af52f67378
- New upstream release 2.006
- Make SSLv3 available even if the SSL library disables it by default in
SSL_CTX_new (like done in LibreSSL); default will stay to disable SSLv3
so this will be only done when setting SSL_version explicitly
- Fix possible segmentation fault when trying to use an invalid certificate
- Use only the ICANN part of the default public suffix list and not the
private domains; this makes existing exceptions for s3.amazonaws.com and
googleapis.com obsolete
- Fix t/protocol_version.t to deal with OpenSSL installations that are
compiled without SSLv3 support
- Make (hopefully) non-blocking work on windows by using EWOULDBLOCK instead
of EAGAIN; while this is the same on UNIX it is different on Windows and
socket operations return there (WSA)EWOULDBLOCK and not EAGAIN
- Enable non-blocking tests on Windows too
- Make PublicSuffix::_default_data thread safe
- Update PublicSuffix with latest list from publicsuffix.org
- Note that this package still uses system-default cipher and SSL versions,
which may have SSL3.0 enabled
- Classify buildreqs by usage
74 lines
2.8 KiB
Diff
74 lines
2.8 KiB
Diff
--- lib/IO/Socket/SSL.pm
|
|
+++ lib/IO/Socket/SSL.pm
|
|
@@ -89,9 +89,7 @@ my %DEFAULT_SSL_ARGS = (
|
|
SSL_verifycn_publicsuffix => undef, # fallback default list verification
|
|
#SSL_verifycn_name => undef, # use from PeerAddr/PeerHost - do not override in set_args_filter_hack 'use_defaults'
|
|
SSL_npn_protocols => undef, # meaning depends whether on server or client side
|
|
- SSL_cipher_list =>
|
|
- 'EECDH+AESGCM+ECDSA EECDH+AESGCM EECDH+ECDSA +AES256 EECDH EDH+AESGCM '.
|
|
- 'EDH ALL +SHA +3DES +RC4 !LOW !EXP !eNULL !aNULL !DES !MD5 !PSK !SRP',
|
|
+ SSL_cipher_list => 'DEFAULT',
|
|
);
|
|
|
|
my %DEFAULT_SSL_CLIENT_ARGS = (
|
|
@@ -101,42 +99,6 @@ my %DEFAULT_SSL_CLIENT_ARGS = (
|
|
SSL_ca_file => undef,
|
|
SSL_ca_path => undef,
|
|
|
|
- # older versions of F5 BIG-IP hang when getting SSL client hello >255 bytes
|
|
- # http://support.f5.com/kb/en-us/solutions/public/13000/000/sol13037.html
|
|
- # http://guest:guest@rt.openssl.org/Ticket/Display.html?id=2771
|
|
- # Debian works around this by disabling TLSv1_2 on the client side
|
|
- # Chrome and IE11 use TLSv1_2 but use only a few ciphers, so that packet
|
|
- # stays small enough
|
|
- # The following list is taken from IE11, except that we don't do RC4-MD5,
|
|
- # RC4-SHA is already bad enough. Also, we have a different sort order
|
|
- # compared to IE11, because we put ciphers supporting forward secrecy on top
|
|
-
|
|
- SSL_cipher_list => join(" ",
|
|
- qw(
|
|
- ECDHE-ECDSA-AES128-GCM-SHA256
|
|
- ECDHE-ECDSA-AES128-SHA256
|
|
- ECDHE-ECDSA-AES256-GCM-SHA384
|
|
- ECDHE-ECDSA-AES256-SHA384
|
|
- ECDHE-ECDSA-AES128-SHA
|
|
- ECDHE-ECDSA-AES256-SHA
|
|
- ECDHE-RSA-AES128-SHA256
|
|
- ECDHE-RSA-AES128-SHA
|
|
- ECDHE-RSA-AES256-SHA
|
|
- DHE-DSS-AES128-SHA256
|
|
- DHE-DSS-AES128-SHA
|
|
- DHE-DSS-AES256-SHA256
|
|
- DHE-DSS-AES256-SHA
|
|
- AES128-SHA256
|
|
- AES128-SHA
|
|
- AES256-SHA256
|
|
- AES256-SHA
|
|
- EDH-DSS-DES-CBC3-SHA
|
|
- DES-CBC3-SHA
|
|
- RC4-SHA
|
|
- ),
|
|
- # just to make sure, that we don't accidentely add bad ciphers above
|
|
- "!EXP !LOW !eNULL !aNULL !DES !MD5 !PSK !SRP"
|
|
- )
|
|
);
|
|
|
|
# set values inside _init to work with perlcc, RT#95452
|
|
--- lib/IO/Socket/SSL.pod
|
|
+++ lib/IO/Socket/SSL.pod
|
|
@@ -937,12 +937,8 @@ documentation (L<http://www.openssl.org/
|
|
for more details.
|
|
|
|
Unless you fail to contact your peer because of no shared ciphers it is
|
|
-recommended to leave this option at the default setting. The default setting
|
|
-prefers ciphers with forward secrecy, disables anonymous authentication and
|
|
-disables known insecure ciphers like MD5, DES etc. This gives a grade A result
|
|
-at the tests of SSL Labs.
|
|
-To use the less secure OpenSSL builtin default (whatever this is) set
|
|
-SSL_cipher_list to ''.
|
|
+recommended to leave this option at the default setting, which honors the
|
|
+system-wide DEFAULT cipher list.
|
|
|
|
=item SSL_honor_cipher_order
|
|
|