| Subject: | get_peer_cert_chain with anon authentication returns SSL object instead of empty list |
Hi,
if the SSL handshake results in an anonymous authentication, like ADH-DES-CBC3-SHA, get_peer_cert_chain will not return an empty list, but instead return the SSL object.
Example:
use strict;
use Net::SSLeay;
use IO::Socket::INET;
# anon cipher - no certificates will be transferred
my $cipher = 'ADH-DES-CBC3-SHA';
my $fd = IO::Socket::INET->new('www.kmcgov.in:443')
or die "tcp connect failed: $!";
Net::SSLeay::initialize();
my $ctx = Net::SSLeay::CTX_new() or die "failed to create CTX";
Net::SSLeay::CTX_set_cipher_list($ctx,$cipher);
my $ssl = Net::SSLeay::new($ctx) or die "failed to create SSL";
Net::SSLeay::set_fd($ssl,$fd);
Net::SSLeay::connect($ssl) or die "failed to SSL connect";
my @chain = Net::SSLeay::get_peer_cert_chain($ssl);
warn "get_peer_cert_chain($ssl) -> @chain";
With the current implementation it will return something like this:
get_peer_cert_chain(28270720) -> 28270720
E.g. it will leave the stack unchanged and thus return what was put onto the stack.
The following change will fix it and return an empty list as expected:
--- SSLeay.xs (revision 412)
+++ SSLeay.xs (working copy)
@@ -1818,7 +1818,7 @@
PPCODE:
chain = SSL_get_peer_cert_chain(s);
if( chain == NULL ) {
- return;
+ XSRETURN_EMPTY;
}
for (i=0; i<sk_X509_num(chain); i++) {
x = sk_X509_value(chain, i);
Regards,
Steffen