Created attachment 1486709 [details] PoC patch Description of problem: Post-handshake auth is disabled by default with TLSv1.3. IMO this is an error but upstream don't seem inclined to reverse it atm, see https://github.com/openssl/openssl/issues/6933 Version-Release number of selected component (if applicable): perl-IO-Socket-SSL-2.059-2.fc29 How reproducible: always Steps to Reproduce: 1. try using TLSv1.3 post-handshake auth Actual results: fail Expected results: success Additional info: Can provide more detailed repro case if required.
Patch should be conditional on Net::SSLeay exposing Net::SSLeay::CTX_set_post_handshake_auth which is done in f29 per bug 1630391, not sure how best to do that.
(In reply to Joe Orton from comment #1) > Patch should be conditional on Net::SSLeay exposing > Net::SSLeay::CTX_set_post_handshake_auth which is done in f29 per bug > 1630391, not sure how best to do that. Probably by using a $can_pha variable, like $can_npn, $can_alpn, $can_ocsp etc., which are set in the BEGIN block of lib/IO/Socket/SSL.pm.
https://github.com/noxxi/p5-io-socket-ssl/pull/80
Paul, if you don't mind, I will apply that patch. I have an intermittent test for that that I will include. (It uses openssl tool, once IO-Socket-SSL obtains server-side support for PHA the test will be rewritten without the openssl tool.)
Petr, go ahead. I was going to wait until upstream commented on the PR but that doesn't appear to be happening at the moment.
perl-IO-Socket-SSL-2.060-3.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-8d92841c14
perl-IO-Socket-SSL-2.060-3.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-8d92841c14
perl-IO-Socket-SSL-2.060-3.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.