|
 |
918fdf2 |
From: Sergei Golovan <sgolovan@debian.org>
|
|
|
918fdf2 |
Date: Sun, 30 Nov 2014 20:20:41 +0300
|
|
|
918fdf2 |
Subject: [PATCH] Patch removes support for SSLv3 protocol because it is proved
|
|
|
918fdf2 |
to be insecure and nobody should use it anymore.
|
|
|
918fdf2 |
|
|
|
918fdf2 |
|
|
|
918fdf2 |
diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml
|
|
|
2893cc5 |
index b53344e..b245621 100644
|
|
|
918fdf2 |
--- a/lib/ssl/doc/src/ssl.xml
|
|
|
918fdf2 |
+++ b/lib/ssl/doc/src/ssl.xml
|
|
|
918fdf2 |
@@ -123,7 +123,7 @@
|
|
|
918fdf2 |
|
|
|
918fdf2 |
<c>sslsocket() - opaque to the user. </c>
|
|
|
918fdf2 |
|
|
|
918fdf2 |
- <c>protocol() = sslv3 | tlsv1 | 'tlsv1.1' | 'tlsv1.2' </c>
|
|
|
918fdf2 |
+ <c>protocol() = tlsv1 | 'tlsv1.1' | 'tlsv1.2' </c>
|
|
|
918fdf2 |
|
|
|
918fdf2 |
<c>ciphers() = [ciphersuite()] | string() (according to old API)</c>
|
|
|
918fdf2 |
|
|
|
918fdf2 |
diff --git a/lib/ssl/doc/src/ssl_app.xml b/lib/ssl/doc/src/ssl_app.xml
|
|
|
918fdf2 |
index 43cb393..ff12e04 100644
|
|
|
918fdf2 |
--- a/lib/ssl/doc/src/ssl_app.xml
|
|
|
918fdf2 |
+++ b/lib/ssl/doc/src/ssl_app.xml
|
|
|
918fdf2 |
@@ -47,10 +47,10 @@
|
|
|
918fdf2 |
|
|
|
918fdf2 |
Note that the environment parameters can be set on the command line,
|
|
|
918fdf2 |
for instance,
|
|
|
918fdf2 |
- <c>erl ... -ssl protocol_version '[sslv3, tlsv1]' ...</c>.
|
|
|
918fdf2 |
+ <c>erl ... -ssl protocol_version '[tlsv1.1, tlsv1]' ...</c>.
|
|
|
918fdf2 |
|
|
|
918fdf2 |
<taglist>
|
|
|
918fdf2 |
- <tag><c>]]></c>.</tag>
|
|
|
918fdf2 |
+ <tag><c>]]></c>.</tag>
|
|
|
918fdf2 |
<item>
|
|
|
918fdf2 |
Protocol that will be supported by started clients and
|
|
|
918fdf2 |
servers. If this option is not set it will default to all
|
|
|
918fdf2 |
@@ -58,6 +58,9 @@
|
|
|
918fdf2 |
Note that this option may be overridden by the version option
|
|
|
918fdf2 |
to ssl:connect/[2,3] and ssl:listen/2.
|
|
|
918fdf2 |
|
|
|
918fdf2 |
+ For Debian GNU/Linux distribution the sslv3 protocol was
|
|
|
918fdf2 |
+ disabled due to its security issues.
|
|
|
918fdf2 |
+
|
|
|
918fdf2 |
</item>
|
|
|
918fdf2 |
|
|
|
918fdf2 |
<tag><c>]]></c></tag>
|
|
|
918fdf2 |
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
|
|
|
2893cc5 |
index 75efb64..155fa81 100644
|
|
|
918fdf2 |
--- a/lib/ssl/src/ssl_internal.hrl
|
|
|
918fdf2 |
+++ b/lib/ssl/src/ssl_internal.hrl
|
|
|
2893cc5 |
@@ -67,8 +67,8 @@
|
|
|
918fdf2 |
-define(TRUE, 0).
|
|
|
918fdf2 |
-define(FALSE, 1).
|
|
|
918fdf2 |
|
|
|
918fdf2 |
--define(ALL_SUPPORTED_VERSIONS, ['tlsv1.2', 'tlsv1.1', tlsv1, sslv3]).
|
|
|
918fdf2 |
--define(MIN_SUPPORTED_VERSIONS, ['tlsv1.1', tlsv1, sslv3]).
|
|
|
918fdf2 |
+-define(ALL_SUPPORTED_VERSIONS, ['tlsv1.2', 'tlsv1.1', tlsv1]).
|
|
|
918fdf2 |
+-define(MIN_SUPPORTED_VERSIONS, ['tlsv1.1', tlsv1]).
|
|
|
918fdf2 |
-define(ALL_DATAGRAM_SUPPORTED_VERSIONS, ['dtlsv1.2', dtlsv1]).
|
|
|
918fdf2 |
-define(MIN_DATAGRAM_SUPPORTED_VERSIONS, ['dtlsv1.2', dtlsv1]).
|
|
|
918fdf2 |
|
|
|
918fdf2 |
diff --git a/lib/ssl/src/ssl_record.hrl b/lib/ssl/src/ssl_record.hrl
|
|
|
918fdf2 |
index 6aab35d..1511abd 100644
|
|
|
918fdf2 |
--- a/lib/ssl/src/ssl_record.hrl
|
|
|
918fdf2 |
+++ b/lib/ssl/src/ssl_record.hrl
|
|
|
918fdf2 |
@@ -144,6 +144,7 @@
|
|
|
918fdf2 |
%% }).
|
|
|
918fdf2 |
|
|
|
918fdf2 |
-define(LOWEST_MAJOR_SUPPORTED_VERSION, 3).
|
|
|
918fdf2 |
+-define(LOWEST_MINOR_SUPPORTED_VERSION, 1).
|
|
|
918fdf2 |
|
|
|
918fdf2 |
|
|
|
918fdf2 |
-record(generic_stream_cipher, {
|
|
|
918fdf2 |
diff --git a/lib/ssl/src/tls_record.erl b/lib/ssl/src/tls_record.erl
|
|
|
918fdf2 |
index f50ea22..aa4fc8d 100644
|
|
|
918fdf2 |
--- a/lib/ssl/src/tls_record.erl
|
|
|
918fdf2 |
+++ b/lib/ssl/src/tls_record.erl
|
|
|
918fdf2 |
@@ -276,14 +276,20 @@ supported_protocol_versions([_|_] = Vsns) ->
|
|
|
918fdf2 |
%%--------------------------------------------------------------------
|
|
|
918fdf2 |
-spec is_acceptable_version(tls_version()) -> boolean().
|
|
|
918fdf2 |
is_acceptable_version({N,_})
|
|
|
918fdf2 |
- when N >= ?LOWEST_MAJOR_SUPPORTED_VERSION ->
|
|
|
918fdf2 |
+ when N > ?LOWEST_MAJOR_SUPPORTED_VERSION ->
|
|
|
918fdf2 |
+ true;
|
|
|
918fdf2 |
+is_acceptable_version({N,M})
|
|
|
918fdf2 |
+ when N == ?LOWEST_MAJOR_SUPPORTED_VERSION andalso M >= ?LOWEST_MINOR_SUPPORTED_VERSION ->
|
|
|
918fdf2 |
true;
|
|
|
918fdf2 |
is_acceptable_version(_) ->
|
|
|
918fdf2 |
false.
|
|
|
918fdf2 |
|
|
|
918fdf2 |
-spec is_acceptable_version(tls_version(), Supported :: [tls_version()]) -> boolean().
|
|
|
918fdf2 |
is_acceptable_version({N,_} = Version, Versions)
|
|
|
918fdf2 |
- when N >= ?LOWEST_MAJOR_SUPPORTED_VERSION ->
|
|
|
918fdf2 |
+ when N > ?LOWEST_MAJOR_SUPPORTED_VERSION ->
|
|
|
918fdf2 |
+ lists:member(Version, Versions);
|
|
|
918fdf2 |
+is_acceptable_version({N,M} = Version, Versions)
|
|
|
918fdf2 |
+ when N == ?LOWEST_MAJOR_SUPPORTED_VERSION andalso M >= ?LOWEST_MINOR_SUPPORTED_VERSION ->
|
|
|
918fdf2 |
lists:member(Version, Versions);
|
|
|
918fdf2 |
is_acceptable_version(_,_) ->
|
|
|
918fdf2 |
false.
|