IO::Socket::SSL 似乎忽略了 SSL_VERIFY_NONE答案

【问题标题】：IO::Socket::SSL seems to be ignoring SSL_VERIFY_NONEIO::Socket::SSL 似乎忽略了 SSL_VERIFY_NONE
【发布时间】：2020-11-05 02:35:56
【问题描述】：

IO::Socket::SSL 似乎忽略了 SSL_VERIFY_NONE；这是在带有 perl 5.18.2 的 OSX 10.14.1 和带有 perl 5.10.1 的 CentOS 6.10 上：

#!/usr/bin/perl

#
#  sslt
#
#  Test ssl connections to self-signed sites
#

use strict;
use warnings;

use IO::Socket::SSL qw( SSL_VERIFY_NONE );
use LWP::UserAgent;

my $url = 'https://internal_site:18443/rest/v1';
my $method = 'GET';

my $ua = LWP::UserAgent->new;
$ua->agent('sslt/0.1');
$ua->ssl_opts(SSL_verify_mode => SSL_VERIFY_NONE);

# Create a request
my $req = HTTP::Request->new($method => $url);

print STDERR "Raw request ($method): $url\n";

# Send request to the user agent and get a response back
my $res = $ua->request($req);
print STDERR "Raw response: ", $res->message, " (", $res->code, ")\n";

exit 0;

结果：

$ sslt
Raw request (GET): https://internal_site:18443/rest/v1
Raw response: Can't connect to internal_site:18443 (certificate verify failed) (500)

【问题讨论】：

标签： perl ssl io-socket-ssl

【解决方案1】：

这不是 IO::Socket::SSL 忽略 SSL_verify_mode 而是 LWP 覆盖它。来自LWP::Protocol::https：

sub _extra_sock_opts
{
    my $self = shift;
    my %ssl_opts = %{$self->{ua}{ssl_opts} || {}};
    if (delete $ssl_opts{verify_hostname}) {
        $ssl_opts{SSL_verify_mode} ||= 1;                  <<<<<<<<<<<<<<<<<<<<
        $ssl_opts{SSL_verifycn_scheme} = 'www';
    }

因此，您必须将 verify_hostname 设置为 0 才能真正禁用验证。另见票证LWP::Protocol::https discards 0 value for SSL_VERIFY_mode。

【讨论】：