import perl-IO-Socket-SSL-2.060-2.el8
This commit is contained in:
CentOS Sources
commit
d677c2d9c7
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
||||
SOURCES/IO-Socket-SSL-2.060.tar.gz
|
||||
1
.perl-IO-Socket-SSL.metadata
Normal file
1
.perl-IO-Socket-SSL.metadata
Normal file
@ -0,0 +1 @@
|
||||
d00985ca87425ab5860bc38e59bcb9d39b372508 SOURCES/IO-Socket-SSL-2.060.tar.gz
|
||||
@ -0,0 +1,121 @@
|
||||
From e96b1c9e394011de4ee181cfa42b8021796bf7d4 Mon Sep 17 00:00:00 2001
|
||||
From: Steffen Ullrich <Steffen_Ullrich@genua.de>
|
||||
Date: Mon, 17 Sep 2018 14:09:48 +0200
|
||||
Subject: [PATCH] make all tests which use fork also ignore signal PIPE
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
||||
---
|
||||
t/nonblock.t | 4 +---
|
||||
t/protocol_version.t | 2 --
|
||||
t/session_ticket.t | 2 --
|
||||
t/signal-readline.t | 1 -
|
||||
t/sni.t | 2 --
|
||||
t/sni_verify.t | 2 --
|
||||
t/testlib.pl | 2 ++
|
||||
7 files changed, 3 insertions(+), 12 deletions(-)
|
||||
|
||||
diff --git a/t/nonblock.t b/t/nonblock.t
|
||||
index 6c1bc38..ad62799 100644
|
||||
--- a/t/nonblock.t
|
||||
+++ b/t/nonblock.t
|
||||
@@ -9,7 +9,7 @@ use Net::SSLeay;
|
||||
use Socket;
|
||||
use IO::Socket::SSL;
|
||||
use IO::Select;
|
||||
-use Errno qw( EWOULDBLOCK EAGAIN EINPROGRESS EPIPE ECONNRESET );
|
||||
+use Errno qw( EWOULDBLOCK EAGAIN EINPROGRESS);
|
||||
do './testlib.pl' || do './t/testlib.pl' || die "no testlib";
|
||||
|
||||
if ( ! eval "use 5.006; use IO::Select; return 1" ) {
|
||||
@@ -17,8 +17,6 @@ if ( ! eval "use 5.006; use IO::Select; return 1" ) {
|
||||
exit;
|
||||
}
|
||||
|
||||
-$SIG{PIPE} = 'IGNORE'; # use EPIPE not signal handler
|
||||
-
|
||||
$|=1;
|
||||
print "1..27\n";
|
||||
|
||||
diff --git a/t/protocol_version.t b/t/protocol_version.t
|
||||
index 2e5cc6f..3577720 100644
|
||||
--- a/t/protocol_version.t
|
||||
+++ b/t/protocol_version.t
|
||||
@@ -7,8 +7,6 @@ use Socket;
|
||||
use IO::Socket::SSL;
|
||||
do './testlib.pl' || do './t/testlib.pl' || die "no testlib";
|
||||
|
||||
-$SIG{PIPE} = 'IGNORE';
|
||||
-
|
||||
plan skip_all => "Test::More has no done_testing"
|
||||
if !defined &done_testing;
|
||||
|
||||
diff --git a/t/session_ticket.t b/t/session_ticket.t
|
||||
index ca70b80..4071b8a 100644
|
||||
--- a/t/session_ticket.t
|
||||
+++ b/t/session_ticket.t
|
||||
@@ -27,8 +27,6 @@ my ($server_cert,$server_key) = CERT_create(
|
||||
purpose => { server => 1 }
|
||||
);
|
||||
|
||||
-$SIG{PIPE} = 'IGNORE';
|
||||
-
|
||||
# create two servers with the same session ticket callback
|
||||
my (@server,@saddr);
|
||||
for (1,2) {
|
||||
diff --git a/t/signal-readline.t b/t/signal-readline.t
|
||||
index 6dcd4ae..3e226c0 100644
|
||||
--- a/t/signal-readline.t
|
||||
+++ b/t/signal-readline.t
|
||||
@@ -50,7 +50,6 @@ if ( $pid == 0 ) {
|
||||
|
||||
my $csock = $server->accept;
|
||||
ok("accept");
|
||||
-$SIG{PIPE} = 'IGNORE';
|
||||
|
||||
syswrite($csock,"foo") or print "not ";
|
||||
ok("wrote foo");
|
||||
diff --git a/t/sni.t b/t/sni.t
|
||||
index c6e6510..de0f06e 100644
|
||||
--- a/t/sni.t
|
||||
+++ b/t/sni.t
|
||||
@@ -17,8 +17,6 @@ if ( ! IO::Socket::SSL->can_client_sni() ) {
|
||||
exit;
|
||||
}
|
||||
|
||||
-$SIG{PIPE} = 'IGNORE';
|
||||
-
|
||||
print "1..17\n";
|
||||
my $server = IO::Socket::SSL->new(
|
||||
LocalAddr => '127.0.0.1',
|
||||
diff --git a/t/sni_verify.t b/t/sni_verify.t
|
||||
index 86b5dca..b3b299b 100644
|
||||
--- a/t/sni_verify.t
|
||||
+++ b/t/sni_verify.t
|
||||
@@ -17,8 +17,6 @@ if ( ! IO::Socket::SSL->can_client_sni() ) {
|
||||
exit;
|
||||
}
|
||||
|
||||
-$SIG{PIPE} = 'IGNORE';
|
||||
-
|
||||
print "1..17\n";
|
||||
my $server = IO::Socket::SSL->new(
|
||||
LocalAddr => '127.0.0.1',
|
||||
diff --git a/t/testlib.pl b/t/testlib.pl
|
||||
index 5a99e49..b3f342c 100644
|
||||
--- a/t/testlib.pl
|
||||
+++ b/t/testlib.pl
|
||||
@@ -19,6 +19,8 @@ unless ( $Config::Config{d_fork} || $Config::Config{d_pseudofork} ||
|
||||
exit
|
||||
}
|
||||
|
||||
+# let IO errors result in EPIPE instead of crashing the test
|
||||
+$SIG{PIPE} = 'IGNORE';
|
||||
|
||||
# small implementations if not used from Test::More (09_fdleak.t)
|
||||
if ( ! defined &ok ) {
|
||||
--
|
||||
2.17.1
|
||||
|
||||
@ -0,0 +1,36 @@
|
||||
--- lib/IO/Socket/SSL.pm
|
||||
+++ lib/IO/Socket/SSL.pm
|
||||
@@ -130,7 +130,7 @@ if ( defined &Net::SSLeay::CTX_set_min_p
|
||||
# global defaults
|
||||
my %DEFAULT_SSL_ARGS = (
|
||||
SSL_check_crl => 0,
|
||||
- SSL_version => 'SSLv23:!SSLv3:!SSLv2', # consider both SSL3.0 and SSL2.0 as broken
|
||||
+ SSL_version => '',
|
||||
SSL_verify_callback => undef,
|
||||
SSL_verifycn_scheme => undef, # fallback cn verification
|
||||
SSL_verifycn_publicsuffix => undef, # fallback default list verification
|
||||
@@ -2295,7 +2295,7 @@ sub new {
|
||||
|
||||
my $ssl_op = $DEFAULT_SSL_OP;
|
||||
|
||||
- my $ver;
|
||||
+ my $ver = '';
|
||||
for (split(/\s*:\s*/,$arg_hash->{SSL_version})) {
|
||||
m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1(?:_?[123])?))$}i
|
||||
or croak("invalid SSL_version specified");
|
||||
--- lib/IO/Socket/SSL.pod
|
||||
+++ lib/IO/Socket/SSL.pod
|
||||
@@ -1010,11 +1010,12 @@ protocol to the specified version.
|
||||
All values are case-insensitive. Instead of 'TLSv1_1' and 'TLSv1_2' one can
|
||||
also use 'TLSv11' and 'TLSv12'. Support for 'TLSv1_1' and 'TLSv1_2' requires
|
||||
recent versions of Net::SSLeay and openssl.
|
||||
+The default SSL_version is defined by the underlying cryptographic library.
|
||||
|
||||
Independent from the handshake format you can limit to set of accepted SSL
|
||||
versions by adding !version separated by ':'.
|
||||
|
||||
-The default SSL_version is 'SSLv23:!SSLv3:!SSLv2' which means, that the
|
||||
+For example, 'SSLv23:!SSLv3:!SSLv2' means that the
|
||||
handshake format is compatible to SSL2.0 and higher, but that the successful
|
||||
handshake is limited to TLS1.0 and higher, that is no SSL2.0 or SSL3.0 because
|
||||
both of these versions have serious security issues and should not be used
|
||||
@ -0,0 +1,98 @@
|
||||
--- lib/IO/Socket/SSL.pm
|
||||
+++ lib/IO/Socket/SSL.pm
|
||||
@@ -138,10 +138,10 @@ my %DEFAULT_SSL_ARGS = (
|
||||
SSL_npn_protocols => undef, # meaning depends whether on server or client side
|
||||
SSL_alpn_protocols => undef, # list of protocols we'll accept/send, for example ['http/1.1','spdy/3.1']
|
||||
|
||||
- # https://wiki.mozilla.org/Security/Server_Side_TLS, 2016/04/20
|
||||
- # "Old backward compatibility" for best compatibility
|
||||
- # .. "Most ciphers that are not clearly broken and dangerous to use are supported"
|
||||
- SSL_cipher_list => 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:SEED:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!RSAPSK:!aDH:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!SRP',
|
||||
+ # Use system-wide default cipher list to support use of system-wide
|
||||
+ # crypto policy (#1076390, #1127577, CPAN RT#97816)
|
||||
+ # https://fedoraproject.org/wiki/Changes/CryptoPolicy
|
||||
+ SSL_cipher_list => 'DEFAULT',
|
||||
);
|
||||
|
||||
my %DEFAULT_SSL_CLIENT_ARGS = (
|
||||
@@ -151,63 +151,6 @@ my %DEFAULT_SSL_CLIENT_ARGS = (
|
||||
SSL_ca_file => undef,
|
||||
SSL_ca_path => undef,
|
||||
|
||||
- # older versions of F5 BIG-IP hang when getting SSL client hello >255 bytes
|
||||
- # http://support.f5.com/kb/en-us/solutions/public/13000/000/sol13037.html
|
||||
- # http://guest:guest@rt.openssl.org/Ticket/Display.html?id=2771
|
||||
- # Ubuntu worked around this by disabling TLSv1_2 on the client side for
|
||||
- # a while. Later a padding extension was added to OpenSSL to work around
|
||||
- # broken F5 but then IronPort croaked because it did not understand this
|
||||
- # extension so it was disabled again :(
|
||||
- # Firefox, Chrome and IE11 use TLSv1_2 but use only a few ciphers, so
|
||||
- # that packet stays small enough. We try the same here.
|
||||
-
|
||||
- SSL_cipher_list => join(" ",
|
||||
-
|
||||
- # SSLabs report for Chrome 48/OSX.
|
||||
- # This also includes the fewer ciphers Firefox uses.
|
||||
- 'ECDHE-ECDSA-AES128-GCM-SHA256',
|
||||
- 'ECDHE-RSA-AES128-GCM-SHA256',
|
||||
- 'DHE-RSA-AES128-GCM-SHA256',
|
||||
- 'ECDHE-ECDSA-CHACHA20-POLY1305',
|
||||
- 'ECDHE-RSA-CHACHA20-POLY1305',
|
||||
- 'ECDHE-ECDSA-AES256-SHA',
|
||||
- 'ECDHE-RSA-AES256-SHA',
|
||||
- 'DHE-RSA-AES256-SHA',
|
||||
- 'ECDHE-ECDSA-AES128-SHA',
|
||||
- 'ECDHE-RSA-AES128-SHA',
|
||||
- 'DHE-RSA-AES128-SHA',
|
||||
- 'AES128-GCM-SHA256',
|
||||
- 'AES256-SHA',
|
||||
- 'AES128-SHA',
|
||||
- 'DES-CBC3-SHA',
|
||||
-
|
||||
- # IE11/Edge has some more ciphers, notably SHA384 and DSS
|
||||
- # we don't offer the *-AES128-SHA256 and *-AES256-SHA384 non-GCM
|
||||
- # ciphers IE/Edge offers because they look like a large mismatch
|
||||
- # between a very strong HMAC and a comparably weak (but sufficient)
|
||||
- # encryption. Similar all browsers which do SHA384 can do ECDHE
|
||||
- # so skip the DHE*SHA384 ciphers.
|
||||
- 'ECDHE-RSA-AES256-GCM-SHA384',
|
||||
- 'ECDHE-ECDSA-AES256-GCM-SHA384',
|
||||
- # 'ECDHE-RSA-AES256-SHA384',
|
||||
- # 'ECDHE-ECDSA-AES256-SHA384',
|
||||
- # 'ECDHE-RSA-AES128-SHA256',
|
||||
- # 'ECDHE-ECDSA-AES128-SHA256',
|
||||
- # 'DHE-RSA-AES256-GCM-SHA384',
|
||||
- # 'AES256-GCM-SHA384',
|
||||
- 'AES256-SHA256',
|
||||
- # 'AES128-SHA256',
|
||||
- 'DHE-DSS-AES256-SHA256',
|
||||
- # 'DHE-DSS-AES128-SHA256',
|
||||
- 'DHE-DSS-AES256-SHA',
|
||||
- 'DHE-DSS-AES128-SHA',
|
||||
- 'EDH-DSS-DES-CBC3-SHA',
|
||||
-
|
||||
- # Just to make sure, that we don't accidentally add bad ciphers above.
|
||||
- # This includes dropping RC4 which is no longer supported by modern
|
||||
- # browsers and also excluded in the SSL libraries of Python and Ruby.
|
||||
- "!EXP !MEDIUM !LOW !eNULL !aNULL !RC4 !DES !MD5 !PSK !SRP"
|
||||
- )
|
||||
);
|
||||
|
||||
# set values inside _init to work with perlcc, RT#95452
|
||||
--- lib/IO/Socket/SSL.pod
|
||||
+++ lib/IO/Socket/SSL.pod
|
||||
@@ -1036,12 +1036,8 @@ documentation (L<http://www.openssl.org/
|
||||
for more details.
|
||||
|
||||
Unless you fail to contact your peer because of no shared ciphers it is
|
||||
-recommended to leave this option at the default setting. The default setting
|
||||
-prefers ciphers with forward secrecy, disables anonymous authentication and
|
||||
-disables known insecure ciphers like MD5, DES etc. This gives a grade A result
|
||||
-at the tests of SSL Labs.
|
||||
-To use the less secure OpenSSL builtin default (whatever this is) set
|
||||
-SSL_cipher_list to ''.
|
||||
+recommended to leave this option at the default setting, which honors the
|
||||
+system-wide DEFAULT cipher list.
|
||||
|
||||
In case different cipher lists are needed for different SNI hosts a hash can be
|
||||
given with the host as key and the cipher suite as value, similar to
|
||||
1505
SPECS/perl-IO-Socket-SSL.spec
Normal file
1505
SPECS/perl-IO-Socket-SSL.spec
Normal file
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user