Re: [9fans] encrypting 9P traffic
Import defaults to unencrypted, at least for me. Import and srv *should* default to TLS but it's not implemented. SSL is implemented for import but it's not the default. Yes, but like you said earlier, it's SSLv2, not SSLv3. However, pushtls is here (even if not used anywhere) and it's easy to implement it. I recently added TLS support in exportfs, import and cpu, but it's not finished yet. The main difference between tlssrvtunnel and import is that tlssrvtunnel is using the TLS handshake protocol, while import is using a custom handshake protocol, without certificate handling. So it depends on what you want. -- David du Colombier
Re: [9fans] encrypting 9P traffic
strange, cpu is definitely encrypted, and import uses cpu to start export on the remote machine so it should be encrypted too - unless I misunderstood. the fs protocol used by srv is not encrypted, I'am guessing because machines need to use it to boot and adding booting over encrypted links was too much hassle. Perhaps there where performance reasons too? -Steve
Re: [9fans] encrypting 9P traffic
Yes, but like you said earlier, it's SSLv2, not SSLv3. what's the advantage of using v3 for plan 9 connections? plan 9 uses only the record format of v2.
Re: [9fans] encrypting 9P traffic
Yes, but like you said earlier, it's SSLv2, not SSLv3. what's the advantage of using v3 for plan 9 connections? plan 9 uses only the record format of v2. exportfs, import and cpu are the three last commands still using devssl. When they will be migrated to devtls, devssl could be definitely removed. HTTP, SMTP, IMAP, POP and others already use both TLS 1.0 handshake and record protocols. It's easier to maintain a single encryption protocol than two. Moreover, if you want to interact with foreign implementations, they often don't implement SSL 2.0 anymore, or, at best, only support the standard and weak ciphers of SSL 2.0, and not the newest ones, standardized in TLS 1.0, 1.1, 1.2 and their extensions (mostly AES, SHA1 and SHA2). -- David du Colombier
Re: [9fans] encrypting 9P traffic
Import defaults to unencrypted, at least for me. Import and srv *should* default to TLS but it's not implemented. SSL is implemented for import but it's not the default. you can change the default. i'm sure there was a performance reason to make it not the default. (think of the import hidden in C.) it's probablly not a valid reason anymore. in fact, it would make sense to me to think about encrypting everything. say at the level of macsec. - erik
[9fans] encrypting 9P traffic
I'm preparing to go to Defcon next week, and to help avoid getting owned I'm planning to bring along a Plan 9 laptop. I'd like to be able to mount, say, my home fileserver while I'm there, but 9P traffic goes out unencrypted if you use srv rather than import -E ssl. This got me to fiddling with tlssrvtunnel and tlsclienttunnel, but I've run into some problems: (gozer is the cpu server, x61 is the terminal) gozer% tlssrvtunnel tcp!gozer!564 tcp!*!12345 cert.pem # I created cert.pem using auth/rsagen, rsa2x509, and pemencode listen started gozer% # I did sha1sum of cert.pem and, on the client side, created thumb containing x509 sha1=hash cn=*.myauthdomain where myauthdomain is the same domain I used to create the cert x61% tlsclienttunnel tcp!gozer!12345 tcp!*!564 thumb x61% srv net!x61!564 x61 x61% mount /srv/x61 /n/x61 mount: mount /n/x61: EOF receiving fversion reply I can't seem to find any mention of these programs in 9fans except for the initial announcement of their creation. Did I do something wrong along the way? I'm not very familiar with TLS so it's definitely possible. On a more general note, I've decided that probably the smartest option will be to import -E ssl myhomesystem /net (because after 9 years, import still doesn't support TLS or SSL v3) so I can essentially tunnel all communication out that way... I'll have to use the open wifi, since Plan 9 doesn't do WPA, and I wouldn't trust Defcon's WPA network either in any case. Can anyone think of a problem with this plan, besides the fact that anyone sniffing packets will figure out that the owner of jfloren.net is quite probably in attendance? John
Re: [9fans] encrypting 9P traffic
Shouldn't import and srv just default to tls?
Re: [9fans] encrypting 9P traffic
On Wed, Jul 27, 2011 at 4:49 PM, Lyndon Nerenberg lyn...@orthanc.ca wrote: Shouldn't import and srv just default to tls? x61% import -E tls gozer / /n/gozer import: gozer: tls has not yet been implemented As far as I can tell, srv doesn't even have an encryption option. Do a 9fs gozer, fire up snoopy, and start reading some files--you'll see the plaintext of the files (and all the rest of the 9p messages) whizzing past. John
Re: [9fans] encrypting 9P traffic
On Wed Jul 27 19:52:55 EDT 2011, j...@jfloren.net wrote: On Wed, Jul 27, 2011 at 4:49 PM, Lyndon Nerenberg lyn...@orthanc.ca wrote: Shouldn't import and srv just default to tls? x61% import -E tls gozer / /n/gozer import: gozer: tls has not yet been implemented As far as I can tell, srv doesn't even have an encryption option. Do a 9fs gozer, fire up snoopy, and start reading some files--you'll see the plaintext of the files (and all the rest of the 9p messages) whizzing past. this works for me. i've been using it for years. ; import -k 'user=hostowner' -E ssl minooka.coraid.com / /n/coraid ; echo bind /net/ether0/n/coraid/dev/aoe/ctl # ouch - erik
Re: [9fans] encrypting 9P traffic
On Wed Jul 27 19:50:05 EDT 2011, lyn...@orthanc.ca wrote: Shouldn't import and srv just default to tls? import, yes*. srv, no. - erik --- * thanks to its undocumented** protocol for negotiating encryption, etc. --- ** unless you count documentation like hardware vendors do. read the source code.
Re: [9fans] encrypting 9P traffic
On Wed, Jul 27, 2011 at 6:27 PM, erik quanstrom quans...@quanstro.net wrote: On Wed Jul 27 19:50:05 EDT 2011, lyn...@orthanc.ca wrote: Shouldn't import and srv just default to tls? import, yes*. srv, no. - erik --- * thanks to its undocumented** protocol for negotiating encryption, etc. --- ** unless you count documentation like hardware vendors do. read the source code. Import defaults to unencrypted, at least for me. Import and srv *should* default to TLS but it's not implemented. SSL is implemented for import but it's not the default. John
