On 1/2/2015 3:46 AM, Dan Fandrich wrote:
On Fri, Jan 02, 2015 at 02:45:32AM -0500, Ray Satiro wrote:
CURL_SSLVERSION_SSLv3 is exclusively SSLv3 [1]. There is no longer a define for
SSLv3 or later. The default is now TLS 1.0 or later. I have attached a patch
that adds legacy support for CURL_SSLVERSION_SSLv3_OR_LATER to all backends; I
wonder if it's useful in your situation or anyone's?
I noticed some semantic differences between some of the back-ends with this
patch. For example, in axTLS and OpenSSL, if SSL3 cannot be set due to the
back-end version of configuration, there is no error returned.
That was intentional, CURL_SSLVERSION_SSLv3_OR_LATER is meant to mimic
the old default behavior, so none of them should fail if SSLv3 cannot be
used. As I noted in the doc changes:
--
SSLv3 is included when attempting to figure which minimum protocol
version to
use. This define has the same behavior as CURL_SSLVERSION_DEFAULT did in
versions prior to 7.39.0, except that the fallback implementation for buggy
SSLv3 servers (only used for NSS SSL) no longer exists.
There is also
another difference I noted (unrelated to your patch), namely that for some
back-ends some of the existing CURL_SSLVERSION_* options select not just one
specific SSL version but rather set the given version as a minimum instead.
This should be at minimum documented in the man page.
I looked into this and I only see the bug in PolarSSL. I've attached a
patch to fix the problem. Also I noticed gskit.c for exclusive SSLv3
uses CURL_GSKPROTO_SSLV2_MASK not CURL_GSKPROTO_SSLV3_MASK, so I've
attached a patch for that as well.
Also, a big no-no: this patch seems to enable SSLv2 for the Cyassl
back-end when the new option is used.
Well, no, it shouldn't do that. CyaSSL has logic very similar to OpenSSL
in that the protocol versions are set some time after the object has
been created. In the patch you'll see that after the handle is created I
set the minimum protocol version to SSLv3 if the CyaSSL version is >=
3.3.0, since SSLv3 is disabled by default >= 3.3.0. If the CyaSSL
version is <3.3.0 then SSLv3 is enabled by default, I thought... I also
thought SSLv2 was not enabled for SSLv23_client_method... but I will
follow up with the CyaSSL team to make sure we're covered in all use cases.
From c0ead608ccc131a0c76faaf01b69a9425080220b Mon Sep 17 00:00:00 2001
From: Jay Satiro <[email protected]>
Date: Fri, 2 Jan 2015 12:33:41 -0500
Subject: [PATCH] polarssl: Fix exclusive SSL protocol version options
Prior to this change the options for exclusive SSL protocol versions did
not actually set the protocol exclusive.
http://curl.haxx.se/mail/lib-2015-01/0002.html
Reported-by: Dan Fandrich
---
lib/vtls/polarssl.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/lib/vtls/polarssl.c b/lib/vtls/polarssl.c
index 05fcfc2..1ab1fdd 100644
--- a/lib/vtls/polarssl.c
+++ b/lib/vtls/polarssl.c
@@ -289,27 +289,36 @@ polarssl_connect_step1(struct connectdata *conn,
switch(data->set.ssl.version) {
default:
case CURL_SSLVERSION_DEFAULT:
+ case CURL_SSLVERSION_TLSv1:
ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3,
SSL_MINOR_VERSION_1);
break;
case CURL_SSLVERSION_SSLv3:
ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3,
SSL_MINOR_VERSION_0);
+ ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3,
+ SSL_MINOR_VERSION_0);
infof(data, "PolarSSL: Forced min. SSL Version to be SSLv3\n");
break;
case CURL_SSLVERSION_TLSv1_0:
ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3,
SSL_MINOR_VERSION_1);
+ ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3,
+ SSL_MINOR_VERSION_1);
infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.0\n");
break;
case CURL_SSLVERSION_TLSv1_1:
ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3,
SSL_MINOR_VERSION_2);
+ ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3,
+ SSL_MINOR_VERSION_2);
infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.1\n");
break;
case CURL_SSLVERSION_TLSv1_2:
ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3,
SSL_MINOR_VERSION_3);
+ ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3,
+ SSL_MINOR_VERSION_3);
infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.2\n");
break;
}
--
1.9.4.msysgit.2
From ef827381fe142c51d41be1361b40c2cfab9c4b62 Mon Sep 17 00:00:00 2001
From: Jay Satiro <[email protected]>
Date: Fri, 2 Jan 2015 12:37:45 -0500
Subject: [PATCH] gskit: Fix exclusive SSLv3 option
---
lib/vtls/gskit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/vtls/gskit.c b/lib/vtls/gskit.c
index ac05f05..9861f77 100644
--- a/lib/vtls/gskit.c
+++ b/lib/vtls/gskit.c
@@ -625,7 +625,7 @@ static CURLcode gskit_connect_step1(struct connectdata
*conn, int sockindex)
sni = (char *) NULL;
break;
case CURL_SSLVERSION_SSLv3:
- protoflags = CURL_GSKPROTO_SSLV2_MASK;
+ protoflags = CURL_GSKPROTO_SSLV3_MASK;
sni = (char *) NULL;
break;
case CURL_SSLVERSION_TLSv1:
--
1.9.4.msysgit.2
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
