- New upstream release 2.018
- Checks for readability of files/dirs for certificates and CA no longer use
-r because this is not safe when ACLs are used (CPAN RT#106295)
- New method sock_certificate similar to peer_certificate (CPAN RT#105733)
- get_fingerprint can now take optional certificate as argument and compute
the fingerprint of it; useful in connection with sock_certificate
- Check for both EWOULDBLOCK and EAGAIN since these codes are different on
some platforms (CPAN RT#106573)
- Enforce default verification scheme if nothing was specified, i.e. no
longer just warn but accept; if really no verification is wanted, a scheme
of 'none' must be explicitly specified
- Support different cipher suites per SNI hosts
- startssl.t failed on darwin with old openssl since server requested client
certificate but offered also anon ciphers (CPAN RT#106687)
- Update patches as needed
- New upstream release 2.016
- Add flag X509_V_FLAG_TRUSTED_FIRST by default if available in OpenSSL
(since 1.02) and available with Net::SSLeay (CPAN RT#104759)
- Work around hanging prompt() with older perl in Makefile.PL
(CPAN RT#104731)
- Make t/memleak_bad_handshake.t work on cygwin and other systems having
/proc/pid/statm (CPAN RT#104659)
- Add better debugging
- New upstream release 2.014
- Utils::CERT_create - work around problems with authorityInfoAccess, where
OpenSSL i2v does not create the same string as v2i expects
- Intercept - don't clone some specific extensions that only make sense with
the original certificate
- New upstream release 2.013
- Assign severities to internal error handling and make sure that follow-up
errors like "configuration failed" or "certificate verify error" don't
replace more specific "hostname verification failed" when reporting in
sub errstr/$SSL_ERROR (CPAN RT#103423)
- Enhanced documentation (https://github.com/noxxi/p5-io-socket-ssl/pull/26)
- New upstream release 2.010
- New options SSL_client_ca_file and SSL_client_ca to let the server send the
list of acceptable CAs for the client certificate
- t/protocol_version.t - fix in case SSLv3 is not supported in Net::SSLeay
(CPAN RT#101485)
- New upstream release 2.009
- Remove util/analyze.pl; this tool is now together with other SSL tools at
https://github.com/noxxi/p5-ssl-tools
- Added ALPN support (needs OpenSSL1.02, Net::SSLeay 1.56+) (CPAN RT#101452)
- New upstream release 2.008
- Work around recent OCSP verification errors for revoked.grc.com (badly
signed OCSP response, Firefox also complains about it) in test
t/external/ocsp.t
- util/analyze.pl - report more details about preferred cipher for specific
TLS versions
- New upstream release 2.007
- Make getline/readline fall back to super class if class is not sslified
yet, i.e. behave the same as sysread, syswrite etc. (CPAN RT#100529)
- New upstream release 2.006
- Make SSLv3 available even if the SSL library disables it by default in
SSL_CTX_new (like done in LibreSSL); default will stay to disable SSLv3
so this will be only done when setting SSL_version explicitly
- Fix possible segmentation fault when trying to use an invalid certificate
- Use only the ICANN part of the default public suffix list and not the
private domains; this makes existing exceptions for s3.amazonaws.com and
googleapis.com obsolete
- Fix t/protocol_version.t to deal with OpenSSL installations that are
compiled without SSLv3 support
- Make (hopefully) non-blocking work on windows by using EWOULDBLOCK instead
of EAGAIN; while this is the same on UNIX it is different on Windows and
socket operations return there (WSA)EWOULDBLOCK and not EAGAIN
- Enable non-blocking tests on Windows too
- Make PublicSuffix::_default_data thread safe
- Update PublicSuffix with latest list from publicsuffix.org
- Note that this package still uses system-default cipher and SSL versions,
which may have SSL3.0 enabled
- Classify buildreqs by usage
- New upstream release 2.002
- Fix check for (invalid) IPv4 when validating hostname against certificate;
do not use inet_aton any longer because it can cause DNS lookups for
malformed IP (CPAN RT#99448)
- Update PublicSuffix with latest version from publicsuffix.org - lots of new
top level domains
- Add exception to PublicSuffix for s3.amazonaws.com (CPAN RT#99702)
- New upstream release 2.001
- Add SSL_OP_SINGLE_(DH|ECDH)_USE to default options to increase PFS security
- Update external tests with currently expected fingerprints of hosts
- Some fixes to make it still work on 5.8.1
- New upstream release 2.000
- Consider SSL3.0 as broken because of POODLE and disable it by default
- Skip live tests without asking if environment NO_NETWORK_TESTING is set
- Skip tests that require fork on non-default windows setups without proper
fork (https://github.com/noxxi/p5-io-socket-ssl/pull/18)
- Note that this package still uses system-default cipher and SSL versions,
which may have SSL3.0 enabled
- New upstream release 1.999
- Make sure we don't use version 0.30 of IO::Socket::IP
- Make sure that PeerHost is checked in all places where PeerAddr is checked,
because these are synonyms and IO::Socket::IP prefers PeerHost while others
prefer PeerAddr; also accept PeerService additionally to PeerPort
(https://github.com/noxxi/p5-io-socket-ssl/issues/16)
- Add ability to use client certificates and to overwrite hostname with
util/analyze-ssl.pl
- New upstream release 1.998
- Make client authentication work at the server side when SNI is in by use
having CA path and other settings in all SSL contexts instead of only the
main one (https://github.com/noxxi/p5-io-socket-ssl/pull/15)
- New upstream release 1.997
- Fix initialization and creation of OpenSSL-internals for perlcc
compatibility (CPAN RT#95452)
- Add refresh option for peer_certificate, so that it checks if the
certificate changed in the mean time (on renegotiation)
- Fix fingerprint checking - now applies only to top-most certificate
- IO::Socket::SSL::Utils - accept extensions within CERT_create
- Various documentation fixes
- New upstream release 1.994
- IO::Socket::SSL can now be used as dual-use socket, e.g. start plain,
upgrade to SSL and downgrade again all with the same object; see
documentation of SSL_startHandshake and chapter Advanced Usage
- Try to apply SSL_ca* even if verify_mode is 0, but don't complain if this
fails; this is needed if one wants to explicitly verify OCSP lookups even
if verification is otherwise off, because otherwise the signature check
would fail (this is mostly useful for testing)
- Reorder documentation of attributes for new, so that the more important
ones are at the top
- New upstream release 1.993
- Major rewrite of documentation, now in separate file
- Rework error handling to distinguish between SSL errors and internal errors
(like missing capabilities)
- Fix handling of default_ca if given during the run of the program
(Debian #750646)
- util/analyze-ssl.pl - fix hostname check if SNI does not work
- New upstream release 1.992
- Set $! to undef before doing IO (accept, read...); on Windows a connection
reset could cause an SSL read error without setting $!, so make sure we
don't keep the old value and maybe thus run into an endless loop
- New upstream release 1.991
- New option SSL_OCSP_TRY_STAPLE to enforce staple request even if
VERIFY_NONE
- Work around for CPAN RT#96013 in peer_certificates
- New upstream release 1.990
- Added option SSL_ocsp_staple_callback to get the stapled OCSP response and
verify it somewhere else
- Try to fix warnings on Windows again (CPAN RT#95967)
- Work around temporary OCSP error in t/external/ocsp.t
- New upstream release 1.988
- Allow IPv4 in common name, because browsers allow this too; only for scheme
www/http though, not for rfc2818 (because RC2818 does not allow this; in
default scheme IPv6 and IPv4 are allowed in CN)
- Fix handling of public suffix; add exemption for *.googleapis.com
wildcard, which should not be allowed according to public suffix list but
actually is used
- Add hostname verification test based on older test of chromium, but change
some of the test expectations because we don't want to support IP as SAN
DNS and because we enforce a public suffix list (and thus *.co.uk should
not be allowed)
- Fix t/verify_hostname_standalone.t on systems without usable IDNA or IPv6
(CPAN RT#95719)
- Enable IPv6 support only if we have a usable inet_pton
- Remove stale entries from MANIFEST
- Add transparent support for DER and PKCS#12 files to specify cert and key,
e.g. it will autodetect the format
- If SSL_cert_file is PEM and no SSL_key_file is given it will check if the
key is in SSL_cert_file too
- New upstream release 1.985
- Make OCSP callback return 1 even if it was called on the server side
because of bad setup of the socket; otherwise we get an endless calling of
the OCSP callback
- Consider an OCSP response that is not yet or no longer valid a soft error
instead of an hard error
- Fix skip in t/external/ocsp.t in case fingerprint does not match
- Call EVP_PKEY_free not EVP_KEY_free in IO::Socket::SSL::Utils::KEY_free
(CPAN RT#95633)
- util/analyze.pl - with --show-chain check if chain with SNI is different
from chain w/o SNI
- Drop ExtUtils::MakeMaker version requirement
- New upstream release 1.984
- Added OCSP support:
- Needs Net::SSLeay ≥ 1.59
- For usage see documentation of IO::Socket::SSL (examples and anything
with OCSP in the name)
- New tool util/analyze-ssl.pl, which is intended to help in debugging of SSL
problems and to get information about capabilities of server; it works also
as an example of how to use various features (like OCSP, SNI...)
- Fix peer_certificates (returns leaf certificate only once on client side)
- Added timeout for stop_SSL (either with Timeout or with the default timeout
for IO::Socket)
- Fix IO::Socket::SSL::Utils mapping between ASN1_TIME and time_t when local
time is not GMT; use Net::SSLeay::ASN1_TIME_timet if available
- Fix t/external/usable_ca.t for system with junk in CA files
- New upstream release 1.983
- Fix public suffix handling: ajax.googleapis.com should be ok even if
googleapis.com is in public suffix list (e.g. check one level less)
(CPAN RT#95317)
- usable_ca.t - update fingerprints after heartbleed attack
- usable_ca.t - make sure we have usable CA for tested hosts in CA store
- New upstream release 1.981
- Fix ecdhe test for openssl 1.0.1d (CPAN RT#95432)
- Fix detection of openssl 1.0.1d (detected 1.0.1e instead)
- New function can_ecdh in IO::Socket::SSL
- New upstream release 1.980
- Disable elliptic curve support for openssl 1.0.1d on 64-bit
(http://rt.openssl.org/Ticket/Display.html?id=2975)
- Fix fingerprint calculation
- Add patch to skip elliptic curve test for openssl 1.0.1d on 64-bit
- Add patch to fix openssl version test
- New upstream release 1.979
- Hostname checking:
- Configuration of 'leftmost' is renamed to 'full_label', but the old
version is kept for compatibility reasons
- Documentation of predefined schemes fixed to match reality
- New upstream release 1.978
- Added public prefix checking to verification of wildcard certificates, e.g.
accept *.foo.com but not *.co.uk; see documentation of
SSL_verifycn_publicsuffix and IO::Socket::SSL::PublicSuffix
- Fix publicsuffix for IDNA, more tests with various IDNA libs
(CPAN RT#94424)
- Reuse result of IDN lib detection from PublicSuffix.pm in SSL.pm
- Add more checks to external/usable_ca.t; now it is enough that at least one
of the hosts verifies against the built-in CA store
- Add openssl and Net::SSLeay version to diagnostics in load test
- Switch preferred IDN back-end from Net::LibIDN to URI::_idna as per upstream,
falling back to Net::IDN::Encode on older distributions
- Add fix from upstream git to support building with Test::More < 0.88
- New upstream release 1.975
- BEHAVIOR CHANGE: work around TEA misfeature on OS X built-in openssl, e.g.
guarantee that only the explicitly-given CA or the openssl default CA will
be used; this means that certificates inside the OS X keyring will no
longer be used, because there is no way to control the use by openssl
(e.g. certificate pinning etc.)
- Make external tests run by default to make sure default CA works on all
platforms; it skips automatically on network problems like timeouts or SSL
interception, and can also use http(s)_proxy environment variables
- New upstream release 1.974
- New function peer_certificates to get the whole certificate chain; needs
Net::SSLeay ≥ 1.58
- Extended IO::Socket::Utils::CERT_asHash to provide way more information,
like issuer information, cert and pubkey digests, all extensions, CRL
distribution points and OCSP uri
- New upstream release 1.973
- With SSL_ca, certificate handles can now be used in addition to
SSL_ca_file and SSL_ca_path
- No longer complain if SSL_ca_file and SSL_ca_path are both given;
instead, add both as options to the CA store
- Shortcut 'issuer' to give both issuer_cert and issuer_key in CERT_create
- New upstream release 1.971
- Try to use SSL_hostname for hostname verification if no SSL_verifycn_name
is given; this way, hostname for SNI and verification can be specified in
one step
- New test program example/simulate_proxy.pl
- New upstream release 1.969
- Fix set_defaults to match documentation regarding short names
- New function set_args_filter_hack to make it possible to override bad SSL
settings from other code at the last moment
- Determine default_ca on module load (and not on first use in each thread)
- Don't try default hostname verification if verify_mode 0
- Fix hostname verification when reusing context
- New upstream release 1.968
- BEHAVIOR CHANGE: removed implicit defaults of certs/server-{cert,key}.pem
for SSL_{cert,key}_file and ca/,certs/my-ca.pem for SSL_ca_file; these
defaults were deprecated since 1.951 (July 2013)
- Usable CA verification path on Windows etc.:
- Do not use Net::SSLeay::CTX_set_default_verify_paths any longer to set
system/build dependent default verification path, because there was no
way to retrieve these default values and check if they contained usable
CA
- Instead, re-implement the same algorithm and export the results with
public function default_ca() and make it possible to overwrite it
- Also check for usable verification path during build; if no usable path
is detected, require Mozilla::CA at build and try to use it at runtime
- New upstream release 1.967
- Verify the hostname inside a certificate by default with a superset of
common verification schemes instead of not verifying identity at all; for
now it will only complain if name verification failed but in the future it
will fail certificate verification, forcing you to set the expected
SSL_verifycn_name if you want to accept the certificate
- New option SSL_fingerprint and new methods get_fingerprint and
get_fingerprint_bin; together they can be used to selectively accept
specific certificates that would otherwise fail verification, like
self-signed, outdated or from unknown CAs
- Utils:
- Default RSA key length 2048
- Digest algorithm to sign certificate in CERT_create can be given;
defaults to SHA-256
- CERT_create can now issue non-CA self-signed certificate
- CERT_create add some more useful constraints to certificate
- Spelling fixes
- New upstream release 1.966
- Fixed bug introduced in 1.964 - disabling TLSv1_2 no longer worked by
specifying !TLSv12; only !TLSv1_2 worked
- Fixed leak of session objects in SessionCache, if another session
replaced an existing session (introduced in 1.965)
- New upstream release 1.965
- New key SSL_session_key to influence how sessions are inserted and looked
up in the client's session cache, which makes it possible to share sessions
over different ip:host (as is required with some FTPS servers)
- t/core.t - handle case where default loopback source is not 127.0.0.1, like
in FreeBSD jails
- New upstream release 1.964
- Disabling TLSv1_1 did not work, because the constant was wrong; now it gets
the constants from calling Net::SSLeay::SSL_OP_NO_TLSv1_1 etc.
- The new syntax for the protocols is TLSv1_1 instead of TLSv11, which matches
the syntax from OpenSSL (the old syntax continues to work in SSL_version)
- New functions get_sslversion and get_sslversion_int, which get the SSL
version of the established session as string or int
- Disable t/io-socket-inet6.t if Acme::Override::INET is installed
- New upstream release 1.963
- Fix behavior of stop_SSL: for blocking sockets it now enough to call it
once, for non-blocking it should be called again as long as EAGAIN and
SSL_ERROR is set to SSL_WANT_(READ|WRITE)
- Don't call blocking if start_SSL failed and downgraded socket has no
blocking method
- Documentation enhancements:
- Special section for differences to IO::Socket
- Describe problem with blocking accept on non-blocking socket
- Describe arguments to new_from_fd and make clear that for upgrading an
existing IO::Socket, start_SSL should be used directly
- New upstream release 1.962
- Work around problems with older F5 BIG-IP by offering fewer ciphers on the
client side by default, so that the client hello stays below 255 bytes
- New upstream release 1.960
- Only documentation enhancements:
- Clarify with text and example code, that within event loops not only
select/poll should be used, but also pending has to be called
- Better introduction into SSL; at least mention anonymous authentication as
something you don't want and should take care with the right cipher
- Make it more clear that it's better not to change the cipher list unless
you really know what you're doing
- Adopt upstream's versioning scheme
