mesos-reviews mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Alexander Rukletsov <ruklet...@gmail.com>
Subject Re: Review Request 70749: WIP: Use openssl hostname validation.
Date Tue, 04 Jun 2019 13:38:21 GMT


> On June 4, 2019, 11:39 a.m., Alexander Rukletsov wrote:
> > 3rdparty/libprocess/src/posix/libevent/libevent_ssl_socket.cpp
> > Lines 530-533 (patched)
> > <https://reviews.apache.org/r/70749/diff/1/?file=2147044#file2147044line530>
> >
> >     Does it mean that hostname validation with the help of openssl is not supported
for clients?
> 
> Benno Evers wrote:
>     I'm not sure I understand your question? This comment is basically talking about
the issue addressed in the follow-up review in the chain.
>     
>     It is supported for clients, but does not add as much security as intended until
this TODO is fixed.

What I meant is that currently, i.e., `legacy`, hostname validation is also performed in the
server mode, i.e., for clients. With `hostname_validation_algorithm=openssl` and `require_cert=true`,
will hostname validation be performed for client certificates as it would be with `hostname_validation_algorithm=legacy`?


- Alexander


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70749/#review215673
-----------------------------------------------------------


On May 31, 2019, 3:47 p.m., Benno Evers wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/70749/
> -----------------------------------------------------------
> 
> (Updated May 31, 2019, 3:47 p.m.)
> 
> 
> Review request for mesos, Alexander Rukletsov and Joseph Wu.
> 
> 
> Bugs: MESOS-9809
>     https://issues.apache.org/jira/browse/MESOS-9809
> 
> 
> Repository: mesos
> 
> 
> Description
> -------
> 
> WIP: Use openssl hostname validation.
> 
> 
> Diffs
> -----
> 
>   3rdparty/libprocess/include/process/ssl/flags.hpp f3483f97f93bb29117b2c78f0f2ed9735d9c4b3a

>   3rdparty/libprocess/src/openssl.hpp 17bec246e516261f8d772f1647c17f092fae82d1 
>   3rdparty/libprocess/src/openssl.cpp e7dbd67913fa8e7fbbf60dee428e7e38895f86ce 
>   3rdparty/libprocess/src/posix/libevent/libevent_ssl_socket.cpp 29a1bf71c1df9d80370455a6269ecea0ec4193b0

> 
> 
> Diff: https://reviews.apache.org/r/70749/diff/1/
> 
> 
> Testing
> -------
> 
> 
> Thanks,
> 
> Benno Evers
> 
>


Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message