If no $version was given to OpenSSL.new, it would use the highest
TLS version implemented in the OpenSSL library. This is a problem
when you access, via e.g. the WWW module which gives you no access
to the OpenSSL instance, a server which only implements older TLS.
The OpenSSL documentation SSL_CTX_new(3) recommends to use the
version-flexible methods in applications, so this module should
at least make it available in some form. The manpage even says that
the version-specific methods are deprecated with OpenSSL 1.1.0,
so I guess it isn't too poor practice to potentially allow protocol
downgrades by default.
Now, the 'new 3/3' test in 01-basic.t probes the version selected
by default, so I had to adjust that as well. With OpenSSL 1.1.0, there
is a special method version 0x10000 indicating version negotiation.
Prior to that, the version was set to the same as the highest implemented
method. See:
Here's an example that's failing with master but working with this commit:
use WWW
use Test
lives-ok { get <https://www.studentenwerk-magdeburg.de/> }
err code: 337056010
error:1417110A:SSL routines:tls_process_server_hello:wrong ssl version
not ok 1 -
# Failed test at <unknown file> line 1
# Internal Error: 'server returned no data'
If no $version was given to OpenSSL.new, it would use the highest TLS version implemented in the OpenSSL library. This is a problem when you access, via e.g. the WWW module which gives you no access to the OpenSSL instance, a server which only implements older TLS.
Now, a version negotiating TLS method is used instead if no explicit $version is requested. Prior to OpenSSL 1.1.0, this was SSLv23_method() and was then renamed to TLS_method(). See https://wiki.openssl.org/index.php/SSL/TLS_Client#Context_Setup
The OpenSSL documentation SSL_CTX_new(3) recommends to use the version-flexible methods in applications, so this module should at least make it available in some form. The manpage even says that the version-specific methods are deprecated with OpenSSL 1.1.0, so I guess it isn't too poor practice to potentially allow protocol downgrades by default.
Now, the 'new 3/3' test in
01-basic.t
probes the version selected by default, so I had to adjust that as well. With OpenSSL 1.1.0, there is a special method version 0x10000 indicating version negotiation. Prior to that, the version was set to the same as the highest implemented method. See:Here's an example that's failing with master but working with this commit: