Re: Missing TLS features in OCamlnet 4.x

--===============1244733247532245347==
Content-Type: multipart/signed; micalg="pgp-sha1";
	protocol="application/pgp-signature"; 
	boundary="=-CM11ap/RbHdeXgg/aEig"


--=-CM11ap/RbHdeXgg/aEig
Content-Type: text/plain; charset="ISO-8859-15"
Content-Transfer-Encoding: quoted-printable

Am Donnerstag, den 07.05.2015, 10:47 +0200 schrieb Thomas Calderon:
>=20
> Hi Gerd,
>=20
>=20
> On Wed, May 6, 2015 at 10:51 PM, Gerd Stolpmann
> <[email protected]> wrote:
>         Hi Thomas,
>        =20
>         Am Mittwoch, den 06.05.2015, 16:31 +0200 schrieb Thomas
>         Calderon:
>         > Hi,
>         >
>         >
>         > I have started working towards supporting OCamlnet 4.x in
>         our project.
>         >
>         >
>         > I had to completely rewrite the TLS code, this was expected
>         due to
>         > OCamlnet switching to GnuTLS.
>         >
>         >
>         > I have noticed the following issues with the current TLS
>         code:
>         >   * dh_params is not used in the code therefore DHE-* suites
>         are not
>         > enabled
>         >     - Using the *gnutls_certificate_set_dh_params* solves
>         the issue
>         > (see attachment for example)
>        =20
>         Well spotted. I have some concerns about the side effect,
>         though. There
>         is no function to copy a certificate.
>=20
>=20
> I am not following you on this. Why would you want to copy the
> certificate?

Because it is surprising for the caller when create_config modifies its
arguments by setting the dh params for the certificates. And the only
way to avoid is to make a local copy of the certificate and modify that
instead of the argument.

It is possible to work around by saving the function that creates the
certificate. I'll probably do that.

Gerd


>=20
> =20
>        =20
>         >   * support for elliptic curve key exchange seems disabled
>         (ECDHE-*
>         > suites), I have not tried an ECC certificate.
>         >   * support for GCM algorithms is not enabled
>        =20
>         I'm quite sure that I saw ECDHE and GCM in tests. I'll retest
>         tomorrow.
> It might be related to the GnuTLS version mess on my machine (Ubuntu
> has two versions installed).
>=20
> Let me know the results of your test.
>=20
>=20
>=20
>        =20
>         It is possible to de-configure these features in GnuTLS.
>        =20
>         >   * sample TLS netplex configuration is missing some ";" for
>         each
>         > sections
>         >
>         >
>         > Do you have the same behavior? It might be linked to my
>         GnuTLS
>         > version.
>         > Did you manage to enable higher-end ciphersuites and PFS
>         suites?
>        =20
>         Gerd
>        =20
>         >
>         > Thanks for the feedback.
>         >
>         >
>         > Thomas.
>         >
>         >
>         >
>         >
>         >
>         -----------------------------------------------------------------=
-------------
>         > One dashboard for servers and applications across
>         Physical-Virtual-Cloud
>         > Widest out-of-the-box monitoring support with 50+
>         applications
>         > Performance metrics, stats and reports that give you
>         Actionable Insights
>         > Deep dive visibility with transaction tracing using APM
>         Insight.
>         > http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
>         > _______________________________________________
>         > Ocamlnet-devel mailing list
>         > [email protected]
>         > https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel
>        =20
>         --
>         ------------------------------------------------------------
>         Gerd Stolpmann, Darmstadt, Germany    [email protected]
>         My OCaml site:          http://www.camlcity.org
>         Contact details:        http://www.camlcity.org/contact.html
>         Company homepage:       http://www.gerd-stolpmann.de
>         ------------------------------------------------------------
>        =20
>=20
>=20

--=20
------------------------------------------------------------
Gerd Stolpmann, Darmstadt, Germany    [email protected]
My OCaml site:          http://www.camlcity.org
Contact details:        http://www.camlcity.org/contact.html
Company homepage:       http://www.gerd-stolpmann.de
------------------------------------------------------------


--=-CM11ap/RbHdeXgg/aEig
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAABAgAGBQJVT1aNAAoJEAaM4b9ZLB5TdFUH/RMZfTWSEn/mlCzQd0RS9ByE
8lTE964dj2GkaZi+TmMKjvXzCi52lbJEcrkA7xjEzJQVT5UoSMhRVlwcZIG/SGDQ
8dAE8Hk/vx8UZyUc0YI2aU6JDPsqaZRFUWx9XSDBF2Fy0ywRFGGGbDD8sdCKy+kS
3o5uT6mFPQksews/edLttMIba/lrSiJNxvDmDUNbSj8SvQ26OBTyAcMU63l8F1Sw
zbcTcyCzoXFkUxDZEimh5vLRboHlqJYVGovC0Rm7BgSGaHXxcQNTLN0xCAK+aTIb
plgFvh5vELuSYjKrSTfq2vXDUunYcCafkDjP60xQ/vjnyKc9ZUCM7yEUEpDgg6M=
=B5Mt
-----END PGP SIGNATURE-----

--=-CM11ap/RbHdeXgg/aEig--



--===============1244733247532245347==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
One dashboard for servers and applications across Physical-Virtual-Cloud 
Widest out-of-the-box monitoring support with 50+ applications
Performance metrics, stats and reports that give you Actionable Insights
Deep dive visibility with transaction tracing using APM Insight.
http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
--===============1244733247532245347==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ocamlnet-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel

--===============1244733247532245347==--