Changes between Version 41 and Version 42 of CertMgr

Timestamp:

Jun 19, 2007, 4:18:53 PM (17 years ago)

Author:

wehlhard

Comment:

better organization

CertMgr

@@ -4 +4 @@
 This is [wiki:wehlhard William Ehlhardt]'s project for [wiki:SummerOfCode2007 Summer of Code]
 
-= Branch =
+== Branch ==
 im.pidgin.soc.2007.certmgr
+
+== Related Pages ==
+ * [wiki:CertMgr/Log Status Log]
+ * [wiki:CertMgr/ToDo Todo list]
 
 = Handy-dandy overview =
@@ -72 +76 @@
 
 The API for this hasn't been totally decided yet. However, the organization will look something like this:
+
 ~/.purple/certificates/cert_scheme_name/cert_pool/cert_unique_id(.pem?)
+
 So an example X.509 certificate might be stored as:
+
 ~/.purple/certificates/x509/tls_servers/gmail_com_1234567890abcdef1234567890abcdef.pem
+
 The keystore logic will be left mostly up to the relevant CertificatePool; these are only guidelines for how the CertificatePools should run their backends.
 
 == Miscellaneous API changes ==
 * Jabber (and possibly other protocols) use purple_ssl_connect_fd to create SSL connections, throwing out possibly important data about the other end of the connection (hostname, port number) in the process. In the interests of keeping this data intact, I propose adding a purple_ssl_connect_proxyconn that will create an SSL connection around a previously existing ProxyConnection instead of ripping out its file descriptor and starting anew.
-
-= Issues =
- * Jabber (and possibly others) use the purple_ssl_connect_fd function to build an SSL connection over a previously existing ProxyConnection. Since all the SSL side sees is the file descriptor in this case, hostname verification is impossible. (29 May)
- * talk.google.com gives back a gmail.com certificate?! (29 May)
-
-= Resolved Issues =
- * It looks like PKCS12 (the certificate import/export format) is supported by both libNSS and GnuTLS.
-
-= TODO =
- * General paranoia
- * Look at how the SILC prpl does its key management, especially the organization of the API used to check certs and interact with the user to verify them.
- * Add some way of passing useful error messages back up out of the SSL interface (23 May)
- * Fix purple_ssl_init in sslconn.c; it doesn't do anything (23 May)
-  * Talking to nosnilmot suggests that this ought to just be removed outright (24 May)
- * Figure out libNSS everything. (25 May)
- * Why am I getting single-byte serial numbers from servers? (25 May)
- * Work out how to use Glib functions for time checking on certificates. (29 May)
- * Stall the timeouts on the TCP connection while waiting for user input on SSL? (29 May)
- * Worry about ensuring that plugins don't kill in-use ciphers/certschemes when unloaded? (29 May)
- * GnuTLS and NSS should probably be configured to use g_malloc and g_free for paranoia's sake (1 June)
-
-= Tasks done =
- * Figure out how to get key fingerprints out of GnuTLS (25 May, 25 May))
 
 = Status =
@@ -113 +98 @@
 ||get_peer_certificates||Written, untested, Exposed||Not started||Not started||
 
-== 1 June 2007 ==
-Well, I'm not so sure about the API structure now. It seems so complex that I can't get a good handle on it or where to start. I need to think about this more; in the meantime, I am implementing some of the logic that I know that the SSL plugins will need to provide, such as functions to load certificates from files.
 
-== 30 May 2007 ==
-I think that I have enough of the API planned out that I can begin implementing it. There may be some further separation of the CertificateScheme structure, but I think that most of the backend functions are ready to be written into the SSL plugin.
-
-== 29 May 2007 ==
-With some prodding from Ethan, a lot of stuff came together for me design-wise today. I got a substantial part of the API changes laid out.
-
-== 25 May 2007 ==
-Divergence point reached. With the addition of purple_base16_encode_chunked, my changes will force at least a minor version increment.
-Slapped some code into the GnuTLS SSL plugin and looked at the certificate characteristics coming back. But why am I getting single-byte serial number values back? How large should these serial numbers be?
-
-== 23 May 2007 ==
-Using "Document the SSL interface as it exists now" as an excuse to build a branch and learn Doxygen
-== 17 May 2007 ==
-Reading documentation. Lots of it.
-