Skip Menu |
 

This queue is for tickets about the Net-SSLeay CPAN distribution.

Report information
The Basics
Id: 60639
Status: resolved
Worked: 30 min
Priority: 0/
Queue: Net-SSLeay

People
Owner: MIKEM [...] cpan.org
Requestors: mas [...] scsy.de
Cc:
AdminCc:

Bug Information
Severity: Wishlist
Broken in: (no value)
Fixed in: (no value)



Subject: Access to X509 cert data (when using IO::Socket::SSL)
Download (untitled) / with headers
text/plain 919b
Hi there! I use IO::Socket::SSL to connect to an SSL server. The IO::Socket::SSL man page suggests that one can use their $sslclient->peer_certificate to get access to the certificate: "If no field is given the internal representation of certificate from Net::SSLeay is returned." Unfortunately, this internal representation only seems to be an integer number, while I expected to get an object containing the actual SSL certificate. I need the certificate in order to read the key length and extended X509 attributes. A Perl hacker from #perl on Freenode told me after brief analysis of Net::SSLeay that it looks like access to the certificate via Net::SSLeay is currently impossible, so I'm placing this as a feature request. Maybe you can add the functionality if you find the time to, or let me know whether there is an alternative way to access the certificate. Kind regards & thanks for your time, -martin
Subject: Re: [rt.cpan.org #60639] Access to X509 cert data (when using IO::Socket::SSL)
Date: Mon, 23 Aug 2010 16:55:30 +0200
To: bug-Net-SSLeay [...] rt.cpan.org
From: Florian Ragwitz <rafl [...] debian.org>
Download (untitled) / with headers
text/plain 752b
"Martin Schmitt via RT" <bug-Net-SSLeay@rt.cpan.org> writes: Show quoted text
> I use IO::Socket::SSL to connect to an SSL server. The IO::Socket::SSL > man page suggests that one can use their $sslclient->peer_certificate to > get access to the certificate: > > "If no field is given the internal representation of certificate from > Net::SSLeay is returned." > > Unfortunately, this internal representation only seems to be an integer > number, while I expected to get an object containing the actual SSL > certificate.
This is Net::SSLeay's weird and somewhat stupid idea of an object. It's really the memory address of the associated c structure. To inspect it, call any function valid for an X509 pointer, i.e. Net::SSLeay::X509_*, with it as the first argument.
Download (untitled)
application/pgp-signature 197b

Message body not shown because it is not plain text.

Download (untitled) / with headers
text/plain 727b
On Mon Aug 23 10:48:51 2010, MSCHMITT wrote: Show quoted text
> A Perl hacker from #perl on Freenode told me after brief analysis of > Net::SSLeay that it looks like access to the certificate via Net::SSLeay > is currently impossible, so I'm placing this as a feature request.
Moreover, that hacker would be me. It looks like, from the typemap, that you're representing an X509* as a simple IV: X509 * T_IV Perhaps this could instead be represented as an instance of a new Net::SSLeay::X509 object, which just has a large collection of accessor methods that poke into the structure of OpenSSL's struct X509. I believe these fields are part of the external API, as they appear in the public header file <openssl/x509.h>. -- Paul Evans
Subject: Re: [rt.cpan.org #60639] Access to X509 cert data (when using IO::Socket::SSL)
Date: Mon, 23 Aug 2010 17:04:39 +0200
To: bug-Net-SSLeay [...] rt.cpan.org
From: Florian Ragwitz <rafl [...] debian.org>
Download (untitled) / with headers
text/plain 1.2k
"Paul Evans via RT" <bug-Net-SSLeay@rt.cpan.org> writes: Show quoted text
> On Mon Aug 23 10:48:51 2010, MSCHMITT wrote:
>> A Perl hacker from #perl on Freenode told me after brief analysis of >> Net::SSLeay that it looks like access to the certificate via Net::SSLeay >> is currently impossible, so I'm placing this as a feature request.
> > Moreover, that hacker would be me. > > It looks like, from the typemap, that you're representing an X509* as a > simple IV: > > X509 * T_IV > > Perhaps this could instead be represented as an instance of a new > Net::SSLeay::X509 object, which just has a large collection of > accessor methods that poke into the structure of OpenSSL's struct > X509. I believe these fields are part of the external API, as they > appear in the public header file <openssl/x509.h>.
Yes, absolutely. The way it is right now (representing pointers as IVs) is purely for historical reasons. And it can be easily changed without breaking back-compat. Just no one did that yet. However, mugwump created Net::SSLeay::OO instead, which provides something similar. Also, I believe there already are a couple of functions to introspect the fields of the X509 struct. If there's anything you need and that's currently missing, both feature requests and patches are welcome.
Download (untitled)
application/pgp-signature 197b

Message body not shown because it is not plain text.

Download (untitled) / with headers
text/plain 644b
Thanks for your feedback, guys. I've now spent a while with Net::SSLeay::OO (cloned from git today) and it seems that the Net::SSLeay::OO::X509 class, being a wrapper for Net::SSLeay, also only offers the discrete fields from the certificate in "cooked" form, but not the certificate itself. man Net::SSLeay::OO lists a to-be-done class Net::SSLeay::OO::PEM which somewhat hints towards the planned capability of extracting the cert, but there's not trace of it to be found so far. Too bad. I'm not too sure what to do from here. My next stop will probably need to be parsing output from openssl s_client to get cert and connection details.
Download (untitled) / with headers
text/plain 678b
On Mon Aug 23 17:07:51 2010, MSCHMITT wrote: Show quoted text
> Too bad. I'm not too sure what to do from here. My next stop will > probably need to be parsing output from openssl s_client to get cert and > connection details.
Florian wrote: Show quoted text
> Also, I believe there already are a couple of functions to introspect > the fields of the X509 struct. If there's anything you need and that's > currently missing, both feature requests and patches are welcome.
Could you give some details on the exact fields you want here? If you can suggest an "ideal use case", the fields you want, then I'm sure I should be able to hack up a quick patch to let you get at them from Net::SSLeay -- Paul Evans
Download (untitled) / with headers
text/plain 744b
Thanks for your offer, but by far the easiest thing for me would be to just have the certificate at hand for manipulation. The values I pull from the cert with Crypt::X509, that are not covered by Net::SSLeay, are: $x509->serial $x509->not_before $x509->not_after $x509->pubkey_size $x509->PubKeyAlg $x509->SigEncAlg $x509->SigHashAlg $x509->BasicConstraints I don't care about subject alternative names right now, but that may change. In all seriousness, I have written a wrapper for openssl s_client today that does all this, so please don't spend too much of your valuable time writing accessors for discrete attributes. If you can, however, pass the certificate back, that would be totally excellent. :-) Thanks & kind regards, -martin
Subject: Re: [rt.cpan.org #60639] Access to X509 cert data (when using IO::Socket::SSL)
Date: Sat, 28 Aug 2010 07:10:20 +0530
To: "bug-Net-SSLeay [...] rt.cpan.org" <bug-Net-SSLeay [...] rt.cpan.org>
From: Mike Mccauley <mikem [...] open.com.au>
Florian, I am travelling for the next 3 weeks. Can you follow this one? Cheers Sent from my iPhone On 23/08/2010, at 8:26 PM, "Florian Ragwitz via RT" <bug-Net-SSLeay@rt.cpan.org Show quoted text
> wrote:
Show quoted text
> Queue: Net-SSLeay > Ticket <URL: https://rt.cpan.org/Ticket/Display.html?id=60639 > > > "Martin Schmitt via RT" <bug-Net-SSLeay@rt.cpan.org> writes:
>> I use IO::Socket::SSL to connect to an SSL server. The >> IO::Socket::SSL >> man page suggests that one can use their $sslclient-
>> >peer_certificate to
>> get access to the certificate: >> >> "If no field is given the internal representation of certificate from >> Net::SSLeay is returned." >> >> Unfortunately, this internal representation only seems to be an >> integer >> number, while I expected to get an object containing the actual SSL >> certificate.
> > This is Net::SSLeay's weird and somewhat stupid idea of an object. > It's > really the memory address of the associated c structure. To inspect > it, > call any function valid for an X509 pointer, i.e. Net::SSLeay::X509_*, > with it as the first argument. > > <mime-attachment>
Download (untitled) / with headers
text/plain 898b
Hi Martin, is this still an issue for you? Cheers. On Tue Aug 24 14:26:57 2010, MSCHMITT wrote: Show quoted text
> Thanks for your offer, but by far the easiest thing for me would be
to Show quoted text
> just have the certificate at hand for manipulation. The values I
pull Show quoted text
> from the cert with Crypt::X509, that are not covered by Net::SSLeay,
are: Show quoted text
> > $x509->serial > $x509->not_before > $x509->not_after > $x509->pubkey_size > $x509->PubKeyAlg > $x509->SigEncAlg > $x509->SigHashAlg > $x509->BasicConstraints > > I don't care about subject alternative names right now, but that may
change. Show quoted text
> > In all seriousness, I have written a wrapper for openssl s_client
today Show quoted text
> that does all this, so please don't spend too much of your valuable
time Show quoted text
> writing accessors for discrete attributes. If you can, however, pass
the Show quoted text
> certificate back, that would be totally excellent. :-) > > Thanks & kind regards, > > -martin
Download (untitled) / with headers
text/plain 109b
Gosh, this is more than a year old. :-) Well, I do have my workaround, the rest is mostly cosmetic, isn't it?
On Sun Sep 25 01:31:30 2011, MSCHMITT wrote:
Show quoted text
> Gosh, this is more than a year old. :-) Well, I do have my workaround,
> the rest is mostly cosmetic, isn't it?

You are right.

FYI the latest (SVN) version of Net::SSLeay has a bunch o new functions related to getting X509 certificate details
check for example http://anonscm.debian.org/viewvc/net-ssleay/trunk/examples/x509_cert_details.pl?revision=322&amp;view=markup

Mike, I guess you should close this RT.

--
kmx



This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.