Attachment 889304 Details for Bug 1090966 – Fix ported to 0.40

[patch] Fix ported to 0.40

perl-ldap-0.40-Do-not-set-SSL_ciphers-to-ALL-by-default.patch (text/plain), 2.15 KB, created by Petr Pisar on 2014-04-24 14:40:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Petr Pisar

Created: 2014-04-24 14:40:58 UTC

Size: 2.15 KB

patch

obsolete

>From 68515879a0effee5859eda7e4b72c29873dd6d12 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
>Date: Thu, 24 Apr 2014 15:51:01 +0200
>Subject: [PATCH] Do not set SSL_ciphers to ALL by default
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>'ALL' cipher list is not the same as OpenSSL default. The 'ALL'
>contains more ciphers. Some of them are too weak, some of them
>prevents from using SSLv3 protocol. Then used SSLv2 protocol does not
>support elliptic curve parameter negotion which can cause
>interoperability issues when server picks a curve not supported by the
>client.
>
>IO-Socket-SSL-1.955 supports special value '' (empty string) to
>designed the OpenSSL default. However older IO-Socket-SSL recommends
>not to set the option at all.
>
>Thus this patch sets SSL_ciphers only if Net::LDAP application passes
>the ciphers option.
>
>Signed-off-by: Petr PÃsaÅ <ppisar@redhat.com>
>
>Ported to 0.40.
>
>Signed-off-by: Petr PÃsaÅ <ppisar@redhat.com>
>---
> lib/Net/LDAP.pm  | 3 ++-
> lib/Net/LDAP.pod | 4 ++--
> 2 files changed, 4 insertions(+), 3 deletions(-)
>
>diff --git a/lib/Net/LDAP.pm b/lib/Net/LDAP.pm
>index 43eb7dd..09253a3 100644
>--- a/lib/Net/LDAP.pm
>+++ b/lib/Net/LDAP.pm
>@@ -219,7 +219,8 @@ sub _SSL_context_init_args {
>   }
> 
>   (
>-    SSL_cipher_list => defined $arg->{'ciphers'} ? $arg->{'ciphers'} : 'ALL',
>+    defined $arg->{ciphers} ?
>+        ( SSL_cipher_list     => defined $arg->{ciphers}) : (),
>     SSL_ca_file     => exists  $arg->{'cafile'}  ? $arg->{'cafile'}  : '',
>     SSL_ca_path     => exists  $arg->{'capath'}  ? $arg->{'capath'}  : '',
>     SSL_key_file    => $clientcert ? $clientkey : undef,
>diff --git a/lib/Net/LDAP.pod b/lib/Net/LDAP.pod
>index 25b46fe..40f1868 100644
>--- a/lib/Net/LDAP.pod
>+++ b/lib/Net/LDAP.pod
>@@ -764,8 +764,8 @@ B<'tlsv1'>.
> 
> Specify which subset of cipher suites are permissible for this
> connection, using the standard OpenSSL string format. The default
>-value is B<'ALL'>, which permits all ciphers, even those that don't
>-encrypt.
>+behavior is to keep the decision on the underlying cryptographic
>+library.
> 
> =item clientcert =E<gt> '/path/to/cert.pem'
> 
>-- 
>1.9.0
>

Actions: View | Diff

Attachments on bug 1090966: 889304 | 924405 | 1096568