Skip Menu |
 

This queue is for tickets about the LWP-Protocol-https CPAN distribution.

Report information
The Basics
Id: 112145
Status: resolved
Priority: 0/
Queue: LWP-Protocol-https

People
Owner: Nobody in particular
Requestors: andytech77 [...] gmail.com
Cc:
AdminCc:

Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: (no value)



Subject: LWP::Protocol::https - SNI support not used for proxy connect
Date: Fri, 19 Feb 2016 10:51:38 +1000
To: bug-LWP-Protocol-https [...] rt.cpan.org
From: Andy Henderson <andytech77 [...] gmail.com>
Download (untitled) / with headers
text/plain 1.8k
Hi, I encountered an error trying to use LWP::Protocol::https to connect to a remote SSL website via a proxy – it was returning a hostname verification error: SSL upgrade failed: hostname verification failed at C:/Perl64/lib/LWP/Protocol/http.pm line 203. The same request worked fine when going directly (not via a proxy), with no certificate issues. On closer inspection, it turns out the host I was connecting to was using SNI to host multiple SSL websites, and the ‘default’ site (when no SNI information is present in the ClientHello message sent by the client in the SSL handshake) on that host was not the one I was trying to get to. The underlying IO::Socket::SSL does have SNI support, however this is not being triggered when using LWP::Protocol::https via a proxy CONNECT tunnel, as the requested hostname isn’t being passed in. This appears to be straightforward to fix, by adding an ‘SSL_hostname’ option to the hash passed to IO::Socket::SSL::start_SSL(): --- C:\Perl64\lib\LWP\Protocol\https.pm.orig 2014-04-18 08:33:26.000000000 +1000 +++ C:\Perl64\lib\LWP\Protocol\https.pm 2016-02-19 10:41:30.000000000 +1000 @@ -150,12 +150,13 @@ # IO::Socket::SSL, but code will only be called in this case if ( $Net::HTTPS::SSL_SOCKET_CLASS->can('start_SSL')) { *_upgrade_sock = sub { my ($self,$sock,$url) = @_; $sock = LWP::Protocol::https::Socket->start_SSL( $sock, SSL_verifycn_name => $url->host, + SSL_hostname => $url->host, $self->_extra_sock_opts, ); $@ = LWP::Protocol::https::Socket->errstr if ! $sock; return $sock; } } Module version: LWP-Protocol-https-6.06 This is perl 5, version 22, subversion 1 (v5.22.1) built for MSWin32-x64-multi-thread Binary build 2201 [299574] provided by ActiveState http://www.ActiveState.com Built Jan 4 2016 12:12:58 Regards, Andy
Download (untitled) / with headers
text/plain 218b
Note that this ticket from 2016 describes exactly the same problem as the two pull requests on github: #24 from 2015 and #17 from 2014. And the solution offered here is exactly the one I've offered in pull request #17.
Download (untitled) / with headers
text/plain 298b
On Sun Feb 19 02:24:29 2017, SULLR wrote: Show quoted text
> Note that this ticket from 2016 describes exactly the same problem as > the two pull requests on github: #24 from 2015 and #17 from 2014. And > the solution offered here is exactly the one I've offered in pull > request #17.
Fix has been shipped in 6.07


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.