Skip Menu |
 

This queue is for tickets about the IO-Socket-SSL CPAN distribution.

Report information
The Basics
Id: 98021
Status: rejected
Priority: 0/
Queue: IO-Socket-SSL

People
Owner: Nobody in particular
Requestors: marshall [...] emolecules.com
Cc:
AdminCc:

Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: (no value)



Subject: invalid SSL_version split looking for colon-delimiter
Date: Wed, 13 Aug 2014 13:30:58 -0700
To: bug-IO-Socket-SSL [...] rt.cpan.org
From: Marshall Levesque <marshall [...] emolecules.com>
Download (untitled) / with headers
text/plain 782b
Hi- We received this error after upgrading to the version 1.997: *invalid SSL_version specified at /usr/local/share/perl/5.10.1/IO/Socket/SSL.pm line 489* We found that the for-loop looks at the the results of a split() which uses a colon : for a delimiter. Starting on line 2085 of IO/Socket/SSL.pm *for (split(/\s*:\s*/,$arg_hash->{SSL_version})) {* * m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1(?:_?[12])?))$}i* * or croak("invalid SSL_version specified”);* But when we print the $arg_hash->{SSL_version} to STDERR, we see that the value is "*SSLv3 TLSv1*”. So there is no colon. -Marshall *---* *Marshall Levesque, PhD* *eMolecules, Inc.* *Director of Software Development* 11025 N. Torrey Pines Road Suite 140 La Jolla, CA 92037, USA +1-858-368-8638
Download (untitled) / with headers
text/plain 1.2k
Am Do 14. Aug 2014, 16:54:47, marshall@emolecules.com schrieb: Show quoted text
> Hi- > > We received this error after upgrading to the version 1.997: > > *invalid SSL_version specified at > /usr/local/share/perl/5.10.1/IO/Socket/SSL.pm line 489* > > We found that the for-loop looks at the the results of a split() which uses > a colon : for a delimiter. Starting on line 2085 of IO/Socket/SSL.pm > > > *for (split(/\s*:\s*/,$arg_hash->{SSL_version})) {* > * m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1(?:_?[12])?))$}i* > * or croak("invalid SSL_version specified”);* > > > > But when we print the $arg_hash->{SSL_version} to STDERR, we see that the > value is "*SSLv3 TLSv1*”. So there is no colon.
This is an error in the application/module using IO::Socket::SSL and not in IO::Socket::SSL itself. Please report the problem there. Background: The syntax with giving multiple versions was never supported and never documented and it never worked like the user might assume. Up to version 1.70 it was only possible to give a single version and everything else was silently ignored. With version 1.70 (released more than 2 years ago) support for disabling specific versions was added and the syntax was enforced instead of invalid settings silently ignored.


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.