Re: Missing TLS features in OCamlnet 4.x
Thomas Calderon <[email protected]> Thu, 7 May 2015 15:19:41 +0200
| Newsgroups | gmane.comp.lang.ocaml.lib.net.devel |
|---|---|
| Message-ID | <CA+1ewKYUKrobrDk+saEqLkszLf6ikOX8zpPf6uEW8LNt2Ouu7g@mail.gmail.com> |
--===============1105051110910581028== Content-Type: multipart/alternative; boundary=20cf303dd346e5609c05157dc46e --20cf303dd346e5609c05157dc46e Content-Type: text/plain; charset=UTF-8 Hi again, I have tried using OCamlnet 4.x TLS on a recent setup (Ubuntu 15.04 amd64 VM) with GnuTLS version being 3.3.8-3ubuntu3. I am unable to have a valid TLS exchange using this setup. I have the following trace: [Thu May 7 15:07:38 2015] [debug] [3476:0] Uq_engines: cancel_reading socket_multiplex_controller mplex=807 fd=3 [Thu May 7 15:07:38 2015] [debug] [3476:0] Uq_engines: input_done socket_multiplex_controller mplex=807 fd=3 [Thu May 7 15:07:38 2015] [debug] [3476:0] Uq_engines: tls_multiplex_controller: update [Thu May 7 15:07:38 2015] [debug] [3476:0] Uq_engines: tls_multiplex_controller: config_adapter recv=true [Thu May 7 15:07:38 2015] [debug] [3476:0] Uq_engines: tls_multiplex_controller: cont_handshake (re)start [Thu May 7 15:07:38 2015] [debug] [3476:0] Netsys_tls: Netsys_tls: hello [Thu May 7 15:07:38 2015] [debug] [3476:0] Uq_engines: tls_adapter: recv caller_size=5 avail_size=305 n=5 [Thu May 7 15:07:38 2015] [debug] [3476:0] Uq_engines: tls_adapter: recv caller_size=300 avail_size=300 n=300 [Thu May 7 15:07:38 2015] [debug] [3476:0] Netsys_tls: Exception in function Netsys_tls.state_driven_action: Nettls_gnutls.TLS.Error(GNUTLS_E_RANDOM_DEVICE_ERROR) - backtrace: [Thu May 7 15:07:38 2015] [debug] [3476:0] Uq_engines: tls_multiplex_controller: cont_handshake exn=Nettls_gnutls.TLS.Error(GNUTLS_E_RANDOM_DEVICE_ERROR) Other C programs linked to GnuTLS work fine on this setup. Any ideas? Cheers. On Thu, May 7, 2015 at 10:47 AM, Thomas Calderon <[email protected]> wrote: > > Hi Gerd, > > > On Wed, May 6, 2015 at 10:51 PM, Gerd Stolpmann <[email protected]> > wrote: > >> Hi Thomas, >> >> Am Mittwoch, den 06.05.2015, 16:31 +0200 schrieb Thomas Calderon: >> > Hi, >> > >> > >> > I have started working towards supporting OCamlnet 4.x in our project. >> > >> > >> > I had to completely rewrite the TLS code, this was expected due to >> > OCamlnet switching to GnuTLS. >> > >> > >> > I have noticed the following issues with the current TLS code: >> > * dh_params is not used in the code therefore DHE-* suites are not >> > enabled >> > - Using the *gnutls_certificate_set_dh_params* solves the issue >> > (see attachment for example) >> >> Well spotted. I have some concerns about the side effect, though. There >> is no function to copy a certificate. >> > > I am not following you on this. Why would you want to copy the certificate? > > >> >> > * support for elliptic curve key exchange seems disabled (ECDHE-* >> > suites), I have not tried an ECC certificate. >> > * support for GCM algorithms is not enabled >> >> I'm quite sure that I saw ECDHE and GCM in tests. I'll retest tomorrow. >> > It might be related to the GnuTLS version mess on my machine (Ubuntu has > two versions installed). > Let me know the results of your test. > > >> It is possible to de-configure these features in GnuTLS. >> >> > * sample TLS netplex configuration is missing some ";" for each >> > sections >> > >> > >> > Do you have the same behavior? It might be linked to my GnuTLS >> > version. >> > Did you manage to enable higher-end ciphersuites and PFS suites? >> >> Gerd >> >> > >> > Thanks for the feedback. >> > >> > >> > Thomas. >> > >> > >> > >> > >> > >> ------------------------------------------------------------------------------ >> > One dashboard for servers and applications across Physical-Virtual-Cloud >> > Widest out-of-the-box monitoring support with 50+ applications >> > Performance metrics, stats and reports that give you Actionable Insights >> > Deep dive visibility with transaction tracing using APM Insight. >> > http://ad.doubleclick.net/ddm/clk/290420510;117567292;y >> > _______________________________________________ >> > Ocamlnet-devel mailing list >> > [email protected] >> > https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel >> >> -- >> ------------------------------------------------------------ >> Gerd Stolpmann, Darmstadt, Germany [email protected] >> My OCaml site: http://www.camlcity.org >> Contact details: http://www.camlcity.org/contact.html >> Company homepage: http://www.gerd-stolpmann.de >> ------------------------------------------------------------ >> >> > --20cf303dd346e5609c05157dc46e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hi again,<div><br></div><div>I have tried using OCamlnet 4= .x TLS on a recent setup (Ubuntu 15.04 amd64 VM) with GnuTLS version being = 3.3.8-3ubuntu3.</div><div>I am unable to have a valid TLS exchange using th= is setup. I have the following trace:<br></div><div><br></div><blockquote s= tyle=3D"margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>[Thu May= =C2=A07 15:07:38 2015] [debug] [3476:0] Uq_engines: cancel_reading socket_= multiplex_controller mplex=3D807 fd=3D3</div></div><div><div>[Thu May =C2= =A07 15:07:38 2015] [debug] [3476:0] Uq_engines: input_done socket_multiple= x_controller mplex=3D807 fd=3D3</div></div><div><div>[Thu May =C2=A07 15:07= :38 2015] [debug] [3476:0] Uq_engines: tls_multiplex_controller: update</di= v></div><div><div>[Thu May =C2=A07 15:07:38 2015] [debug] [3476:0] Uq_engin= es: tls_multiplex_controller: config_adapter recv=3Dtrue</div></div><div><d= iv>[Thu May =C2=A07 15:07:38 2015] [debug] [3476:0] Uq_engines: tls_multipl= ex_controller: cont_handshake (re)start</div></div><div><div>[Thu May =C2= =A07 15:07:38 2015] [debug] [3476:0] Netsys_tls: Netsys_tls: hello</div></d= iv><div><div>[Thu May =C2=A07 15:07:38 2015] [debug] [3476:0] Uq_engines: t= ls_adapter: recv caller_size=3D5 avail_size=3D305 n=3D5</div></div><div><di= v>[Thu May =C2=A07 15:07:38 2015] [debug] [3476:0] Uq_engines: tls_adapter:= recv caller_size=3D300 avail_size=3D300 n=3D300</div></div><div><div>[Thu = May =C2=A07 15:07:38 2015] [debug] [3476:0] Netsys_tls: Exception in functi= on Netsys_tls.state_driven_action: Nettls_gnutls.TLS.Error(GNUTLS_E_RANDOM_= DEVICE_ERROR) - backtrace:</div></div><div><div>[Thu May =C2=A07 15:07:38 2= 015] [debug] [3476:0] Uq_engines: tls_multiplex_controller: cont_handshake = exn=3DNettls_gnutls.TLS.Error(GNUTLS_E_RANDOM_DEVICE_ERROR)</div></div><div= ><br></div></blockquote>Other C programs linked to GnuTLS work fine on this= setup.<div>Any ideas?<div><br></div><div>Cheers.</div></div></div><div cla= ss=3D"gmail_extra"><br><div class=3D"gmail_quote">On Thu, May 7, 2015 at 10= :47 AM, Thomas Calderon <span dir=3D"ltr"><<a href=3D"mailto:calderon.th= [email protected]" target=3D"_blank">[email protected]</a>></span> = wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bord= er-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><br>Hi Gerd,<br><= br><div class=3D"gmail_extra"><br><div class=3D"gmail_quote"><span class=3D= "">On Wed, May 6, 2015 at 10:51 PM, Gerd Stolpmann <span dir=3D"ltr"><<a= href=3D"mailto:[email protected]" target=3D"_blank">info@gerd-stolpma= nn.de</a>></span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"m= argin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Thomas,<br= > <span><br> Am Mittwoch, den 06.05.2015, 16:31 +0200 schrieb Thomas Calderon:<br> > Hi,<br> ><br> ><br> > I have started working towards supporting OCamlnet 4.x in our project.= <br> ><br> ><br> > I had to completely rewrite the TLS code, this was expected due to<br> > OCamlnet switching to GnuTLS.<br> ><br> ><br> > I have noticed the following issues with the current TLS code:<br> >=C2=A0 =C2=A0* dh_params is not used in the code therefore DHE-* suites= are not<br> > enabled<br> >=C2=A0 =C2=A0 =C2=A0- Using the *gnutls_certificate_set_dh_params* solv= es the issue<br> > (see attachment for example)<br> <br> </span>Well spotted. I have some concerns about the side effect, though. Th= ere<br> is no function to copy a certificate.<br></blockquote><div><br></div></span= ><div>I am not following you on this. Why would you want to copy the certif= icate?<br></div><span class=3D""><div>=C2=A0</div><blockquote class=3D"gmai= l_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left= :1ex"> <span><br> >=C2=A0 =C2=A0* support for elliptic curve key exchange seems disabled (= ECDHE-*<br> > suites), I have not tried an ECC certificate.<br> >=C2=A0 =C2=A0* support for GCM algorithms is not enabled<br> <br> </span>I'm quite sure that I saw ECDHE and GCM in tests. I'll retes= t tomorrow.<br></blockquote></span><div>It might be related to the GnuTLS v= ersion mess on my machine (Ubuntu has two versions installed).<br></div><di= v>Let me know the results of your test.<br></div><div><div class=3D"h5"><di= v><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bo= rder-left:1px #ccc solid;padding-left:1ex"> <br> It is possible to de-configure these features in GnuTLS.<br> <span><br> >=C2=A0 =C2=A0* sample TLS netplex configuration is missing some ";= " for each<br> > sections<br> ><br> ><br> > Do you have the same behavior? It might be linked to my GnuTLS<br> > version.<br> > Did you manage to enable higher-end ciphersuites and PFS suites?<br> <br> </span>Gerd<br> <span><br> ><br> > Thanks for the feedback.<br> ><br> ><br> > Thomas.<br> ><br> ><br> ><br> ><br> </span>> ---------------------------------------------------------------= ---------------<br> > One dashboard for servers and applications across Physical-Virtual-Clo= ud<br> > Widest out-of-the-box monitoring support with 50+ applications<br> > Performance metrics, stats and reports that give you Actionable Insigh= ts<br> > Deep dive visibility with transaction tracing using APM Insight.<br> > <a href=3D"http://ad.doubleclick.net/ddm/clk/290420510;117567292;y" ta= rget=3D"_blank">http://ad.doubleclick.net/ddm/clk/290420510;117567292;y</a>= <br> > _______________________________________________<br> > Ocamlnet-devel mailing list<br> > <a href=3D"mailto:[email protected]" target=3D"_bla= nk">[email protected]</a><br> > <a href=3D"https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel= " target=3D"_blank">https://lists.sourceforge.net/lists/listinfo/ocamlnet-d= evel</a><br> <span><font color=3D"#888888"><br> --<br> ------------------------------------------------------------<br> Gerd Stolpmann, Darmstadt, Germany=C2=A0 =C2=A0 <a href=3D"mailto:gerd@gerd= -stolpmann.de" target=3D"_blank">[email protected]</a><br> My OCaml site:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"http://www.caml= city.org" target=3D"_blank">http://www.camlcity.org</a><br> Contact details:=C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"http://www.camlcity.= org/contact.html" target=3D"_blank">http://www.camlcity.org/contact.html</a= ><br> Company homepage:=C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"http://www.gerd-stol= pmann.de" target=3D"_blank">http://www.gerd-stolpmann.de</a><br> ------------------------------------------------------------<br> <br> </font></span></blockquote></div></div></div><br></div></div> </blockquote></div><br></div> --20cf303dd346e5609c05157dc46e-- --===============1105051110910581028== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ One dashboard for servers and applications across Physical-Virtual-Cloud Widest out-of-the-box monitoring support with 50+ applications Performance metrics, stats and reports that give you Actionable Insights Deep dive visibility with transaction tracing using APM Insight. http://ad.doubleclick.net/ddm/clk/290420510;117567292;y --===============1105051110910581028== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ocamlnet-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel --===============1105051110910581028==--