From 6ed7f418dd1595752a916db94f77ac4e124aaa24 Mon Sep 17 00:00:00 2001 From: Paul Howarth paul@city-fan.org Date: Wed, 20 Apr 2016 15:24:10 +0100 Subject: Update to 2.026
- New upstream release 2.026 - Upstream's default cipher lists updated (we use system default though) - Update patches as needed --- ...-SSL-2.021-use-system-default-cipher-list.patch | 73 ---------------- ...-SSL-2.024-use-system-default-SSL-version.patch | 36 -------- ...-SSL-2.026-use-system-default-SSL-version.patch | 36 ++++++++ ...-SSL-2.026-use-system-default-cipher-list.patch | 98 ++++++++++++++++++++++ perl-IO-Socket-SSL.spec | 11 ++- sources | 2 +- 6 files changed, 143 insertions(+), 113 deletions(-) delete mode 100644 IO-Socket-SSL-2.021-use-system-default-cipher-list.patch delete mode 100644 IO-Socket-SSL-2.024-use-system-default-SSL-version.patch create mode 100644 IO-Socket-SSL-2.026-use-system-default-SSL-version.patch create mode 100644 IO-Socket-SSL-2.026-use-system-default-cipher-list.patch
diff --git a/IO-Socket-SSL-2.021-use-system-default-cipher-list.patch b/IO-Socket-SSL-2.021-use-system-default-cipher-list.patch deleted file mode 100644 index dea2cc0..0000000 --- a/IO-Socket-SSL-2.021-use-system-default-cipher-list.patch +++ /dev/null @@ -1,73 +0,0 @@ ---- lib/IO/Socket/SSL.pm -+++ lib/IO/Socket/SSL.pm -@@ -92,9 +92,7 @@ my %DEFAULT_SSL_ARGS = ( - #SSL_verifycn_name => undef, # use from PeerAddr/PeerHost - do not override in set_args_filter_hack 'use_defaults' - SSL_npn_protocols => undef, # meaning depends whether on server or client side - SSL_alpn_protocols => undef, # list of protocols we'll accept/send, for example ['http/1.1','spdy/3.1'] -- SSL_cipher_list => -- 'EECDH+AESGCM+ECDSA EECDH+AESGCM EECDH+ECDSA +AES256 EECDH EDH+AESGCM '. -- 'EDH ALL +SHA +3DES !RC4 !LOW !EXP !eNULL !aNULL !DES !MD5 !PSK !SRP', -+ SSL_cipher_list => 'DEFAULT', - ); - - my %DEFAULT_SSL_CLIENT_ARGS = ( -@@ -104,42 +102,6 @@ my %DEFAULT_SSL_CLIENT_ARGS = ( - SSL_ca_file => undef, - SSL_ca_path => undef, - -- # older versions of F5 BIG-IP hang when getting SSL client hello >255 bytes -- # http://support.f5.com/kb/en-us/solutions/public/13000/000/sol13037.html -- # http://guest:guest@rt.openssl.org/Ticket/Display.html?id=2771 -- # Debian works around this by disabling TLSv1_2 on the client side -- # Chrome and IE11 use TLSv1_2 but use only a few ciphers, so that packet -- # stays small enough -- # The following list is taken from IE11, except that we don't do RC4-MD5, -- # RC4-SHA is already bad enough. Also, we have a different sort order -- # compared to IE11, because we put ciphers supporting forward secrecy on top -- -- SSL_cipher_list => join(" ", -- qw( -- ECDHE-ECDSA-AES128-GCM-SHA256 -- ECDHE-ECDSA-AES128-SHA256 -- ECDHE-ECDSA-AES256-GCM-SHA384 -- ECDHE-ECDSA-AES256-SHA384 -- ECDHE-ECDSA-AES128-SHA -- ECDHE-ECDSA-AES256-SHA -- ECDHE-RSA-AES128-SHA256 -- ECDHE-RSA-AES128-SHA -- ECDHE-RSA-AES256-SHA -- DHE-DSS-AES128-SHA256 -- DHE-DSS-AES128-SHA -- DHE-DSS-AES256-SHA256 -- DHE-DSS-AES256-SHA -- AES128-SHA256 -- AES128-SHA -- AES256-SHA256 -- AES256-SHA -- EDH-DSS-DES-CBC3-SHA -- DES-CBC3-SHA -- RC4-SHA -- ), -- # just to make sure, that we don't accidentally add bad ciphers above -- "!EXP !LOW !eNULL !aNULL !DES !MD5 !PSK !SRP" -- ) - ); - - # set values inside _init to work with perlcc, RT#95452 ---- lib/IO/Socket/SSL.pod -+++ lib/IO/Socket/SSL.pod -@@ -968,12 +968,8 @@ documentation (L<http://www.openssl.org/ - for more details. - - Unless you fail to contact your peer because of no shared ciphers it is --recommended to leave this option at the default setting. The default setting --prefers ciphers with forward secrecy, disables anonymous authentication and --disables known insecure ciphers like MD5, DES etc. This gives a grade A result --at the tests of SSL Labs. --To use the less secure OpenSSL builtin default (whatever this is) set --SSL_cipher_list to ''. -+recommended to leave this option at the default setting, which honors the -+system-wide DEFAULT cipher list. - - In case different cipher lists are needed for different SNI hosts a hash can be - given with the host as key and the cipher suite as value, similar to diff --git a/IO-Socket-SSL-2.024-use-system-default-SSL-version.patch b/IO-Socket-SSL-2.024-use-system-default-SSL-version.patch deleted file mode 100644 index c1dfeff..0000000 --- a/IO-Socket-SSL-2.024-use-system-default-SSL-version.patch +++ /dev/null @@ -1,36 +0,0 @@ ---- lib/IO/Socket/SSL.pm -+++ lib/IO/Socket/SSL.pm -@@ -85,7 +85,7 @@ my $algo2digest = do { - # global defaults - my %DEFAULT_SSL_ARGS = ( - SSL_check_crl => 0, -- SSL_version => 'SSLv23:!SSLv3:!SSLv2', # consider both SSL3.0 and SSL2.0 as broken -+ SSL_version => '', - SSL_verify_callback => undef, - SSL_verifycn_scheme => undef, # fallback cn verification - SSL_verifycn_publicsuffix => undef, # fallback default list verification -@@ -2179,7 +2179,7 @@ sub new { - $ssl_op |= &Net::SSLeay::OP_SINGLE_DH_USE; - $ssl_op |= &Net::SSLeay::OP_SINGLE_ECDH_USE if $can_ecdh; - -- my $ver; -+ my $ver = ''; - for (split(/\s*:\s*/,$arg_hash->{SSL_version})) { - m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1(?:_?[12])?))$}i - or croak("invalid SSL_version specified"); ---- lib/IO/Socket/SSL.pod -+++ lib/IO/Socket/SSL.pod -@@ -942,11 +942,12 @@ protocol to the specified version. - All values are case-insensitive. Instead of 'TLSv1_1' and 'TLSv1_2' one can - also use 'TLSv11' and 'TLSv12'. Support for 'TLSv1_1' and 'TLSv1_2' requires - recent versions of Net::SSLeay and openssl. -+The default SSL_version is defined by the underlying cryptographic library. - - Independent from the handshake format you can limit to set of accepted SSL - versions by adding !version separated by ':'. - --The default SSL_version is 'SSLv23:!SSLv3:!SSLv2' which means, that the -+For example, 'SSLv23:!SSLv3:!SSLv2' means that the - handshake format is compatible to SSL2.0 and higher, but that the successful - handshake is limited to TLS1.0 and higher, that is no SSL2.0 or SSL3.0 because - both of these versions have serious security issues and should not be used diff --git a/IO-Socket-SSL-2.026-use-system-default-SSL-version.patch b/IO-Socket-SSL-2.026-use-system-default-SSL-version.patch new file mode 100644 index 0000000..247205c --- /dev/null +++ b/IO-Socket-SSL-2.026-use-system-default-SSL-version.patch @@ -0,0 +1,36 @@ +--- lib/IO/Socket/SSL.pm ++++ lib/IO/Socket/SSL.pm +@@ -85,7 +85,7 @@ my $algo2digest = do { + # global defaults + my %DEFAULT_SSL_ARGS = ( + SSL_check_crl => 0, +- SSL_version => 'SSLv23:!SSLv3:!SSLv2', # consider both SSL3.0 and SSL2.0 as broken ++ SSL_version => '', + SSL_verify_callback => undef, + SSL_verifycn_scheme => undef, # fallback cn verification + SSL_verifycn_publicsuffix => undef, # fallback default list verification +@@ -2183,7 +2183,7 @@ sub new { + $ssl_op |= &Net::SSLeay::OP_SINGLE_DH_USE; + $ssl_op |= &Net::SSLeay::OP_SINGLE_ECDH_USE if $can_ecdh; + +- my $ver; ++ my $ver = ''; + for (split(/\s*:\s*/,$arg_hash->{SSL_version})) { + m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1(?:_?[12])?))$}i + or croak("invalid SSL_version specified"); +--- lib/IO/Socket/SSL.pod ++++ lib/IO/Socket/SSL.pod +@@ -942,11 +942,12 @@ protocol to the specified version. + All values are case-insensitive. Instead of 'TLSv1_1' and 'TLSv1_2' one can + also use 'TLSv11' and 'TLSv12'. Support for 'TLSv1_1' and 'TLSv1_2' requires + recent versions of Net::SSLeay and openssl. ++The default SSL_version is defined by the underlying cryptographic library. + + Independent from the handshake format you can limit to set of accepted SSL + versions by adding !version separated by ':'. + +-The default SSL_version is 'SSLv23:!SSLv3:!SSLv2' which means, that the ++For example, 'SSLv23:!SSLv3:!SSLv2' means that the + handshake format is compatible to SSL2.0 and higher, but that the successful + handshake is limited to TLS1.0 and higher, that is no SSL2.0 or SSL3.0 because + both of these versions have serious security issues and should not be used diff --git a/IO-Socket-SSL-2.026-use-system-default-cipher-list.patch b/IO-Socket-SSL-2.026-use-system-default-cipher-list.patch new file mode 100644 index 0000000..fa5500d --- /dev/null +++ b/IO-Socket-SSL-2.026-use-system-default-cipher-list.patch @@ -0,0 +1,98 @@ +--- lib/IO/Socket/SSL.pm ++++ lib/IO/Socket/SSL.pm +@@ -93,10 +93,10 @@ my %DEFAULT_SSL_ARGS = ( + SSL_npn_protocols => undef, # meaning depends whether on server or client side + SSL_alpn_protocols => undef, # list of protocols we'll accept/send, for example ['http/1.1','spdy/3.1'] + +- # https://wiki.mozilla.org/Security/Server_Side_TLS, 2016/04/20 +- # "Old backward compatibility" for best compatibility +- # .. "Most ciphers that are not clearly broken and dangerous to use are supported" +- SSL_cipher_list => 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:SEED:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!RSAPSK:!aDH:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!SRP', ++ # Use system-wide default cipher list to support use of system-wide ++ # crypto policy (#1076390, #1127577, CPAN RT#97816) ++ # https://fedoraproject.org/wiki/Changes/CryptoPolicy ++ SSL_cipher_list => 'DEFAULT', + ); + + my %DEFAULT_SSL_CLIENT_ARGS = ( +@@ -106,63 +106,6 @@ my %DEFAULT_SSL_CLIENT_ARGS = ( + SSL_ca_file => undef, + SSL_ca_path => undef, + +- # older versions of F5 BIG-IP hang when getting SSL client hello >255 bytes +- # http://support.f5.com/kb/en-us/solutions/public/13000/000/sol13037.html +- # http://guest:guest@rt.openssl.org/Ticket/Display.html?id=2771 +- # Ubuntu worked around this by disabling TLSv1_2 on the client side for +- # a while. Later a padding extension was added to OpenSSL to work around +- # broken F5 but then IronPort croaked because it did not understand this +- # extension so it was disabled again :( +- # Firefox, Chrome and IE11 use TLSv1_2 but use only a few ciphers, so +- # that packet stays small enough. We try the same here. +- +- SSL_cipher_list => join(" ", +- +- # SSLabs report for Chrome 48/OSX. +- # This also includes the fewer ciphers Firefox uses. +- 'ECDHE-ECDSA-AES128-GCM-SHA256', +- 'ECDHE-RSA-AES128-GCM-SHA256', +- 'DHE-RSA-AES128-GCM-SHA256', +- 'ECDHE-ECDSA-CHACHA20-POLY1305', +- 'ECDHE-RSA-CHACHA20-POLY1305', +- 'ECDHE-ECDSA-AES256-SHA', +- 'ECDHE-RSA-AES256-SHA', +- 'DHE-RSA-AES256-SHA', +- 'ECDHE-ECDSA-AES128-SHA', +- 'ECDHE-RSA-AES128-SHA', +- 'DHE-RSA-AES128-SHA', +- 'AES128-GCM-SHA256', +- 'AES256-SHA', +- 'AES128-SHA', +- 'DES-CBC3-SHA', +- +- # IE11/Edge has some more ciphers, notably SHA384 and DSS +- # we don't offer the *-AES128-SHA256 and *-AES256-SHA384 non-GCM +- # ciphers IE/Edge offers because they look like a large mismatch +- # between a very strong HMAC and a comparably weak (but sufficient) +- # encryption. Similar all browsers which do SHA384 can do ECDHE +- # so skip the DHE*SHA384 ciphers. +- 'ECDHE-RSA-AES256-GCM-SHA384', +- 'ECDHE-ECDSA-AES256-GCM-SHA384', +- # 'ECDHE-RSA-AES256-SHA384', +- # 'ECDHE-ECDSA-AES256-SHA384', +- # 'ECDHE-RSA-AES128-SHA256', +- # 'ECDHE-ECDSA-AES128-SHA256', +- # 'DHE-RSA-AES256-GCM-SHA384', +- # 'AES256-GCM-SHA384', +- 'AES256-SHA256', +- # 'AES128-SHA256', +- 'DHE-DSS-AES256-SHA256', +- # 'DHE-DSS-AES128-SHA256', +- 'DHE-DSS-AES256-SHA', +- 'DHE-DSS-AES128-SHA', +- 'EDH-DSS-DES-CBC3-SHA', +- +- # Just to make sure, that we don't accidentally add bad ciphers above. +- # This includes dropping RC4 which is no longer supported by modern +- # browsers and also excluded in the SSL libraries of Python and Ruby. +- "!EXP !MEDIUM !LOW !eNULL !aNULL !RC4 !DES !MD5 !PSK !SRP" +- ) + ); + + # set values inside _init to work with perlcc, RT#95452 +--- lib/IO/Socket/SSL.pod ++++ lib/IO/Socket/SSL.pod +@@ -968,12 +968,8 @@ documentation (L<http://www.openssl.org/ + for more details. + + Unless you fail to contact your peer because of no shared ciphers it is +-recommended to leave this option at the default setting. The default setting +-prefers ciphers with forward secrecy, disables anonymous authentication and +-disables known insecure ciphers like MD5, DES etc. This gives a grade A result +-at the tests of SSL Labs. +-To use the less secure OpenSSL builtin default (whatever this is) set +-SSL_cipher_list to ''. ++recommended to leave this option at the default setting, which honors the ++system-wide DEFAULT cipher list. + + In case different cipher lists are needed for different SNI hosts a hash can be + given with the host as key and the cipher suite as value, similar to diff --git a/perl-IO-Socket-SSL.spec b/perl-IO-Socket-SSL.spec index cb3cf1c..a3ebf9d 100644 --- a/perl-IO-Socket-SSL.spec +++ b/perl-IO-Socket-SSL.spec @@ -1,13 +1,13 @@ Name: perl-IO-Socket-SSL -Version: 2.025 +Version: 2.026 Release: 1%{?dist} Summary: Perl library for transparent SSL Group: Development/Libraries License: GPL+ or Artistic URL: http://search.cpan.org/dist/IO-Socket-SSL/ Source0: http://search.cpan.org/CPAN/authors/id/S/SU/SULLR/IO-Socket-SSL-%%7Bversion%... -Patch0: IO-Socket-SSL-2.021-use-system-default-cipher-list.patch -Patch1: IO-Socket-SSL-2.024-use-system-default-SSL-version.patch +Patch0: IO-Socket-SSL-2.026-use-system-default-cipher-list.patch +Patch1: IO-Socket-SSL-2.026-use-system-default-SSL-version.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(id -nu) BuildArch: noarch # Module Build @@ -115,6 +115,11 @@ rm -rf %{buildroot} %{_mandir}/man3/IO::Socket::SSL::Utils.3*
%changelog +* Wed Apr 20 2016 Paul Howarth paul@city-fan.org - 2.026-1 +- Update to 2.026 + - Upstream's default cipher lists updated (we use system default though) +- Update patches as needed + * Mon Apr 4 2016 Paul Howarth paul@city-fan.org - 2.025-1 - Update to 2.025 - Resolved memleak if SSL_crl_file was used (CPAN RT#113257, CPAN RT#113530) diff --git a/sources b/sources index fb59f8e..b607d7b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -675664fbe0a48b5844f916761323b5ce IO-Socket-SSL-2.025.tar.gz +9e7614fd4cc8206ebb1032b7b3c4be70 IO-Socket-SSL-2.026.tar.gz
perl-devel@lists.fedoraproject.org