Attachment 165516 Details for Bug 203693 – Disables flawed SSL protocols; disables the SSL option by default

[patch] Disables flawed SSL protocols; disables the SSL option by default

ftimes-2016-01-13-1250.diff (text/plain), 1.98 KB, created by klm on 2016-01-13 17:58:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: klm

Created: 2016-01-13 17:58:50 UTC

Size: 1.98 KB

patch

obsolete

>Index: Makefile
>===================================================================
>--- Makefile	(revision 406060)
>+++ Makefile	(working copy)
>@@ -53,7 +53,7 @@
> 			${WRKSRC}/tools/zipmap/zipmap
> 
> OPTIONS_DEFINE=		DBM_TOOLS DIG_TOOLS FILE_HOOKS HASHDIG_TOOLS MAP_TOOLS SSL XMAGIC
>-OPTIONS_DEFAULT=	DBM_TOOLS DIG_TOOLS FILE_HOOKS HASHDIG_TOOLS MAP_TOOLS SSL XMAGIC
>+OPTIONS_DEFAULT=	DBM_TOOLS DIG_TOOLS FILE_HOOKS HASHDIG_TOOLS MAP_TOOLS XMAGIC
> DBM_TOOLS_DESC=		Install DBM tools
> DIG_TOOLS_DESC=		Install dig tools
> FILE_HOOKS_DESC=	Include file hooks support
>Index: files/patch-src__ssl.c
>===================================================================
>--- files/patch-src__ssl.c	(revision 0)
>+++ files/patch-src__ssl.c	(working copy)
>@@ -0,0 +1,37 @@
>+diff -urN ftimes-3.11.0.old/src/ssl.c ftimes-3.11.0.new/src/ssl.c
>+--- src/ssl.c	2014-07-18 02:40:44.000000000 -0400
>++++ src/ssl.c	2016-01-13 11:13:51.513075930 -0500
>+@@ -251,7 +251,7 @@
>+    *
>+    *********************************************************************
>+    */
>+-  psProperties->psslCTX = SSL_CTX_new(SSLv3_client_method());
>++  psProperties->psslCTX = SSL_CTX_new(SSLv23_client_method());
>+   if (psProperties->psslCTX == NULL)
>+   {
>+     ERR_error_string(ERR_get_error(), acLocalError);
>+@@ -262,6 +262,24 @@
>+   /*-
>+    *********************************************************************
>+    *
>++   * Disable protocol versions that are no longer safe to use.
>++   *
>++   *********************************************************************
>++   */
>++  SSL_CTX_set_options
>++  (
>++    psProperties->psslCTX,
>++    (
>++        SSL_OP_NO_SSLv2
>++      | SSL_OP_NO_SSLv3
>++      | SSL_OP_NO_TLSv1
>++      | SSL_OP_NO_TLSv1_1
>++    )
>++  );
>++
>++  /*-
>++   *********************************************************************
>++   *
>+    * Setup SSL certificate verification. Load the bundled certificate
>+    * authorities file. A common name (CN) and a positive chain length
>+    * must be specified to activate PEER verification. If you want to

Actions: View | Diff

Attachments on bug 203693: 161902 | 165516 | 165525 | 165530 | 165621