Codebase list openssl / c6c9f88
Avoid errors with a priori inapplicable protocol bounds The 'MinProtocol' and 'MaxProtocol' configuration commands now silently ignore TLS protocol version bounds when configurign DTLS-based contexts, and conversely, silently ignore DTLS protocol version bounds when configuring TLS-based contexts. The commands can be repeated to set bounds of both types. The same applies with the corresponding "min_protocol" and "max_protocol" command-line switches, in case some application uses both TLS and DTLS. SSL_CTX instances that are created for a fixed protocol version (e.g. TLSv1_server_method()) also silently ignore version bounds. Previously attempts to apply bounds to these protocol versions would result in an error. Now only the "version-flexible" SSL_CTX instances are subject to limits in configuration files in command-line options. Expected to resolve #12394 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> GH: #12507 Viktor Dukhovni 3 years ago
5 changed file(s) with 70 addition(s) and 30 deletion(s). Raw diff Collapse all Expand all
+15
-0
CHANGES less more
77 release branch.
88
99 Changes between 1.1.1g and 1.1.1h [xx XXX xxxx]
10
11 *) The 'MinProtocol' and 'MaxProtocol' configuration commands now silently
12 ignore TLS protocol version bounds when configuring DTLS-based contexts, and
13 conversely, silently ignore DTLS protocol version bounds when configuring
14 TLS-based contexts. The commands can be repeated to set bounds of both
15 types. The same applies with the corresponding "min_protocol" and
16 "max_protocol" command-line switches, in case some application uses both TLS
17 and DTLS.
18
19 SSL_CTX instances that are created for a fixed protocol version (e.g.
20 TLSv1_server_method()) also silently ignore version bounds. Previously
21 attempts to apply bounds to these protocol versions would result in an
22 error. Now only the "version-flexible" SSL_CTX instances are subject to
23 limits in configuration files in command-line options.
24 [Viktor Dukhovni]
1025
1126 *) Handshake now fails if Extended Master Secret extension is dropped
1227 on renegotiation.
+20
-9
doc/man3/SSL_CONF_cmd.pod less more
146146 =item B<-min_protocol>, B<-max_protocol>
147147
148148 Sets the minimum and maximum supported protocol.
149 Currently supported protocol values are B<SSLv3>, B<TLSv1>,
150 B<TLSv1.1>, B<TLSv1.2>, B<TLSv1.3> for TLS and B<DTLSv1>, B<DTLSv1.2> for DTLS,
151 and B<None> for no limit.
152 If either bound is not specified then only the other bound applies,
153 if specified.
154 To restrict the supported protocol versions use these commands rather
155 than the deprecated alternative commands below.
149 Currently supported protocol values are B<SSLv3>, B<TLSv1>, B<TLSv1.1>,
150 B<TLSv1.2>, B<TLSv1.3> for TLS; B<DTLSv1>, B<DTLSv1.2> for DTLS, and B<None>
151 for no limit.
152 If either the lower or upper bound is not specified then only the other bound
153 applies, if specified.
154 If your application supports both TLS and DTLS you can specify any of these
155 options twice, once with a bound for TLS and again with an appropriate bound
156 for DTLS.
157 To restrict the supported protocol versions use these commands rather than the
158 deprecated alternative commands below.
156159
157160 =item B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>, B<-no_tls1_3>
158161
369372
370373 Currently supported protocol values are B<SSLv3>, B<TLSv1>, B<TLSv1.1>,
371374 B<TLSv1.2>, B<TLSv1.3>, B<DTLSv1> and B<DTLSv1.2>.
372 The value B<None> will disable the limit.
375 The SSL and TLS bounds apply only to TLS-based contexts, while the DTLS bounds
376 apply only to DTLS-based contexts.
377 The command can be repeated with one instance setting a TLS bound, and the
378 other setting a DTLS bound.
379 The value B<None> applies to both types of contexts and disables the limits.
373380
374381 =item B<MaxProtocol>
375382
377384
378385 Currently supported protocol values are B<SSLv3>, B<TLSv1>, B<TLSv1.1>,
379386 B<TLSv1.2>, B<TLSv1.3>, B<DTLSv1> and B<DTLSv1.2>.
380 The value B<None> will disable the limit.
387 The SSL and TLS bounds apply only to TLS-based contexts, while the DTLS bounds
388 apply only to DTLS-based contexts.
389 The command can be repeated with one instance setting a TLS bound, and the
390 other setting a DTLS bound.
391 The value B<None> applies to both types of contexts and disables the limits.
381392
382393 =item B<Protocol>
383394
+9
-6
doc/man5/config.pod less more
261261 ssl_conf = ssl_sect
262262
263263 [ssl_sect]
264
265264 system_default = system_default_sect
266265
267266 [system_default_sect]
268
269267 MinProtocol = TLSv1.2
270
268 MinProtocol = DTLSv1.2
271269
272270 =head1 NOTES
273271
354352 Note: in the above example you will get an error in non FIPS capable versions
355353 of OpenSSL.
356354
357 Simple OpenSSL library configuration to make TLS 1.3 the system-default
358 minimum TLS version:
355 Simple OpenSSL library configuration to make TLS 1.2 and DTLS 1.2 the
356 system-default minimum TLS and DTLS versions, respectively:
359357
360358 # Toplevel section for openssl (including libssl)
361359 openssl_conf = default_conf_section
368366 system_default = system_default_section
369367
370368 [system_default_section]
371 MinProtocol = TLSv1.3
369 MinProtocol = TLSv1.2
370 MinProtocol = DTLSv1.2
371
372 The minimum TLS protocol is applied to B<SSL_CTX> objects that are TLS-based,
373 and the minimum DTLS protocol to those are DTLS-based.
374 The same applies also to maximum versions set with B<MaxProtocol>.
372375
373376 More complex OpenSSL library configuration. Add OID and don't enter FIPS mode:
374377
+7
-0
ssl/ssl_conf.c less more
304304 const char *name;
305305 int version;
306306 };
307 /*
308 * Note: To avoid breaking previously valid configurations, we must retain
309 * legacy entries in this table even if the underlying protocol is no
310 * longer supported. This also means that the constants SSL3_VERSION, ...
311 * need to be retained indefinitely. This table can only grow, never
312 * shrink.
313 */
307314 static const struct protocol_versions versions[] = {
308315 {"None", 0},
309316 {"SSLv3", SSL3_VERSION},
+19
-15
ssl/statem/statem_lib.c less more
16551655 */
16561656 int ssl_set_version_bound(int method_version, int version, int *bound)
16571657 {
1658 int valid_tls;
1659 int valid_dtls;
1660
16581661 if (version == 0) {
16591662 *bound = version;
16601663 return 1;
16611664 }
1665
1666 valid_tls = version >= SSL3_VERSION && version <= TLS_MAX_VERSION;
1667 valid_dtls =
1668 DTLS_VERSION_LE(version, DTLS_MAX_VERSION) &&
1669 DTLS_VERSION_GE(version, DTLS1_BAD_VER);
1670
1671 if (!valid_tls && !valid_dtls)
1672 return 0;
16621673
16631674 /*-
16641675 * Restrict TLS methods to TLS protocol versions.
16701681 * configurations. If the MIN (supported) version ever rises, the user's
16711682 * "floor" remains valid even if no longer available. We don't expect the
16721683 * MAX ceiling to ever get lower, so making that variable makes sense.
1684 *
1685 * We ignore attempts to set bounds on version-inflexible methods,
1686 * returning success.
16731687 */
16741688 switch (method_version) {
16751689 default:
1676 /*
1677 * XXX For fixed version methods, should we always fail and not set any
1678 * bounds, always succeed and not set any bounds, or set the bounds and
1679 * arrange to fail later if they are not met? At present fixed-version
1680 * methods are not subject to controls that disable individual protocol
1681 * versions.
1682 */
1683 return 0;
1690 break;
16841691
16851692 case TLS_ANY_VERSION:
1686 if (version < SSL3_VERSION || version > TLS_MAX_VERSION)
1687 return 0;
1693 if (valid_tls)
1694 *bound = version;
16881695 break;
16891696
16901697 case DTLS_ANY_VERSION:
1691 if (DTLS_VERSION_GT(version, DTLS_MAX_VERSION) ||
1692 DTLS_VERSION_LT(version, DTLS1_BAD_VER))
1693 return 0;
1698 if (valid_dtls)
1699 *bound = version;
16941700 break;
16951701 }
1696
1697 *bound = version;
16981702 return 1;
16991703 }
17001704