On 12/10/2012 03:05 AM, Patrick Pelletier wrote:
So I had been thinking it couldn't be done with the callback. However, after re-reading the manpage for SSL_CTX_set_verify, it sounds like it does get called on success, and is given the opportunity to fail the connection. So perhaps I could call validate_hostname() from inside the callback after all. I just haven't seen it done that way, but I'll give it a try and see if it works.
The problem with this is that the callback set with SSL_CTX_set_verify is called once for *each* certificate in the chain, starting with the certificate authority, working its way through the intermediate certificates (if any) and ending with the server's certificate. The server certificate is the one I want to check the hostname of. But how do I tell when my callback is being called for the *last* time? That seems to be a fundamentally intractable problem.
The moment to do this: ... - SSL_connect() returns without a failure - <here and other post SSL connect checks> - continue handing over the (SSL *) ...Yeah, I'd been thinking that might be the only way to do it, before I went back and re-read the SSL_CTX_set_verify documentation. But it seems like the disadvantage of doing the connect before handing the SSL over to libevent is that then the connect has to be synchronous, right? The handshake wouldn't be event-driven.
So, is that what everybody else does? Just do the handshake synchronously and then hand it over to libevent after performing the handshake and checking the certificate?
--Patrick *********************************************************************** To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxx with unsubscribe libevent-users in the body.