generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

New option to enable/disable connection to unpatched servers

Browse Source
This commit is contained in:
Dr. Stephen Henson
2009-12-16 20:34:20 +00:00
parent 593a6dbe19
commit ccc3df8c33
6 changed files with 24 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
CHANGES
View File

@@ -4,6 +4,11 @@
Changes between 0.9.8l (?) and 0.9.8m (?) [xx XXX xxxx] Changes between 0.9.8l (?) and 0.9.8m (?) [xx XXX xxxx]
*) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to
connect (but not renegotiate) with servers which do not support RI.
Until RI is more widely deployed this option is enabled by default.
[Steve Henson]
*) Add "missing" ssl ctrls to clear options and mode. *) Add "missing" ssl ctrls to clear options and mode.
[Steve Henson] [Steve Henson]

9
apps/s_client.c
View File

@@ -287,7 +287,7 @@ int MAIN(int, char **);
int MAIN(int argc, char **argv) int MAIN(int argc, char **argv)
{ {
int off=0; int off=0, clr = 0;
SSL *con=NULL,*con2=NULL; SSL *con=NULL,*con2=NULL;
X509_STORE *store = NULL; X509_STORE *store = NULL;
int s,k,width,state=0; int s,k,width,state=0;
@@ -539,6 +539,10 @@ int MAIN(int argc, char **argv)
off|=SSL_OP_CIPHER_SERVER_PREFERENCE; off|=SSL_OP_CIPHER_SERVER_PREFERENCE;
else if (strcmp(*argv,"-legacy_renegotiation") == 0) else if (strcmp(*argv,"-legacy_renegotiation") == 0)
off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION; off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
else if (strcmp(*argv,"-legacy_server_connect") == 0)
{ off|=SSL_OP_LEGACY_SERVER_CONNECT; }
else if (strcmp(*argv,"-no_legacy_server_connect") == 0)
{ clr|=SSL_OP_LEGACY_SERVER_CONNECT; }
else if (strcmp(*argv,"-cipher") == 0) else if (strcmp(*argv,"-cipher") == 0)
{ {
if (--argc < 1) goto bad; if (--argc < 1) goto bad;
@@ -713,6 +717,9 @@ bad:
SSL_CTX_set_options(ctx,SSL_OP_ALL|off); SSL_CTX_set_options(ctx,SSL_OP_ALL|off);
else else
SSL_CTX_set_options(ctx,off); SSL_CTX_set_options(ctx,off);
if (clr)
SSL_CTX_clear_options(ctx, clr);
/* DTLS: partial reads end up discarding unread UDP bytes :-( /* DTLS: partial reads end up discarding unread UDP bytes :-(
* Setting read ahead solves this problem. * Setting read ahead solves this problem.
*/ */

2
ssl/ssl.h
View File

@@ -485,6 +485,8 @@ typedef struct ssl_session_st
#define SSL_OP_MICROSOFT_SESS_ID_BUG 0x00000001L #define SSL_OP_MICROSOFT_SESS_ID_BUG 0x00000001L
#define SSL_OP_NETSCAPE_CHALLENGE_BUG 0x00000002L #define SSL_OP_NETSCAPE_CHALLENGE_BUG 0x00000002L
/* Allow initial connection to servers that don't support RI */
#define SSL_OP_LEGACY_SERVER_CONNECT 0x00000004L
#define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG 0x00000008L #define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG 0x00000008L
#define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG 0x00000010L #define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG 0x00000010L
#define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER 0x00000020L #define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER 0x00000020L

2
ssl/ssl3.h
View File

@@ -130,7 +130,9 @@ extern "C" {
#endif #endif
/* Magic Cipher Suite Value. NB: bogus value used for testing */ /* Magic Cipher Suite Value. NB: bogus value used for testing */
#ifndef SSL3_CK_MCSV
#define SSL3_CK_MCSV 0x03000FEC #define SSL3_CK_MCSV 0x03000FEC
#endif
#define SSL3_CK_RSA_NULL_MD5 0x03000001 #define SSL3_CK_RSA_NULL_MD5 0x03000001
#define SSL3_CK_RSA_NULL_SHA 0x03000002 #define SSL3_CK_RSA_NULL_SHA 0x03000002

4
ssl/ssl_lib.c
View File

@@ -1591,6 +1591,10 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
} }
#endif #endif
#endif #endif
/* Default is to connect to non-RI servers. When RI is more widely
* deployed might change this.
*/
ret->options = SSL_OP_LEGACY_SERVER_CONNECT;
return(ret); return(ret);
err: err:

5
ssl/t1_lib.c
View File

@@ -705,8 +705,9 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
* which doesn't support RI so for the immediate future tolerate RI * which doesn't support RI so for the immediate future tolerate RI
* absence on initial connect only. * absence on initial connect only.
*/ */
if (!renegotiate_seen && s->new_session && if (!renegotiate_seen &&
!(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) (s->new_session || !(s->options & SSL_OP_LEGACY_SERVER_CONNECT))
&& !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
{ {
/* FIXME: Spec currently doesn't give alert to use */ /* FIXME: Spec currently doesn't give alert to use */
*al = SSL_AD_ILLEGAL_PARAMETER; *al = SSL_AD_ILLEGAL_PARAMETER;