| Subject: | Under mod_perl, first client connection fails in CTX_new, but subsequent connections work |
Running in a (preforking) mod_perl context, the first client conneciton
attempted (during each process lifetime) fails. Subsequent connections work.
Occurs in Debian stable (v8) with and in Debian unstable (using a mod_perl 2.0.9 prerelease / Apache 2.4.10 and mod_perl 2.0.9 / Apache 2.4.23, respectively). Have not attempted other OSes or versions yet.
Example script:
#!/usr/bin/perl
use Net::SSLeay qw(post_https make_form);
$Net::SSLeay::trace = 0;
my $host = 'secure.authorize.net';
my ($page, $response, %reply_headers) = post_https($host, 443, '/', '', make_form(var1 => 'one', var2 => 'two' ));
print "response $response\n";
#again, it'll work...
($page, $response, %reply_headers) = post_https($host, 443, '/', '', make_form(var1 => 'one', var2 => 'two' ));
print "response $response\n";
Example Apache config:
AddHandler perl-script .cgi
PerlHandler ModPerl::Registry
Options +ExecCGI
In a non-mod_perl context, this returns (e.g., depending on $host):
ivan@fleetpaw:/var/www/html$ perl testssl.cgi
response HTTP/1.1 303 See Other
response HTTP/1.1 303 See Other
In a mod_perl context, the first time this is called in a process (i.e. after a
restart), this returns:
response HTTP/1.0 900 NET OR SSL ERROR
CTX_new 30723: 1 - error:0906D06C:PEM routines:PEM_read_bio:no start line
CTX_new 30723: 2 - error:0906D06C:PEM routines:PEM_read_bio:no start line
response HTTP/1.1 303 See Other
Full trace of failing connection:
do_httpx3(POST,1,secure.authorize.net:443) at blib/lib/Net/SSLeay.pm (autosplit into blib/lib/auto/Net/SSLeay/do_httpx3.al) line 1318. (blib/lib/Net/SSLeay.pm (autosplit into blib/lib/auto/Net/SSLeay/do_httpx3.al):1318)
httpx_cat: usessl=1 (secure.authorize:443) at blib/lib/Net/SSLeay.pm (autosplit into blib/lib/auto/Net/SSLeay/httpx_cat.al) line 1227. (blib/lib/Net/SSLeay.pm (autosplit into blib/lib/auto/Net/SSLeay/httpx_cat.al):1227)
Opening connection to secure.authorize.net:443 (64.94.118.32) at blib/lib/Net/SSLeay.pm (autosplit into blib/lib/auto/Net/SSLeay/open_tcp_connection.al) line 486. (blib/lib/Net/SSLeay.pm (autosplit into blib/lib/auto/Net/SSLeay/open_tcp_connection.al):486)
next connect at blib/lib/Net/SSLeay.pm (autosplit into blib/lib/auto/Net/SSLeay/open_tcp_connection.al) line 491. (blib/lib/Net/SSLeay.pm (autosplit into blib/lib/auto/Net/SSLeay/open_tcp_connection.al):491)
connected to secure.authorize.net, 443 at blib/lib/Net/SSLeay.pm (autosplit into blib/lib/auto/Net/SSLeay/open_tcp_connection.al) line 494. (blib/lib/Net/SSLeay.pm (autosplit into blib/lib/auto/Net/SSLeay/open_tcp_connection.al):494)
Creating SSL 0 context... (blib/lib/Net/SSLeay.pm (autosplit into blib/lib/auto/Net/SSLeay/https_cat.al):1126)
CTX_new 30717: 1 - error:0906D06C:PEM routines:PEM_read_bio:no start line (/usr/lib/x86_64-linux-gnu/perl5/5.22/Net/SSLeay.pm:422)
CTX_new 30717: 2 - error:0906D06C:PEM routines:PEM_read_bio:no start line (/usr/lib/x86_64-linux-gnu/perl5/5.22/Net/SSLeay.pm:422)
Changing $host between connections has no effect, so it isn't a per-host
failure/cache. Changing $ssl_version has no effect. This does not appear to
be specific to ModPerl::Registry (originally observed in an HTML::Mason app).
As a workaround, I'm using the following code per-process to trigger the
one-time context creation error so all subsequent real connections work:
{
use Net::SSLeay;
package Net::SSLeay;
initialize();
my $bad_ctx = new_x_ctx();
while ( ERR_get_error() ) {}; #print_errs('CTX_new');
CTX_free($bad_ctx);
}
Oddly, retrieving the errors is necessary to make this work.
ref http://bugs.debian.org/830152
--
Ivan Kohler
President and Head Geek, Freeside Internet Services, Inc. http://freeside.biz/
Debian GNU/Linux developer | CPAN author | cat person | ski addict