search

mojolicious / mojo

:sparkles: Mojolicious - Perl real-time web framework
https://mojolicious.org
Artistic License 2.0
2.66k stars 576 forks source link

dont overwrite tls_option #2148

Open tagg opened 4 months ago

tagg commented 4 months ago

Summary

tls_option(SSL_verifycn_name) is unconditionally overwritten.

Motivation

Mojo::UserAgent tls_option() is used to pass extra options to IO::Socket::SSL, but the code in Mojo::IOLoop::TLS unconditionally overwrites any SSL_verifycn_name the user is trying to pass.

References

As discussed on IRC.

I wanted to add a test case, but I cannot run the TEST_TLS tests. Being a very simple change, maybe a test is unneccessary.

kraih commented 4 months ago

I'm afraid without a test this probably won't be considered.

kraih commented 4 months ago

Don't think any TLS changes should be considered until our tests pass in github actions again. https://github.com/mojolicious/mojo/commit/5d83a17e79b71bc3bbd492adc13b5942f1a61ac6