On Mon Jan 28 05:52:31 2013, vsespb wrote:
Show quoted text> ONE SERVER:
> perl=v5.10.1 IO:Socket::SSL=1.81 Net::SSLeay=1.52 openssl=9080bf
> ...SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert unexpected message
Show quoted text> ANOTHER SERVER:
> perl=v5.14.2 IO:Socket::SSL=1.81 Net::SSLeay=1.42 openssl=1000005f
> ssl handshake done
I doubt that the perl version is relevant here, so this leaves the Net::SSLeay
version or the OpenSSL version. Since I use 1.52 to successfully connect
to the host I would suggest, that the old openssl version causes the problem.
This would not affect firefox (since it does not use openssl) and might not
affect curl too (which can use either GnuTLS or OpenSSL).
I can reproduce the problem on a system with an older openssl library and
a recent version of IO::Socket::SSL. A look at the exchange messages with
wireshark gives the following picture:
- the server accepts TLSv1.0 records with TLSv1.1 handshakes inside
This is used with recent openssl versions, which support TLSv1.1
- the server accepts SSLv2 records with TLSv1.0 handshakes inside
This is used when SSL_version is set to 'sslv23' in IO::Socket::SSL.
This was the default in older IO::Socket::SSL versions, but for security
reasons SSLv2 is now disabled by default, e.g. sslv23:!sslv2
- sslv23:!sslv2 causes on older openssl versions TLSv1.0 records with TLSv1.0
handshakes inside. For some strange reason (maybe misconfiguration) the
server does not understand these SSL messages, other servers have no problems.
Because you can probably not change the server configuration the following
workarounds are possible:
- use a newer openssl version which supports TLSv1.1 (openssl>=1.0)
- allow SSLv2 by setting SSL_version => 'sslv23'. Note that SSLv2 is disabled
for security reasons, so enabling it increases your risk.
Show quoted text>
> I use code example from your documentation, without
> Net::SSLeay::VERIFY_NONE(). I am not sure how to use
> Net::SSLeay::VERIFY_NONE(), because
> obvious things
> IO::Socket::SSL->new("google.com:https",
> SSL_verify_mode=>Net::SSLeay::VERIFY_NONE())
> my $client = IO::Socket::SSL->new("google.com:https",
> {SSL_verify_mode=>Net::SSLeay::VERIFY_NONE()})
>
> crash on both servers.
The syntax is not class->new(host,%args)
but class->new(host) OR class->new(%args)
if you want to give other arguments you have to specificy the target with
PeerAddr or PeerAddr+PeerPort.
This is the same with all the other IO::Socket::* stuff.
RT for rt.cpan.org