edicl / drakma

HTTP client written in Common Lisp
http://edicl.github.io/drakma/
248 stars 58 forks source link

LispWorks: Fix SSL verification #114

Closed tdrhq closed 3 years ago

tdrhq commented 3 years ago

By default COMM:ATTACH-SSL doesn't doesn't do certificate verification, there needs to be an extra step to configure the SSL object, which is what this pull request does. Tests are passing now (it was failing earlier)

Communication from Martin Simmons from Lispworks when I checked this with him:

Hi Arnold,

LispWorks doesn't verify the certificate by default.  You need to use
comm:set-verification-mode to make it do this (see the example below).

Note that it can also be used inside the configuration callbacks that
can be passed to comm::open-tcp-stream, and also can be used on each
comm:ssl-pointer rather than on the comm:ssl-ctx-pointer.

The point of using the callbacks is to avoid the need to explicitly
create the ssl-ctx before calling comm:open-tcp-stream.

-------------------------------
(defvar *my-verifying-ctx* nil)
;;; initialize-verifying-ctx is assumed to be called once at run time during
;;; initialization of the application. 
(defun initialize-verifying-ctx ()
   (let ((ctx (comm:make-ssl-ctx ::ssl-side :client))) 
     (comm:set-verification-mode ctx :client :always nil) 
     ;; ... other configuration
     (setq *my-verifying-ctx* ctx)))
---------------------------

CL-USER 3 > (initialize-verifying-ctx)
#<SSL-CTX-POINTER = #x100223DF0 {CLIENT}>

CL-USER 4 > (comm:open-tcp-stream "google.com" 443 :ssl-ctx *my-verifying-ctx*)
#<COMM:SOCKET-STREAM 402001C02B>

CL-USER 5 > (comm:open-tcp-stream "self-signed.badssl.com" 443 :ssl-ctx *my-verifying-ctx*)

Error: SSL failure in #<COMM:SOCKET-STREAM 402001EEFB>: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
  1 (abort) Return to level 0.
  2 Restart top-level loop.

Type :b for backtrace or :c <option number> to proceed.
Type :bug-form "<subject>" for a bug report template or :? for other options.
tdrhq commented 3 years ago

hmm, hold on, this isn't completely right

tdrhq commented 3 years ago

This actually fails on the happy path with :verify :required, let me dig in and see what's going on and send another PR