| Subject: | Peer idnetify always unknown in server |
| Date: | Tue, 02 Apr 2013 16:55:30 -0400 |
| To: | bug-IO-Socket-SSL [...] rt.cpan.org |
| From: | "Piotr Malek" <pm426 [...] graffiti.net> |
Hello,
I have been attempting to create client and server using IO::Socket::SSL
and have them both make sure peer is validated. For that I use
SSL_verify_mode set to SSL_VERIFY_PEER in the client and
SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the server.
Everything works as expected in the client, but not for server.
Creating IO::Socket::SSL server with following options:
SSL_verify_mode: SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT
SSL_verifycn_scheme: 'www'
attepmts to and always fails to determine peer hostname before peer
connects:
DEBUG: .../IO/Socket/SSL.pm:1320: Cannot determine peer hostname for verification error:00000000:lib(0):func(0):reason(0)
Using SSL_verifycn_scheme callback does not help, though it allows
the server to start. The problem here is that it will set $host value to
'unknown' in configure_SSL() and it will always be 'unknown' for each peer
that connects (value passed to callback is never changed):
DEBUG: .../IO/Socket/SSL.pm:1202: identity=unknown cn=10.10.10.10 alt=
Should peer lookup be delayed and done once client connects? Or am I
missing something obvious?
Server used to test this:
my $server = IO::Socket::SSL->new(
LocalAddr => '127.0.0.1',
LocalPort => 9000,
Listen => 10,
SSL_cert_file => 'cert.pem',
SSL_key_file => 'key.pem',
SSL_ca_file => 'ca.pem',
SSL_verify_mode => SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
#SSL_verifycn_scheme => 'www',
SSL_verifycn_scheme => {
callback => sub {
warn " *** SSL_verifycn_name callback args:\n" . join "\n", @_;
return 1;
},
},
) or die "failed to listen: $!";
my $client = $server->accept or die
"failed to accept or ssl handshake: $!,$SSL_ERROR";
$client->print("Hello there\n");
And client:
openssl s_client -connect 127.0.0.1:9000 -cert client.crt -key client.key -CAfile ca.pem
This was tested on stock libio-socket-ssl included with ubuntu and latest cpan:
IO::Socket::SSL 1.76 (and 1.84)
perl 5.14.2
Ubuntu 12.10