From bdc758a36f2ad96799dbef156e9e6cdd314f4109 Mon Sep 17 00:00:00 2001
From: Paul Howarth <paul@city-fan.org>
Date: Aug 07 2014 15:26:51 +0000
Subject: Use system-default SSL version too


---

diff --git a/IO-Socket-SSL-1.997-use-system-default-SSL-version.patch b/IO-Socket-SSL-1.997-use-system-default-SSL-version.patch
new file mode 100644
index 0000000..eed3aa9
--- /dev/null
+++ b/IO-Socket-SSL-1.997-use-system-default-SSL-version.patch
@@ -0,0 +1,32 @@
+--- lib/IO/Socket/SSL.pm
++++ lib/IO/Socket/SSL.pm
+@@ -83,7 +83,7 @@ my $algo2digest = do {
+ # global defaults
+ my %DEFAULT_SSL_ARGS = (
+     SSL_check_crl => 0,
+-    SSL_version => 'SSLv23:!SSLv2',
++    SSL_version => '',
+     SSL_verify_callback => undef,
+     SSL_verifycn_scheme => undef,  # fallback cn verification
+     SSL_verifycn_publicsuffix => undef,  # fallback default list verification
+@@ -2043,7 +2043,7 @@ WARN
+ 
+     my $ssl_op = Net::SSLeay::OP_ALL();
+ 
+-    my $ver;
++    my $ver = '';
+     for (split(/\s*:\s*/,$arg_hash->{SSL_version})) {
+ 	m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1(?:_?[12])?))$}i
+ 	or croak("invalid SSL_version specified");
+--- lib/IO/Socket/SSL.pod
++++ lib/IO/Socket/SSL.pod
+@@ -910,7 +910,8 @@ recent versions of Net::SSLeay and opens
+ 
+ You can limit to set of supported protocols by adding !version separated by ':'.
+ 
+-The default SSL_version is 'SSLv23:!SSLv2' which means, that SSLv2, SSLv3 and
++The default SSL_version is defined by underlying cryptographic library.
++For example, 'SSLv23:!SSLv2' means that SSLv2, SSLv3 and TLSv1
+ TLSv1 are supported for initial protocol handshakes, but SSLv2 will not be
+ accepted, leaving only SSLv3 and TLSv1. You can also use !TLSv1_1 and !TLSv1_2
+ to disable TLS versions 1.1 and 1.2 while allowing TLS version 1.0.
diff --git a/perl-IO-Socket-SSL.spec b/perl-IO-Socket-SSL.spec
index ab32433..c49c251 100644
--- a/perl-IO-Socket-SSL.spec
+++ b/perl-IO-Socket-SSL.spec
@@ -1,12 +1,13 @@
 Name:		perl-IO-Socket-SSL
 Version:	1.997
-Release:	2%{?dist}
+Release:	3%{?dist}
 Summary:	Perl library for transparent SSL
 Group:		Development/Libraries
 License:	GPL+ or Artistic
 URL:		http://search.cpan.org/dist/IO-Socket-SSL/
 Source0:	http://search.cpan.org/CPAN/authors/id/S/SU/SULLR/IO-Socket-SSL-%{version}.tar.gz
 Patch0:		IO-Socket-SSL-1.997-use-system-default-cipher-list.patch
+Patch1:		IO-Socket-SSL-1.997-use-system-default-SSL-version.patch
 BuildRoot:	%{_tmppath}/%{name}-%{version}-%{release}-root-%(id -nu)
 BuildArch:	noarch
 BuildRequires:	openssl >= 0.9.8
@@ -67,6 +68,9 @@ mod_perl.
 # https://fedoraproject.org/wiki/Changes/CryptoPolicy
 %patch0
 
+# Use system-default SSL version too
+%patch1
+
 %build
 echo n | perl Makefile.PL INSTALLDIRS=vendor
 make %{?_smp_mflags}
@@ -96,6 +100,9 @@ rm -rf %{buildroot}
 %{_mandir}/man3/IO::Socket::SSL::Utils.3*
 
 %changelog
+* Thu Aug  7 2014 Paul Howarth <paul@city-fan.org> - 1.997-3
+- Use system-default SSL version too
+
 * Thu Aug  7 2014 Paul Howarth <paul@city-fan.org> - 1.997-2
 - Use system-wide default cipher list to support use of system-wide
   crypto policy (#1076390, #1127577, CPAN RT#97816)