rpms/perl-Net-SSLeay
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Adapt tests to system-wide crypto policy

Browse Source 
openssl-1:1.1.1-0.pre8.2.fc29 started to obey to a system-wide crypto
policy. This affected Net-SSLeay tests. Please note that
openssl-1.1.1-0.pre8.3.fc29 fixed some regressions affecting
Net-SSLeay tests.
This commit is contained in:
Petr Písař 2018-08-13 15:24:37 +02:00
parent 49c2c785dd
commit 4f30952208
2 changed files with 67 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
Net-SSLeay-1.85-Adapt-CTX_get_min_proto_version-tests-to-system-wide.patch Normal file
View File

@ -0,0 +1,63 @@
From a00a70b7195438c543191b69382ff20e452548bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Mon, 13 Aug 2018 12:33:58 +0200
Subject: [PATCH] Adapt CTX_get_min_proto_version tests to system-wide policy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
In our distribution, /etc/crypto-policies/back-ends/opensslcnf.config
can override default minimal SSL/TLS protocol version. If it does,
t/local/09_ctx_new.t test will fail because OpenSSL will return
different then 0 value.
This patch parses the configuration file and adjusts expect values in
the test.
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
t/local/09_ctx_new.t | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/t/local/09_ctx_new.t b/t/local/09_ctx_new.t
index 6d06f21..c584856 100644
--- a/t/local/09_ctx_new.t
+++ b/t/local/09_ctx_new.t
@@ -109,14 +109,32 @@ else
# Having TLS_method() does not necessarily that proto getters are available
if ($ctx_tls && exists &Net::SSLeay::CTX_get_min_proto_version)
{
+ my $min_ver = 0;
+ # Adjust minimal version to system-wide crypto policy
+ if (open(my $f, '<', '/etc/crypto-policies/back-ends/opensslcnf.config')) {
+ while(<$f>) {
+ if (/^MinProtocol = ([\w.]+)\b/) {
+ if ($1 eq 'TLSv1') {
+ $min_ver = 0x0301;
+ } elsif ($1 eq 'TLSv1.1') {
+ $min_ver = 0x0302;
+ } elsif ($1 eq 'TLSv1.2') {
+ $min_ver = 0x0303;
+ } elsif ($1 eq 'TLSv1.3') {
+ $min_ver = 0x0304;
+ }
+ }
+ }
+ close($f);
+ }
my $ver;
$ver = Net::SSLeay::CTX_get_min_proto_version($ctx_tls);
- is($ver, 0, 'TLS_method CTX has automatic minimum version');
+ is($ver, $min_ver, 'TLS_method CTX has automatic minimum version');
$ver = Net::SSLeay::CTX_get_max_proto_version($ctx_tls);
is($ver, 0, 'TLS_method CTX has automatic maximum version');
$ver = Net::SSLeay::get_min_proto_version($ssl_tls);
- is($ver, 0, 'SSL from TLS_method CTX has automatic minimum version');
+ is($ver, $min_ver, 'SSL from TLS_method CTX has automatic minimum version');
$ver = Net::SSLeay::get_max_proto_version($ssl_tls);
is($ver, 0, 'SSL from TLS_method CTX has automatic maximum version');
--
2.14.4

4
perl-Net-SSLeay.spec
View File

@ -16,6 +16,8 @@ URL: https://metacpan.org/release/Net-SSLeay
Source0: https://cpan.metacpan.org/authors/id/M/MI/MIKEM/Net-SSLeay-%{version}.tar.gz
# Adapt to OpenSSL 1.1.1, bug #1614884, CPAN RT#125218
Patch0: Net-SSLeay-1.85-Adapt-to-OpenSSL-1.1.1.patch
# Adapt tests to system-wide crypto policy, bug #1614884
Patch1: Net-SSLeay-1.85-Adapt-CTX_get_min_proto_version-tests-to-system-wide.patch
# =========== Module Build ===========================
BuildRequires: coreutils
BuildRequires: findutils
@ -72,6 +74,7 @@ so you can write servers or clients for more complicated applications.
%prep
%setup -q -n Net-SSLeay-%{version}
%patch0 -p1
%patch1 -p1
# Fix permissions in examples to avoid bogus doc-file dependencies
chmod -c 644 examples/*
@ -121,6 +124,7 @@ perl -Iblib/{arch,lib} -MNet::SSLeay -e 'Net::SSLeay::CTX_v3_new()'
%changelog
* Mon Aug 13 2018 Petr Pisar <ppisar@redhat.com> - 1.85-4
- Adapt to OpenSSL 1.1.1 (bug #1614884)
- Adapt tests to system-wide crypto policy (bug #1614884)
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.85-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild