taskWeeChat - Tasks: task #12724, expected SSL-Certificate

 
 

task #12724: expected SSL-Certificate

Submitted by:  Roland <roidal>
Submitted on:  Sun Jun 30 12:59:31 2013  
 
Category: irc pluginShould Start On: Sun Jun 30 00:00:00 2013
Should be Finished on: Sun Jun 30 00:00:00 2013Priority: 5 - Normal
Status: DonePrivacy: Public
Percent Complete: 100%Assigned to: Sebastien Helleu <flashcode>
Originator Name: Open/Closed: Closed
Planned Release: 0.4.3IRC nick: roidal

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue Jan 21 11:35:34 2014, comment #4:

Committed, thanks for the patch.

And I refactorized the gnutls callback to display certificates, even if the new server option "ssl_fingerprint" is set.

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Mon Jan 20 12:07:33 2014, comment #3:

Task 12293 is also related. It proposes an alternative method to accept certificates.

Task #11357 is also related. It requests a per-network root CA list. But with this option, it does become less important. It seems to me that if you're going to set a network specific CA, you might as well just specify exactly which certificate to accept. But I might be wrong.

Maarten de Vries <de_vri_es>
Mon Jan 20 11:58:39 2014, comment #2:

Uploaded a patch that adds a 'ssl_fingerprint' option for servers. When non-empty, the normal checks are disabled and the certificate fingerprint must match the set sha1 fingerprint. It should be given as hexadecimal string withouth seperators between the bytes. That's also what weechat shows when it rejects the certificate.

We could still maybe add a message when the certificate is rejected that the user can accept it by setting this option.

I thought this was easier than the gnutls builtin trusted keystore, since it can be managed from weechat with simple set/unset commands.

This is my first patch for weechat, so I hope it's good enough :)

Maarten de Vries <de_vri_es>
Mon Jan 20 07:55:54 2014, comment #1:

By the way there is also a GnuTLS feature which directly implements something very similar to this, called TOFU (Trust On First Use): http://www.gnutls.org/manual/html_node/Verifying-a-certificate-using-trust-on-first-use-authentication.html#Verifying-a-certificate-using-trust-on-first-use-authentication

Anonymous
Sun Jun 30 12:59:31 2013, original submission:

Options for the sha1 fingerprint and/or the path to the expected ssl-certificate for a connection.

Roland <roidal>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #30317:  0001-irc-add-option-to-accept-server-certificate-with-fin.patch added by de_vri_es (10kB - text/x-patch - This patch adds a 'ssl_fingerprint' option for servers. When non-empty, the normal checks are disabled and the certificate fingerprint must match the set sha1 fingerprint. It should be given as hexadecimal string withouth seperators between the bytes.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by flashcode (Posted a comment)
  • -unavailable- added by de_vri_es (Updated the item)
  • -unavailable- added by roidal (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun Feb 9 09:48:48 2014flashcodeOpen/ClosedOpen=>Closed
    Tue Jan 21 11:35:34 2014flashcodeCategoryNone=>irc plugin
      StatusNone=>Done
      Percent Complete0%=>100%
      Assigned toNone=>flashcode
      Planned ReleaseNone=>0.4.3
    Mon Jan 20 11:53:44 2014de_vri_esAttached File-=>Added 0001-irc-add-option-to-accept-server-certificate-with-fin.patch, #30317

    Back to the top


    Powered by Savane 3.1-cleanup