Bug #98021 for IO-Socket-SSL: invalid SSL_version split looking for colon-delimiter

Thu Aug 14 16:54:47 2014 marshall [...] emolecules.com - Ticket created

Subject:	invalid SSL_version split looking for colon-delimiter
Date:	Wed, 13 Aug 2014 13:30:58 -0700
To:	bug-IO-Socket-SSL [...] rt.cpan.org
From:	Marshall Levesque <marshall [...] emolecules.com>

Hi- We received this error after upgrading to the version 1.997: *invalid SSL_version specified at /usr/local/share/perl/5.10.1/IO/Socket/SSL.pm line 489* We found that the for-loop looks at the the results of a split() which uses a colon : for a delimiter. Starting on line 2085 of IO/Socket/SSL.pm *for (split(/\s*:\s*/,$arg_hash->{SSL_version})) {* * m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1(?:_?[12])?))$}i* * or croak("invalid SSL_version specified”);* But when we print the $arg_hash->{SSL_version} to STDERR, we see that the value is "*SSLv3 TLSv1*”. So there is no colon. -Marshall *---* *Marshall Levesque, PhD* *eMolecules, Inc.* *Director of Software Development* 11025 N. Torrey Pines Road Suite 140 La Jolla, CA 92037, USA +1-858-368-8638

Fri Aug 15 14:00:17 2014 Steffen_Ullrich [...] genua.de - Correspondence added

Am Do 14. Aug 2014, 16:54:47, marshall@emolecules.com schrieb: Show quoted text

> Hi- > > We received this error after upgrading to the version 1.997: > > *invalid SSL_version specified at > /usr/local/share/perl/5.10.1/IO/Socket/SSL.pm line 489* > > We found that the for-loop looks at the the results of a split() which uses > a colon : for a delimiter. Starting on line 2085 of IO/Socket/SSL.pm > > > *for (split(/\s*:\s*/,$arg_hash->{SSL_version})) {* > * m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1(?:_?[12])?))$}i* > * or croak("invalid SSL_version specified”);* > > > > But when we print the $arg_hash->{SSL_version} to STDERR, we see that the > value is "*SSLv3 TLSv1*”. So there is no colon.

This is an error in the application/module using IO::Socket::SSL and not in IO::Socket::SSL itself. Please report the problem there. Background: The syntax with giving multiple versions was never supported and never documented and it never worked like the user might assume. Up to version 1.70 it was only possible to give a single version and everything else was silently ignored. With version 1.70 (released more than 2 years ago) support for disabling specific versions was added and the syntax was enforced instead of invalid settings silently ignored.

Fri Aug 15 14:00:18 2014 The RT System itself - Status changed from 'new' to 'open'

Fri Aug 15 14:00:19 2014 Steffen_Ullrich [...] genua.de - Status changed from 'open' to 'rejected'