[BACK]Return to lonssl.pm CVS log [TXT] [DIR] Up to [LON-CAPA] / loncom

Diff for /loncom/lonssl.pm between versions 1.17 and 1.18

version 1.17, 2018/08/07 17:12:08 version 1.18, 2018/08/09 13:27:55
Line 134  sub PromoteClientSocket { Line 134  sub PromoteClientSocket {
  $MyCert,   $MyCert,
  $KeyFile,   $KeyFile,
         $peer,          $peer,
         $CRLFile)          = @_;          $CRLFile) = @_;
       
       
     Debug("Client promotion using key: $KeyFile, Cert: $MyCert, CA: $CACert, CRL: $CRLFile, Remote Host: $peer\n");      Debug("Client promotion using key: $KeyFile, Cert: $MyCert, CA: $CACert, CRL: $CRLFile, Remote Host: $peer\n");
   
     # To create the ssl socket we need to duplicate the existing      # To create the ssl socket we need to duplicate the existing
Line 196  sub PromoteClientSocket { Line 195  sub PromoteClientSocket {
 #               CRLFile                    Full path name to the certificate  #               CRLFile                    Full path name to the certificate
 #                                          revocation list file for the cluster  #                                          revocation list file for the cluster
 #                                          to which server belongs (optional)  #                                          to which server belongs (optional)
   #               clientversion              LON-CAPA version running on remote
   #                                          client
 # Returns  # Returns
 # - Reference to an SSL socket on success  # - Reference to an SSL socket on success
 #       - undef on failure.  Reason for failure can be interrogated from   #       - undef on failure.  Reason for failure can be interrogated from 
Line 209  sub PromoteServerSocket { Line 210  sub PromoteServerSocket {
  $MyCert,   $MyCert,
  $KeyFile,   $KeyFile,
         $peer,          $peer,
         $CRLFile)          = @_;          $CRLFile,
           $clientversion) = @_;
   
   
     # To create the ssl socket we need to duplicate the existing      # To create the ssl socket we need to duplicate the existing
     # socket.  Otherwise closing the ssl socket will close the plaintext socket      # socket.  Otherwise closing the ssl socket will close the plaintext socket
Line 229  sub PromoteServerSocket { Line 229  sub PromoteServerSocket {
                    SSL_use_cert      => 1,                     SSL_use_cert      => 1,
                    SSL_key_file      => $KeyFile,                     SSL_key_file      => $KeyFile,
                    SSL_cert_file     => $MyCert,                     SSL_cert_file     => $MyCert,
                    SSL_ca_file       => $CACert,                     SSL_ca_file       => $CACert);
                    SSL_verifycn_name => $peer,      my ($major,$minor) = split(/\./,$clientversion);
                    SSL_verify_mode   => Net::SSLeay::VERIFY_PEER());       if (($major < 2) || ($major == 2 && $minor < 12)) {
     if (($CRLFile ne '') && (-e $CRLFile)) {          $sslargs{SSL_verify_mode} = Net::SSLeay::VERIFY_NONE();
         $sslargs{SSL_check_crl} = 1;      } else {
         $sslargs{SSL_crl_file} = $CRLFile;           $sslargs{SSL_verifycn_name} = $peer;
           $sslargs{SSL_verify_mode} = Net::SSLeay::VERIFY_PEER();
           if (($CRLFile ne '') && (-e $CRLFile)) {
               $sslargs{SSL_check_crl} = 1;
               $sslargs{SSL_crl_file} = $CRLFile; 
           }
     }      }
     my $client = IO::Socket::SSL->new_from_fd($dupfno,%sslargs);      my $client = IO::Socket::SSL->new_from_fd($dupfno,%sslargs);
     if(!$client) {      if(!$client) {
Removed from v.1.17  
changed lines
  Added in v.1.18

FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>