RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1316377 - IO::Socket::SSL does not support ECDHE
Summary: IO::Socket::SSL does not support ECDHE
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: perl-IO-Socket-SSL
Version: 7.2
Hardware: x86_64
OS: Linux
high
medium
Target Milestone: rc
: ---
Assignee: perl-maint-list
QA Contact: Karel Srot
Lenka Špačková
URL:
Whiteboard:
Depends On: 1316379
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-03-10 06:32 UTC by Karel Srot
Modified: 2016-11-04 00:22 UTC (History)
14 users (show)

Fixed In Version: perl-IO-Socket-SSL-1.94-5.el7
Doc Type: Enhancement
Doc Text:
Perl *IO::Socket::SSL* now supports ECDHE Support for Elliptic Curve Diffie–Hellman Exchange (ECDHE) has been added to the *IO::Socket::SSL* Perl module. The new `SSL_ecdh_curve` option can be used for specifying a suitable curve by the Object Identifier (OID) or Name Identifier (NID). As a result, it is now possible to override the default elliptic curve parameters when implementing a TLS client using *IO::Socket:SSL*.
Clone Of: 1078084
Environment:
Last Closed: 2016-11-04 00:22:29 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
Upstream support for ECDH key exchange ported to 1.94 (5.02 KB, patch)
2016-03-10 14:39 UTC, Jitka Plesnikova 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2201 0 normal SHIPPED_LIVE perl-IO-Socket-SSL bug fix and enhancement update 2016-11-03 13:22:24 UTC

Description Karel Srot 2016-03-10 06:32:36 UTC 
RHEL-7 version doesn't support ECDHE while it is being added to RHEL-6.8

+++ This bug was initially created as a clone of Bug #1078084 +++

[...]
--- Additional comment from Deepak Das on 2014-02-27 08:45:44 GMT ---

The issue is not from openssl end. The issue seems to be on perl side. 

During ssl handshake "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" cipher was selected. It seems perl shipped with RHEL 6.5 does not have support to handle ECDHE based connection.

When following cpan modules were installed in perl the issue got resolved.

  1) cpan  Net::SSLeay

  2) cpan  IO::Socket::SSL

--- Additional comment from Tomas Mraz on 2014-02-27 09:49:01 GMT ---

This is fairly strange as the TLS client side should not require any code changes for ECDHE support. Perhaps just rebuild of these perl packages would help?
Reassigning.

--- Additional comment from Petr Pisar on 2014-02-27 10:22:43 GMT ---

Rebuild is not enough. One has to add the support to the binding and upper layers.

Support for ECDH has been added by upstream in IO-Socket-SSL-1.955 and Net-SSLeay-1.56.

RHEL-6 delivers perl-IO-Socket-SSL-1.31-2.el6 and perl-Net-SSLeay-1.35-9.el6.

[...]
--- Additional comment from Petr Pisar on 2014-03-19 06:54:38 GMT ---

There is definitely the problem that Perl TLS libraries as delivered by Red Hat Enterprise Linux 6 now do not support ECDHE. We will focus on this issue first.

We need to port the support available from latest version as described in comment #19.
----

IO::Socket:SSL as layer above Net::SSLeay has to be fixed too.

The reproducer is t/ecdhe.t from recent IO-Socket-SSL test suite <http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.969/t/ecdhe.t>.
Comment 1 Karel Srot 2016-03-10 06:42:21 UTC 
RHEL-6 bug also depends on bug 1078301. I don't know if such a change is needed for RHEL-7 too, please double check that.
Comment 2 Jitka Plesnikova 2016-03-10 14:39:23 UTC 
Created attachment 1134908 [details]
Upstream support for ECDH key exchange ported to 1.94
Comment 3 Jitka Plesnikova 2016-03-10 14:47:47 UTC 
(In reply to Karel Srot from comment #1)
> RHEL-6 bug also depends on bug 1078301. I don't know if such a change is
> needed for RHEL-7 too, please double check that.

The test failure mention in bug 1078301 is fixed in 1.94.
Comment 6 Jitka Plesnikova 2016-03-16 16:39:33 UTC 
Verification steps are same as in BZ#1078084 comment 7
Comment 9 errata-xmlrpc 2016-11-04 00:22:29 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2201.html
Note You need to log in before you can comment on or make changes to this bug.