[perl-IO-Socket-SSL] Use system-default SSL version too
Paul Howarth
pghmcfc at fedoraproject.org
Thu Aug 7 15:28:53 UTC 2014
commit bdc758a36f2ad96799dbef156e9e6cdd314f4109
Author: Paul Howarth <paul at city-fan.org>
Date: Thu Aug 7 16:26:51 2014 +0100
Use system-default SSL version too
...-SSL-1.997-use-system-default-SSL-version.patch | 32 ++++++++++++++++++++
perl-IO-Socket-SSL.spec | 9 +++++-
2 files changed, 40 insertions(+), 1 deletions(-)
---
diff --git a/IO-Socket-SSL-1.997-use-system-default-SSL-version.patch b/IO-Socket-SSL-1.997-use-system-default-SSL-version.patch
new file mode 100644
index 0000000..eed3aa9
--- /dev/null
+++ b/IO-Socket-SSL-1.997-use-system-default-SSL-version.patch
@@ -0,0 +1,32 @@
+--- lib/IO/Socket/SSL.pm
++++ lib/IO/Socket/SSL.pm
+@@ -83,7 +83,7 @@ my $algo2digest = do {
+ # global defaults
+ my %DEFAULT_SSL_ARGS = (
+ SSL_check_crl => 0,
+- SSL_version => 'SSLv23:!SSLv2',
++ SSL_version => '',
+ SSL_verify_callback => undef,
+ SSL_verifycn_scheme => undef, # fallback cn verification
+ SSL_verifycn_publicsuffix => undef, # fallback default list verification
+@@ -2043,7 +2043,7 @@ WARN
+
+ my $ssl_op = Net::SSLeay::OP_ALL();
+
+- my $ver;
++ my $ver = '';
+ for (split(/\s*:\s*/,$arg_hash->{SSL_version})) {
+ m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1(?:_?[12])?))$}i
+ or croak("invalid SSL_version specified");
+--- lib/IO/Socket/SSL.pod
++++ lib/IO/Socket/SSL.pod
+@@ -910,7 +910,8 @@ recent versions of Net::SSLeay and opens
+
+ You can limit to set of supported protocols by adding !version separated by ':'.
+
+-The default SSL_version is 'SSLv23:!SSLv2' which means, that SSLv2, SSLv3 and
++The default SSL_version is defined by underlying cryptographic library.
++For example, 'SSLv23:!SSLv2' means that SSLv2, SSLv3 and TLSv1
+ TLSv1 are supported for initial protocol handshakes, but SSLv2 will not be
+ accepted, leaving only SSLv3 and TLSv1. You can also use !TLSv1_1 and !TLSv1_2
+ to disable TLS versions 1.1 and 1.2 while allowing TLS version 1.0.
diff --git a/perl-IO-Socket-SSL.spec b/perl-IO-Socket-SSL.spec
index ab32433..c49c251 100644
--- a/perl-IO-Socket-SSL.spec
+++ b/perl-IO-Socket-SSL.spec
@@ -1,12 +1,13 @@
Name: perl-IO-Socket-SSL
Version: 1.997
-Release: 2%{?dist}
+Release: 3%{?dist}
Summary: Perl library for transparent SSL
Group: Development/Libraries
License: GPL+ or Artistic
URL: http://search.cpan.org/dist/IO-Socket-SSL/
Source0: http://search.cpan.org/CPAN/authors/id/S/SU/SULLR/IO-Socket-SSL-%{version}.tar.gz
Patch0: IO-Socket-SSL-1.997-use-system-default-cipher-list.patch
+Patch1: IO-Socket-SSL-1.997-use-system-default-SSL-version.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(id -nu)
BuildArch: noarch
BuildRequires: openssl >= 0.9.8
@@ -67,6 +68,9 @@ mod_perl.
# https://fedoraproject.org/wiki/Changes/CryptoPolicy
%patch0
+# Use system-default SSL version too
+%patch1
+
%build
echo n | perl Makefile.PL INSTALLDIRS=vendor
make %{?_smp_mflags}
@@ -96,6 +100,9 @@ rm -rf %{buildroot}
%{_mandir}/man3/IO::Socket::SSL::Utils.3*
%changelog
+* Thu Aug 7 2014 Paul Howarth <paul at city-fan.org> - 1.997-3
+- Use system-default SSL version too
+
* Thu Aug 7 2014 Paul Howarth <paul at city-fan.org> - 1.997-2
- Use system-wide default cipher list to support use of system-wide
crypto policy (#1076390, #1127577, CPAN RT#97816)
More information about the perl-devel
mailing list