Re: Like OpenSSL::SSL::SSLSocket#connect_nonblock

[Eric Wong <normalperson@yhbt.net>]

Iñaki Baz Castillo <ibc@aliax.net> wrote:
> 2012/4/9 Iñaki Baz Castillo <ibc@aliax.net>:
> > Hi Eric, the doc says:
> >
> > -------------------
> > Kgio::SSLConnector
> > Like Kgio::SSL, but for SSL/TLS clients that connect to clients, not
> > SSL/TLS servers.
> > -------------------
> >
> > So, if the doc wrong? maybe it should say:
> >
> > "Like Kgio::SSL, but for SSL/TLS clients that connect to *servers*,
> > not SSL/TLS servers."
> >
> > :)

Correct, can you send a patch for this?

> -------------------
> Kgio::SSLConnector.new(io, ssl_ctx, hostname, session = nil)
> 
> Initializes and SSL/TLS client socket. Like Kgio::SSL.new, except
> hostname is required for verification and session may be specified as
> an OpenSSL::SSL::Session object.
> -------------------
> 
> 
> Two points:
> 
> 1) The doc should say "Initializes an SSL/TLS client socket." :)

Also correct, patch? :)

> 2) What does it mean "hostname is required for verification"? I hope
> it does not mean that "hostname" is a required argument and it's
> matched against the CommonName field in the server certificate. That
> would be a really ugly limitation of certificate validation since
> there are other ways to validate a certificate (i.e. SubjectAltName
> fields).

(I'm not remotely close to being an SSL expert, and kgio-monkey includes
 plenty of disclaimers :)

The hostname should be matched against CommonName and/or SubjectAltName

kgio-monkey calls SSL_set_tlsext_host_name() and
OpenSSL::SSL.verify_certificate_identity (for SubjectAltName), so one of
the methods for handling hostname verification _should_ work.