| Subject: | server SSL certificate verify broken when start_tls is used |
Net::LDAP can't verify server certificate if start_ssl is used.
Test case:
use Net::LDAP;
use IO::Socket::SSL;
my $ldap = Net::LDAP->new('ldap.example.ru');
my $mesg = $ldap->start_tls(verify => 'require', cafile =>
'/etc/ssl/ca.pem');
die $mesg->error if $mesg->code;
dies with message:
Cannot determine peer hostname for
verificationerror:00000000:lib(0):func(0):reason(0) at ./test_ldap.pl
line 14, <DATA> line 522.
----
OS: FreeBSD
p5-perl-ldap-0.4300
perl v5.10.1
----
patch to fix this bug is attached.
from IO::Socket::SSL doc:
SSL_verifycn_name
Set the name which is used in verification of hostname. If
SSL_verifycn_scheme is set and no SSL_verifycn_name is given it will try
to use the PeerHost and PeerAddr settings and fail if no name caan be
determined.
Using PeerHost or PeerAddr works only if you create the connection
directly with IO::Socket::SSL->new, if an IO::Socket::INET object is
upgraded with start_SSL the name has to be given in SSL_verifycn_name.
| Subject: | patch-Net-LDAP.pm |
--- Net/LDAP.pm.orig 2011-09-07 22:51:44.000000000 +0400
+++ Net/LDAP.pm 2011-09-07 22:53:19.000000000 +0400
@@ -1035,7 +1035,10 @@
my $sock_class = ref($sock);
return $mesg
- if IO::Socket::SSL->start_SSL($sock, {_SSL_context_init_args($arg)});
+ if IO::Socket::SSL->start_SSL($sock, {
+ SSL_verifycn_name => $ldap->{net_ldap_host}
+ _SSL_context_init_args($arg)
+ });
my $err = $@ || $IO::Socket::SSL::SSL_ERROR || $IO::Socket::SSL::SSL_ERROR || ''; # avoid use on once warning