Re: Missing TLS features in OCamlnet 4.x
Thomas Calderon <[email protected]> Thu, 7 May 2015 10:47:44 +0200
| Newsgroups | gmane.comp.lang.ocaml.lib.net.devel |
|---|---|
| Message-ID | <CA+1ewKbvreV7HS-zG2bfVMwBXF7=r_ER0XhaZHO3p-0yUiiLrA@mail.gmail.com> |
--===============1722037653368756241== Content-Type: multipart/alternative; boundary=089e0111b76a55f084051579f8d4 --089e0111b76a55f084051579f8d4 Content-Type: text/plain; charset=UTF-8 Hi Gerd, On Wed, May 6, 2015 at 10:51 PM, Gerd Stolpmann <[email protected]> wrote: > Hi Thomas, > > Am Mittwoch, den 06.05.2015, 16:31 +0200 schrieb Thomas Calderon: > > Hi, > > > > > > I have started working towards supporting OCamlnet 4.x in our project. > > > > > > I had to completely rewrite the TLS code, this was expected due to > > OCamlnet switching to GnuTLS. > > > > > > I have noticed the following issues with the current TLS code: > > * dh_params is not used in the code therefore DHE-* suites are not > > enabled > > - Using the *gnutls_certificate_set_dh_params* solves the issue > > (see attachment for example) > > Well spotted. I have some concerns about the side effect, though. There > is no function to copy a certificate. > I am not following you on this. Why would you want to copy the certificate? > > > * support for elliptic curve key exchange seems disabled (ECDHE-* > > suites), I have not tried an ECC certificate. > > * support for GCM algorithms is not enabled > > I'm quite sure that I saw ECDHE and GCM in tests. I'll retest tomorrow. > It might be related to the GnuTLS version mess on my machine (Ubuntu has two versions installed). Let me know the results of your test. > It is possible to de-configure these features in GnuTLS. > > > * sample TLS netplex configuration is missing some ";" for each > > sections > > > > > > Do you have the same behavior? It might be linked to my GnuTLS > > version. > > Did you manage to enable higher-end ciphersuites and PFS suites? > > Gerd > > > > > Thanks for the feedback. > > > > > > Thomas. > > > > > > > > > > > ------------------------------------------------------------------------------ > > One dashboard for servers and applications across Physical-Virtual-Cloud > > Widest out-of-the-box monitoring support with 50+ applications > > Performance metrics, stats and reports that give you Actionable Insights > > Deep dive visibility with transaction tracing using APM Insight. > > http://ad.doubleclick.net/ddm/clk/290420510;117567292;y > > _______________________________________________ > > Ocamlnet-devel mailing list > > [email protected] > > https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel > > -- > ------------------------------------------------------------ > Gerd Stolpmann, Darmstadt, Germany [email protected] > My OCaml site: http://www.camlcity.org > Contact details: http://www.camlcity.org/contact.html > Company homepage: http://www.gerd-stolpmann.de > ------------------------------------------------------------ > > --089e0111b76a55f084051579f8d4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><br>Hi Gerd,<br><br><div class=3D"gmail_extra"><br><div cl= ass=3D"gmail_quote">On Wed, May 6, 2015 at 10:51 PM, Gerd Stolpmann <span d= ir=3D"ltr"><<a href=3D"mailto:[email protected]" target=3D"_blank">= [email protected]</a>></span> wrote:<br><blockquote class=3D"gmail_= quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1= ex">Hi Thomas,<br> <span class=3D""><br> Am Mittwoch, den 06.05.2015, 16:31 +0200 schrieb Thomas Calderon:<br> > Hi,<br> ><br> ><br> > I have started working towards supporting OCamlnet 4.x in our project.= <br> ><br> ><br> > I had to completely rewrite the TLS code, this was expected due to<br> > OCamlnet switching to GnuTLS.<br> ><br> ><br> > I have noticed the following issues with the current TLS code:<br> >=C2=A0 =C2=A0* dh_params is not used in the code therefore DHE-* suites= are not<br> > enabled<br> >=C2=A0 =C2=A0 =C2=A0- Using the *gnutls_certificate_set_dh_params* solv= es the issue<br> > (see attachment for example)<br> <br> </span>Well spotted. I have some concerns about the side effect, though. Th= ere<br> is no function to copy a certificate.<br></blockquote><div><br></div><div>I= am not following you on this. Why would you want to copy the certificate?<= br></div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin= :0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <span class=3D""><br> >=C2=A0 =C2=A0* support for elliptic curve key exchange seems disabled (= ECDHE-*<br> > suites), I have not tried an ECC certificate.<br> >=C2=A0 =C2=A0* support for GCM algorithms is not enabled<br> <br> </span>I'm quite sure that I saw ECDHE and GCM in tests. I'll retes= t tomorrow.<br></blockquote><div>It might be related to the GnuTLS version = mess on my machine (Ubuntu has two versions installed).<br></div><div>Let m= e know the results of your test.<br></div><div><br></div><blockquote class= =3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd= ing-left:1ex"> <br> It is possible to de-configure these features in GnuTLS.<br> <span class=3D""><br> >=C2=A0 =C2=A0* sample TLS netplex configuration is missing some ";= " for each<br> > sections<br> ><br> ><br> > Do you have the same behavior? It might be linked to my GnuTLS<br> > version.<br> > Did you manage to enable higher-end ciphersuites and PFS suites?<br> <br> </span>Gerd<br> <span class=3D""><br> ><br> > Thanks for the feedback.<br> ><br> ><br> > Thomas.<br> ><br> ><br> ><br> ><br> </span>> ---------------------------------------------------------------= ---------------<br> > One dashboard for servers and applications across Physical-Virtual-Clo= ud<br> > Widest out-of-the-box monitoring support with 50+ applications<br> > Performance metrics, stats and reports that give you Actionable Insigh= ts<br> > Deep dive visibility with transaction tracing using APM Insight.<br> > <a href=3D"http://ad.doubleclick.net/ddm/clk/290420510;117567292;y" ta= rget=3D"_blank">http://ad.doubleclick.net/ddm/clk/290420510;117567292;y</a>= <br> > _______________________________________________<br> > Ocamlnet-devel mailing list<br> > <a href=3D"mailto:[email protected]">Ocamlnet-devel= @lists.sourceforge.net</a><br> > <a href=3D"https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel= " target=3D"_blank">https://lists.sourceforge.net/lists/listinfo/ocamlnet-d= evel</a><br> <span class=3D"HOEnZb"><font color=3D"#888888"><br> --<br> ------------------------------------------------------------<br> Gerd Stolpmann, Darmstadt, Germany=C2=A0 =C2=A0 <a href=3D"mailto:gerd@gerd= -stolpmann.de">[email protected]</a><br> My OCaml site:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"http://www.caml= city.org" target=3D"_blank">http://www.camlcity.org</a><br> Contact details:=C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"http://www.camlcity.= org/contact.html" target=3D"_blank">http://www.camlcity.org/contact.html</a= ><br> Company homepage:=C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"http://www.gerd-stol= pmann.de" target=3D"_blank">http://www.gerd-stolpmann.de</a><br> ------------------------------------------------------------<br> <br> </font></span></blockquote></div><br></div></div> --089e0111b76a55f084051579f8d4-- --===============1722037653368756241== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ One dashboard for servers and applications across Physical-Virtual-Cloud Widest out-of-the-box monitoring support with 50+ applications Performance metrics, stats and reports that give you Actionable Insights Deep dive visibility with transaction tracing using APM Insight. http://ad.doubleclick.net/ddm/clk/290420510;117567292;y --===============1722037653368756241== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ocamlnet-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel --===============1722037653368756241==--