Author: cliffjansen
Date: Sat Oct 18 00:16:01 2014
New Revision: 1632702
URL: http://svn.apache.org/r1632702
Log:
PROTON-719 : prevent ssl3 connections in Windows with schannel
Modified:
qpid/proton/trunk/proton-c/src/windows/schannel.c
Modified: qpid/proton/trunk/proton-c/src/windows/schannel.c
URL:
http://svn.apache.org/viewvc/qpid/proton/trunk/proton-c/src/windows/schannel.c?rev=1632702&r1=1632701&r2=1632702&view=diff
==============================================================================
--- qpid/proton/trunk/proton-c/src/windows/schannel.c (original)
+++ qpid/proton/trunk/proton-c/src/windows/schannel.c Sat Oct 18 00:16:01 2014
@@ -209,7 +209,7 @@ static size_t _pni_min(size_t a, size_t
}
// unrecoverable SSL failure occured, notify transport and generate error code.
-static int ssl_failed(pn_ssl_t *ssl, char *reason)
+static int ssl_failed(pn_ssl_t *ssl, const char *reason)
{
char buf[512] = "Unknown error.";
if (!reason) {
@@ -521,6 +521,16 @@ int pn_ssl_get_peer_hostname( pn_ssl_t *
/** SChannel specific: */
+const char *tls_version_check(pn_ssl_t *ssl)
+{
+ SecPkgContext_ConnectionInfo info;
+ QueryContextAttributes(&ssl->ctxt_handle, SECPKG_ATTR_CONNECTION_INFO,
&info);
+ // Ascending bit patterns denote newer SSL/TLS protocol versions.
+ // SP_PROT_TLS1_0_SERVER is not defined until VS2010.
+ return (info.dwProtocol < SP_PROT_TLS1_SERVER) ?
+ "peer does not support TLS 1.0 security" : NULL;
+}
+
static void ssl_encrypt(pn_ssl_t *ssl, char *app_data, size_t count)
{
// Get SChannel to encrypt exactly one Record.
@@ -732,6 +742,10 @@ static void client_handshake( pn_ssl_t*
ssl_failed(ssl, "unexpected final server token");
break;
}
+ if (const char *err = tls_version_check(ssl)) {
+ ssl_failed(ssl, err);
+ break;
+ }
if (token_buffs[1].BufferType == SECBUFFER_EXTRA &&
token_buffs[1].cbBuffer > 0) {
// This seems to work but not documented, plus logic differs from
decrypt message
// since the pvBuffer value is not set. Grrr.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
