Hey!
Ok, so I sat down and "packaged" some fixes to mainly iOS SqueakSSL that we have done here at 3DICC. We have no intention to keep stuff like this for ourselves, but daily we work using our own repos so it needs some attention and time to get it out there :)
Sorry if this email is long but I just wanted to make it easy for people to know how to integrate this.
The fixes span:
* A new SqueakSSL Monticello package, that has other fixes too done at 3DICC. I haven't looked through them all in detail, so here a bit of manual cherry picking is needed. For example we removed some "compatibility code" for Squeak 4.2 causing us some problems.
* Modified platform files: platforms/Cross/plugins/SqueakSSL/SqueakSSL.h platforms/iOS/plugins/SqueakSSL/sqMacSSL.c platforms/unix/plugins/SqueakSSL/sqUnixOpenSSL.c platforms/win32/plugins/SqueakSSL/sqWin32SSL.c
I have so far only tested the new sqMacSSL.c on iOS - OSX 10.8.5. The changes in the other platforms are not complicated, its about being able to disable certificate check mainly so I don't think they should fail.
As of now SqueakSSL-Tests show 14 run, 3 passes, 8 expected failures and 3 errors on my Mac. The errors still left are: testSSLSockets, testSocketAccept, testSocketConnect. AFAIK all these try to use a test certificate and Accept - and *that* I haven't implemented on Mac (well, ok, I started - there is a way to at least set a Mac test cert into the plugin - but I didn't go further).
New methods in the classes:
SqueakSSL,SecureSocketStream>>certVerify: aBoolean Now one can tell the plugin to verify certs or just skip that.
SqueakSSL,SecureSocketStream>>logLevel: anInteger Now one can set the logLevel in the plugin, 0 or 1 so far.
Attached ssl-fix.zip which contains: . ├── platforms │ ├── Cross │ │ └── plugins │ │ └── SqueakSSL │ │ └── SqueakSSL.h │ ├── iOS │ │ └── plugins │ │ └── SqueakSSL │ │ └── sqMacSSL.c │ ├── unix │ │ └── plugins │ │ └── SqueakSSL │ │ └── sqUnixOpenSSL.c │ └── win32 │ └── plugins │ └── SqueakSSL │ └── sqWin32SSL.c ├── SqueakSSL-Core-gk.36.mcz ├── SqueakSSL-Tests-ar.17.mcz └── ssl-fix.patch
I threw in the latest SqueakSSL-Core and Tests that we have here at 3DICC. The Tests package is the same as on SS. The Core has 4 more fixes from Ron I think, just look in "History" to see commit messages there.
ssl-fix.patch - this should show you what I have done in the platform files, and I produced it using git diff on those four files with this command:
git diff 83bce99715cddd8a82c3d94c487e45ec0213be19 platforms/Cross/plugins/SqueakSSL/SqueakSSL.h platforms/iOS/plugins/SqueakSSL/sqMacSSL.c platforms/unix/plugins/SqueakSSL/sqUnixOpenSSL.c platforms/win32/plugins/SqueakSSL/sqWin32SSL.c > ssl-fix.patch
The SHA is:
commit 83bce99715cddd8a82c3d94c487e45ec0213be19 Author: Camillo Bruni camillobruni@gmail.com Date: Fri Nov 15 12:24:11 2013 +0100
fixed wrong path ------------------------------
...phew. Ok, let me know if you need anything more and ask questions.
regards, Göran
Hi guys!
Ok, soo.... obviously I now noted these files didn't include the latest tweaks from Levente (mem leaks) etc. Just a heads up.
Let's now move this thread to vm-dev only - don't want to spam squeak-dev nor pharo-dev. I presume people interested track vm-dev.
So if you reply - stick to vm-dev. :)
regards, Göran
Göran Krampe wrote
...phew. Ok, let me know if you need anything more and ask questions.
regards, Göran
Hi Göran,
On the Seaside Dev list there was a discussion about accessing RAND_bytes from OpenSSL via the SqueakSSL plugin for secure key generation. Is that something that would be possible to add to the SqueakSSL plugin at this time?
The discussion is here:
http://forum.world.st/Seaside-Security-td4742433.html
Thanks
Paul
-- View this message in context: http://forum.world.st/SqueakSSL-fixes-tp4743244p4744392.html Sent from the Squeak VM mailing list archive at Nabble.com.
From: Paul DeBruicker
Göran Krampe wrote
...phew. Ok, let me know if you need anything more and ask questions.
regards, Göran
Hi Göran,
On the Seaside Dev list there was a discussion about accessing RAND_bytes from OpenSSL via the SqueakSSL plugin for secure key generation. Is that something that would be possible to add to the SqueakSSL plugin at this time?
The discussion is here:
Hi Paul,
I may be missing something so maybe you could answer a question for me. The best cryptography is the simplest for developers to implement. I understand wanting to provide crypto components, that's what we did with the Cryptography Team. SqueakSSL is a much better solution for adding security to end user (developers) of seaside. The reason for this is that all of the technical details are left for the professionals. SqueakSSL uses OpenSSL on Linux and the windows security implementation on windows, and the apple security implementation on mac. You really can't get better than that. SqueakSSL eliminates your need for PRNG, since it is used and implemented properly on each platform. So given that, why do you need PRNG? If you are implementing your own secure stream, you had better know what you are doing, in which case PRNG becomes less of an issue, since there are a lot of platform specific solutions.
If you are sure you need it we did one in Cryptography which might be useful. If you really feel like you need a proper platform specific random generator see the Croquet plugin and TCryptoRandom.
Also if you are planning on using SSL on a Linux server I would highly recommend using STUD.
All the best,
Ron Teitelbaum
Thanks
Paul
-- View this message in context: http://forum.world.st/SqueakSSL-fixes- tp4743244p4744392.html Sent from the Squeak VM mailing list archive at Nabble.com.
Hi Ron,
I agree with everything you said. Its my undesrtanding that the use of the PRNG data will be for things like the Seaside specific _s session keys and _k callback keys and cookies. Not any kind of secure streaming protocol. Since SqueakSSL now ships with Eliot's vm and the pharo vm it seems like a convenient, better source than the Random class on those platforms.
Thanks
Paul
Ron Teitelbaum wrote
From: Paul DeBruicker
Göran Krampe wrote
...phew. Ok, let me know if you need anything more and ask questions.
regards, Göran
Hi Göran,
On the Seaside Dev list there was a discussion about accessing RAND_bytes from OpenSSL via the SqueakSSL plugin for secure key generation. Is that something that would be possible to add to the SqueakSSL plugin at this time?
The discussion is here:
Hi Paul,
I may be missing something so maybe you could answer a question for me. The best cryptography is the simplest for developers to implement. I understand wanting to provide crypto components, that's what we did with the Cryptography Team. SqueakSSL is a much better solution for adding security to end user (developers) of seaside. The reason for this is that all of the technical details are left for the professionals. SqueakSSL uses OpenSSL on Linux and the windows security implementation on windows, and the apple security implementation on mac. You really can't get better than that. SqueakSSL eliminates your need for PRNG, since it is used and implemented properly on each platform. So given that, why do you need PRNG? If you are implementing your own secure stream, you had better know what you are doing, in which case PRNG becomes less of an issue, since there are a lot of platform specific solutions.
If you are sure you need it we did one in Cryptography which might be useful. If you really feel like you need a proper platform specific random generator see the Croquet plugin and TCryptoRandom.
Also if you are planning on using SSL on a Linux server I would highly recommend using STUD.
All the best,
Ron Teitelbaum
Thanks
Paul
-- View this message in context: http://forum.world.st/SqueakSSL-fixes- tp4743244p4744392.html Sent from the Squeak VM mailing list archive at Nabble.com.
-- View this message in context: http://forum.world.st/SqueakSSL-fixes-tp4743244p4744443.html Sent from the Squeak VM mailing list archive at Nabble.com.
From: Paul DeBruicker
Hi Ron,
I agree with everything you said. Its my undesrtanding that the use of the PRNG data will be for things like the Seaside specific _s session keys and _k callback keys and cookies. Not any kind of secure streaming protocol. Since SqueakSSL now ships with Eliot's vm and the pharo vm it seems like a convenient, better source than the Random class on those platforms.
Thanks
Paul
I guess the risk is that the PRNG is not SSL and I would hate to risk confusing developers about why it is there. Simple is definitely best where Cryto is concerned. Did you look at Croquet plugin? It has everything you need you could just pull the PRNG part out and ship it with a new PRNG plugin.
Ron
Ron Teitelbaum wrote
From: Paul DeBruicker
Göran Krampe wrote
...phew. Ok, let me know if you need anything more and ask questions.
regards, Göran
Hi Göran,
On the Seaside Dev list there was a discussion about accessing RAND_bytes from OpenSSL via the SqueakSSL plugin for secure key generation. Is that something that would be possible to add to the SqueakSSL plugin at this time?
The discussion is here:
Hi Paul,
I may be missing something so maybe you could answer a question for me. The best cryptography is the simplest for developers to implement. I understand wanting to provide crypto components, that's what we did with the Cryptography Team. SqueakSSL is a much better solution for adding security to end user (developers) of seaside. The reason for this is that all of the technical details are left for the professionals. SqueakSSL uses OpenSSL on Linux and the windows security implementation on windows, and the apple security implementation on mac. You really can't get better than that. SqueakSSL eliminates your need for PRNG, since it is used and implemented properly on each platform. So given that, why do you need PRNG? If you are implementing your own secure stream, you had better know what you are doing, in which case PRNG becomes less of an issue, since
there are a lot of platform specific solutions.
If you are sure you need it we did one in Cryptography which might be useful. If you really feel like you need a proper platform specific random generator see the Croquet plugin and TCryptoRandom.
Also if you are planning on using SSL on a Linux server I would highly recommend using STUD.
All the best,
Ron Teitelbaum
Thanks
Paul
-- View this message in context: http://forum.world.st/SqueakSSL-fixes- tp4743244p4744392.html Sent from the Squeak VM mailing list archive at Nabble.com.
-- View this message in context: http://forum.world.st/SqueakSSL-fixes- tp4743244p4744443.html Sent from the Squeak VM mailing list archive at Nabble.com.
vm-dev@lists.squeakfoundation.org
-
Göran Krampe -
Paul DeBruicker -
Ron Teitelbaum