I'm far from any sort of crypto expert, but this looks a bit odd.
SSL.File() is bombing out when trying to work with ECDHE ciphers.
Using this Pike script:
object ssl;
void readcb(mixed id, string data) {exit(0, "Readable\n%s\n", data);}
int x=1; void writecb() {if (x) ssl->write("asdf\n"); x=0; write("Writable\n");}
int main()
{
Stdio.File sock = Stdio.File();
sock->connect("127.0.0.1", 2211);
ssl = SSL.File(sock, SSL.Context());
ssl->set_nonblocking(readcb, writecb, lambda() {exit(0, "Closed\n");});
ssl->connect("localhost");
write("Connected\n");
return -1;
}
Generate a keypair:
$ openssl req -x509 -newkey rsa:4096 -keyout server.pem -out cert.pem
-days 365 -nodes -subj '/CN=localhost'
Start a simple server:
$ openssl s_server -port 2211 -cert cert.pem -key server.pem
Run the above script. It crashes out:
sprintf: Wrong type for argument 3: expected integer, got string.
pike/lib/modules/SSL.pmod/Cipher.pmod:1213:
SSL.Cipher.KeyExchangeECDHE()->client_key_exchange_packet(_static_modules.
_Stdio()->Buffer(0 bytes, read=[..-1] data=[0..-1] free=[0..224] allocated
),771)
... full traceback snipped ...
Start the server with ECDH ciphers disabled:
$ openssl s_server -port 2211 -cert cert.pem -key server.pem -cipher
'DEFAULT:!ECDH'
Run the same script. It succeeds - sends a message to the server,
waits for a response, then terminates.
There seems to be an issue with the way the premaster_secret is being
generated. But a quick hack to change get_x() to get_x_num(), while it
prevents the crash, doesn't actually make the connection work.
Hoping that someone else actually understands what's going on here!
ChrisA
