[MESOS-9809] Use OpenSSL built-in functions for hostname validation

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.9.0
• Labels: foundations libprocess ssl-tls
• Epic Link: ssl-cert-verification
• Sprint: Mesos Foundations: RI15 Sp 48, Mesos Foundations: RI 15 Sp 49, Mesos Foundations: RI-16 Sp 50
• Story Points: 5
• Assignee: Unassigned
• Reporter: Benno Evers
• Created: 03/Jun/19 22:40
• Updated: 05/Jul/19 13:47
• Resolved: 05/Jul/19 13:47

Description

We traditionally use a hand-written hostname validation algorithm in libprocess that is based on the example code in https://wiki.openssl.org/index.php/Hostname_validation

However, since OpenSSL 1.1.0, there is a new built-in function API `SSL_set1_host()` that can be used to let OpenSSL handle hostname validation during the TLS handshake in a standardized manner.

We should take advantage of this when possible.

Issue Links

• supercedes: MESOS-9790 Libprocess does not use standard tooling for hostname validation.