Mercurial > emacs
comparison lisp/net/tls.el @ 91204:53108e6cea98
Merge from emacs--devo--0
Revision: emacs@sv.gnu.org/emacs--unicode--0--patch-294
author | Miles Bader <miles@gnu.org> |
---|---|
date | Thu, 06 Dec 2007 09:51:45 +0000 |
parents | 880960b70474 781256628613 |
children | 606f2d163a64 |
comparison
equal
deleted
inserted
replaced
91203:db40129142b2 | 91204:53108e6cea98 |
---|---|
83 "openssl s_client -connect %h:%p -no_ssl2") | 83 "openssl s_client -connect %h:%p -no_ssl2") |
84 "List of strings containing commands to start TLS stream to a host. | 84 "List of strings containing commands to start TLS stream to a host. |
85 Each entry in the list is tried until a connection is successful. | 85 Each entry in the list is tried until a connection is successful. |
86 %h is replaced with server hostname, %p with port to connect to. | 86 %h is replaced with server hostname, %p with port to connect to. |
87 The program should read input on stdin and write output to | 87 The program should read input on stdin and write output to |
88 stdout. Also see `tls-success' for what the program should output | 88 stdout. |
89 after successful negotiation." | 89 |
90 :type '(repeat string) | 90 See `tls-checktrust' on how to check trusted root certs. |
91 | |
92 Also see `tls-success' for what the program should output after | |
93 successful negotiation." | |
94 :type | |
95 '(choice | |
96 (list :tag "Choose commands" | |
97 :value | |
98 ("gnutls-cli -p %p %h" | |
99 "gnutls-cli -p %p %h --protocols ssl3" | |
100 "openssl s_client -connect %h:%p -no_ssl2") | |
101 (set :inline t | |
102 ;; FIXME: add brief `:tag "..."' descriptions. | |
103 ;; (repeat :inline t :tag "Other" (string)) | |
104 ;; See `tls-checktrust': | |
105 (const "gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p %p %h") | |
106 (const "gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p %p %h --protocols ssl3") | |
107 (const "openssl s_client -connect %h:%p -CAfile /etc/ssl/certs/ca-certificates.crt -no_ssl2") | |
108 ;; No trust check: | |
109 (const "gnutls-cli -p %p %h") | |
110 (const "gnutls-cli -p %p %h --protocols ssl3") | |
111 (const "openssl s_client -connect %h:%p -no_ssl2")) | |
112 (repeat :inline t :tag "Other" (string))) | |
113 (const :tag "Default list of commands" | |
114 ("gnutls-cli -p %p %h" | |
115 "gnutls-cli -p %p %h --protocols ssl3" | |
116 "openssl s_client -connect %h:%p -no_ssl2")) | |
117 (list :tag "List of commands" | |
118 (repeat :tag "Command" (string)))) | |
91 :version "22.1" | 119 :version "22.1" |
92 :group 'tls) | 120 :group 'tls) |
93 | 121 |
94 (defcustom tls-process-connection-type nil | 122 (defcustom tls-process-connection-type nil |
95 "*Value for `process-connection-type' to use when starting TLS process." | 123 "Value for `process-connection-type' to use when starting TLS process." |
96 :version "22.1" | 124 :version "22.1" |
97 :type 'boolean | 125 :type 'boolean |
98 :group 'tls) | 126 :group 'tls) |
99 | 127 |
100 (defcustom tls-success "- Handshake was completed\\|SSL handshake has read " | 128 (defcustom tls-success "- Handshake was completed\\|SSL handshake has read " |
101 "*Regular expression indicating completed TLS handshakes. | 129 "Regular expression indicating completed TLS handshakes. |
102 The default is what GNUTLS's \"gnutls-cli\" or OpenSSL's | 130 The default is what GNUTLS's \"gnutls-cli\" or OpenSSL's |
103 \"openssl s_client\" outputs." | 131 \"openssl s_client\" outputs." |
104 :version "22.1" | 132 :version "22.1" |
105 :type 'regexp | 133 :type 'regexp |
134 :group 'tls) | |
135 | |
136 (defcustom tls-checktrust nil | |
137 "Indicate if certificates should be checked against trusted root certs. | |
138 If this is `ask', the user can decide whether to accept an | |
139 untrusted certificate. You may have to adapt `tls-program' in | |
140 order to make this feature work properly, i.e., to ensure that | |
141 the external program knows about the root certificates you | |
142 consider trustworthy, e.g.: | |
143 | |
144 \(setq tls-program | |
145 '(\"gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p %p %h\" | |
146 \"gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p %p %h --protocols ssl3\" | |
147 \"openssl s_client -connect %h:%p -CAfile /etc/ssl/certs/ca-certificates.crt -no_ssl2\"))" | |
148 :type '(choice (const :tag "Always" t) | |
149 (const :tag "Never" nil) | |
150 (const :tag "Ask" ask)) | |
151 :version "23.0" ;; No Gnus | |
152 :group 'tls) | |
153 | |
154 (defcustom tls-untrusted | |
155 "- Peer's certificate is NOT trusted\\|Verify return code: \\([^0] \\|.[^ ]\\)" | |
156 "Regular expression indicating failure of TLS certificate verification. | |
157 The default is what GNUTLS's \"gnutls-cli\" or OpenSSL's | |
158 \"openssl s_client\" return in the event of unsuccessful | |
159 verification." | |
160 :type 'regexp | |
161 :version "23.0" ;; No Gnus | |
162 :group 'tls) | |
163 | |
164 (defcustom tls-hostmismatch | |
165 "# The hostname in the certificate does NOT match" | |
166 "Regular expression indicating a host name mismatch in certificate. | |
167 When the host name specified in the certificate doesn't match the | |
168 name of the host you are connecting to, gnutls-cli issues a | |
169 warning to this effect. There is no such feature in openssl. Set | |
170 this to nil if you want to ignore host name mismatches." | |
171 :type 'regexp | |
172 :version "23.0" ;; No Gnus | |
106 :group 'tls) | 173 :group 'tls) |
107 | 174 |
108 (defcustom tls-certtool-program (executable-find "certtool") | 175 (defcustom tls-certtool-program (executable-find "certtool") |
109 "Name of GnuTLS certtool. | 176 "Name of GnuTLS certtool. |
110 Used by `tls-certificate-information'." | 177 Used by `tls-certificate-information'." |
139 "Open a TLS connection for a port to a host. | 206 "Open a TLS connection for a port to a host. |
140 Returns a subprocess-object to represent the connection. | 207 Returns a subprocess-object to represent the connection. |
141 Input and output work as for subprocesses; `delete-process' closes it. | 208 Input and output work as for subprocesses; `delete-process' closes it. |
142 Args are NAME BUFFER HOST PORT. | 209 Args are NAME BUFFER HOST PORT. |
143 NAME is name for process. It is modified if necessary to make it unique. | 210 NAME is name for process. It is modified if necessary to make it unique. |
144 BUFFER is the buffer (or buffer-name) to associate with the process. | 211 BUFFER is the buffer (or buffer name) to associate with the process. |
145 Process output goes at end of that buffer, unless you specify | 212 Process output goes at end of that buffer, unless you specify |
146 an output stream or filter function to handle the output. | 213 an output stream or filter function to handle the output. |
147 BUFFER may be also nil, meaning that this process is not associated | 214 BUFFER may be also nil, meaning that this process is not associated |
148 with any buffer | 215 with any buffer |
149 Third arg is name of the host to connect to, or its IP address. | 216 Third arg is name of the host to connect to, or its IP address. |
175 (not (setq done (re-search-forward tls-success nil t))))) | 242 (not (setq done (re-search-forward tls-success nil t))))) |
176 (unless (accept-process-output process 1) | 243 (unless (accept-process-output process 1) |
177 (sit-for 1))) | 244 (sit-for 1))) |
178 (message "Opening TLS connection with `%s'...%s" cmd | 245 (message "Opening TLS connection with `%s'...%s" cmd |
179 (if done "done" "failed")) | 246 (if done "done" "failed")) |
180 (if (not done) | 247 (if done |
181 (delete-process process) | 248 (setq done process) |
182 ;; advance point to after all informational messages that | 249 (delete-process process)))) |
183 ;; `openssl s_client' and `gnutls' print | 250 (when done |
184 (let ((start-of-data nil)) | 251 (save-excursion |
185 (while | 252 (set-buffer buffer) |
186 (not (setq start-of-data | 253 (when |
187 ;; the string matching `tls-end-of-info' | 254 (or |
188 ;; might come in separate chunks from | 255 (and tls-checktrust |
189 ;; `accept-process-output', so start the | 256 (progn |
190 ;; search where `tls-success' ended | 257 (goto-char (point-min)) |
191 (save-excursion | 258 (re-search-forward tls-untrusted nil t)) |
192 (if (re-search-forward tls-end-of-info nil t) | 259 (or |
193 (match-end 0))))) | 260 (and (not (eq tls-checktrust 'ask)) |
194 (accept-process-output process 1)) | 261 (message "The certificate presented by `%s' is NOT trusted." host)) |
195 (if start-of-data | 262 (not (yes-or-no-p |
196 ;; move point to start of client data | 263 (format "The certificate presented by `%s' is NOT trusted. Accept anyway? " host))))) |
197 (goto-char start-of-data))) | 264 (and tls-hostmismatch |
198 (setq done process)))) | 265 (progn |
266 (goto-char (point-min)) | |
267 (re-search-forward tls-hostmismatch nil t)) | |
268 (not (yes-or-no-p | |
269 (format "Host name in certificate doesn't match `%s'. Connect anyway? " host))))) | |
270 (setq done nil) | |
271 (delete-process process)))) | |
199 (message "Opening TLS connection to `%s'...%s" | 272 (message "Opening TLS connection to `%s'...%s" |
200 host (if done "done" "failed"))) | 273 host (if done "done" "failed"))) |
201 (when use-temp-buffer | 274 (when use-temp-buffer |
202 (if done (set-process-buffer process nil)) | 275 (if done (set-process-buffer process nil)) |
203 (kill-buffer buffer)) | 276 (kill-buffer buffer)) |