls_state_t;
^
In file included from lstream.c:30:
./lstream.h:400:26: note: previous definition is here
typedef struct tls_state tls_state_t;
Easily fixed by removing the typedefs from tls.h and by #including
"lstream.h" in tls.c. Still looking at the rest!
--
‘Liston operated so fast that he once accidentally amputated an assistant’s
fingers along with a patient’s leg, […] The patient and the assistant both
died of sepsis, and a spectator reportedly died of shock, resulting in the
only known procedure with a 300% mortality.’ (Atul Gawande, NEJM, 2012)
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
3:29 p.m.
Ar an t-ochtú lá de mí Iúil, scríobh Jerry James:
[...] A month goes by ....
Try this version. This has STARTTLS support, and more of the Lisp
bits. I'm sure there are still plenty of bugs, so please speak up if
something doesn't work right.
Looks good with some superficial testing. I note that the print method for
Lisp level code doesn’t give any indication that the connection is encrypted:
(process-list)
=> (#<network connection "erc-irc.freenode.net-6697" (6697 .
"irc.freenode.net") state:run>) ;; where the connection *is* over SSL
The unix_process_data structure seems not to have any state associated with
TLS, but storing a flag somewhere and printing it would make debugging and
initial setup of one’s SSL configuration that bit easier.
--
‘Liston operated so fast that he once accidentally amputated an assistant’s
fingers along with a patient’s leg, […] The patient and the assistant both
died of sepsis, and a spectator reportedly died of shock, resulting in the
only known procedure with a 300% mortality.’ (Atul Gawande, NEJM, 2012)
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
4:41 p.m.
Ar an t-ochtú lá de mí Iúil, scríobh Jerry James:
>> I will soon. I think I have the Lisp side mostly worked
out, except
>> for STARTTLS support. If I can't figure out how to do that soon, I
>> will submit what I have and keep working on STARTTLS afterwards.
>
> Excellent!
A month goes by ....
Try this version.
Another thing is that usually in the XEmacs code, in situations like
unix_open_network_stream where the Lisp_Object tls is just used for its
booleanness, the C api uses an integer (say, a Boolint) for the boolean value,
converting when passing from Lisp like so:
PROCMETH (open_network_stream, (name, host, service, protocol,
&inch, &outch, !NILP (tls)));
This is cleaner for debugging problems with the garbage collector, since there
won’t be pointers hanging around to objects that are not necessarily garbage
protected. I don’t anticipate any problems with how you’ve written it, but
it’s better style not to pass the Lisp_Object itself on if it’s not being
used.
This has STARTTLS support, and more of the Lisp bits. I'm sure
there are
still plenty of bugs, so please speak up if something doesn't work right.
--
‘Liston operated so fast that he once accidentally amputated an assistant’s
fingers along with a patient’s leg, […] The patient and the assistant both
died of sepsis, and a spectator reportedly died of shock, resulting in the
only known procedure with a 300% mortality.’ (Atul Gawande, NEJM, 2012)
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
8:55 a.m.
>>>> Jerry James <james(a)xemacs.org> writes:
A month goes by ....
Another month or so goes by and I tried to build it on my old SuSE
still using openssl-0.9.8! This is what happens.
----------------------------------------------------------------------
make[1]: Entering directory `/src/xemacs/work/testing/src'
gcc -c -Wall -Wno-switch -Wundef -Wsign-compare -Wno-char-subscripts -Wpacked -Wshadow
-Wmissing-declarations -Wmissing-prototypes -Wstrict-prototypes
-Wdeclaration-after-statement -Wunused-parameter -g -Demacs -I.
-I/src/xemacs/work/testing/src -DHAVE_CONFIG_H -I/usr/include/freetype2 tls.c
tls.c: In function \u2018init_tls\u2019:
tls.c:1114: error: \u2018SSL_OP_NO_COMPRESSION\u2019 undeclared (first use in this
function)
tls.c:1114: error: (Each undeclared identifier is reported only once
tls.c:1114: error: for each function it appears in.)
tls.c:1117: error: \u2018SSL_MODE_RELEASE_BUFFERS\u2019 undeclared (first use in this
function)
make[1]: *** [tls.o] Error 1
make[1]: Leaving directory `/src/xemacs/work/testing/src'
----------------------------------------------------------------------
From searching the net I suspect this is because we are not compatible
with 0.9.8. What to do, disable tls if openssl is to old or make it
compatible? I'm in favor of the former.
Yours
--
%% Mats
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
10:30 p.m.
On Thu, Dec 11, 2014 at 1:55 AM, Mats Lidell <matsl(a)xemacs.org> wrote:
>>>>> Jerry James <james(a)xemacs.org> writes:
> A month goes by ....
Another month or so goes by and I tried to build it on my old SuSE
still using openssl-0.9.8! This is what happens.
----------------------------------------------------------------------
make[1]: Entering directory `/src/xemacs/work/testing/src'
gcc -c -Wall -Wno-switch -Wundef -Wsign-compare -Wno-char-subscripts -Wpacked -Wshadow
-Wmissing-declarations -Wmissing-prototypes -Wstrict-prototypes
-Wdeclaration-after-statement -Wunused-parameter -g -Demacs -I.
-I/src/xemacs/work/testing/src -DHAVE_CONFIG_H -I/usr/include/freetype2 tls.c
tls.c: In function \u2018init_tls\u2019:
tls.c:1114: error: \u2018SSL_OP_NO_COMPRESSION\u2019 undeclared (first use in this
function)
tls.c:1114: error: (Each undeclared identifier is reported only once
tls.c:1114: error: for each function it appears in.)
tls.c:1117: error: \u2018SSL_MODE_RELEASE_BUFFERS\u2019 undeclared (first use in this
function)
make[1]: *** [tls.o] Error 1
make[1]: Leaving directory `/src/xemacs/work/testing/src'
----------------------------------------------------------------------
From searching the net I suspect this is because we are not compatible
with 0.9.8. What to do, disable tls if openssl is to old or make it
compatible? I'm in favor of the former.
Me, too. The code would need some significant work to operate
properly with openssl < 1.0.0. Does this work for you?
diff -r bf1e13811159 configure.ac
--- a/configure.ac Fri Dec 19 15:01:46 2014 -0700
+++ b/configure.ac Fri Dec 19 15:28:55 2014 -0700
＠＠ -5344,7 +5344,14 ＠＠
[XE_DIE("Required NSS support cannot be provided.")])
elif test "$with_tls" = "openssl"; then
AC_CHECK_HEADER([openssl/ssl.h],
- [AC_CHECK_LIB(ssl, SSL_library_init, [with_tls=openssl],
+ [AC_CHECK_LIB(ssl, SSL_library_init,
+ [AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+#include <openssl/ssl.h>
+#if OPENSSL_VERSION_NUMBER < 0x1000000fL
+#error OpenSSL is too old to use
+#endif
+ ]])], [with_tls=openssl],
+ [XE_DIE("Required openssl support cannot be provided.")])],
[XE_DIE("Required openssl support cannot be provided.")])],
[XE_DIE("Required openssl support cannot be provided.")])
fi
＠＠ -5359,7 +5366,14 ＠＠
fi
if test "$with_tls" = "yes"; then
AC_CHECK_HEADER([openssl/ssl.h],
- [AC_CHECK_LIB(ssl, SSL_library_init, [with_tls=openssl], [with_tls=no])])
+ [AC_CHECK_LIB(ssl, SSL_library_init,
+ [AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+#include <openssl/ssl.h>
+#if OPENSSL_VERSION_NUMBER < 0x1000000fL
+#error OpenSSL is too old to use
+#endif
+ ]])], [with_tls=openssl], [with_tls=no])],
+ [with_tls=openssl], [with_tls=no])])
fi
if test "$with_tls" != "no"; then
AC_DEFINE(WITH_TLS)
Regards,
--
Jerry James
http://www.jamezone.org/
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
4:23 p.m.
On Fri, Dec 19, 2014 at 3:30 PM, Jerry James <james(a)xemacs.org> wrote:
On Thu, Dec 11, 2014 at 1:55 AM, Mats Lidell <matsl(a)xemacs.org>
wrote:
> Another month or so goes by and I tried to build it on my old SuSE
> still using openssl-0.9.8! This is what happens.
>
> ----------------------------------------------------------------------
> make[1]: Entering directory `/src/xemacs/work/testing/src'
> gcc -c -Wall -Wno-switch -Wundef -Wsign-compare -Wno-char-subscripts -Wpacked
-Wshadow -Wmissing-declarations -Wmissing-prototypes -Wstrict-prototypes
-Wdeclaration-after-statement -Wunused-parameter -g -Demacs -I.
-I/src/xemacs/work/testing/src -DHAVE_CONFIG_H -I/usr/include/freetype2 tls.c
> tls.c: In function \u2018init_tls\u2019:
> tls.c:1114: error: \u2018SSL_OP_NO_COMPRESSION\u2019 undeclared (first use in this
function)
> tls.c:1114: error: (Each undeclared identifier is reported only once
> tls.c:1114: error: for each function it appears in.)
> tls.c:1117: error: \u2018SSL_MODE_RELEASE_BUFFERS\u2019 undeclared (first use in this
function)
> make[1]: *** [tls.o] Error 1
> make[1]: Leaving directory `/src/xemacs/work/testing/src'
> ----------------------------------------------------------------------
>
> From searching the net I suspect this is because we are not compatible
> with 0.9.8. What to do, disable tls if openssl is to old or make it
> compatible? I'm in favor of the former.
Me, too. The code would need some significant work to operate
properly with openssl < 1.0.0. Does this work for you?
Any thoughts on this patch? Should I commit it?
--
Jerry James
http://www.jamezone.org/
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
5:41 p.m.
>>>> Jerry James <james(a)xemacs.org> writes:
Any thoughts on this patch? Should I commit it?
Sorry for late feedback again but I'm back at work now again after a
long Christmas vacation.
The patch seems to be good. If I specify with-tls=openssl I get a
message during configure that Required openssl support isn't
available. That is good. So please apply it.
What confuses the issue is that if I just say with-tls=yes I get
support for NSS(!) compiled in. This seems to work one machine but not
on another. I need to come back on the details here.
Yours
--
%% Mats
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
6:31 a.m.
>>>> Mats Lidell <matsl(a)xemacs.org> writes:
What confuses the issue is that if I just say with-tls=yes I get
support for NSS(!) compiled in. This seems to work one machine but
not on another. I need to come back on the details here.
Testing on the "another" SuSE machine I get the proper behavior if I
say with-tls=openssl. If I only specify with-tls=yes it figures out I
have openssl on the machine and I get the compile error.
Could there be something with the line "gcc: with_tls=no: No such file
or directory" in the excerpt from config.log below?
Yours
----------------------------------------------------------------------
/* Override any GCC internal prototype to avoid an error.
| Use char because int might match the return type of a GCC
| builtin and then its argument prototype would still apply. */
| #ifdef __cplusplus
| extern "C"
| #endif
| char NSS_InitContext ();
| int
| main ()
| {
| return NSS_InitContext ();
| ;
| return 0;
| }
configure:43382: result: no
configure:43403: checking openssl/ssl.h usability
configure:43420: gcc -c -Wall -Wno-switch -Wundef -Wsign-compare -Wno-char-subscripts
-Wpacked -Wshadow -Wmissing-declarations -Wmissing-prototypes -Wstrict-prototypes
-Wdeclaration-after-statement -g -I/usr/include/freetype2 conftest.c >&5
configure:43427: $? = 0
configure:43441: result: yes
configure:43445: checking openssl/ssl.h presence
configure:43460: gcc -E -I/usr/include/freetype2 conftest.c
configure:43467: $? = 0
configure:43481: result: yes
configure:43514: checking for openssl/ssl.h
configure:43521: result: yes
configure:43526: checking for SSL_library_init in -lssl
configure:43561: gcc -o conftest -Wall -Wno-switch -Wundef -Wsign-compare
-Wno-char-subscripts -Wpacked -Wshadow -Wmissing-declarations -Wmissing-prototypes
-Wstrict-prototypes -Wdeclaration-after-statement -g -I/usr/include/freetype2
-lXft -lXrender -lfontconfig -lfreetype -lz -lX11 conftest.c -lXaw -ltiff -lpng
-ljpeg -lXpm -lXft -lfontconfig -lXrender -lXmu -lXt -lXext -lX11 -lSM -lICE -lssl
with_tls=no -lgdbm_compat -lgdbm -lgpm -lncurses -lasound -lm -lutil 1>&5
gcc: with_tls=no: No such file or directory
conftest.c:258: warning: function declaration isn't a prototype
conftest.c:261: warning: function declaration isn't a prototype
configure:43568: $? = 1
configure: failed program was:
| /* confdefs.h. */
| #define PACKAGE_NAME "XEmacs"
| #define PACKAGE_TARNAME "xemacs"
| #define PACKAGE_VERSION "21.5"
| #define PACKAGE_STRING "XEmacs 21.5"
[...]
| #define HAVE_U_INT8_T 1
| #define HAVE_U_INT16_T 1
| #define HAVE_U_INT32_T 1
| #define HAVE_DATABASE 1
| /* end confdefs.h. */
|
| /* Override any GCC internal prototype to avoid an error.
| Use char because int might match the return type of a GCC
| builtin and then its argument prototype would still apply. */
| #ifdef __cplusplus
| extern "C"
| #endif
| char SSL_library_init ();
| int
| main ()
| {
| return SSL_library_init ();
| ;
| return 0;
| }
configure:43589: result: no
configure:43868: checking for X509_check_host
configure:43924: gcc -o conftest -Wall -Wno-switch -Wundef -Wsign-compare
-Wno-char-subscripts -Wpacked -Wshadow -Wmissing-declarations -Wmissing-prototypes
-Wstrict-prototypes -Wdeclaration-after-statement -g -I/usr/include/freetype2
-lXft -lXrender -lfontconfig -lfreetype -lz -lX11 conftest.c -lXaw -ltiff
-lpng -ljpeg -lXpm -lXft -lfontconfig -lXrender -lXmu -lXt -lXext -lX11 -lSM -lICE
-lgdbm_compat -lgdbm -lgpm -lncurses -lasound -lm -lssl -lcrypto -ldl -lz -lutil
1>&5
conftest.c:276: warning: function declaration isn't a prototype
conftest.c:286: warning: function declaration isn't a prototype
/tmp/ccPIjx9I.o: In function `main':
/src/xemacs/work/testing/conftest.c:287: undefined reference to `X509_check_host'
collect2: ld returned 1 exit status
configure:43931: $? = 1
configure: failed program was:
| /* confdefs.h. */
| #define PACKAGE_NAME "XEmacs"
| #define PACKAGE_TARNAME "xemacs"
| #define PACKAGE_VERSION "21.5"
| #define PACKAGE_STRING "XEmacs 21.5"
[...]
| #define HAVE_U_INT8_T 1
| #define HAVE_U_INT16_T 1
| #define HAVE_U_INT32_T 1
| #define HAVE_DATABASE 1
| #define WITH_TLS 1
| #define HAVE_OPENSSL 1
| /* end confdefs.h. */
----------------------------------------------------------------------
Yours
--
%% Mats
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://lists.xemacs.org/mailman/listinfo/xemacs-beta
3383
days inactive
3634
days old
12 comments
4 participants
participants (4)
-
Aidan Kehoe -
Jerry James -
Michael Sperber -
The XEmacs Package Smoketest