search

jhthorsen / mojo-irc

IRC Client for the Mojo IOLoop
14 stars 12 forks source link

insecure TLS should not force default cert / key #34

Open greencoloured opened 3 months ago

greencoloured commented 3 months ago

The following code in Mojo::IRC sets a default cert / key including when using "insecure" tls. I do not think these should be forced when using this mode.

  if (my $tls = $self->tls) {
    push @extra, tls         => 1;
    push @extra, tls_ca      => $tls->{ca} if $tls->{ca};  # not sure why this should be supported, but adding it anyway
    push @extra, tls_cert    => $tls->{cert} || DEFAULT_CERT; 
    push @extra, tls_key     => $tls->{key}  || DEFAULT_KEY;
    push @extra, tls_verify  => 0x00                      if $tls->{insecure};    # Mojolicious < 9.0
    push @extra, tls_options => {SSL_verify_mode => 0x00} if $tls->{insecure};    # Mojolicious >= 9.0
  }

One other point, because of the way this is implemented it makes it rather inconvenient to work around. It would have been better if the defaults were defined as a package scope variable rather than constants (inlined subs) or even if the "//" operator was used so an empty string could be provided.

Grinnz commented 3 months ago

I think these defaults should simply be removed and cert/key only set if passed.

greencoloured commented 3 months ago

That would be a cleaner way of doing it.