From f44dff73bcd1e6c51091dd97baf5fb671b3be311 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Mon, 6 Feb 2012 22:25:04 +0100 Subject: [PATCH 2/3] --ssl-no-empty-fragments added This option tells curl to not send empty fragments over SSL in order to work around a security flaw in the SSL3 and TLS1.0 protocols. It uses the CURLOPT_SSL_NO_EMPTY_FRAGMENTS libcurl option for this. --- docs/curl.1 | 7 +++++++ src/tool_cfgable.h | 4 ++-- src/tool_getparam.c | 7 ++++++- src/tool_help.c | 3 ++- src/tool_operate.c | 4 ++++ 5 files changed, 21 insertions(+), 4 deletions(-) diff --git a/docs/curl.1 b/docs/curl.1 index e92cf51..d8ae06e 100644 --- a/docs/curl.1 +++ b/docs/curl.1 @@ -1258,6 +1258,13 @@ connection if the server doesn't support SSL/TLS. (Added in 7.20.0) This option was formerly known as \fI--ftp-ssl-reqd\fP (added in 7.15.5). That option name can still be used but will be removed in a future version. +.IP "--ssl-no-empty-fragments" +(SSL) This option tells curl to not send empty fragments over SSL in order to +work around a security flaw in the SSL3 and TLS1.0 protocols. If this option +isn't used, the SSL layer may use this work-around which is known to cause +interoperability problems with some older SSL implementations. WARNING: +avoiding this work-around loosens the security, and by using this flag you ask +for exactly that. (Added in 7.25.0) .IP "--socks4 " Use the specified SOCKS4 proxy. If the port number is not specified, it is assumed at port 1080. (Added in 7.15.2) diff --git a/src/tool_cfgable.h b/src/tool_cfgable.h index adbb446..1b27668 100644 --- a/src/tool_cfgable.h +++ b/src/tool_cfgable.h @@ -7,7 +7,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2011, Daniel Stenberg, , et al. + * Copyright (C) 1998 - 2012, Daniel Stenberg, , et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -195,7 +195,7 @@ struct Configurable { bool xattr; /* store metadata in extended attributes */ long gssapi_delegation; - + bool ssl_no_empty_frags; /* don't sent empty SSL fragments */ }; /* struct Configurable */ void free_config_fields(struct Configurable *config); diff --git a/src/tool_getparam.c b/src/tool_getparam.c index bd7375f..ab85107 100644 --- a/src/tool_getparam.c +++ b/src/tool_getparam.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2011, Daniel Stenberg, , et al. + * Copyright (C) 1998 - 2012, Daniel Stenberg, , et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -202,6 +202,7 @@ static const struct LongShort aliases[]= { {"Ek", "tlsuser", TRUE}, {"El", "tlspassword", TRUE}, {"Em", "tlsauthtype", TRUE}, + {"En", "ssl-no-empty-fragments", FALSE}, {"f", "fail", FALSE}, {"F", "form", TRUE}, {"Fs", "form-string", TRUE}, @@ -1144,6 +1145,10 @@ ParameterError getparameter(char *flag, /* f or -long-flag */ else return PARAM_LIBCURL_DOESNT_SUPPORT; break; + case 'n': /* no empty SSL fragments */ + if(curlinfo->features & CURL_VERSION_SSL) + config->ssl_no_empty_frags = toggle; + break; default: /* certificate file */ { char *ptr = strchr(nextarg, ':'); diff --git a/src/tool_help.c b/src/tool_help.c index 7c7d8d3..7c8fce5 100644 --- a/src/tool_help.c +++ b/src/tool_help.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2011, Daniel Stenberg, , et al. + * Copyright (C) 1998 - 2012, Daniel Stenberg, , et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -187,6 +187,7 @@ static const char *const helptext[] = { " --ssl-reqd Require SSL/TLS (FTP, IMAP, POP3, SMTP)", " -2, --sslv2 Use SSLv2 (SSL)", " -3, --sslv3 Use SSLv3 (SSL)", + " --ssl-no-empty-fragments Disable empty fragments work-around (SSL)", " --stderr FILE Where to redirect stderr. - means stdout", " --tcp-nodelay Use the TCP_NODELAY option", " -t, --telnet-option OPT=VAL Set telnet option", diff --git a/src/tool_operate.c b/src/tool_operate.c index d086ac5..f92297c 100644 --- a/src/tool_operate.c +++ b/src/tool_operate.c @@ -1204,6 +1204,10 @@ int operate(struct Configurable *config, int argc, argv_item_t argv[]) my_setopt_str(curl, CURLOPT_GSSAPI_DELEGATION, config->gssapi_delegation); + /* new in 7.25.0 */ + if(config->ssl_no_empty_frags) + my_setopt(curl, CURLOPT_SSL_NO_EMPTY_FRAGMENTS, 1L); + /* initialize retry vars for loop below */ retry_sleep_default = (config->retry_delay) ? config->retry_delay*1000L : RETRY_SLEEP_DEFAULT; /* ms */ -- 1.7.9