diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/README.UPDATING | 11 | ||||
| -rw-r--r-- | src/src/tls-openssl.c | 11 |
2 files changed, 19 insertions, 3 deletions
diff --git a/src/README.UPDATING b/src/README.UPDATING index 6a820bc7c..d34dec1e1 100644 --- a/src/README.UPDATING +++ b/src/README.UPDATING @@ -43,6 +43,12 @@ Exim version 4.80 the message. No tool has been provided as we believe this is a rare occurence. + * For OpenSSL, SSLv2 is now disabled by default. (GnuTLS does not support + SSLv2). RFC 6176 prohibits SSLv2 and some informal surveys suggest no + actual usage. You can re-enable with the "openssl_options" Exim option, + in the main configuration section. Note that supporting SSLv2 exposes + you to ciphersuite downgrade attacks. + * With OpenSSL 1.0.1+, Exim now supports TLS 1.1 and TLS 1.2. If built against 1.0.1a then you will get a warning message and the "openssl_options" value will not parse "no_tlsv1_1": the value changes @@ -52,8 +58,9 @@ Exim version 4.80 "openssl_options" gains "no_tlsv1_1", "no_tlsv1_2" and "no_compression". COMPATIBILITY WARNING: The default value of "openssl_options" is no longer - "+dont_insert_empty_fragments". We default to unset. That old default was - grandfathered in from before openssl_options became a configuration option. + "+dont_insert_empty_fragments". We default to "+no_sslv2". + That old default was grandfathered in from before openssl_options became a + configuration option. Empty fragments are inserted by default through TLS1.0, to partially defend against certain attacks; TLS1.1+ change the protocol so that this is not needed. The DIEF SSL option was required for some old releases of mail diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c index 43b79634e..22c0730c3 100644 --- a/src/src/tls-openssl.c +++ b/src/src/tls-openssl.c @@ -744,7 +744,13 @@ list of available digests. */ EVP_add_digest(EVP_sha256()); #endif -/* Create a context */ +/* Create a context. +The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant +negotiation in the different methods; as far as I can tell, the only +*_{server,client}_method which allows negotiation is SSLv23, which exists even +when OpenSSL is built without SSLv2 support. +By disabling with openssl_options, we can let admins re-enable with the +existing knob. */ ctx = SSL_CTX_new((host == NULL)? SSLv23_server_method() : SSLv23_client_method()); @@ -1872,6 +1878,9 @@ BOOL adding, item_parsed; result = 0L; /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed * from default because it increases BEAST susceptibility. */ +#ifdef SSL_OP_NO_SSLv2 +result |= SSL_OP_NO_SSLv2; +#endif if (option_spec == NULL) { |