Sure, working up Gambit's built-in OpenSSL API integration to work as a client for ordinary usecases, works.

The outcome will be something like ~5,000-10,000 lines of integration code, that requires some degree of continuous maintenance. For comparison, LibCurl's integration is in the range 3600 - 7000 lines, https://github.com/curl/curl/blob/master/lib/vtls/openssl.c https://github.com/curl/curl/blob/master/lib/vtls/vtls.c https://github.com/curl/curl/blob/master/lib/vtls/schannel.c .


Please remember that SSL domain validation only is the tip of the iceberg though, in such a way that in particular for server usecases and also for more sophisticated client usecases, OpenSSL's unending quirks (and very low code quality) lead you to need an application-level solution anyhow.

(
I suggest SSL domain name validation is only the tip of the iceberg, you'll want to
 * negotiate the right ciphers with the right settings,
 * configure exact TLS/SSL versions supported,
 * cap TSL renegotiation ability,
 * in server mode deliver more TLS certificates on the same TLS server (IP),
 * read certificates from binary blobs and generate local certificates,
 * and then finally someone will like to do a non-TSL handshake/warmup before the TLS takes over, or do TLS over something else than a TCP port.
)


On my TODO is to implement a proof of concept application layer ports for Gambit. After reading _io.scm a couple of times and talking to Vyzo about it, I was struck with a sense of confidence that I could actually do it heh.



2017-11-16 1:09 GMT+08:00 Dimitris Vyzovitis <vyzo@hackzen.org>:
Seems that it's a matter of using SSL_CTX_set_verify on the tls context, with SSL_VERIFY_PEER.
See https://wiki.openssl.org/index.php/Manual:SSL_CTX_set_verify(3)

-- vyzo

On Wed, Nov 15, 2017 at 2:33 PM, Marc Feeley <feeley@iro.umontreal.ca> wrote:
Clearly something has to be done! I didn’t write that code, so perhaps someone with more experience with OpenSSL should take a look at it.

Marc



> On Nov 15, 2017, at 4:17 AM, Dimitris Vyzovitis <vyzo@hackzen.org> wrote:
>
> Marc,
>
> It seems that the TLS stack is completely lacking client-side server
> certificate validation. There are now two open issues on github (#200
> and #312 which I just opened).
>
> This is a real security problem, as not having certificate validation
> defeats the whole purpose of TLS.
>
> Can we do something about it?
>
> -- vyzo
>



_______________________________________________
Gambit-list mailing list
Gambit-list@iro.umontreal.ca
https://webmail.iro.umontreal.ca/mailman/listinfo/gambit-list