CODEWITHSUNDEEP
httpslualuasec
bokirov
bokirov

Reputation: 13

Lua - HTTPS / tlsv1 alert internal error

I am trying to interact with the Cleverbot API with Lua. I've got a key and a username, so I tested with Postman and it worked perfectly. Then I tried to do the same thing with Lua but I'm having a weird error.

This is the code:

local https = require("ssl.https")
local string = require("string")
local ltn12 = require ("ltn12")
local funcs = (loadfile "./libs/functions.lua")()

local function cleverbot(msg)
    local params = {
        ['user'] = 'SyR2nvN1cAxxxxxx',
        ['key'] = 'ckym8oDRNvpYO95GmTD14O9PuGxxxxxx',
        ['nick'] = 'cleverbot',
        ['text'] = tostring(msg),
    }

    local body = funcs.encode_table(params)
    local response = {}
    ok, code, headers, status = https.request({
        method = "POST",
        url = "https://cleverbot.io/1.0/ask/",
        headers = {
            ['Accept'] = '*/*',
            ['content-type'] = 'application/x-www-form-urlencoded',
            ['accept-encoding'] = 'gzip',
            ['content-length'] = tostring(#body),
        },
        print(tostring(ok)),
        print(tostring(code)),
        print(tostring(headers)),
        print(tostring(status)),

        source = ltn12.source.string(body),
        sink = ltn12.sink.table(response)
    })

    response = table.concat(response)

    if code ~= 200 then
       return 
    end

    if response[1] ~= nil then
       return tostring(response)
    end
end

However, when I call this, this is what those 4 prints shows:

nil
tlsv1 alert internal error
nil
nil

I tried to connect using HTTP instead, but this is what happens:

1
301
table: 0xe5f7d60
HTTP/1.1 301 Moved Permanently

response is always empty. Please, what am I doing wrong? Thanks!

Upvotes: 0

Views: 1025

Answers (1)

Ctx
Ctx

Reputation: 18410

My strong suspicion is, that the target host (cleverbot.io) insists to get a hostname through SNI (server name indication), which the ssl-library you use does not send. Usually, servers use a default site then, but of course they are free to let the handshake fail then. Seems like this is, what cloudflare (where cleverbot.io is hosted or proxied through) does.

Unfortunately there is no easy way to fix this, unless the underlying ssl-libraries are changed to use sni with hostname cleverbot.io for the ssl handshake.

See also

Fails:
openssl s_client -connect cleverbot.io:443  -tls1_1 

Succeeds:
openssl s_client -servername cleverbot.io -connect cleverbot.io:443  -tls1_1

This means, not only the underlying ssl libraries have to support sni, but also have to be told, which servername to use by the lua-binding-layer in between. Luasec for example does not make use of sni currently, afaik

Upvotes: 1

Related Questions