[PATCH] Fix issue #1330: accept server cert permanently, take 2

[Tobias Ringstrom <to...@ringstrom.mine.nu>]

There was a minor problem with the old patch. The code in the function 
server_ssl_file_first_credentials did not check if the cert had expired 
or if the hostname was incorrect. An updated patch and log message are 
attached.

/Tobias


Log message:
Fix issue #1330: accept server cert permanently

User visible changes
====================

If the server cert is signed by an unknown CA, but is otherwise fine,
the user can choose to reject the cert, to accept it temporarily or to
accept it permanently.

If the server certificate has other problems (incorrect hostname, not
yet valid or expired), the user can coose to reject the cert or to
accept it temporarily.

The ssl-ignore-* server configuration options are now gone because they
are insecure. Subversion mostly behaves in the same way as Mozilla and
other web browsers.

Implementation details
======================

See the implementation proposal in notes/server-cert-revamp.txt.

subversion/include/svn_config.h
   Remove the ssl-ignore-* config options.

subversion/include/svn_auth.h
   (svn_auth_cred_server_ssl_t): Replace failures_allow with
   trust_permanantly.
   (svn_auth_ssl_server_prompt_func_t): Add the text encoded cert to
   the arguments of the server cert prompt function prototype.

subversion/libsvn_subr/config_file.c
   (ensure_auth_dirs): Create the SVN_AUTH_CRED_SERVER_SSL auth dir.
   (svn_config_ensure): Remove the ssl-ignore-* config options from the
   template servers file.

subversion/libsvn_client/auth.c
   (ssl_server_file_provider_baton_t): New type
   (server_ssl_file_first_credentials): Rewritten to look for the cert
   in the auth system. Only accept the cert if the only problem is that
   the CA is unknown.
   (server_ssl_file_save_credentials): New function used to store a
   cert in the auth system.
   (svn_client_get_ssl_server_file_provider): Allocate a provider baton
   and initialize the provider type in the baton.
   (server_ssl_prompt_first_cred): Pass the realmstring (which is the
   text encoded certificate) to the prompt function.

subversion/clients/cmdline/cl.h
   (svn_cl__auth_ssl_server_prompt): Add the text_cert argument to the
   prompt prototype.

subversion/clients/cmdline/prompt.c
   (svn_cl__auth_ssl_server_prompt): Rewritten to decode the supplied
   text encoded cert, present an informative prompt to the user, and
   create the appropriate credentials.

subversion/libsvn_ra_dav/session.c
   (server_ssl_callback): Export the cert to a text string and use that
   as the realm string. Save credentials permanently if requested.

Re: [PATCH] Fix issue #1330: accept server cert permanently, take 2

[Tobias Ringstrom <to...@ringstrom.mine.nu>]

Justin Erenkrantz wrote:
> --On Thursday, September 11, 2003 2:05 PM +0200 Tobias Ringstrom 
> <to...@ringstrom.mine.nu> wrote:
> 
>> If the server certificate has other problems (incorrect hostname, not
>> yet valid or expired), the user can coose to reject the cert or to
>> accept it temporarily.
> 
> I think the user should be allowed to accept it permanently even with 
> these errors.  Most web browsers will allow this.  -- justin

I'm not sure what you mean. I just tried IE 6.0 SP1 and Mozilla 1.4 on 
both Windows and Linux and while you can choose to trust the cert 
permanently, you still get warned every time that the cert has expired 
and that the hostname is incorrect.

Ahh. I guess you mean that Subversion should allow the cert to be 
stored permanently and not warn for future connections that the cert 
cannot be verified, but do warn if the cert has expired or if the 
hostname is wrong. I think that's reasonable.

Unless someone objects, I'll add that to the patch (as well as the two 
ssl-ignore options).

/Tobias


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org

Re: [PATCH] Fix issue #1330: accept server cert permanently, take 2

[Justin Erenkrantz <ju...@erenkrantz.com>]

--On Thursday, September 11, 2003 2:05 PM +0200 Tobias Ringstrom 
<to...@ringstrom.mine.nu> wrote:

> If the server certificate has other problems (incorrect hostname, not
> yet valid or expired), the user can coose to reject the cert or to
> accept it temporarily.

I think the user should be allowed to accept it permanently even with these 
errors.  Most web browsers will allow this.  -- justin

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org