search

ninenines / gun

HTTP/1.1, HTTP/2, Websocket client (and more) for Erlang/OTP.
ISC License
891 stars 232 forks source link

Problems with some certificates #207

Closed alex-strizhakov closed 4 years ago

alex-strizhakov commented 4 years ago

Hello! Seems that in master handshakes with some certificates are broken. (for example cloudflare certificates). iex(1)> {:ok, conn} = :gun.open('pleroma.strizhakov.dev', 443) {:ok, #PID<0.2027.0>} iex(2)> [info] ['TLS', 32, 'client', 58, 32, 73, 110, 32, 115, 116, 97, 116, 101, 32, 'hello', 32, 'received SERVER ALERT: Fatal - Handshake Failure', 10] [info] ['TLS', 32, 'client', 58, 32, 73, 110, 32, 115, 116, 97, 116, 101, 32, 'hello', 32, 'received SERVER ALERT: Fatal - Handshake Failure', 10]

It can be fixed by adding server_name_indication to the tls_opts: iex(2)> {:ok, conn} = :gun.open('pleroma.strizhakov.dev', 443, %{tls_opts: [server_name_indication: 'pleroma.strizhakov.dev']}) {:ok, #PID<0.2052.0>}

As i understand it is caused by change in master that gun use ip for connect and by default ssl module don't add sni option for ip. http://erlang.org/doc/man/ssl.html#type-sni Same code works fine in 1.3.

Can it be fixed in master?

Is there an approximate release date for gun version 2?

essen commented 4 years ago

Thanks for the report! From the documentation that seems normal, so I guess we'll have to duplicate the behavior in Gun to avoid unexpected issues like this. I'll see if I can do it next week.

There'll be a pre-release once all the elixir-grpc changes are merged but otherwise no fixed date for 2.0, though I'm working hard on it.

alex-strizhakov commented 4 years ago

Great, thank you!

essen commented 4 years ago

This should be fixed by cd6d550398fceafbcd47ff22534666bf21e9d8f1. Thanks!

I am releasing the first 2.0 pre-release of Gun this week. It will also contain the Socks5 support that I believe you guys need.