Marc,
It seems that the TLS stack is completely lacking client-side server certificate validation. There are now two open issues on github (#200 and #312 which I just opened).
This is a real security problem, as not having certificate validation defeats the whole purpose of TLS.
Can we do something about it?
-- vyzo
Afficher les réponses par date
Clearly something has to be done! I didn’t write that code, so perhaps someone with more experience with OpenSSL should take a look at it.
Marc
On Nov 15, 2017, at 4:17 AM, Dimitris Vyzovitis vyzo@hackzen.org wrote:
Marc,
It seems that the TLS stack is completely lacking client-side server certificate validation. There are now two open issues on github (#200 and #312 which I just opened).
This is a real security problem, as not having certificate validation defeats the whole purpose of TLS.
Can we do something about it?
-- vyzo
Seems that it's a matter of using SSL_CTX_set_verify on the tls context, with SSL_VERIFY_PEER. See https://wiki.openssl.org/index.php/Manual:SSL_CTX_set_verify(3)
-- vyzo
On Wed, Nov 15, 2017 at 2:33 PM, Marc Feeley feeley@iro.umontreal.ca wrote:
Clearly something has to be done! I didn’t write that code, so perhaps someone with more experience with OpenSSL should take a look at it.
Marc
On Nov 15, 2017, at 4:17 AM, Dimitris Vyzovitis vyzo@hackzen.org
wrote:
Marc,
It seems that the TLS stack is completely lacking client-side server certificate validation. There are now two open issues on github (#200 and #312 which I just opened).
This is a real security problem, as not having certificate validation defeats the whole purpose of TLS.
Can we do something about it?
-- vyzo
Sure, working up Gambit's built-in OpenSSL API integration to work as a client for ordinary usecases, works.
The outcome will be something like ~5,000-10,000 lines of integration code, that requires some degree of continuous maintenance. For comparison, LibCurl's integration is in the range 3600 - 7000 lines, https://github.com/ curl/curl/blob/master/lib/vtls/openssl.c https://github. com/curl/curl/blob/master/lib/vtls/vtls.c https://github. com/curl/curl/blob/master/lib/vtls/schannel.c .
Please remember that SSL domain validation only is the tip of the iceberg though, in such a way that in particular for server usecases and also for more sophisticated client usecases, OpenSSL's unending quirks (and very low code quality) lead you to need an application-level solution anyhow.
( I suggest SSL domain name validation is only the tip of the iceberg, you'll want to * negotiate the right ciphers with the right settings, * configure exact TLS/SSL versions supported, * cap TSL renegotiation ability, * in server mode deliver more TLS certificates on the same TLS server (IP), * read certificates from binary blobs and generate local certificates, * and then finally someone will like to do a non-TSL handshake/warmup before the TLS takes over, or do TLS over something else than a TCP port. )
On my TODO is to implement a proof of concept application layer ports for Gambit. After reading _io.scm a couple of times and talking to Vyzo about it, I was struck with a sense of confidence that I could actually do it heh.
2017-11-16 1:09 GMT+08:00 Dimitris Vyzovitis vyzo@hackzen.org:
Seems that it's a matter of using SSL_CTX_set_verify on the tls context, with SSL_VERIFY_PEER. See https://wiki.openssl.org/index.php/Manual:SSL_CTX_set_verify(3)
-- vyzo
On Wed, Nov 15, 2017 at 2:33 PM, Marc Feeley feeley@iro.umontreal.ca wrote:
Clearly something has to be done! I didn’t write that code, so perhaps someone with more experience with OpenSSL should take a look at it.
Marc
On Nov 15, 2017, at 4:17 AM, Dimitris Vyzovitis vyzo@hackzen.org
wrote:
Marc,
It seems that the TLS stack is completely lacking client-side server certificate validation. There are now two open issues on github (#200 and #312 which I just opened).
This is a real security problem, as not having certificate validation defeats the whole purpose of TLS.
Can we do something about it?
-- vyzo
Gambit-list mailing list Gambit-list@iro.umontreal.ca https://webmail.iro.umontreal.ca/mailman/listinfo/gambit-list