From f4c3cb5c8a877a577be3d13be31e67932e4599b9 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Mon, 6 Feb 2012 22:12:06 +0100 Subject: [PATCH 1/3] CURLOPT_SSL_NO_EMPTY_FRAGMENTS: added Tell libcurl to not send empty fragments over SSL in order to work around a security flaw in the SSL3 and TLS1.0 protocol versions. This is a reaction to us removing that behavior after this security advisory: http://curl.haxx.se/docs/adv_20120124B.html ... it did however cause a lot of programs to fail because of old servers not liking this work-around. Now programs can opt to decrease the security in order to interoperate with old servers better. --- docs/libcurl/curl_easy_setopt.3 | 7 +++++++ include/curl/curl.h | 4 ++++ lib/ssluse.c | 5 ++++- lib/url.c | 5 +++++ lib/urldata.h | 1 + 5 files changed, 21 insertions(+), 1 deletions(-) diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3 index d94a84b..288e417 100644 --- a/docs/libcurl/curl_easy_setopt.3 +++ b/docs/libcurl/curl_easy_setopt.3 @@ -2295,6 +2295,13 @@ this to 1 to enable it. By default all transfers are done using the cache. While nothing ever should get hurt by attempting to reuse SSL session-IDs, there seem to be broken SSL implementations in the wild that may require you to disable this in order for you to succeed. (Added in 7.16.0) +.IP CURLOPT_SSL_NO_EMPTY_FRAGMENTS +Pass a long set to 1 to tell libcurl to not send empty fragments over SSL in +order to work around a security flaw in the SSL3 and TLS1.0 protocols. If +this option isn't used or set to 0, the SSL layer libcurl uses may use this +work-around which is known to cause interoperability problem with some (older) +SSL implementations. WARNING: avoiding this work-around loosens the security, +and by setting this option to 1 you ask for exactly that. (Added in 7.25.0) .IP CURLOPT_KRBLEVEL Pass a char * as parameter. Set the kerberos security level for FTP; this also enables kerberos awareness. This is a string, \&'clear', \&'safe', diff --git a/include/curl/curl.h b/include/curl/curl.h index 59a5c79..cc81edc 100644 --- a/include/curl/curl.h +++ b/include/curl/curl.h @@ -1499,6 +1499,10 @@ typedef enum { of miliseconds. */ CINIT(ACCEPTTIMEOUT_MS, LONG, 212), + /* Switch off the empty-fragments work-around with SSLv3/TLSv1.0 for those + SSL libraries that use it (like OpenSSL) */ + CINIT(SSL_NO_EMPTY_FRAGMENTS, LONG, 213), + CURLOPT_LASTENTRY /* the last unused */ } CURLoption; diff --git a/lib/ssluse.c b/lib/ssluse.c index 014d5b5..710f08e 100644 --- a/lib/ssluse.c +++ b/lib/ssluse.c @@ -1566,7 +1566,10 @@ ossl_connect_step1(struct connectdata *conn, #endif #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS - ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; + /* unless explicitly asked to not insert empty fragments, keep that + work-around enabled */ + if(!conn->data->set.ssl_no_empty_frags) + ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; #endif /* disable SSLv2 in the default case (i.e. allow SSLv3 and TLSv1) */ diff --git a/lib/url.c b/lib/url.c index 466748b..e7e9d83 100644 --- a/lib/url.c +++ b/lib/url.c @@ -2175,6 +2175,11 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option, */ data->set.use_ssl = (curl_usessl)va_arg(param, long); break; + + case CURLOPT_SSL_NO_EMPTY_FRAGMENTS: + data->set.ssl_no_empty_frags = va_arg(param, long)?TRUE:FALSE; + break; + #endif case CURLOPT_FTPSSLAUTH: /* diff --git a/lib/urldata.h b/lib/urldata.h index adabf5b..ec6f2e7 100644 --- a/lib/urldata.h +++ b/lib/urldata.h @@ -1508,6 +1508,7 @@ struct UserDefined { bool ftp_skip_ip; /* skip the IP address the FTP server passes on to us */ bool connect_only; /* make connection, let application use the socket */ + bool ssl_no_empty_frags; /* don't send empty SSL fragments */ long ssh_auth_types; /* allowed SSH auth types */ bool http_te_skip; /* pass the raw body data to the user, even when transfer-encoded (chunked, compressed) */ -- 1.7.9