mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-02-05 18:05:16 +00:00
Code Issues Releases Activity

As pointed out by several people, r273114 was incorrect: it unconditionally

Browse Source 
disabled everything except TLS 1.0.  Replace it with a more carefully
wrought patch:

 - Switch the default for SSLv3 from on to off
 - Add environment variables to control TLS 1.1 and 1.2
 - In verbose mode, report which version is used
 - Update the man page to reflect these changes.

MFC after:	1 week
This commit is contained in:
Dag-Erling Smørgrav 2014-10-15 07:35:50 +00:00
parent 45c3925d9d
commit 767207650c
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=273124
2 changed files with 25 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
lib/libfetch/common.c
View File

@ -675,10 +675,14 @@ fetch_ssl_setup_transport_layer(SSL_CTX *ctx, int verbose)
ssl_ctx_options = SSL_OP_ALL | SSL_OP_NO_TICKET;
if (getenv("SSL_ALLOW_SSL2") == NULL)
ssl_ctx_options |= SSL_OP_NO_SSLv2;
if (getenv("SSL_NO_SSL3") != NULL)
if (getenv("SSL_ALLOW_SSL3") == NULL)
ssl_ctx_options |= SSL_OP_NO_SSLv3;
if (getenv("SSL_NO_TLS1") != NULL)
ssl_ctx_options |= SSL_OP_NO_TLSv1;
if (getenv("SSL_NO_TLS1_1") != NULL)
ssl_ctx_options |= SSL_OP_NO_TLSv1_1;
if (getenv("SSL_NO_TLS1_2") != NULL)
ssl_ctx_options |= SSL_OP_NO_TLSv1_2;
if (verbose)
fetch_info("SSL options: %lx", ssl_ctx_options);
SSL_CTX_set_options(ctx, ssl_ctx_options);
@ -820,7 +824,7 @@ fetch_ssl(conn_t *conn, const struct url *URL, int verbose)
SSL_load_error_strings();
conn->ssl_meth = TLSv1_client_method();
conn->ssl_meth = SSLv23_client_method();
conn->ssl_ctx = SSL_CTX_new(conn->ssl_meth);
SSL_CTX_set_mode(conn->ssl_ctx, SSL_MODE_AUTO_RETRY);
@ -873,8 +877,8 @@ fetch_ssl(conn_t *conn, const struct url *URL, int verbose)
}
if (verbose) {
fetch_info("SSL connection established using %s",
SSL_get_cipher(conn->ssl));
fetch_info("%s connection established using %s",
SSL_get_version(conn->ssl), SSL_get_cipher(conn->ssl));
name = X509_get_subject_name(conn->ssl_cert);
str = X509_NAME_oneline(name, 0, 0);
fetch_info("Certificate subject: %s", str);

28
lib/libfetch/fetch.3
View File

@ -26,7 +26,7 @@
.\"
.\" $FreeBSD$
.\"
.Dd July 30, 2013
.Dd October 15, 2014
.Dt FETCH 3
.Os
.Sh NAME
@ -438,15 +438,17 @@ input (see
.Pp
By default
.Nm libfetch
allows SSLv3 and TLSv1 when negotiating the connecting with the remote
allows TLSv1 and newer when negotiating the connecting with the remote
peer.
You can change this behavior by setting the environment variable
You can change this behavior by setting the
.Ev SSL_ALLOW_SSL2
to allow SSLv2 (not recommended) and
.Ev SSL_NO_SSL3
or
.Ev SSL_NO_TLS1
to disable the respective methods.
and
.Ev SSL_ALLOW_SSL3
environment variables to allow SSLv2 and SSLv3, respectively, and
.Ev SSL_NO_TLS1 ,
.Ev SSL_NO_TLS1_1 and
.Ev SSL_NO_TLS1_2
to disable TLS 1.0, 1.1 and 1.2 respectively.
.Sh AUTHENTICATION
Apart from setting the appropriate environment variables and
specifying the user name and password in the URL or the
@ -646,6 +648,8 @@ Same as
for compatibility.
.It Ev SSL_ALLOW_SSL2
Allow SSL version 2 when negotiating the connection (not recommended).
.It Ev SSL_ALLOW_SSL3
Allow SSL version 3 when negotiating the connection (not recommended).
.It Ev SSL_CA_CERT_FILE
CA certificate bundle containing trusted CA certificates.
Default value:
@ -660,10 +664,12 @@ PEM encoded client key in case key and client certificate
are stored separately.
.It Ev SSL_CRL_FILE
File containing certificate revocation list.
.It Ev SSL_NO_SSL3
Don't allow SSL version 3 when negotiating the connection.
.It Ev SSL_NO_TLS1
Don't allow TLV version 1 when negotiating the connection.
Do not allow TLS version 1.0 when negotiating the connection.
.It Ev SSL_NO_TLS1_1
Do not allow TLS version 1.1 when negotiating the connection.
.It Ev SSL_NO_TLS1_2
Do not allow TLS version 1.2 when negotiating the connection.
.It Ev SSL_NO_VERIFY_HOSTNAME
If set, do not verify that the hostname matches the subject of the
certificate presented by the server.