[Haskell-cafe] Taking the TLS package for a spin ... and failing

Mads Lindstrøm mads.lindstroem at gmail.com
Sun Dec 12 20:13:59 CET 2010


Hi Haskellers,


I am trying to connect a Java client to a Haskell server using the
Haskell tls package, and things are not working out for me. There is a
lot of steps involved and I do not know what I am doing wrong, so this
is a long message. But first I create a private/public key-pair:

> openssl genrsa -out privkey.pem 2048

then I make a self-signed certificate:

> openssl req -new -x509 -key privkey.pem -out cacert.pem -days 1095

> Country Name (2 letter code) [AU]:
> State or Province Name (full name) [Some-State]:
> Locality Name (eg, city) []:
> Organization Name (eg, company) [Internet Widgits Pty Ltd]:
> Organizational Unit Name (eg, section) []:
> Common Name (eg, YOUR name) []:192.168.1.6
> Email Address []:

then I convert the certificate to DER format and stuff it into a Java
keystore:

> openssl x509 -in cacert.pem -out cert.der -outform DER
> keytool -keystore myKeystore.store -importcert -storepass foobar -keypass foobar -file cert.der

now I start the Haskell server:

> ghc -hide-package monads-tf Server.hs -e main

and then the Java client:

> javac Client.java
> java  -Djavax.net.debug=all -Djavax.net.ssl.trustStore=myKeystore.store -Djavax.net.ssl.trustStorePassword=foobar Client >JavaClientOutput.txt 2>&1

The server output is:

> <interactive>: user error (unexpected type received. expecting handshake ++ Left (Error_Packet "invalid type"))

and not "Hello world" as expected.

The client output is very long, but the most interesting part is
properly:

> main, received EOFException: error
> main, handling exception: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
> main, SEND TLSv1 ALERT:  fatal, description = handshake_failure

I have attached the Haskell server, the Java client and the full java
output. Hope somebody can help figure out what I do wrong.

I am using the Haskell tsl package version 0.3.1. And I run Debian
Linux.


I also tried connecting a Java client to a Java server. First create
server keystore:

> openssl pkcs8 -topk8 -nocrypt -in privkey.pem -inform PEM -out privkey.der -outform DER
> java -Dkeystore=myServerKeystore.store ImportKey privkey.der cert.der

ImportKey.java can be found here
http://www.agentbob.info/agentbob/79-AB.html .

then start Java server:

> javac JavaServer.java
> java -Djavax.net.ssl.keyStore=myServerKeystore.store -Djavax.net.ssl.keyStorePassword=importkey JavaServer

and run the client again:

> java  -Djavax.net.debug=all -Djavax.net.ssl.trustStore=myKeystore.store -Djavax.net.ssl.trustStorePassword=foobar Client

and the server outputs:

> Hello world

as expected. Thus I think the certificates are fine, and the Java client
is fine. But what am I doing wrong in the Haskell server?

I have attached JavaServer.java.


Regards,

Mads Lindstrøm

-------------- next part --------------
A non-text attachment was scrubbed...
Name: Client.java
Type: text/x-java
Size: 863 bytes
Desc: not available
URL: <http://www.haskell.org/pipermail/haskell-cafe/attachments/20101212/1afd7d4e/attachment.java>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: JavaServer.java
Type: text/x-java
Size: 999 bytes
Desc: not available
URL: <http://www.haskell.org/pipermail/haskell-cafe/attachments/20101212/1afd7d4e/attachment-0001.java>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Server.hs
Type: text/x-vhdl
Size: 3354 bytes
Desc: not available
URL: <http://www.haskell.org/pipermail/haskell-cafe/attachments/20101212/1afd7d4e/attachment.bin>
-------------- next part --------------
keyStore is : 
keyStore type is : jks
keyStore provider is : 
init keystore
init keymanager of type SunX509
trustStore is: myKeystore.store
trustStore type is : jks
trustStore provider is : 
init truststore
adding as trusted cert:
  Subject: CN=192.168.1.6, O=Internet Widgits Pty Ltd, ST=Some-State, C=AU
  Issuer:  CN=192.168.1.6, O=Internet Widgits Pty Ltd, ST=Some-State, C=AU
  Algorithm: RSA; Serial number: 0xafd8b93f9f4ca3d7
  Valid from Sun Dec 12 19:50:14 CET 2010 until Wed Dec 11 19:50:14 CET 2013

trigger seeding of SecureRandom
done seeding SecureRandom
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
%% No cached client session
*** ClientHello, TLSv1
RandomCookie:  GMT: 1292180106 bytes = { 40, 135, 73, 129, 198, 116, 247, 112, 56, 12, 229, 94, 70, 112, 36, 197, 0, 80, 139, 101, 102, 152, 214, 85, 31, 198, 224, 53 }
Session ID:  {}
Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
***
[write] MD5 and SHA1 hashes:  len = 75
0000: 01 00 00 47 03 01 4D 05   1B 8A 28 87 49 81 C6 74  ...G..M...(.I..t
0010: F7 70 38 0C E5 5E 46 70   24 C5 00 50 8B 65 66 98  .p8..^Fp$..P.ef.
0020: D6 55 1F C6 E0 35 00 00   20 00 04 00 05 00 2F 00  .U...5.. ...../.
0030: 33 00 32 00 0A 00 16 00   13 00 09 00 15 00 12 00  3.2.............
0040: 03 00 08 00 14 00 11 00   FF 01 00                 ...........
main, WRITE: TLSv1 Handshake, length = 75
[write] MD5 and SHA1 hashes:  len = 101
0000: 01 03 01 00 3C 00 00 00   20 00 00 04 01 00 80 00  ....<... .......
0010: 00 05 00 00 2F 00 00 33   00 00 32 00 00 0A 07 00  ..../..3..2.....
0020: C0 00 00 16 00 00 13 00   00 09 06 00 40 00 00 15  ............ at ...
0030: 00 00 12 00 00 03 02 00   80 00 00 08 00 00 14 00  ................
0040: 00 11 00 00 FF 4D 05 1B   8A 28 87 49 81 C6 74 F7  .....M...(.I..t.
0050: 70 38 0C E5 5E 46 70 24   C5 00 50 8B 65 66 98 D6  p8..^Fp$..P.ef..
0060: 55 1F C6 E0 35                                     U...5
main, WRITE: SSLv2 client hello message, length = 101
[Raw write]: length = 103
0000: 80 65 01 03 01 00 3C 00   00 00 20 00 00 04 01 00  .e....<... .....
0010: 80 00 00 05 00 00 2F 00   00 33 00 00 32 00 00 0A  ....../..3..2...
0020: 07 00 C0 00 00 16 00 00   13 00 00 09 06 00 40 00  .............. at .
0030: 00 15 00 00 12 00 00 03   02 00 80 00 00 08 00 00  ................
0040: 14 00 00 11 00 00 FF 4D   05 1B 8A 28 87 49 81 C6  .......M...(.I..
0050: 74 F7 70 38 0C E5 5E 46   70 24 C5 00 50 8B 65 66  t.p8..^Fp$..P.ef
0060: 98 D6 55 1F C6 E0 35                               ..U...5
main, received EOFException: error
main, handling exception: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
main, SEND TLSv1 ALERT:  fatal, description = handshake_failure
main, WRITE: TLSv1 Alert, length = 2
[Raw write]: length = 7
0000: 15 03 01 00 02 02 28                               ......(
main, called closeSocket()
main, called close()
main, called closeInternal(true)
main, called close()
main, called closeInternal(true)


More information about the Haskell-Cafe mailing list