public inbox for cygwin@cygwin.com
 help / color / mirror / Atom feed
* Problem with HTTPS in LWP module in Perl
@ 2012-11-01 18:05 Björn Kautler
  2012-11-01 18:22 ` Reini Urban
                   ` (2 more replies)
  0 siblings, 3 replies; 12+ messages in thread
From: Björn Kautler @ 2012-11-01 18:05 UTC (permalink / raw)
  To: cygwin

Hi,

I'm having a problem with https requests to
"https://www.geocaching.com" in perl.
Nothing was done at all, then I found out I need to install
LWP::Protocol:https which I did with "cpan LWP::Protocol:https".
Now according to Wireshark at least SSL communication is started.
But after the "Client Hello" it just hangs until a timeout happens,
waiting for the "Server Hello".
With other HTTPS pages like "https://www.google.com" it works fine.
The exact same Perl script works fine under Ubuntu.
The https request to the same page works fine with curl under cygwin.
If I change the SSL socket class to Net::SSL instead of
IO::Socket::SSL, it also hangs after the "Client Hello", but then
retries with SSLv3 instead of TLSv1 according to Wireshark and this at
least works a bit better though not completely.
So I guess something is weird in the Cygwin port of IO::Socket::SSL. :-/

Regards
Björn

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: Problem with HTTPS in LWP module in Perl
  2012-11-01 18:05 Problem with HTTPS in LWP module in Perl Björn Kautler
@ 2012-11-01 18:22 ` Reini Urban
  2012-11-01 18:29   ` Reini Urban
  2012-11-06 16:48 ` Achim Gratz
       [not found] ` <CAKChYSqz8PXYhF3azLRVe=BcAQOC1ZnwzjLAxn7EWw-qKn398w at mail dot gmail dot com>
  2 siblings, 1 reply; 12+ messages in thread
From: Reini Urban @ 2012-11-01 18:22 UTC (permalink / raw)
  To: cygwin

On Thu, Nov 1, 2012 at 1:05 PM, Björn Kautler  wrote:
> I'm having a problem with https requests to
> "https://www.geocaching.com" in perl.
> Nothing was done at all, then I found out I need to install
> LWP::Protocol:https which I did with "cpan LWP::Protocol:https".
> Now according to Wireshark at least SSL communication is started.
> But after the "Client Hello" it just hangs until a timeout happens,
> waiting for the "Server Hello".
> With other HTTPS pages like "https://www.google.com" it works fine.
> The exact same Perl script works fine under Ubuntu.
> The https request to the same page works fine with curl under cygwin.
> If I change the SSL socket class to Net::SSL instead of
> IO::Socket::SSL, it also hangs after the "Client Hello", but then
> retries with SSLv3 instead of TLSv1 according to Wireshark and this at
> least works a bit better though not completely.
> So I guess something is weird in the Cygwin port of IO::Socket::SSL. :-/

Probably, but I cannot reproduce it.
If it is, you need to file a rt.cpan.org ticket for this,
with some wireshark loggings and the exact request.

$ lwp-request https://www.geocaching.com/
501 Protocol scheme 'https' is not supported (LWP::Protocol::https not
installed)
$ cpan LWP::Protocol::https
... (built and installed SULLR/IO-Socket-SSL-1.77.tar.gz,
GAAS/LWP-Protocol-https-6.03.tar.gz)
  /usr/bin/make install  -- OK

$ lwp-request -USed https://www.geocaching.com/
GET https://www.geocaching.com/
User-Agent: lwp-request/6.03 libwww-perl/6.04

500 Can't connect to www.geocaching.com:443
Content-Type: text/plain
Client-Date: Thu, 01 Nov 2012 18:21:07 GMT
Client-Warning: Internal response

From debian:
$ lwp-request -USed https://www.geocaching.com/
GET https://www.geocaching.com/
User-Agent: lwp-request/5.834 libwww-perl/6.04

GET https://www.geocaching.com/ --> 500 Can't connect to www.geocaching.com:443
Content-Type: text/plain
Client-Date: Thu, 01 Nov 2012 18:18:49 GMT
Client-Warning: Internal response

$ lwp-request -USed https://www.google.com/
-> 200 OK

-- 
Reini Urban
http://cpanel.net/   http://www.perl-compiler.org/

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: Problem with HTTPS in LWP module in Perl
  2012-11-01 18:22 ` Reini Urban
@ 2012-11-01 18:29   ` Reini Urban
  2012-11-06 10:58     ` Björn Kautler
  0 siblings, 1 reply; 12+ messages in thread
From: Reini Urban @ 2012-11-01 18:29 UTC (permalink / raw)
  To: cygwin

On Thu, Nov 1, 2012 at 1:22 PM, Reini Urban wrote:
> On Thu, Nov 1, 2012 at 1:05 PM, Björn Kautler  wrote:
>> I'm having a problem with https requests to
>> "https://www.geocaching.com" in perl.
>> Nothing was done at all, then I found out I need to install
>> LWP::Protocol:https which I did with "cpan LWP::Protocol:https".
>> Now according to Wireshark at least SSL communication is started.
>> But after the "Client Hello" it just hangs until a timeout happens,
>> waiting for the "Server Hello".
>> With other HTTPS pages like "https://www.google.com" it works fine.
>> The exact same Perl script works fine under Ubuntu.
>> The https request to the same page works fine with curl under cygwin.
>> If I change the SSL socket class to Net::SSL instead of
>> IO::Socket::SSL, it also hangs after the "Client Hello", but then
>> retries with SSLv3 instead of TLSv1 according to Wireshark and this at
>> least works a bit better though not completely.
>> So I guess something is weird in the Cygwin port of IO::Socket::SSL. :-/
>
> Probably, but I cannot reproduce it.
> If it is, you need to file a rt.cpan.org ticket for this,
> with some wireshark loggings and the exact request.
>
> $ lwp-request https://www.geocaching.com/
> 501 Protocol scheme 'https' is not supported (LWP::Protocol::https not
> installed)
> $ cpan LWP::Protocol::https
> ... (built and installed SULLR/IO-Socket-SSL-1.77.tar.gz,
> GAAS/LWP-Protocol-https-6.03.tar.gz)
>   /usr/bin/make install  -- OK
>
> $ lwp-request -USed https://www.geocaching.com/
> GET https://www.geocaching.com/
> User-Agent: lwp-request/6.03 libwww-perl/6.04
>
> 500 Can't connect to www.geocaching.com:443
> Content-Type: text/plain
> Client-Date: Thu, 01 Nov 2012 18:21:07 GMT
> Client-Warning: Internal response
>
> From debian:
> $ lwp-request -USed https://www.geocaching.com/
> GET https://www.geocaching.com/
> User-Agent: lwp-request/5.834 libwww-perl/6.04
>
> GET https://www.geocaching.com/ --> 500 Can't connect to www.geocaching.com:443
> Content-Type: text/plain
> Client-Date: Thu, 01 Nov 2012 18:18:49 GMT
> Client-Warning: Internal response
>
> $ lwp-request -USed https://www.google.com/
> -> 200 OK

I got a bit more information from some other version:

$ perl5.14.3 -S lwp-request -USed https://www.geocaching.com/
GET https://www.geocaching.com/
User-Agent: lwp-request/5.834 libwww-perl/6.04

GET https://www.geocaching.com/ --> 500 Can't connect to
www.geocaching.com:443 (Crypt-SSLeay can't verify hostnames)
Content-Type: text/plain
Client-Date: Thu, 01 Nov 2012 18:22:57 GMT
Client-Warning: Internal response

So I think it's on the application level, not the library. This is
with Crypt::SSLeay 0.64.
My Cygwin has 0.60, and debian had 0.58.

See http://stackoverflow.com/questions/12116244/https-proxy-and-lwpuseragent
how to utilize PERL_LWP_SSL_VERIFY_HOSTNAME=0
-- 
Reini Urban
http://cpanel.net/   http://www.perl-compiler.org/

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: Problem with HTTPS in LWP module in Perl
  2012-11-01 18:29   ` Reini Urban
@ 2012-11-06 10:58     ` Björn Kautler
  2012-11-06 11:29       ` Helmut Karlowski
  0 siblings, 1 reply; 12+ messages in thread
From: Björn Kautler @ 2012-11-06 10:58 UTC (permalink / raw)
  To: cygwin

Hi,

I think you have hit exactly the same problem than me as far as i can
tell from your output, though I didn't use lwp-request but
LWP::UserAgent, but I tried with lwp-request and it is the same. Let
me explain inline in your mail what I think happened during your
tries.

2012/11/1 Reini Urban <rurban@x-ray.at>:
> On Thu, Nov 1, 2012 at 1:22 PM, Reini Urban wrote:
>> On Thu, Nov 1, 2012 at 1:05 PM, Björn Kautler  wrote:
>>> I'm having a problem with https requests to
>>> "https://www.geocaching.com" in perl.
>>> Nothing was done at all, then I found out I need to install
>>> LWP::Protocol:https which I did with "cpan LWP::Protocol:https".
>>> Now according to Wireshark at least SSL communication is started.
>>> But after the "Client Hello" it just hangs until a timeout happens,
>>> waiting for the "Server Hello".
>>> With other HTTPS pages like "https://www.google.com" it works fine.
>>> The exact same Perl script works fine under Ubuntu.
>>> The https request to the same page works fine with curl under cygwin.
>>> If I change the SSL socket class to Net::SSL instead of
>>> IO::Socket::SSL, it also hangs after the "Client Hello", but then
>>> retries with SSLv3 instead of TLSv1 according to Wireshark and this at
>>> least works a bit better though not completely.
>>> So I guess something is weird in the Cygwin port of IO::Socket::SSL. :-/
>>
>> Probably, but I cannot reproduce it.
>> If it is, you need to file a rt.cpan.org ticket for this,
>> with some wireshark loggings and the exact request.
>>
>> $ lwp-request https://www.geocaching.com/
>> 501 Protocol scheme 'https' is not supported (LWP::Protocol::https not
>> installed)
>> $ cpan LWP::Protocol::https
>> ... (built and installed SULLR/IO-Socket-SSL-1.77.tar.gz,
>> GAAS/LWP-Protocol-https-6.03.tar.gz)
>>   /usr/bin/make install  -- OK
>>
>> $ lwp-request -USed https://www.geocaching.com/
>> GET https://www.geocaching.com/
>> User-Agent: lwp-request/6.03 libwww-perl/6.04
>>
>> 500 Can't connect to www.geocaching.com:443
>> Content-Type: text/plain
>> Client-Date: Thu, 01 Nov 2012 18:21:07 GMT
>> Client-Warning: Internal response

How long did this need from executing until error message?
I think this is the exact place where the error happens, also for you.
At least the output seems like that to me.

>> From debian:
>> $ lwp-request -USed https://www.geocaching.com/
>> GET https://www.geocaching.com/
>> User-Agent: lwp-request/5.834 libwww-perl/6.04
>>
>> GET https://www.geocaching.com/ --> 500 Can't connect to www.geocaching.com:443
>> Content-Type: text/plain
>> Client-Date: Thu, 01 Nov 2012 18:18:49 GMT
>> Client-Warning: Internal response
>>
>> $ lwp-request -USed https://www.google.com/
>> -> 200 OK
>
> I got a bit more information from some other version:
>
> $ perl5.14.3 -S lwp-request -USed https://www.geocaching.com/
> GET https://www.geocaching.com/
> User-Agent: lwp-request/5.834 libwww-perl/6.04
>
> GET https://www.geocaching.com/ --> 500 Can't connect to
> www.geocaching.com:443 (Crypt-SSLeay can't verify hostnames)
> Content-Type: text/plain
> Client-Date: Thu, 01 Nov 2012 18:22:57 GMT
> Client-Warning: Internal response
>
> So I think it's on the application level, not the library. This is
> with Crypt::SSLeay 0.64.
> My Cygwin has 0.60, and debian had 0.58.
>
> See http://stackoverflow.com/questions/12116244/https-proxy-and-lwpuseragent
> how to utilize PERL_LWP_SSL_VERIFY_HOSTNAME=0

I don't think this is more information but another case.
There are two SSL Socket classes that you can set.
If you use Net::SSL like "PERL_NET_HTTPS_SSL_SOCKET_CLASS='Net::SSL'
lwp-request -USed https://www.geocaching.com" you get teh error 500
with "Crypt-SSLeay can't verify hostnames". If you use IO::Socket::SSL
like "PERL_NET_HTTPS_SSL_SOCKET_CLASS='IO::Socket::SSL' lwp-request
-USed https://www.geocaching.com" which seems to be the default on all
systems I tried on, you don't get the error with hostname
verification, but the timeout.
If I use Net::SSL as socket class and switch off hostname verification
with "PERL_LWP_SSL_VERIFY_HOSTNAME=0", I'm getting the very same
timeout I get with the other socket class, just that after the timeout
the library tries again with an SSLv3 client hello instead of an TLSv1
client hello and succeds.
But using curl shows that it should work with the TLSv1 client hello right away.
Just like I described in my original message already. :-)

Cheers
Björn

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: Problem with HTTPS in LWP module in Perl
  2012-11-06 10:58     ` Björn Kautler
@ 2012-11-06 11:29       ` Helmut Karlowski
  2012-11-06 13:17         ` Björn Kautler
  0 siblings, 1 reply; 12+ messages in thread
From: Helmut Karlowski @ 2012-11-06 11:29 UTC (permalink / raw)
  To: cygwin

Björn Kautler, 06.11.2012 11:57:32:

> Hi,
>
> I think you have hit exactly the same problem than me as far as i can
> tell from your output, though I didn't use lwp-request but
> LWP::UserAgent, but I tried with lwp-request and it is the same. Let

The same happens with links:

links https://www.geocaching.com

It starts ssl-negotiation, and timeouts later. I also see this with other  
urls, while other https-urls work fine. I guess there are some  
certificates missing or similar, I'm no expert for ssl.

But it seems it's not only perl-related.

-- 
Helmut Karlowski

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: Problem with HTTPS in LWP module in Perl
  2012-11-06 11:29       ` Helmut Karlowski
@ 2012-11-06 13:17         ` Björn Kautler
  0 siblings, 0 replies; 12+ messages in thread
From: Björn Kautler @ 2012-11-06 13:17 UTC (permalink / raw)
  To: cygwin

Yes, seems so, same here with links.
But I don't think this is about missing certificates.
On Ubuntu it works fine for me and with another server
(https://www.kautler.net) where only an expired self-signed certifcate
is present, it says that the "Certificate verify failed" if
PERL_LWP_SSL_VERIFY_HOSTNAME is on or goes on if it is switched off.
Also the certificate is transmitted after the server hello, so it is
"client hello from client to server -> server hello from server to
client -> certificate and other stuff from server to client" but the
timeout happens before the certificates are transmitted during waiting
for the server hello.

The interesting thing is that it works with curl but fails with
lwp-request and links.


2012/11/6 Helmut Karlowski <helmut.karlowski@ish.de>:
> Björn Kautler, 06.11.2012 11:57:32:
>
>
>> Hi,
>>
>> I think you have hit exactly the same problem than me as far as i can
>> tell from your output, though I didn't use lwp-request but
>> LWP::UserAgent, but I tried with lwp-request and it is the same. Let
>
>
> The same happens with links:
>
> links https://www.geocaching.com
>
> It starts ssl-negotiation, and timeouts later. I also see this with other
> urls, while other https-urls work fine. I guess there are some certificates
> missing or similar, I'm no expert for ssl.
>
> But it seems it's not only perl-related.
>
> --
> Helmut Karlowski
>
>
> --
> Problem reports:       http://cygwin.com/problems.html
> FAQ:                   http://cygwin.com/faq/
> Documentation:         http://cygwin.com/docs.html
> Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
>

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: Problem with HTTPS in LWP module in Perl
  2012-11-01 18:05 Problem with HTTPS in LWP module in Perl Björn Kautler
  2012-11-01 18:22 ` Reini Urban
@ 2012-11-06 16:48 ` Achim Gratz
  2012-11-06 17:55   ` Helmut Karlowski
  2012-11-06 22:52   ` Björn Kautler
       [not found] ` <CAKChYSqz8PXYhF3azLRVe=BcAQOC1ZnwzjLAxn7EWw-qKn398w at mail dot gmail dot com>
  2 siblings, 2 replies; 12+ messages in thread
From: Achim Gratz @ 2012-11-06 16:48 UTC (permalink / raw)
  To: cygwin

Björn Kautler writes:
> I'm having a problem with https requests to
> "https://www.geocaching.com" in perl.

This has nothing to do with Cygwin, the same error happens on Linux:

$ perl -e 'use LWP::Simple;' -e '($r=get("https://www.geocaching.com")) or print "$!\n$@\n";print "$r\n";'
Connection reset by peer
Can't connect to www.geocaching.com:443

LWP::Protocol::https::Socket: SSL connect attempt failed with unknown error error:00000000:lib(0):func(0):reason(0) at /usr/lib/perl5/vendor_perl/5.16.0/LWP/Protocol/http.pm line 51.

The error message is slightly different than on Cygwin.  I haven't
looked further into this, but I wouldn't be surprised if the server
simply doesn't accept connections from LWP and some other user agents
that are typically used for crawling…


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Wavetables for the Waldorf Blofeld:
http://Synth.Stromeko.net/Downloads.html#BlofeldUserWavetables


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: Problem with HTTPS in LWP module in Perl
  2012-11-06 16:48 ` Achim Gratz
@ 2012-11-06 17:55   ` Helmut Karlowski
  2012-11-06 23:02     ` Björn Kautler
  2012-11-06 22:52   ` Björn Kautler
  1 sibling, 1 reply; 12+ messages in thread
From: Helmut Karlowski @ 2012-11-06 17:55 UTC (permalink / raw)
  To: cygwin

Achim Gratz, 06.11.2012 17:48:19:

> This has nothing to do with Cygwin, the same error happens on Linux:
>
> $ perl -e 'use LWP::Simple;' -e '($r=get("https://www.geocaching.com"))  
> or print "$!\n$@\n";print "$r\n";'
> Connection reset by peer
> Can't connect to www.geocaching.com:443

Just got this in lynx (after waiting real long):

Geocaching.com will be going offline temporarily for maintenance on  
Tuesday, November 6, 2012 at approximately 6pm PST

Maybe that's the reason? links still timeouts while lynx says after some  
minutes:

unable to get local issuer certificate - Continue?

when I agree it worked before but now issues:

Suche nach www.geocaching.com
HTTPS-Verbindung zu www.geocaching.com wird aufgebaut.
Verbindung erneut versuchen, ohne TLS.
Suche nach www.geocaching.com
HTTPS-Verbindung zu www.geocaching.com wird aufgebaut.
SSL callback:unable to get local issuer certificate, preverify_ok=0,  
ssl_okay=0
SSL callback:certificate not trusted, preverify_ok=0, ssl_okay=1
SSL callback:certificate not trusted, preverify_ok=1, ssl_okay=1
SSL callback:certificate not trusted, preverify_ok=1, ssl_okay=1
Obacht: Unable to make secure connection to remote host.

lynx: Unzugängliche Startdatei https://www.geocaching.com/

lynx exits here.

(sorry for german).

Also the other urls I cannot connect to with links work with lynx after  
answering the above certificate-question and a long time of waiting.

-- 
Helmut Karlowski

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: Problem with HTTPS in LWP module in Perl
  2012-11-06 16:48 ` Achim Gratz
  2012-11-06 17:55   ` Helmut Karlowski
@ 2012-11-06 22:52   ` Björn Kautler
  1 sibling, 0 replies; 12+ messages in thread
From: Björn Kautler @ 2012-11-06 22:52 UTC (permalink / raw)
  To: cygwin

2012/11/6 Achim Gratz <Stromeko@nexgo.de>:
> Björn Kautler writes:
>> I'm having a problem with https requests to
>> "https://www.geocaching.com" in perl.
>
> This has nothing to do with Cygwin, the same error happens on Linux:
>
> $ perl -e 'use LWP::Simple;' -e '($r=get("https://www.geocaching.com")) or print "$!\n$@\n";print "$r\n";'
> Connection reset by peer
> Can't connect to www.geocaching.com:443
>
> LWP::Protocol::https::Socket: SSL connect attempt failed with unknown error error:00000000:lib(0):func(0):reason(0) at /usr/lib/perl5/vendor_perl/5.16.0/LWP/Protocol/http.pm line 51.
>
> The error message is slightly different than on Cygwin.  I haven't
> looked further into this, but I wouldn't be surprised if the server
> simply doesn't accept connections from LWP and some other user agents
> that are typically used for crawling…

For me the command you wrote works absolutely fine on Ubuntu Karmic
and Debian Lenny, but shows the same timeout behaviour on Cygwin.
I get the exact same error message on Cygwin like you wrote, just with
perl 5.14 in the path.
As this is hanging after the "Client Hello" and while waiting for the
"Server Hello" I don't think that a blocking of some user agent is
possible at this stage, because this is before the initial SSL
handshake took place and thus a user agent is not available.
Also on Ubuntu and Debian it is working fine here.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: Problem with HTTPS in LWP module in Perl
  2012-11-06 17:55   ` Helmut Karlowski
@ 2012-11-06 23:02     ` Björn Kautler
  2012-11-07 11:44       ` Björn Kautler
  0 siblings, 1 reply; 12+ messages in thread
From: Björn Kautler @ 2012-11-06 23:02 UTC (permalink / raw)
  To: cygwin

2012/11/6 Helmut Karlowski <helmut.karlowski@ish.de>:
> Achim Gratz, 06.11.2012 17:48:19:
>
>
>> This has nothing to do with Cygwin, the same error happens on Linux:
>>
>> $ perl -e 'use LWP::Simple;' -e '($r=get("https://www.geocaching.com")) or
>> print "$!\n$@\n";print "$r\n";'
>> Connection reset by peer
>> Can't connect to www.geocaching.com:443
>
>
> Just got this in lynx (after waiting real long):
>
> Geocaching.com will be going offline temporarily for maintenance on Tuesday,
> November 6, 2012 at approximately 6pm PST
>
> Maybe that's the reason?

I don't think so, I'm having this for days and from Cygwin yes, but
Ubuntu and Debian no, so I don't think this is caused by the server.

> links still timeouts while lynx says after some
> minutes:
>
> unable to get local issuer certificate - Continue?
>
> when I agree it worked before but now issues:
>
> Suche nach www.geocaching.com
> HTTPS-Verbindung zu www.geocaching.com wird aufgebaut.
> Verbindung erneut versuchen, ohne TLS.
> Suche nach www.geocaching.com
> HTTPS-Verbindung zu www.geocaching.com wird aufgebaut.
> SSL callback:unable to get local issuer certificate, preverify_ok=0,
> ssl_okay=0
> SSL callback:certificate not trusted, preverify_ok=0, ssl_okay=1
> SSL callback:certificate not trusted, preverify_ok=1, ssl_okay=1
> SSL callback:certificate not trusted, preverify_ok=1, ssl_okay=1
> Obacht: Unable to make secure connection to remote host.
>
> lynx: Unzugängliche Startdatei https://www.geocaching.com/
>
> lynx exits here.
>
> (sorry for german).
>
> Also the other urls I cannot connect to with links work with lynx after
> answering the above certificate-question and a long time of waiting.
>

lynx behaves similar to LWP with Net::SSL as socket class and hostname
verification off.
It sends a TLSv1 Client Hello.
Then times out waiting for the Server Hello.
Then sends again an SSLv3 Client Hello and kind of succeeds.
So it shows the same behaviour for the TLSv1 case which should work as
curl shows.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: Problem with HTTPS in LWP module in Perl
  2012-11-06 23:02     ` Björn Kautler
@ 2012-11-07 11:44       ` Björn Kautler
  0 siblings, 0 replies; 12+ messages in thread
From: Björn Kautler @ 2012-11-07 11:44 UTC (permalink / raw)
  To: cygwin

Some additional information, it is also broken in curl.
By accident I used GnuWin32 curl and there it worked.
Now I used the Cygwin curl and am facing the exact same problem.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: Problem with HTTPS in LWP module in Perl - solution
       [not found] ` <CAKChYSqz8PXYhF3azLRVe=BcAQOC1ZnwzjLAxn7EWw-qKn398w at mail dot gmail dot com>
@ 2013-01-08 21:05   ` doesniedoen
  0 siblings, 0 replies; 12+ messages in thread
From: doesniedoen @ 2013-01-08 21:05 UTC (permalink / raw)
  To: cygwin

FYI,

I ran into the same problem, did some wiresharking, and  figured out 
what the differences are
between a successful handshake (Firefox) and the failure (LWP using 
SSLeay/openssl).
I'm not too familiar with SSL/TLS etc, but it turns out that the cipher 
list is way larger using
openssl (64 suites) than with Firefox (36 suites). I figure the order 
and presence of some ciphers
is the cause: the actual cipher used is TLS_RSA_WITH_RC4_128_SHA, which 
is present in both
cases. Also the TLS version used (1.0 for Firefox, 1.2 for openssl) does 
not make a difference.

The following code allows for a successful transaction with 
https://www.geocaching.com.
The solution is in the SSL_cipher_list:

$ perl -e '$ENV{PERL_NET_HTTPS_SSL_SOCKET_CLASS}="IO::Socket::SSL";\
use IO::Socket::SSL; IO::Socket::SSL::set_defaults(SSL_cipher_list => 
"RC4-SHA");\
use LWP::UserAgent; print LWP::UserAgent->new()->request(\
HTTP::Request->new(GET=>"https://www.geocaching.com"))->content;'

However this includes only the one cipher (and 
TLS_EMPTY_RENEGOTIATION_INFO_SCSV).

Expanding to all SHA ciphers, the following filter must be used:
           'SHA:!NULL:!3DES:!DES:!ADH:!SRP'

Finally, this is the filter with a relatively broad scope, and again all 
exclusions are required:

          'ALL:!3DES:!DES:!ADH:!SRP:!AESGCM:!SHA256:!SHA384'

When any of these excluded ciphers/hashes are present in the Client 
Hello negotiation packet,
there is no response from the server besides a TCP ACK.
Note that, for instance, '!3DES' also filters out ciphers that use 3DES 
as an encoding (I guess)
and not as the main cipher, such as TLS_RSA_WITH_3DES_EDE_CBC_SHA, who's 
presence in the handshake is not problematic.

I figure that servers that do not respond at the TLS/SSL level when they 
see a client offering certain capabilities have their reasons for doing 
so, for a 'rep scasw' can't be that buggy.

Yours sincerely,
   Kenney Westerhof


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 12+ messages in thread

end of thread, other threads:[~2013-01-08 21:05 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-11-01 18:05 Problem with HTTPS in LWP module in Perl Björn Kautler
2012-11-01 18:22 ` Reini Urban
2012-11-01 18:29   ` Reini Urban
2012-11-06 10:58     ` Björn Kautler
2012-11-06 11:29       ` Helmut Karlowski
2012-11-06 13:17         ` Björn Kautler
2012-11-06 16:48 ` Achim Gratz
2012-11-06 17:55   ` Helmut Karlowski
2012-11-06 23:02     ` Björn Kautler
2012-11-07 11:44       ` Björn Kautler
2012-11-06 22:52   ` Björn Kautler
     [not found] ` <CAKChYSqz8PXYhF3azLRVe=BcAQOC1ZnwzjLAxn7EWw-qKn398w at mail dot gmail dot com>
2013-01-08 21:05   ` Problem with HTTPS in LWP module in Perl - solution doesniedoen

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).