Bug#606243: [rt.cpan.org #63741] Re: Bug#606243: IO::Socket::SSL fails when verify_callback is supplied without ca_path or ca_file

2010-12-13 Thread Daniel Kahn Gillmor 
On 12/09/2010 10:26 AM, Salvatore Bonaccorso wrote:
 I just uploaded 1.37 to unstable. See [1] for Steffen's answer.
 
  [1] https://rt.cpan.org/Public/Bug/Display.html?id=63741#txn-866329
 
 Could you please test it?

Yes, IO::Socket::SSL 1.37 appears to work for my purposes with  ca_file
and ca_path set to undef.  Thanks to everyone involved for their quick
responses!

--dkg



signature.asc
Description: OpenPGP digital signature

Bug#606243: [rt.cpan.org #63741] Re: Bug#606243: IO::Socket::SSL fails when verify_callback is supplied without ca_path or ca_file

2010-12-09 Thread Salvatore Bonaccorso 
Hi Daniel

I just uploaded 1.37 to unstable. See [1] for Steffen's answer.

 [1] https://rt.cpan.org/Public/Bug/Display.html?id=63741#txn-866329

Could you please test it?

Thanks and bests
Salvatore


signature.asc
Description: Digital signature

Bug#606243: [rt.cpan.org #63741] Re: Bug#606243: IO::Socket::SSL fails when verify_callback is supplied without ca_path or ca_file

2010-12-08 Thread Daniel Kahn Gillmor 
On 12/08/2010 04:24 PM, Salvatore Bonaccorso wrote:
 - Forwarded message from Steffen Ullrich via RT 
 bug-io-socket-...@rt.cpan.org -
 it's not that simple:
 - usually SSL_verify_callback is used together with a valid CA file or
   CA path, because one wants to let openssl pre-check the certificate
   and only add additional checks (see SSL_set_verify openssl docs),
 - if SSL_verifycn_scheme is set there will be an implicite 
   SSL_verify_callback which checks the name in the certificate
 
 Because the case, that somebody wants to check the certificate completly 
 by itself w/o having openssl check the certificate chain, is IMHO
 uncommon, I don't change the code for now.

Hrm.  i'm doing it with a tool i hope to release later this week,
actually [0], so while it might be uncommon, it does happen.

What do you suggest i do to make this work?  maybe i should do something
like:

 ca_path = '/'

?

That seems pretty weird to me.  Can you recommend a better way that i
can fully disable these checks, or is this the best way?

 I think it is safer than risk to not doing certificate checks.

What do you think is the risk here?  If no trusted root authorities are
supplied (by either ca_path or ca_file), but a verify callback is
present, that verify callback will simply never see a preverify_ok
argument set to 1, right?  why is that dangerous?

--dkg

[0] https://labs.riseup.net/code/issues/2016



signature.asc
Description: OpenPGP digital signature