Rework tls internals #78
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Owner
jetmore
commented
Dec 3, 2023
jetmore
commented
- Reorganize TLS internals to make support easier
- Switch method for getting peer certs, making debug way more reliable
- Clean up the output when we print local and peer cert info, make it more compact and uniform
The goal of this action is to produce a copy/pastable version of the comand that was run for human debugging bugfix: it did not properly preserve quoted arguments. It turned "--pipe 'smtp-server.pl --arg 1 --foo 2'" into "--pipe smtp-server.pl --arg 1 --foo 2". It now maintains the quoting improvement: now adds backslashes and newlines after every option/arg pair to make it way easier to read
no logic changes, just breaking the starttls method into logical groupings to make it easier to work on
Previously I saved copies of each cert I saw in the verify callback function. This had all sorts of problems, including sometimes causing duplicates to appear, sometimes causing certs to appear that weren't presented (I think these were certs from the local CA, though this was not reliable enough to be useful), and getting different verification callbacks between macos/debian and freebsd, meaning testing wasn't working well on freebsd. The solution is to skip getting the certs from verify and just get them directly from get_peer_cert_chain. This is way, way more reliable and reproducible
- remove notBefore - move notAfter, serverAltName, and commonName to one line - wrap all in [], get rid of spaces cushioning subjectAltName - change DN= to subject=, wrap it in [] instead of double quotes - use peer/local[0] regardless of whether there's more than one cert
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.