search

noxxi / p5-io-socket-ssl

IO::Socket::SSL Perl Module
36 stars 59 forks source link

lwp-request – fallback missing to IPv4 when IPv6 not accessible (Windows) #153

Closed GwenDragon closed 2 months ago

GwenDragon commented 2 months ago
  1. Run Strawberry Perl on Windows 11
  2. Run a Linux server with hostname resolving to IPv4 and IPv6
  3. Have on server a temporary unreachable IPv6 (can me made by drop of iptables/fail2ban on local Linux server with your client IPv6)
  4. Connect with LWPs lwp-request pn Windows Strawberry Perl
  5. lwp-request connects only with IPv6
  6. lwp-request dies with error message "500 Can't connect to DOMAIN.TLD:443 (Bad address)"

Windows 11 23H2 StrawberryPerl 5.36.3.1 x64 libwww-perl-6.77 LWP-Protocol-https-6.14 Net-SSLeay-1.94 Net-SSLGlue-1.058 IO-Socket-SSL-2.085 Crypt-SSLeay-0.72

The unfamiliar error message "500 Can't connect to DOMAIN.TLD:443 (Bad hostname)" on Windows is not really explaining the issue for users to recognise the culprit. On Linux i get "500 Can't connect to DOMAIN.TLD:443 (Connection refused)"

There should be more resilience for SSL connections, lwp-request is often used in bash scripts on Linux PCs and servers. Please, could IO::Socket::SSL get a fallback as not all admins want/can patch lwp-request or write a own Perl program for their needs. Some other programs like curl or wget to not stop working IPv6 and IPv4 when IPv6 can be reached.

Related to https://github.com/libwww-perl/LWP-Protocol-https/issues/79

noxxi commented 2 months ago

Trying all IPv6/IPv4 addresses returned by DNS until one succeeds (your question is just a special case of this) is not an abstraction which is done by IO::Socket modules and IO::Socket::SSL is no different here. IO::Socket::SSL connects to the server using IO::Socket::IP and this does not provide this feature either. Adding this feature to IO::Socket::SSL would also not help with plain HTTP connections in LWP, since IO::Socket::SSL is not used here.

Note that the case of a IPv6 target destination not being available temporarily is different from not having IPv6 connectivity locally. In this case getaddrinfo will not return any IPv6 addresses for the host in the first place and thus no IPv6 will be tried.