0002-PROTON-1326-restore-anonymous-cyphers-by-lowering-Op.patch 2.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162
  1. From 8c54c62516671375de4068158ccaa0bc1dba0a4a Mon Sep 17 00:00:00 2001
  2. From: Cliff Jansen <cjansen@redhat.com>
  3. Date: Wed, 2 Aug 2017 16:34:39 -0700
  4. Subject: [PATCH] PROTON-1326: restore anonymous cyphers by lowering OpenSSL
  5. v1.1 security level just for the PN_SSL_ANONYMOUS_PEER verification mode
  6. Upstream: https://github.com/apache/qpid-proton/commit/8c54c62516671375de4068158ccaa0bc1dba0a4a
  7. Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
  8. ---
  9. proton-c/src/ssl/openssl.c | 14 ++++++++++++++
  10. 1 file changed, 14 insertions(+)
  11. diff --git a/proton-c/src/ssl/openssl.c b/proton-c/src/ssl/openssl.c
  12. index 8cb4e7b..f37cf49 100644
  13. --- a/proton-c/src/ssl/openssl.c
  14. +++ b/proton-c/src/ssl/openssl.c
  15. @@ -72,6 +72,9 @@ struct pn_ssl_domain_t {
  16. char *trusted_CAs;
  17. int ref_count;
  18. +#if OPENSSL_VERSION_NUMBER >= 0x10100000
  19. + int default_seclevel;
  20. +#endif
  21. pn_ssl_mode_t mode;
  22. pn_ssl_verify_mode_t verify_mode;
  23. @@ -524,6 +527,9 @@ pn_ssl_domain_t *pn_ssl_domain( pn_ssl_mode_t mode )
  24. // Mitigate the CRIME vulnerability
  25. SSL_CTX_set_options(domain->ctx, SSL_OP_NO_COMPRESSION);
  26. #endif
  27. +#if OPENSSL_VERSION_NUMBER >= 0x10100000
  28. + domain->default_seclevel = SSL_CTX_get_security_level(domain->ctx);
  29. +#endif
  30. // by default, allow anonymous ciphers so certificates are not required 'out of the box'
  31. if (!SSL_CTX_set_cipher_list( domain->ctx, CIPHERS_ANONYMOUS )) {
  32. @@ -647,6 +653,10 @@ int pn_ssl_domain_set_peer_authentication(pn_ssl_domain_t *domain,
  33. case PN_SSL_VERIFY_PEER:
  34. case PN_SSL_VERIFY_PEER_NAME:
  35. +#if OPENSSL_VERSION_NUMBER >= 0x10100000
  36. + SSL_CTX_set_security_level(domain->ctx, domain->default_seclevel);
  37. +#endif
  38. +
  39. if (!domain->has_ca_db) {
  40. pn_transport_logf(NULL, "Error: cannot verify peer without a trusted CA configured.\n"
  41. " Use pn_ssl_domain_set_trusted_ca_db()");
  42. @@ -685,6 +695,10 @@ int pn_ssl_domain_set_peer_authentication(pn_ssl_domain_t *domain,
  43. break;
  44. case PN_SSL_ANONYMOUS_PEER: // hippie free love mode... :)
  45. +#if OPENSSL_VERSION_NUMBER >= 0x10100000
  46. + // Must use lowest OpenSSL security level to enable anonymous ciphers.
  47. + SSL_CTX_set_security_level(domain->ctx, 0);
  48. +#endif
  49. SSL_CTX_set_verify( domain->ctx, SSL_VERIFY_NONE, NULL );
  50. break;
  51. --
  52. 1.9.1