diff mbox series

[7/8] ids-functions.pl: Adjust code to deal with new LWP::UserAgent.

Message ID 20220203111613.13632-7-stefan.schantl@ipfire.org
State Accepted
Commit 954dbdadcf0915c3f0f31bee818b99d3d1843ae9
Headers
Series [1/8] perl-Try-Tiny: New package. |

Commit Message

Stefan Schantl Feb. 3, 2022, 11:16 a.m. UTC 
  Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---
 config/cfgroot/ids-functions.pl | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

Comments

Peter Müller Feb. 5, 2022, 12:26 p.m. UTC | #1 
Interesting to see this requires certificate validation to be actively enabled.
I wonder how many Perl projects using LWP are vulnerable to TLS interception by
self-signed/untrusted certificates... :-/

Reviewed-by: Peter Müller <peter.mueller@ipfire.org>

> Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
> ---
>  config/cfgroot/ids-functions.pl | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl
> index 74d55def6..bf02bcbaa 100644
> --- a/config/cfgroot/ids-functions.pl
> +++ b/config/cfgroot/ids-functions.pl
> @@ -281,7 +281,15 @@ sub downloadruleset ($) {
>  	use LWP::UserAgent;
>  
>  	# Init the download module.
> -	my $downloader = LWP::UserAgent->new;
> +	#
> +	# Request SSL hostname verification and specify path
> +	# to the CA file.
> +	my $downloader = LWP::UserAgent->new(
> +		ssl_opts => {
> +			SSL_ca_file     => '/etc/ssl/cert.pem',
> +			verify_hostname => 1,
> +		}
> +	);
>  
>  	# Set timeout to 10 seconds.
>  	$downloader->timeout(10);
Adolf Belka Feb. 14, 2022, 9:15 p.m. UTC | #2 
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>

On 03/02/2022 12:16, Stefan Schantl wrote:
> Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
> ---
>   config/cfgroot/ids-functions.pl | 10 +++++++++-
>   1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl
> index 74d55def6..bf02bcbaa 100644
> --- a/config/cfgroot/ids-functions.pl
> +++ b/config/cfgroot/ids-functions.pl
> @@ -281,7 +281,15 @@ sub downloadruleset ($) {
>   	use LWP::UserAgent;
>   
>   	# Init the download module.
> -	my $downloader = LWP::UserAgent->new;
> +	#
> +	# Request SSL hostname verification and specify path
> +	# to the CA file.
> +	my $downloader = LWP::UserAgent->new(
> +		ssl_opts => {
> +			SSL_ca_file     => '/etc/ssl/cert.pem',
> +			verify_hostname => 1,
> +		}
> +	);
>   
>   	# Set timeout to 10 seconds.
>   	$downloader->timeout(10);
diff mbox series

Patch

diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl
index 74d55def6..bf02bcbaa 100644
--- a/config/cfgroot/ids-functions.pl
+++ b/config/cfgroot/ids-functions.pl
@@ -281,7 +281,15 @@  sub downloadruleset ($) {
 	use LWP::UserAgent;
 
 	# Init the download module.
-	my $downloader = LWP::UserAgent->new;
+	#
+	# Request SSL hostname verification and specify path
+	# to the CA file.
+	my $downloader = LWP::UserAgent->new(
+		ssl_opts => {
+			SSL_ca_file     => '/etc/ssl/cert.pem',
+			verify_hostname => 1,
+		}
+	);
 
 	# Set timeout to 10 seconds.
 	$downloader->timeout(10);