Missing TLS features in OCamlnet 4.x

--089e0129531a03177d05156aa8da
Content-Type: multipart/alternative; boundary=089e0129531a03177905156aa8d8

--089e0129531a03177905156aa8d8
Content-Type: text/plain; charset=UTF-8

Hi,

I have started working towards supporting OCamlnet 4.x in our project.

I had to completely rewrite the TLS code, this was expected due to OCamlnet
switching to GnuTLS.

I have noticed the following issues with the current TLS code:
  * dh_params is not used in the code therefore DHE-* suites are not enabled
    - Using the *gnutls_certificate_set_dh_params* solves the issue (see
attachment for example)

  * support for elliptic curve key exchange seems disabled (ECDHE-*
suites), I have not tried an ECC certificate.
  * support for GCM algorithms is not enabled
  * sample TLS netplex configuration is missing some ";" for each sections

Do you have the same behavior? It might be linked to my GnuTLS version.
Did you manage to enable higher-end ciphersuites and PFS suites?

Thanks for the feedback.

Thomas.

--089e0129531a03177905156aa8d8
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<div><br></div><div>I have started working towards supp=
orting OCamlnet 4.x in our project.</div><div><br></div><div>I had to compl=
etely rewrite the TLS code, this was expected due to OCamlnet switching to =
GnuTLS.</div><div><br></div><div>I have noticed the following issues with t=
he current TLS code:</div><div>=C2=A0 * dh_params is not used in the code t=
herefore DHE-* suites are not enabled</div><div>=C2=A0 =C2=A0 - Using the *=
gnutls_certificate_set_dh_params* solves the issue (see attachment for exam=
ple)</div><div><br></div><div>=C2=A0 * support for elliptic curve key excha=
nge seems disabled (ECDHE-* suites), I have not tried an ECC certificate.</=
div><div>=C2=A0 * support for GCM algorithms is not enabled</div><div>=C2=
=A0 * sample TLS netplex configuration is missing some &quot;;&quot; for ea=
ch sections</div><div><br></div><div>Do you have the same behavior? It migh=
t be linked to my GnuTLS version.</div><div>Did you manage to enable higher=
-end ciphersuites and PFS suites?</div><div><br></div><div>Thanks for the f=
eedback.</div><div><br></div><div>Thomas.</div><div><br></div><div><br></di=
v></div>

--089e0129531a03177905156aa8d8--
--089e0129531a03177d05156aa8da
Content-Type: text/x-patch; charset=US-ASCII; name="use-dh_params.patch"
Content-Disposition: attachment; filename="use-dh_params.patch"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_i9cty0600

ZGlmZiAtdXJwTiBvY2FtbG5ldC00LjAuMy9zcmMvbmV0dGxzLWdudXRscy9uZXR0bHNfZ251dGxz
Lm1sIG9jYW1sbmV0LTQuMC4zLm5ldy9zcmMvbmV0dGxzLWdudXRscy9uZXR0bHNfZ251dGxzLm1s
Ci0tLSBvY2FtbG5ldC00LjAuMy9zcmMvbmV0dGxzLWdudXRscy9uZXR0bHNfZ251dGxzLm1sCTIw
MTUtMDQtMjcgMDE6Mjc6MzIuMDAwMDAwMDAwICswMjAwCisrKyBvY2FtbG5ldC00LjAuMy5uZXcv
c3JjL25ldHRscy1nbnV0bHMvbmV0dGxzX2dudXRscy5tbAkyMDE1LTA1LTA2IDE2OjE3OjE2LjI5
ODg5NjAxMyArMDIwMApAQCAtMTgyLDE0ICsxODIsMjMgQEAgbW9kdWxlIE1ha2VfVExTXzEKICAg
ICAgICAgICAgICAgICAgIExpc3QuaGQgKHBhcnNlX3BlbSBbIkRIIFBBUkFNRVRFUlMiXSBmaWxl
IHNuZCkgaW4KICAgICAgICAgICAgICAgICBsZXQgZGhwID0gRy5nbnV0bHNfZGhfcGFyYW1zX2lu
aXQoKSBpbgogICAgICAgICAgICAgICAgIEcuZ251dGxzX2RoX3BhcmFtc19pbXBvcnRfcGtjczMg
ZGhwIGRhdGEgYERlcjsKKyAgICAgICAgICAgICAgICBsZXQgXyA9IG1hdGNoIGNyZWRlbnRpYWxz
LmdjcmVkIHdpdGgKKyAgICAgICAgICAgICAgICAgICAgYENlcnRpZmljYXRlIHggIC0+IEcuZ251
dGxzX2NlcnRpZmljYXRlX3NldF9kaF9wYXJhbXMgeCBkaHAKKyAgICAgICAgICAgICAgICAgICAg
fCBfIC0+ICgpIGluCiAgICAgICAgICAgICAgICAgU29tZSBkaHAKICAgICAgICAgICAgIHwgU29t
ZShgUEtDUzNfREVSIGRhdGEpIC0+CiAgICAgICAgICAgICAgICAgbGV0IGRocCA9IEcuZ251dGxz
X2RoX3BhcmFtc19pbml0KCkgaW4KICAgICAgICAgICAgICAgICBHLmdudXRsc19kaF9wYXJhbXNf
aW1wb3J0X3BrY3MzIGRocCBkYXRhIGBEZXI7CisgICAgICAgICAgICAgICAgbGV0IF8gPSBtYXRj
aCBjcmVkZW50aWFscy5nY3JlZCB3aXRoCisgICAgICAgICAgICAgICAgICAgIGBDZXJ0aWZpY2F0
ZSB4ICAtPiBHLmdudXRsc19jZXJ0aWZpY2F0ZV9zZXRfZGhfcGFyYW1zIHggZGhwCisgICAgICAg
ICAgICAgICAgICAgIHwgXyAtPiAoKSBpbgogICAgICAgICAgICAgICAgIFNvbWUgZGhwCiAgICAg
ICAgICAgICB8IFNvbWUoYEdlbmVyYXRlIGJpdHMpIC0+CiAgICAgICAgICAgICAgICAgbGV0IGRo
cCA9IEcuZ251dGxzX2RoX3BhcmFtc19pbml0KCkgaW4KICAgICAgICAgICAgICAgICBHLmdudXRs
c19kaF9wYXJhbXNfZ2VuZXJhdGUyIGRocCBiaXRzOworICAgICAgICAgICAgICAgIGxldCBfID0g
bWF0Y2ggY3JlZGVudGlhbHMuZ2NyZWQgd2l0aAorICAgICAgICAgICAgICAgICAgICBgQ2VydGlm
aWNhdGUgeCAgLT4gRy5nbnV0bHNfY2VydGlmaWNhdGVfc2V0X2RoX3BhcmFtcyB4IGRocAorICAg
ICAgICAgICAgICAgICAgICB8IF8gLT4gKCkgaW4KICAgICAgICAgICAgICAgICBTb21lIGRocCBp
bgogICAgICAgICB7IHByaW9yaXR5OwogICAgICAgICAgIGRoX3BhcmFtcyA9IGRocF9vcHQ7Cg==
--089e0129531a03177d05156aa8da
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
One dashboard for servers and applications across Physical-Virtual-Cloud 
Widest out-of-the-box monitoring support with 50+ applications
Performance metrics, stats and reports that give you Actionable Insights
Deep dive visibility with transaction tracing using APM Insight.
http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
--089e0129531a03177d05156aa8da
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ocamlnet-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel

--089e0129531a03177d05156aa8da--