Skip Menu |

This queue is for tickets about the IO-Socket-SSL CPAN distribution.

Report information
The Basics
Id: 105936
Status: rejected
Priority: 0/
Queue: IO-Socket-SSL
People
Owner: Nobody in particular
Requestors: natxo [...] asenjo.nl
Cc:
AdminCc:
Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: (no value)

History Show all quoted text
  Sat Jul 18 15:50:19 2015 natxo [...] asenjo.nl - Ticket created
Subject: SSL_start not working
Date: Sat, 18 Jul 2015 21:49:53 +0200
To: bug-IO-Socket-SSL [...] rt.cpan.org <bug-IO-Socket-SSL [...] rt.cpan.org>
From: Natxo Asenjo <natxo [...] asenjo.nl>
hi, IO::Socket::SSL version: 2.016. Using a similar snippet as in http://search.cpan.org/~sullr/IO-Socket-SSL-2.016/lib/IO/Socket/SSL.pod#Basic_SSL_Client I get this error: DEBUG: .../IO/Socket/SSL.pm:2649: new ctx 33030096 DEBUG: .../IO/Socket/SSL.pm:1389: start handshake DEBUG: .../IO/Socket/SSL.pm:586: ssl handshake not started DEBUG: .../IO/Socket/SSL.pm:619: using SNI with hostname alt1.gmail-smtp-in.l.google.com DEBUG: .../IO/Socket/SSL.pm:654: request OCSP stapling DEBUG: .../IO/Socket/SSL.pm:686: call Net::SSLeay::connect DEBUG: .../IO/Socket/SSL.pm:689: done Net::SSLeay::connect -> -1 DEBUG: .../IO/Socket/SSL.pm:692: SSL connect attempt failed DEBUG: .../IO/Socket/SSL.pm:692: local error: SSL connect attempt failed error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol DEBUG: .../IO/Socket/SSL.pm:695: fatal SSL error: SSL connect attempt failed error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol DEBUG: .../IO/Socket/SSL.pm:2682: free ctx 33030096 open=33030096 DEBUG: .../IO/Socket/SSL.pm:2687: free ctx 33030096 callback DEBUG: .../IO/Socket/SSL.pm:2694: OK free ctx 33030096 SSL connect attempt failed error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol at /tmp/starttls.pl line 34. use strict; use warnings; use autodie; use IO::Socket::SSL; $IO::Socket::SSL::DEBUG = 4; my $smtp = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "alt1.gmail-smtp-in.l.google.com", PeerPort => 25, ); IO::Socket::SSL->start_SSL( $smtp, SSL_hostname => "alt1.gmail-smtp-in.l.google.com" , ) or die $SSL_ERROR; using openssl works fine: $ openssl s_client -starttls smtp -connect gmail-smtp-in.l.google.com:25 .... Timeout : 300 (sec) Verify return code: 0 (ok) --- 250 SMTPUTF8 ^C I must be doing something wrong but I cannot see what exactly. Any help greatly appreciated. Regards, Natxo Asenjo
  Sun Jul 19 07:04:55 2015 Steffen_Ullrich [...] genua.de - Correspondence added
Show quoted text
> my $smtp = IO::Socket::INET->new( > Proto => "tcp", > PeerAddr => "alt1.gmail-smtp-in.l.google.com", > PeerPort => 25, > ); > > IO::Socket::SSL->start_SSL( > $smtp, > SSL_hostname => "alt1.gmail-smtp-in.l.google.com" , > ) or die $SSL_ERROR; > > > using openssl works fine: > > $ openssl s_client -starttls smtp -connect gmail-smtp- > in.l.google.com:25
Using the -starttls smtp from openssl make s_client do a TCP connection to the given host and speak the SMTP protocol to upgrade the TCP socket to SSL, i.e. reads the SMTP welcome message, issues EHLO command and reads responds, issues STARTTLS command and reads response and if the last response was successful it starts with the SSL handshake. If used with something else instead of smtp it will do a different protocol specific sequence for connecting to the server as lain text and upgrade to TLS. The method start_SSL of IO::Socket::SSL instead only starts the SSL handshake on the given socket and nothing else. It has no idea of the underlying protocol. It is thus similar to ssl.wrap_socket in python.
  Sun Jul 19 07:04:57 2015 The RT System itself - Status changed from 'new' to 'open'
  Sun Jul 19 07:05:00 2015 Steffen_Ullrich [...] genua.de - Status changed from 'open' to 'rejected'
  Sun Jul 19 16:04:32 2015 natxo [...] asenjo.nl - Correspondence added
Subject: RE: [rt.cpan.org #105936] SSL_start not working
Date: Sun, 19 Jul 2015 22:04:13 +0200
To: bug-IO-Socket-SSL [...] rt.cpan.org <bug-IO-Socket-SSL [...] rt.cpan.org>
From: Natxo Asenjo <natxo [...] asenjo.nl>
Thanks for your prompt reply. Show quoted text
> Using the -starttls smtp from openssl make s_client do a TCP connection to the > given host and speak the SMTP protocol to upgrade the TCP socket to SSL, i.e. > reads the SMTP welcome message, issues EHLO command and reads responds, issues > STARTTLS command and reads response and if the last response was successful it > starts with the SSL handshake. If used with something else instead of smtp it > will do a different protocol specific sequence for connecting to the server as > lain text and upgrade to TLS. > > The method start_SSL of IO::Socket::SSL instead only starts the SSL handshake > on the given socket and nothing else. It has no idea of the underlying > protocol. It is thus similar to ssl.wrap_socket in python.
so maybe the example in the documentation should be removed because it confuses people :-) (at least, it confuses me) or a full working example should be provided. Thanks. Regards, Natxo
  Sun Jul 19 16:45:13 2015 Steffen_Ullrich [...] genua.de - Correspondence added
Show quoted text
> so maybe the example in the documentation should be removed because it > confuses people :-) (at least, it confuses me) or a full working > example should be provided.
I've changed the example so that it is hopefully more clear that start_SSL does only the SSL upgrade (as documented) and does not do any SMTP specific handshakes. A fully working example would be too much code which is unrelated to SSL but I made sure that it should be obvious what need to be filled in by the user. https://github.com/noxxi/p5-io-socket-ssl/commit/eb8a20e0e4b0e60ba3134a26ba3b426bc1ec5cec BTW, if you want to use TLS with SMTP I recommend Net::SMTP. Since version 3.0 it includes support for explicit and implicit SSL and also IPv6.
  Sun Jul 19 17:10:33 2015 natxo [...] asenjo.nl - Correspondence added
Subject: RE: [rt.cpan.org #105936] SSL_start not working
Date: Sun, 19 Jul 2015 23:10:22 +0200
To: bug-IO-Socket-SSL [...] rt.cpan.org <bug-IO-Socket-SSL [...] rt.cpan.org>
From: Natxo Asenjo <natxo [...] asenjo.nl>
Show quoted text
> > so maybe the example in the documentation should be removed because it > > confuses people :-) (at least, it confuses me) or a full working > > example should be provided.
> > I've changed the example so that it is hopefully more clear that start_SSL does > only the SSL upgrade (as documented) and does not do any SMTP specific > handshakes. A fully working example would be too much code which is unrelated > to SSL but I made sure that it should be obvious what need to be filled in by > the user. > https://github.com/noxxi/p5-io-socket-ssl/commit/eb8a20e0e4b0e60ba3134a26ba3b426 > bc1ec5cec > > BTW, if you want to use TLS with SMTP I recommend Net::SMTP. Since version 3.0 > it includes support for explicit and implicit SSL and also IPv6.
Thanks! much clearer (for me). Yes, I have sucessfully used that but I am trying to use certificates to relay through a smtp server without user/password. This is currently not implemented in Net::SMTP and I was wondering if it would be possible to do with IO::Socket::SSL. It is possible to do with python (https://docs.python.org/2/library/smtplib.html ( SMTP.starttls([keyfile[, certfile]]) but I'd rather use Perl :-) Thanks again. -- regards, natxo
  Mon Jul 20 02:01:06 2015 Steffen_Ullrich [...] genua.de - Correspondence added
Show quoted text
> This is currently not implemented in Net::SMTP and I was wondering if > it would be possible to do with IO::Socket::SSL. It is possible to do > with python (https://docs.python.org/2/library/smtplib.html ( > > SMTP.starttls([keyfile[, certfile]])
There is a starttls function in Net:SMTP version 3.0+ which should do what you need. If you have any more questions please don't ask them on this bug because they are not releated.