rpms/perl-IO-Socket-SSL
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Use system-default SSL version too

Browse Source
This commit is contained in:
Paul Howarth 2014-08-07 16:26:51 +01:00
parent 223f2f3a2c
commit bdc758a36f
2 changed files with 40 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
IO-Socket-SSL-1.997-use-system-default-SSL-version.patch Normal file
View File

@ -0,0 +1,32 @@
--- lib/IO/Socket/SSL.pm
+++ lib/IO/Socket/SSL.pm
@@ -83,7 +83,7 @@ my $algo2digest = do {
# global defaults
my %DEFAULT_SSL_ARGS = (
SSL_check_crl => 0,
- SSL_version => 'SSLv23:!SSLv2',
+ SSL_version => '',
SSL_verify_callback => undef,
SSL_verifycn_scheme => undef, # fallback cn verification
SSL_verifycn_publicsuffix => undef, # fallback default list verification
@@ -2043,7 +2043,7 @@ WARN
my $ssl_op = Net::SSLeay::OP_ALL();
- my $ver;
+ my $ver = '';
for (split(/\s*:\s*/,$arg_hash->{SSL_version})) {
m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1(?:_?[12])?))$}i
or croak("invalid SSL_version specified");
--- lib/IO/Socket/SSL.pod
+++ lib/IO/Socket/SSL.pod
@@ -910,7 +910,8 @@ recent versions of Net::SSLeay and opens
You can limit to set of supported protocols by adding !version separated by ':'.
-The default SSL_version is 'SSLv23:!SSLv2' which means, that SSLv2, SSLv3 and
+The default SSL_version is defined by underlying cryptographic library.
+For example, 'SSLv23:!SSLv2' means that SSLv2, SSLv3 and TLSv1
TLSv1 are supported for initial protocol handshakes, but SSLv2 will not be
accepted, leaving only SSLv3 and TLSv1. You can also use !TLSv1_1 and !TLSv1_2
to disable TLS versions 1.1 and 1.2 while allowing TLS version 1.0.

9
perl-IO-Socket-SSL.spec
View File

@ -1,12 +1,13 @@
Name: perl-IO-Socket-SSL
Version: 1.997
Release: 2%{?dist}
Release: 3%{?dist}
Summary: Perl library for transparent SSL
Group: Development/Libraries
License: GPL+ or Artistic
URL: http://search.cpan.org/dist/IO-Socket-SSL/
Source0: http://search.cpan.org/CPAN/authors/id/S/SU/SULLR/IO-Socket-SSL-%{version}.tar.gz
Patch0: IO-Socket-SSL-1.997-use-system-default-cipher-list.patch
Patch1: IO-Socket-SSL-1.997-use-system-default-SSL-version.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(id -nu)
BuildArch: noarch
BuildRequires: openssl >= 0.9.8
@ -67,6 +68,9 @@ mod_perl.
# https://fedoraproject.org/wiki/Changes/CryptoPolicy
%patch0
# Use system-default SSL version too
%patch1
%build
echo n | perl Makefile.PL INSTALLDIRS=vendor
make %{?_smp_mflags}
@ -96,6 +100,9 @@ rm -rf %{buildroot}
%{_mandir}/man3/IO::Socket::SSL::Utils.3*
%changelog
* Thu Aug 7 2014 Paul Howarth <paul@city-fan.org> - 1.997-3
- Use system-default SSL version too
* Thu Aug 7 2014 Paul Howarth <paul@city-fan.org> - 1.997-2
- Use system-wide default cipher list to support use of system-wide
crypto policy (#1076390, #1127577, CPAN RT#97816)