Re: TLS feature when migrating from OCamlnet 3.x to 4.x

--===============4467187116347975454==
Content-Type: multipart/signed; micalg="pgp-sha1";
	protocol="application/pgp-signature"; 
	boundary="=-X5X050A1utn/PfEb7iVO"


--=-X5X050A1utn/PfEb7iVO
Content-Type: text/plain; charset="ISO-8859-15"
Content-Transfer-Encoding: quoted-printable

Am Mittwoch, den 25.11.2015, 10:50 +0000 schrieb Thomas Calderon:
> Hi,
>=20
>=20
> Our project, Caml Crush, a PKCS#11 proxy in OCaml uses OCamlnet
> Netplex and RPC layer.
>=20
>=20
> We have been migrating from OCamlnet 3.x to OCamlnet 4.x during the
> last months and we had some questions regarding the newly released TLS
> bindings.
>=20
>=20
> In our code compatible with Ocamlnet 3.x SSL bindings (through
> OCaml-ssl), we are using the Ssl.get_certificate OCaml-ssl call in the
> 'get_peer_user_name' server hook to get and dump the peer client
> certificate (this allows us to check this certificate against a white
> list on the server side).
>=20
>=20
> We would like to have the same degree of control with the 4.x release
> of OCamlnet.
>=20
>=20
> After some digging in OCamlnet 4.x TLS code, we have not found an API
> providing the Ssl.get_certificate service. Did we miss something? Is
> it possible to emulate such a feature?

=46rom the RPC server you get the certificate this way:

let props =3D Rpc_server.get_tls_session_props session

then, there are a couple of methods for props, in particular
peer_credentials_raw for getting the DER encoding of the certificate,
and peer_credentials for a structured view of the certificate (see the
Netx509 module for accessing the components). There is also a utility
function Nettls_support.get_tls_user_name.

For a fingerprint of a certificate, the common method is to use a digest
(usually SHA-1) of the DER encoding.

If you want to check the peer certificate earlier (before receiving
data), there is also the verify callback in the TLS configuration (arg
of Netsys_tls.create_x509_config; get the certificate with the
get_peer_creds function of the provider module; I guess this is what you
are missing: remember that the TLS provider is a first-class module, and
you can call functions of this module:

let provider =3D Netsys_crypto.current_tls()

let verify endpoint p_trust p_hostmatch =3D
  let module P =3D (val provider : Netsys_crypto_types.TLS_PROVIDER) in
  let cert =3D P.get_peer_creds endpoint in
  p_trust && p_hostmatch && my_check cert

let tls_config =3D=20
  Netsys_tls.create_x509_config
    ...
    ~verify
    provider

).

> Also, the current implementation does not allow to have a separate
> trust chain (one for the server and one for the clients when peer_auth
> is enabled). This would be a welcome addition.

Hmm, why do you need the trust chain for the server? The trust chain
always refers to the peer, AFAIK.

Gerd

>=20
>=20
> Thanks in advance for your help,
>=20
>=20
> Thomas
> -------------------------------------------------------------------------=
-----
> Go from Idea to Many App Stores Faster with Intel(R) XDK
> Give your users amazing mobile app experiences with Intel(R) XDK.
> Use one codebase in this all-in-one HTML5 development environment.
> Design, debug & build mobile apps & 2D/3D high-impact games for multiple =
OSs.
> http://pubads.g.doubleclick.net/gampad/clk?id=3D254741551&iu=3D/4140
> _______________________________________________
> Ocamlnet-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel

--=20
------------------------------------------------------------
Gerd Stolpmann, Darmstadt, Germany    [email protected]
My OCaml site:          http://www.camlcity.org
Contact details:        http://www.camlcity.org/contact.html
Company homepage:       http://www.gerd-stolpmann.de
------------------------------------------------------------


--=-X5X050A1utn/PfEb7iVO
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAABAgAGBQJWWJ6WAAoJEAaM4b9ZLB5TnNoH/iNbd1io4pQh/TVzf2YObbdi
2WqF10b8MPqpv2nuKrl56ChMvb4qoSckdTf2cEAvQ2/MVtQJw6is9JI7rV0iOJ+s
hiqmrdpJbwLMz6ydKQ8kU5GzdQ1q40v1/uG2HCayqfl9znRZpu65edyBFapk3HqD
VCqxJ+sw4zEVns3ACrpIgB3aI1wRYbwVny/WJ6mvHodrmTR3FKyCuF2WqFCDSYjU
qUlfWtUE8PUPBqCARut7SoJcI+BD4rVYHwMvwt+ii/f8iOAS3S1RmdPbHx+qfTl4
vypQtDGMJtaZr2KhvjtiikaflTq9vEZMc+wR9fae5ZRjY2bN0v9g7YtCzO4mTPU=
=uSx2
-----END PGP SIGNATURE-----

--=-X5X050A1utn/PfEb7iVO--



--===============4467187116347975454==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------

--===============4467187116347975454==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ocamlnet-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel

--===============4467187116347975454==--