search

noxxi / p5-io-socket-ssl

IO::Socket::SSL Perl Module
36 stars 59 forks source link

"no cipher match" after upgrade to IO::Socket::SSL 2.073 #112

Closed jpalus closed 2 years ago

jpalus commented 2 years ago

ddclient started to fail for me after upgrade of IO::Socket::SSL to 2.073 with:

 Failed to set SSL cipher list error:0A0000B9:SSL routines::no cipher match

Reproducible with simple code sample based on ddclient code:

require IO::Socket::SSL;

$sd = IO::Socket::SSL->new(
  PeerAddr => 'dynupdate.no-ip.com',
  PeerPort => 443,
  Proto => 'tcp',
  MultiHomed => 1);

defined $sd or print("cannot connect to socket: $@ " . IO::Socket::SSL::errstr());

Downgrade to 2.072 solves the issue.

perl 5.32.1
openssl 3.0.1
Net::SSLeay 1.90
noxxi commented 2 years ago

The changes with 2.073 are really minimal. Are you sure that 2.072 was used with exactly same software stack (Net::SSLeay, OpenSSL ...)? I myself have no problems with the given example.

If the problem persist please use the following code which is more verbose and provide the full output:

use warnings;
use IO::Socket::SSL 'debug4';

printf("openssl version compiled=0x%0x linked=0x%0x -- %s\n",
    Net::SSLeay::OPENSSL_VERSION_NUMBER(),
    Net::SSLeay::SSLeay(),
    Net::SSLeay::SSLeay_version(0));
printf("Net::SSLeay version=%s\n", $Net::SSLeay::VERSION);
printf("IO::Socket::SSL version=%s\n", $IO::Socket::VERSION);
printf("parent %s version=%s\n", $_, $_->VERSION)
    for (@IO::Socket::SSL::ISA);

my $sd = IO::Socket::SSL->new(
  PeerAddr => 'dynupdate.no-ip.com',
  PeerPort => 443,
  Proto => 'tcp',
  MultiHomed => 1,
  SSL_ca_file => '/etc/ssl/certs/ca-certificates.crt', # maybe need to be changed to match local cert store
);

defined $sd or print("cannot connect to socket: $@ $SSL_ERROR");
jpalus commented 2 years ago

I'm terribly sorry... it seems to be caused by downstream distribution patch that happened to be added in between 2.072 and 2.073, apparently based taken from Fedora: http://git.pld-linux.org/?p=packages/perl-IO-Socket-SSL.git;a=blob;f=IO-Socket-SSL-2.068-use-system-default-cipher-list.patch;h=800ab647181660b79030c30d5c5a05d0008d5c33;hb=HEAD

Closing and sorry for the trouble.