rpms/perl-IO-Socket-SSL
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Update to 2.061

Browse Source 
- New upstream release 2.061
  - Support for TLS 1.3 session reuse (needs Net::SSLeay ≥ 1.86); note that
    the previous (and undocumented) API for the session cache has been changed
  - Support for multiple curves, automatic setting of curves and setting of
    supported curves in client (needs Net::SSLeay ≥ 1.86)
  - Enable Post-Handshake-Authentication (TLSv1.3 feature) client-side when
    client certificates are provided (needs Net::SSLeay ≥ 1.86)
This commit is contained in:
Paul Howarth 2019-02-23 12:45:00 +00:00
parent ddedb553a3
commit 62e054c052
6 changed files with 27 additions and 205 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
IO-Socket-SSL-2.060-Enable-Post-Handshake-Authentication-TLSv1.3-feature.patch
View File

@ -1,55 +0,0 @@
From 270badae7595332807d71b946446a70137369bf0 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Sat, 26 Jan 2019 11:16:08 +0100
Subject: [PATCH] Enable Post-Handshake-Authentication (TLSv1.3 feature)
client-side iff available.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
lib/IO/Socket/SSL.pm | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/lib/IO/Socket/SSL.pm b/lib/IO/Socket/SSL.pm
index f35211b..0a0eef6 100644
--- a/lib/IO/Socket/SSL.pm
+++ b/lib/IO/Socket/SSL.pm
@@ -67,6 +67,7 @@ my $can_ecdh; # do we support ECDH key exchange
my $can_ocsp; # do we support OCSP
my $can_ocsp_staple; # do we support OCSP stapling
my $can_tckt_keycb; # TLS ticket key callback
+my $can_pha; # do we support PHA
BEGIN {
$can_client_sni = Net::SSLeay::OPENSSL_VERSION_NUMBER() >= 0x01000000;
$can_server_sni = defined &Net::SSLeay::get_servername;
@@ -87,6 +88,7 @@ BEGIN {
&& defined &Net::SSLeay::set_tlsext_status_type;
$can_tckt_keycb = defined &Net::SSLeay::CTX_set_tlsext_ticket_getkey_cb
&& $Net::SSLeay::VERSION >= 1.80;
+ $can_pha = defined &Net::SSLeay::CTX_set_post_handshake_auth;
}
my $algo2digest = do {
@@ -2018,6 +2020,7 @@ sub can_ecdh { return $can_ecdh }
sub can_ipv6 { return CAN_IPV6 }
sub can_ocsp { return $can_ocsp }
sub can_ticket_keycb { return $can_tckt_keycb }
+sub can_pha { return $can_pha }
sub DESTROY {
my $self = shift or return;
@@ -2602,6 +2605,9 @@ sub new {
"Failed to load key from file (no PEM or DER)");
}
+ Net::SSLeay::CTX_set_post_handshake_auth($ctx,1)
+ if (!$is_server && $can_pha && $havecert && $havekey);
+
# replace arg_hash with created context
$ctx{$host} = $ctx;
}
--
2.17.2

121
IO-Socket-SSL-2.060-make-all-tests-which-use-fork-also-ignore-signal-PIP.patch
View File

@ -1,121 +0,0 @@
From e96b1c9e394011de4ee181cfa42b8021796bf7d4 Mon Sep 17 00:00:00 2001
From: Steffen Ullrich <Steffen_Ullrich@genua.de>
Date: Mon, 17 Sep 2018 14:09:48 +0200
Subject: [PATCH] make all tests which use fork also ignore signal PIPE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
t/nonblock.t | 4 +---
t/protocol_version.t | 2 --
t/session_ticket.t | 2 --
t/signal-readline.t | 1 -
t/sni.t | 2 --
t/sni_verify.t | 2 --
t/testlib.pl | 2 ++
7 files changed, 3 insertions(+), 12 deletions(-)
diff --git a/t/nonblock.t b/t/nonblock.t
index 6c1bc38..ad62799 100644
--- a/t/nonblock.t
+++ b/t/nonblock.t
@@ -9,7 +9,7 @@ use Net::SSLeay;
use Socket;
use IO::Socket::SSL;
use IO::Select;
-use Errno qw( EWOULDBLOCK EAGAIN EINPROGRESS EPIPE ECONNRESET );
+use Errno qw( EWOULDBLOCK EAGAIN EINPROGRESS);
do './testlib.pl' || do './t/testlib.pl' || die "no testlib";
if ( ! eval "use 5.006; use IO::Select; return 1" ) {
@@ -17,8 +17,6 @@ if ( ! eval "use 5.006; use IO::Select; return 1" ) {
exit;
}
-$SIG{PIPE} = 'IGNORE'; # use EPIPE not signal handler
-
$|=1;
print "1..27\n";
diff --git a/t/protocol_version.t b/t/protocol_version.t
index 2e5cc6f..3577720 100644
--- a/t/protocol_version.t
+++ b/t/protocol_version.t
@@ -7,8 +7,6 @@ use Socket;
use IO::Socket::SSL;
do './testlib.pl' || do './t/testlib.pl' || die "no testlib";
-$SIG{PIPE} = 'IGNORE';
-
plan skip_all => "Test::More has no done_testing"
if !defined &done_testing;
diff --git a/t/session_ticket.t b/t/session_ticket.t
index ca70b80..4071b8a 100644
--- a/t/session_ticket.t
+++ b/t/session_ticket.t
@@ -27,8 +27,6 @@ my ($server_cert,$server_key) = CERT_create(
purpose => { server => 1 }
);
-$SIG{PIPE} = 'IGNORE';
-
# create two servers with the same session ticket callback
my (@server,@saddr);
for (1,2) {
diff --git a/t/signal-readline.t b/t/signal-readline.t
index 6dcd4ae..3e226c0 100644
--- a/t/signal-readline.t
+++ b/t/signal-readline.t
@@ -50,7 +50,6 @@ if ( $pid == 0 ) {
my $csock = $server->accept;
ok("accept");
-$SIG{PIPE} = 'IGNORE';
syswrite($csock,"foo") or print "not ";
ok("wrote foo");
diff --git a/t/sni.t b/t/sni.t
index c6e6510..de0f06e 100644
--- a/t/sni.t
+++ b/t/sni.t
@@ -17,8 +17,6 @@ if ( ! IO::Socket::SSL->can_client_sni() ) {
exit;
}
-$SIG{PIPE} = 'IGNORE';
-
print "1..17\n";
my $server = IO::Socket::SSL->new(
LocalAddr => '127.0.0.1',
diff --git a/t/sni_verify.t b/t/sni_verify.t
index 86b5dca..b3b299b 100644
--- a/t/sni_verify.t
+++ b/t/sni_verify.t
@@ -17,8 +17,6 @@ if ( ! IO::Socket::SSL->can_client_sni() ) {
exit;
}
-$SIG{PIPE} = 'IGNORE';
-
print "1..17\n";
my $server = IO::Socket::SSL->new(
LocalAddr => '127.0.0.1',
diff --git a/t/testlib.pl b/t/testlib.pl
index 5a99e49..b3f342c 100644
--- a/t/testlib.pl
+++ b/t/testlib.pl
@@ -19,6 +19,8 @@ unless ( $Config::Config{d_fork} || $Config::Config{d_pseudofork} ||
exit
}
+# let IO errors result in EPIPE instead of crashing the test
+$SIG{PIPE} = 'IGNORE';
# small implementations if not used from Test::More (09_fdleak.t)
if ( ! defined &ok ) {
--
2.17.1

12
IO-Socket-SSL-2.060-use-system-default-SSL-version.patch → IO-Socket-SSL-2.061-use-system-default-SSL-version.patch
View File

@ -1,6 +1,6 @@
--- lib/IO/Socket/SSL.pm --- lib/IO/Socket/SSL.pm
+++ lib/IO/Socket/SSL.pm +++ lib/IO/Socket/SSL.pm
@@ -130,7 +130,7 @@ if ( defined &Net::SSLeay::CTX_set_min_p @@ -146,7 +146,7 @@ if ( defined &Net::SSLeay::CTX_set_min_p
# global defaults # global defaults
my %DEFAULT_SSL_ARGS = ( my %DEFAULT_SSL_ARGS = (
SSL_check_crl => 0, SSL_check_crl => 0,
@ -9,7 +9,7 @@
SSL_verify_callback => undef, SSL_verify_callback => undef,
SSL_verifycn_scheme => undef, # fallback cn verification SSL_verifycn_scheme => undef, # fallback cn verification
SSL_verifycn_publicsuffix => undef, # fallback default list verification SSL_verifycn_publicsuffix => undef, # fallback default list verification
@@ -2295,7 +2295,7 @@ sub new { @@ -2315,7 +2315,7 @@ sub new {
my $ssl_op = $DEFAULT_SSL_OP; my $ssl_op = $DEFAULT_SSL_OP;
@ -20,10 +20,10 @@
or croak("invalid SSL_version specified"); or croak("invalid SSL_version specified");
--- lib/IO/Socket/SSL.pod --- lib/IO/Socket/SSL.pod
+++ lib/IO/Socket/SSL.pod +++ lib/IO/Socket/SSL.pod
@@ -1010,11 +1010,12 @@ protocol to the specified version. @@ -1011,11 +1011,12 @@ All values are case-insensitive. Instea
All values are case-insensitive. Instead of 'TLSv1_1' and 'TLSv1_2' one can 'TLSv1_3' one can also use 'TLSv11', 'TLSv12', and 'TLSv13'. Support for
also use 'TLSv11' and 'TLSv12'. Support for 'TLSv1_1' and 'TLSv1_2' requires 'TLSv1_1', 'TLSv1_2', and 'TLSv1_3' requires recent versions of Net::SSLeay
recent versions of Net::SSLeay and openssl. and openssl.
+The default SSL_version is defined by the underlying cryptographic library. +The default SSL_version is defined by the underlying cryptographic library.
Independent from the handshake format you can limit to set of accepted SSL Independent from the handshake format you can limit to set of accepted SSL

6
IO-Socket-SSL-2.060-use-system-default-cipher-list.patch → IO-Socket-SSL-2.061-use-system-default-cipher-list.patch
View File

@ -1,6 +1,6 @@
--- lib/IO/Socket/SSL.pm --- lib/IO/Socket/SSL.pm
+++ lib/IO/Socket/SSL.pm +++ lib/IO/Socket/SSL.pm
@@ -138,10 +138,10 @@ my %DEFAULT_SSL_ARGS = ( @@ -154,10 +154,10 @@ my %DEFAULT_SSL_ARGS = (
SSL_npn_protocols => undef, # meaning depends whether on server or client side SSL_npn_protocols => undef, # meaning depends whether on server or client side
SSL_alpn_protocols => undef, # list of protocols we'll accept/send, for example ['http/1.1','spdy/3.1'] SSL_alpn_protocols => undef, # list of protocols we'll accept/send, for example ['http/1.1','spdy/3.1']
@ -15,7 +15,7 @@
); );
my %DEFAULT_SSL_CLIENT_ARGS = ( my %DEFAULT_SSL_CLIENT_ARGS = (
@@ -151,63 +151,6 @@ my %DEFAULT_SSL_CLIENT_ARGS = ( @@ -167,63 +167,6 @@ my %DEFAULT_SSL_CLIENT_ARGS = (
SSL_ca_file => undef, SSL_ca_file => undef,
SSL_ca_path => undef, SSL_ca_path => undef,
@ -81,7 +81,7 @@
# set values inside _init to work with perlcc, RT#95452 # set values inside _init to work with perlcc, RT#95452
--- lib/IO/Socket/SSL.pod --- lib/IO/Socket/SSL.pod
+++ lib/IO/Socket/SSL.pod +++ lib/IO/Socket/SSL.pod
@@ -1036,12 +1036,8 @@ documentation (L<http://www.openssl.org/ @@ -1037,12 +1037,8 @@ documentation (L<http://www.openssl.org/
for more details. for more details.
Unless you fail to contact your peer because of no shared ciphers it is Unless you fail to contact your peer because of no shared ciphers it is

36
perl-IO-Socket-SSL.spec
View File

@ -1,19 +1,12 @@
Name: perl-IO-Socket-SSL Name: perl-IO-Socket-SSL
Version: 2.060 Version: 2.061
Release: 4%{?dist} Release: 1%{?dist}
Summary: Perl library for transparent SSL Summary: Perl library for transparent SSL
License: GPL+ or Artistic License: GPL+ or Artistic
URL: https://metacpan.org/release/IO-Socket-SSL URL: https://metacpan.org/release/IO-Socket-SSL
Source0: https://cpan.metacpan.org/modules/by-module/IO/IO-Socket-SSL-%{version}.tar.gz Source0: https://cpan.metacpan.org/modules/by-module/IO/IO-Socket-SSL-%{version}.tar.gz
Patch0: IO-Socket-SSL-2.060-use-system-default-cipher-list.patch Patch0: IO-Socket-SSL-2.061-use-system-default-cipher-list.patch
Patch1: IO-Socket-SSL-2.060-use-system-default-SSL-version.patch Patch1: IO-Socket-SSL-2.061-use-system-default-SSL-version.patch
# Prevent tests from dying on SIGPIPE, CPAN RT#126899,
# in upstream after 2.060
Patch2: IO-Socket-SSL-2.060-make-all-tests-which-use-fork-also-ignore-signal-PIP.patch
# Client sends a post-handshake-authentication extension if a client key and
# a certificate are available, bug #1632660,
# <https://github.com/noxxi/p5-io-socket-ssl/pull/80>, in upstream after 2.060
Patch3: IO-Socket-SSL-2.060-Enable-Post-Handshake-Authentication-TLSv1.3-feature.patch
# A test for Enable-Post-Handshake-Authentication-TLSv1.3-feature.patch, # A test for Enable-Post-Handshake-Authentication-TLSv1.3-feature.patch,
# bug #1632660, requires openssl tool # bug #1632660, requires openssl tool
Patch4: IO-Socket-SSL-2.060-Test-client-performs-Post-Handshake-Authentication.patch Patch4: IO-Socket-SSL-2.060-Test-client-performs-Post-Handshake-Authentication.patch
@ -100,11 +93,7 @@ mod_perl.
# Use system-default SSL version too # Use system-default SSL version too
%patch1 %patch1
# Prevent tests from dying on SIGPIPE (CPAN RT#126899) # Add test for PHA
%patch2 -p1
# Enable PHA on a client side
%patch3 -p1
%patch4 -p1 %patch4 -p1
%build %build
@ -132,6 +121,15 @@ make test
%{_mandir}/man3/IO::Socket::SSL::Utils.3* %{_mandir}/man3/IO::Socket::SSL::Utils.3*
%changelog %changelog
* Sat Feb 23 2019 Paul Howarth <paul@city-fan.org> - 2.061-1
- Update to 2.061
- Support for TLS 1.3 session reuse (needs Net::SSLeay ≥ 1.86); note that
the previous (and undocumented) API for the session cache has been changed
- Support for multiple curves, automatic setting of curves and setting of
supported curves in client (needs Net::SSLeay ≥ 1.86)
- Enable Post-Handshake-Authentication (TLSv1.3 feature) client-side when
client certificates are provided (needs Net::SSLeay ≥ 1.86)
* Thu Feb 07 2019 Petr Pisar <ppisar@redhat.com> - 2.060-4 * Thu Feb 07 2019 Petr Pisar <ppisar@redhat.com> - 2.060-4
- Client sends a post-handshake-authentication extension if a client key and - Client sends a post-handshake-authentication extension if a client key and
a certificate are available (bug #1632660) a certificate are available (bug #1632660)
@ -144,9 +142,9 @@ make test
* Mon Sep 17 2018 Paul Howarth <paul@city-fan.org> - 2.060-1 * Mon Sep 17 2018 Paul Howarth <paul@city-fan.org> - 2.060-1
- Update to 2.060 - Update to 2.060
- Support for TLS 1.3 with OpenSSL 1.1.1 (needs support in Net::SSLeay too); - Support for TLS 1.3 with OpenSSL 1.1.1 (needs Net::SSLeay ≥ 1.86); see
see also CPAN RT#126899 also CPAN RT#126899
- TLS 1.3 support is not complete yet for session resume - TLS 1.3 support is not complete yet for session reuse
* Tue Aug 21 2018 Petr Pisar <ppisar@redhat.com> - 2.059-2 * Tue Aug 21 2018 Petr Pisar <ppisar@redhat.com> - 2.059-2
- Adapt to OpenSSL 1.1.1, it requires patched Net-SSLeay (bug #1616198) - Adapt to OpenSSL 1.1.1, it requires patched Net-SSLeay (bug #1616198)

2
sources
View File

@ -1 +1 @@
SHA512 (IO-Socket-SSL-2.060.tar.gz) = 1a1e29f8a4b912bd3643509356c66b3a567ae41bb0ac9eb30f6ca97eb68bf9507e20c0fb8512f5dfd309accd6cfba61811b8d637f5e991aaa0a250a906fcb95c SHA512 (IO-Socket-SSL-2.061.tar.gz) = 2c5aa45f0ace5843e87c2b88f0805efa95b90af3b6e9c8bb258118886ab10ba9feb9b57a224704c33176a02563ae23dacb0707e644a7c647f7ead81132d1e3e0