I am trying to use openssl to exercise some ipv6-literate
networking gear. It's not working, and I am investigating
what I'm doing wrong. here's what I think I see. note -
I did some bit of poking on the list and I didn't see
anything but a vaguely recent discussion about a proposed
v6 patch and some mention of using something from the live
source tree instead.
(and if you too hit this in three years because v6 is
still not deployed, read past this in the mailing list
in case some wise soul corrects me...)
to test in v4, I do this:
0. set up the network. if you think about linux and two boxes
wired together it's like this:
ifconfig eth0 10.0.0.1 netmask 255.255.255.0 on the server
ifconfig eth0 10.0.0.2 netmask 255.255.255.0 on the client
1. use apps/CA.pl, etc. to spin a CA and then a server certificate
2. use "openssl s_server", with the cert spun in step 1,
3. use "openssl s_client -connect server" to connect to the server
started in step 2.
this gives me a whole http-over-ssl sequence, that I can tweak to
check sloppy vendors for enabling sslv2, etc.
with ipv6, I want to do the same thing:
0. ifconfig eth0 add 2001:0df8::1/32 on the server
ifconfig eth0 add 2001:0df8::2/32 on the client
1. cert generation is the same
2. "openssl s_server".
...
now it gets to be a problem. "openssl s_server" doesn't seem to
put up a tcp "listen" on the ipv6 address.
and, "openssl s_client" doesn't seem to parse ipv6 addresses like
"2001:0df8::1" or "[2001:0df8::1]" or an entry in /etc/hosts or
an entry in the dns that's an aaaa record.
so here's some questions...
1. does the openssl tool work with ipv6? for listening or for
calling? is there an alternate test tool in the openssl distro?
2. how are you supposed to do the ipv6 reverse lookup stuff to check
a server certificate for verification? how is that tested (assuming
it's there)? I know there's some v6 support in the PKIX certificate
parsing area but is it supported in (BIO? where networking things
happen.)
3. assuming for the moment I am correct and there is only partial v6
support, are there any other folks out there wishing to use TLS over
ipv6?
4. I could use curl or wget or lynx or firefox or something
to exercise tls-over-ipv6 connections. Anyone else hit this issue
and worked around it with some other tool?
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [EMAIL PROTECTED]
