Bug #111517 for LWP-Protocol-https: LWP::Protocol::https discards 0 value for SSL_VERIFY

Thu Jan 28 11:53:08 2016 errietta [...] errietta.me - Ticket created

Subject:	LWP::Protocol::https discards 0 value for SSL_VERIFY_mode
Date:	Thu, 28 Jan 2016 16:52:46 +0000
To:	bug-LWP-Protocol-https [...] rt.cpan.org
From:	Errietta Kostala <errietta [...] errietta.me>

Hello, If you want to disable ssl cert verification, you need to use SSL_VERIFY_NONE, which resolves to 0. LWP::Protocol::https transforms this value to 1: $ssl_opts{SSL_verify_mode} ||= 1; Patch: --- https_old.pm 2016-01-28 16:51:38.970331004 +0000 +++ https.pm 2016-01-28 16:42:22.410331004 +0000 @@ -17,7 +17,8 @@ my $self = shift; my %ssl_opts = %{$self->{ua}{ssl_opts} || {}}; if (delete $ssl_opts{verify_hostname}) { - $ssl_opts{SSL_verify_mode} ||= 1; + $ssl_opts{SSL_verify_mode} = defined $ssl_opts{SSL_verify_mode} ? $ssl_opts{SSL_verify_mode} : 1; + $ssl_opts{SSL_verifycn_scheme} = 'www'; } else { -- Errietta Kostala <errietta@errietta.me>

Thu Jan 28 11:54:36 2016 errietta [...] errietta.me - Correspondence added

Subject:	Re: [rt.cpan.org #111517] AutoReply: LWP::Protocol::https discards 0 value for SSL_VERIFY_mode
Date:	Thu, 28 Jan 2016 16:54:08 +0000
To:	bug-LWP-Protocol-https [...] rt.cpan.org
From:	Errietta Kostala <errietta [...] errietta.me>

Versions: LWP::Protocol::https 6.06 This is perl 5, version 22, subversion 1 (v5.22.1) built for x86_64-linux-gnu-thread-multi On Thu, Jan 28, 2016 at 4:53 PM Bugs in LWP-Protocol-https via RT < bug-LWP-Protocol-https@rt.cpan.org> wrote: Show quoted text

> > Greetings, > > This message has been automatically generated in response to the > creation of a trouble ticket regarding: > "LWP::Protocol::https discards 0 value for SSL_VERIFY_mode", > a summary of which appears below. > > There is no need to reply to this message right now. Your ticket has been > assigned an ID of [rt.cpan.org #111517]. Your ticket is accessible > on the web at: > > https://rt.cpan.org/Ticket/Display.html?id=111517 > > Please include the string: > > [rt.cpan.org #111517] > > in the subject line of all future correspondence about this issue. To do > so, > you may reply to this message. > > Thank you, > bug-LWP-Protocol-https@rt.cpan.org > > ------------------------------------------------------------------------- > Hello, > > If you want to disable ssl cert verification, you need to use > SSL_VERIFY_NONE, which resolves to 0. LWP::Protocol::https transforms this > value to 1: > > $ssl_opts{SSL_verify_mode} ||= 1; > Patch: > > --- https_old.pm 2016-01-28 16:51:38.970331004 +0000 > +++ https.pm 2016-01-28 16:42:22.410331004 +0000 > @@ -17,7 +17,8 @@ > my $self = shift; > my %ssl_opts = %{$self->{ua}{ssl_opts} || {}}; > if (delete $ssl_opts{verify_hostname}) { > - $ssl_opts{SSL_verify_mode} ||= 1; > + $ssl_opts{SSL_verify_mode} = defined $ssl_opts{SSL_verify_mode} ? > $ssl_opts{SSL_verify_mode} : 1; > + > $ssl_opts{SSL_verifycn_scheme} = 'www'; > } > else { > -- > Errietta Kostala > <errietta@errietta.me> >

-- Errietta Kostala <errietta@errietta.me>

Sun May 15 17:25:35 2016 Sune.Karlsson [...] oru.se - Correspondence added

Subject:	[rt.cpan.org #111517]
Date:	Sun, 15 May 2016 21:25:11 +0000
To:	"bug-LWP-Protocol-https [...] rt.cpan.org" <bug-LWP-Protocol-https [...] rt.cpan.org>
From:	Sune Karlsson <Sune.Karlsson [...] oru.se>

I can confirm this bug. In general it is of course not a good thing to turn off SSL verification but there are legitimate cases for this. This bug in combination with changed behavior in IO::Socket::SSL makes it impossible to turn off SSL verification (it used to be possible to pass a non-numerical value to IO::Socket::SSL and that would do the trick). Fixing this would be highly appreciated! /Sune -- Sune Karlsson Professor of Statistics Handelshögskolan/Örebro University School of Business Örebro University, SE-70182 Örebro, Sweden Phone +46 19 301257 http://www.oru.se/hh/sune_karlsson http://econpapers.repec.org/RAS/pka1.htm

Sun May 15 17:25:35 2016 The RT System itself - Status changed from 'new' to 'open'

Mon May 16 16:39:14 2016 SREZIC [...] cpan.org - Requestor SREZIC added

Wed Jul 06 19:24:15 2016 williamt [...] sonic.net - Correspondence added

From:

williamt [...] sonic.net

Please also change $ssl_opts{SSL_verifycn_scheme} = 'www'; to $ssl_opts{SSL_verifycn_scheme} ||= 'www'; That way we can pass along our own verification scheme. For example if we want to verify a portion of the hostname or something like: LWP::UserAgent->new( ssl_opts => { SSL_verifycn_scheme => { callback => sub { if ($_[1] =~ m/^$_[0]:.*/) { return 1; } return 0; } }});

Wed Jul 06 19:38:07 2016 williamt [...] sonic.net - Correspondence added

From:

williamt [...] sonic.net

Also in the same method, shouldn't the return be return ($self->SUPER::_extra_sock_opts, %ssl_opts); not return (%ssl_opts, $self->SUPER::_extra_sock_opts); Otherwise your base class would be overriding your subclasses options. On Wed Jul 06 19:24:15 2016, williamt@sonic.net wrote: Show quoted text

> Please also change > > $ssl_opts{SSL_verifycn_scheme} = 'www'; > to > $ssl_opts{SSL_verifycn_scheme} ||= 'www'; > > That way we can pass along our own verification scheme. > For example if we want to verify a portion of the hostname or > something like: > LWP::UserAgent->new( ssl_opts => { > SSL_verifycn_scheme => { > callback => sub { > if ($_[1] =~ m/^$_[0]:.*/) { > return 1; > } > return 0; > } > }});

Fri Mar 31 15:33:31 2017 olaf [...] wundersolutions.com - Correspondence added

Ticket migrated to github as https://github.com/libwww-perl/LWP-Protocol-https/issues/47

Fri Mar 31 15:33:33 2017 olaf [...] wundersolutions.com - Status changed from 'open' to 'resolved'

Bug #111517 for LWP-Protocol-https: LWP::Protocol::https discards 0 value for SSL_VERIFY_mode