VirtualBox

Ignore:
Timestamp:
Mar 3, 2022 7:17:34 PM (3 years ago)
Author:
vboxsync
svn:sync-xref-src-repo-rev:
150325
Message:

libs/openssl-3.0.1: started applying and adjusting our OpenSSL changes to 3.0.1. bugref:10128

Location:
trunk/src/libs/openssl-3.0.1
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/libs/openssl-3.0.1

    • Property svn:mergeinfo

      •  

        old new  
        1212/vendor/openssl/1.1.1c:131722-131725
        1313/vendor/openssl/1.1.1k:145841-145843
         14/vendor/openssl/3.0.1:150323-150324
         15/vendor/openssl/current:147554-150322

  • trunk/src/libs/openssl-3.0.1/doc/man3/SSL_CTX_set_options.pod

    r91772 r94082  
    1111 #include <openssl/ssl.h>
    1212
    13  long SSL_CTX_set_options(SSL_CTX *ctx, long options);
    14  long SSL_set_options(SSL *ssl, long options);
    15 
    16  long SSL_CTX_clear_options(SSL_CTX *ctx, long options);
    17  long SSL_clear_options(SSL *ssl, long options);
    18 
    19  long SSL_CTX_get_options(SSL_CTX *ctx);
    20  long SSL_get_options(SSL *ssl);
     13 uint64_t SSL_CTX_set_options(SSL_CTX *ctx, uint64_t options);
     14 uint64_t SSL_set_options(SSL *ssl, uint64_t options);
     15
     16 uint64_t SSL_CTX_clear_options(SSL_CTX *ctx, uint64_t options);
     17 uint64_t SSL_clear_options(SSL *ssl, uint64_t options);
     18
     19 uint64_t SSL_CTX_get_options(const SSL_CTX *ctx);
     20 uint64_t SSL_get_options(const SSL *ssl);
    2121
    2222 long SSL_get_secure_renegotiation_support(SSL *ssl);
    … …  
    2424=head1 DESCRIPTION
    2525
    26 SSL_CTX_set_options() adds the options set via bit mask in B<options> to B<ctx>.
     26SSL_CTX_set_options() adds the options set via bit-mask in B<options> to B<ctx>.
    2727Options already set before are not cleared!
    2828
    29 SSL_set_options() adds the options set via bit mask in B<options> to B<ssl>.
     29SSL_set_options() adds the options set via bit-mask in B<options> to B<ssl>.
    3030Options already set before are not cleared!
    3131
    32 SSL_CTX_clear_options() clears the options set via bit mask in B<options>
     32SSL_CTX_clear_options() clears the options set via bit-mask in B<options>
    3333to B<ctx>.
    3434
    35 SSL_clear_options() clears the options set via bit mask in B<options> to B<ssl>.
     35SSL_clear_options() clears the options set via bit-mask in B<options> to B<ssl>.
    3636
    3737SSL_CTX_get_options() returns the options set for B<ctx>.
    … …  
    4646
    4747The behaviour of the SSL library can be changed by setting several options.
    48 The options are coded as bit masks and can be combined by a bitwise B<or>
     48The options are coded as bit-masks and can be combined by a bitwise B<or>
    4949operation (|).
    5050
    … …  
    6363=over 4
    6464
    65 =item SSL_OP_SAFARI_ECDHE_ECDSA_BUG
    66 
    67 Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X.
    68 OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
     65=item SSL_OP_CRYPTOPRO_TLSEXT_BUG
     66
     67Add server-hello extension from the early version of cryptopro draft
     68when GOST ciphersuite is negotiated. Required for interoperability with CryptoPro
     69CSP 3.x.
    6970
    7071=item SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
    … …  
    7576using other ciphers.
    7677
     78=item SSL_OP_SAFARI_ECDHE_ECDSA_BUG
     79
     80Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X.
     81OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
     82
    7783=item SSL_OP_TLSEXT_PADDING
    7884
    … …  
    8389=item SSL_OP_ALL
    8490
    85 All of the above bug workarounds plus B<SSL_OP_LEGACY_SERVER_CONNECT> as
    86 mentioned below.
     91All of the above bug workarounds.
    8792
    8893=back
    … …  
    96101=over 4
    97102
    98 =item SSL_OP_TLS_ROLLBACK_BUG
    99 
    100 Disable version rollback attack detection.
    101 
    102 During the client key exchange, the client must send the same information
    103 about acceptable SSL/TLS protocol levels as during the first hello. Some
    104 clients violate this rule by adapting to the server's answer. (Example:
    105 the client sends a SSLv2 hello and accepts up to SSLv3.1=TLSv1, the server
    106 only understands up to SSLv3. In this case the client must still use the
    107 same SSLv3.1=TLSv1 announcement. Some clients step down to SSLv3 with respect
    108 to the server's answer and violate the version rollback protection.)
     103=item SSL_OP_ALLOW_CLIENT_RENEGOTIATION
     104
     105Client-initiated renegotiation is disabled by default. Use
     106this option to enable it.
     107
     108=item SSL_OP_ALLOW_NO_DHE_KEX
     109
     110In TLSv1.3 allow a non-(ec)dhe based key exchange mode on resumption. This means
     111that there will be no forward secrecy for the resumed session.
     112
     113=item SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
     114
     115Allow legacy insecure renegotiation between OpenSSL and unpatched clients or
     116servers. See the B<SECURE RENEGOTIATION> section for more details.
    109117
    110118=item SSL_OP_CIPHER_SERVER_PREFERENCE
    … …  
    114122preferences. When set, the SSL/TLS server will choose following its
    115123own preferences.
     124
     125=item SSL_OP_CISCO_ANYCONNECT
     126
     127Use Cisco's version identifier of DTLS_BAD_VER when establishing a DTLSv1
     128connection. Only available when using the deprecated DTLSv1_client_method() API.
     129
     130=item SSL_OP_CLEANSE_PLAINTEXT
     131
     132By default TLS connections keep a copy of received plaintext
     133application data in a static buffer until it is overwritten by the
     134next portion of data. When enabling SSL_OP_CLEANSE_PLAINTEXT
     135deciphered application data is cleansed by calling OPENSSL_cleanse(3)
     136after passing data to the application. Data is also cleansed when
     137releasing the connection (e.g. L<SSL_free(3)>).
     138
     139Since OpenSSL only cleanses internal buffers, the application is still
     140responsible for cleansing all other buffers. Most notably, this
     141applies to buffers passed to functions like L<SSL_read(3)>,
     142L<SSL_peek(3)> but also like L<SSL_write(3)>.
     143
     144=item SSL_OP_COOKIE_EXCHANGE
     145
     146Turn on Cookie Exchange as described in RFC4347 Section 4.2.1. Only affects
     147DTLS connections.
     148
     149=item SSL_OP_DISABLE_TLSEXT_CA_NAMES
     150
     151Disable TLS Extension CA Names. You may want to disable it for security reasons
     152or for compatibility with some Windows TLS implementations crashing when this
     153extension is larger than 1024 bytes.
     154
     155=item SSL_OP_ENABLE_KTLS
     156
     157Enable the use of kernel TLS. In order to benefit from kernel TLS OpenSSL must
     158have been compiled with support for it, and it must be supported by the
     159negotiated ciphersuites and extensions. The specific ciphersuites and extensions
     160that are supported may vary by platform and kernel version.
     161
     162The kernel TLS data-path implements the record layer, and the encryption
     163algorithm. The kernel will utilize the best hardware
     164available for encryption. Using the kernel data-path should reduce the memory
     165footprint of OpenSSL because no buffering is required. Also, the throughput
     166should improve because data copy is avoided when user data is encrypted into
     167kernel memory instead of the usual encrypt then copy to kernel.
     168
     169Kernel TLS might not support all the features of OpenSSL. For instance,
     170renegotiation, and setting the maximum fragment size is not possible as of
     171Linux 4.20.
     172
     173Note that with kernel TLS enabled some cryptographic operations are performed
     174by the kernel directly and not via any available OpenSSL Providers. This might
     175be undesirable if, for example, the application requires all cryptographic
     176operations to be performed by the FIPS provider.
     177
     178=item SSL_OP_ENABLE_MIDDLEBOX_COMPAT
     179
     180If set then dummy Change Cipher Spec (CCS) messages are sent in TLSv1.3. This
     181has the effect of making TLSv1.3 look more like TLSv1.2 so that middleboxes that
     182do not understand TLSv1.3 will not drop the connection. Regardless of whether
     183this option is set or not CCS messages received from the peer will always be
     184ignored in TLSv1.3. This option is set by default. To switch it off use
     185SSL_clear_options(). A future version of OpenSSL may not set this by default.
     186
     187=item SSL_OP_IGNORE_UNEXPECTED_EOF
     188
     189Some TLS implementations do not send the mandatory close_notify alert on
     190shutdown. If the application tries to wait for the close_notify alert but the
     191peer closes the connection without sending it, an error is generated. When this
     192option is enabled the peer does not need to send the close_notify alert and a
     193closed connection will be treated as if the close_notify alert was received.
     194
     195You should only enable this option if the protocol running over TLS
     196can detect a truncation attack itself, and that the application is checking for
     197that truncation attack.
     198
     199For more information on shutting down a connection, see L<SSL_shutdown(3)>.
     200
     201=item SSL_OP_LEGACY_SERVER_CONNECT
     202
     203Allow legacy insecure renegotiation between OpenSSL and unpatched servers
     204B<only>. See the B<SECURE RENEGOTIATION> section for more details.
     205
     206=item SSL_OP_NO_ANTI_REPLAY
     207
     208By default, when a server is configured for early data (i.e., max_early_data > 0),
     209OpenSSL will switch on replay protection. See L<SSL_read_early_data(3)> for a
     210description of the replay protection feature. Anti-replay measures are required
     211to comply with the TLSv1.3 specification. Some applications may be able to
     212mitigate the replay risks in other ways and in such cases the built in OpenSSL
     213functionality is not required. Those applications can turn this feature off by
     214setting this option. This is a server-side opton only. It is ignored by
     215clients.
     216
     217=item SSL_OP_NO_COMPRESSION
     218
     219Do not use compression even if it is supported. This option is set by default.
     220To switch it off use SSL_clear_options().
     221
     222=item SSL_OP_NO_ENCRYPT_THEN_MAC
     223
     224Normally clients and servers will transparently attempt to negotiate the
     225RFC7366 Encrypt-then-MAC option on TLS and DTLS connection.
     226
     227If this option is set, Encrypt-then-MAC is disabled. Clients will not
     228propose, and servers will not accept the extension.
     229
     230=item SSL_OP_NO_EXTENDED_MASTER_SECRET
     231
     232Normally clients and servers will transparently attempt to negotiate the
     233RFC7627 Extended Master Secret option on TLS and DTLS connection.
     234
     235If this option is set, Extended Master Secret is disabled. Clients will
     236not propose, and servers will not accept the extension.
     237
     238=item SSL_OP_NO_QUERY_MTU
     239
     240Do not query the MTU. Only affects DTLS connections.
     241
     242=item SSL_OP_NO_RENEGOTIATION
     243
     244Disable all renegotiation in TLSv1.2 and earlier. Do not send HelloRequest
     245messages, and ignore renegotiation requests via ClientHello.
     246
     247=item SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
     248
     249When performing renegotiation as a server, always start a new session
     250(i.e., session resumption requests are only accepted in the initial
     251handshake). This option is not needed for clients.
    116252
    117253=item SSL_OP_NO_SSLv3, SSL_OP_NO_TLSv1, SSL_OP_NO_TLSv1_1,
    … …  
    124260L<SSL_CTX_set_min_proto_version(3)> and
    125261L<SSL_CTX_set_max_proto_version(3)> instead.
    126 
    127 =item SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
    128 
    129 When performing renegotiation as a server, always start a new session
    130 (i.e., session resumption requests are only accepted in the initial
    131 handshake). This option is not needed for clients.
    132 
    133 =item SSL_OP_NO_COMPRESSION
    134 
    135 Do not use compression even if it is supported.
    136 
    137 =item SSL_OP_NO_QUERY_MTU
    138 
    139 Do not query the MTU. Only affects DTLS connections.
    140 
    141 =item SSL_OP_COOKIE_EXCHANGE
    142 
    143 Turn on Cookie Exchange as described in RFC4347 Section 4.2.1. Only affects
    144 DTLS connections.
    145262
    146263=item SSL_OP_NO_TICKET
    … …  
    180297L<SSL_set_num_tickets(3)>.
    181298
    182 =item SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
    183 
    184 Allow legacy insecure renegotiation between OpenSSL and unpatched clients or
    185 servers. See the B<SECURE RENEGOTIATION> section for more details.
    186 
    187 =item SSL_OP_LEGACY_SERVER_CONNECT
    188 
    189 Allow legacy insecure renegotiation between OpenSSL and unpatched servers
    190 B<only>: this option is currently set by default. See the
    191 B<SECURE RENEGOTIATION> section for more details.
    192 
    193 =item SSL_OP_NO_ENCRYPT_THEN_MAC
    194 
    195 Normally clients and servers will transparently attempt to negotiate the
    196 RFC7366 Encrypt-then-MAC option on TLS and DTLS connection.
    197 
    198 If this option is set, Encrypt-then-MAC is disabled. Clients will not
    199 propose, and servers will not accept the extension.
    200 
    201 =item SSL_OP_NO_RENEGOTIATION
    202 
    203 Disable all renegotiation in TLSv1.2 and earlier. Do not send HelloRequest
    204 messages, and ignore renegotiation requests via ClientHello.
    205 
    206 =item SSL_OP_ALLOW_NO_DHE_KEX
    207 
    208 In TLSv1.3 allow a non-(ec)dhe based key exchange mode on resumption. This means
    209 that there will be no forward secrecy for the resumed session.
    210 
    211299=item SSL_OP_PRIORITIZE_CHACHA
    212300
    … …  
    218306ciphers. Requires B<SSL_OP_CIPHER_SERVER_PREFERENCE>.
    219307
    220 =item SSL_OP_ENABLE_MIDDLEBOX_COMPAT
    221 
    222 If set then dummy Change Cipher Spec (CCS) messages are sent in TLSv1.3. This
    223 has the effect of making TLSv1.3 look more like TLSv1.2 so that middleboxes that
    224 do not understand TLSv1.3 will not drop the connection. Regardless of whether
    225 this option is set or not CCS messages received from the peer will always be
    226 ignored in TLSv1.3. This option is set by default. To switch it off use
    227 SSL_clear_options(). A future version of OpenSSL may not set this by default.
    228 
    229 =item SSL_OP_NO_ANTI_REPLAY
    230 
    231 By default, when a server is configured for early data (i.e., max_early_data > 0),
    232 OpenSSL will switch on replay protection. See L<SSL_read_early_data(3)> for a
    233 description of the replay protection feature. Anti-replay measures are required
    234 to comply with the TLSv1.3 specification. Some applications may be able to
    235 mitigate the replay risks in other ways and in such cases the built in OpenSSL
    236 functionality is not required. Those applications can turn this feature off by
    237 setting this option. This is a server-side opton only. It is ignored by
    238 clients.
     308=item SSL_OP_TLS_ROLLBACK_BUG
     309
     310Disable version rollback attack detection.
     311
     312During the client key exchange, the client must send the same information
     313about acceptable SSL/TLS protocol levels as during the first hello. Some
     314clients violate this rule by adapting to the server's answer. (Example:
     315the client sends a SSLv2 hello and accepts up to SSLv3.1=TLSv1, the server
     316only understands up to SSLv3. In this case the client must still use the
     317same SSLv3.1=TLSv1 announcement. Some clients step down to SSLv3 with respect
     318to the server's answer and violate the version rollback protection.)
    239319
    240320=back
    … …  
    306386renegotiation B<always> succeeds.
    307387
    308 =head2 Patched OpenSSL client and unpatched server.
     388=head2 Patched OpenSSL client and unpatched server
    309389
    310390If the option B<SSL_OP_LEGACY_SERVER_CONNECT> or
    … …  
    314394servers will fail.
    315395
    316 The option B<SSL_OP_LEGACY_SERVER_CONNECT> is currently set by default even
    317 though it has security implications: otherwise it would be impossible to
    318 connect to unpatched servers (i.e. all of them initially) and this is clearly
    319 not acceptable. Renegotiation is permitted because this does not add any
    320 additional security issues: during an attack clients do not see any
    321 renegotiations anyway.
    322 
    323 As more servers become patched the option B<SSL_OP_LEGACY_SERVER_CONNECT> will
    324 B<not> be set by default in a future version of OpenSSL.
     396Setting the option B<SSL_OP_LEGACY_SERVER_CONNECT> has security implications;
     397clients that are willing to connect to servers that do not implement
     398RFC 5746 secure renegotiation are subject to attacks such as
     399CVE-2009-3555.
    325400
    326401OpenSSL client applications wishing to ensure they can connect to unpatched
    … …  
    341416=head1 RETURN VALUES
    342417
    343 SSL_CTX_set_options() and SSL_set_options() return the new options bit mask
     418SSL_CTX_set_options() and SSL_set_options() return the new options bit-mask
    344419after adding B<options>.
    345420
    346 SSL_CTX_clear_options() and SSL_clear_options() return the new options bit mask
     421SSL_CTX_clear_options() and SSL_clear_options() return the new options bit-mask
    347422after clearing B<options>.
    348423
    349 SSL_CTX_get_options() and SSL_get_options() return the current bit mask.
     424SSL_CTX_get_options() and SSL_get_options() return the current bit-mask.
    350425
    351426SSL_get_secure_renegotiation_support() returns 1 is the peer supports
    … …  
    354429=head1 SEE ALSO
    355430
    356 L<ssl(7)>, L<SSL_new(3)>, L<SSL_clear(3)>,
     431L<ssl(7)>, L<SSL_new(3)>, L<SSL_clear(3)>, L<SSL_shutdown(3)>
    357432L<SSL_CTX_set_tmp_dh_callback(3)>,
    358433L<SSL_CTX_set_min_proto_version(3)>,
    359 L<dhparam(1)>
     434L<openssl-dhparam(1)>
    360435
    361436=head1 HISTORY
    … …  
    367442were added in OpenSSL 1.1.1.
    368443
     444The B<SSL_OP_NO_EXTENDED_MASTER_SECRET> and B<SSL_OP_IGNORE_UNEXPECTED_EOF>
     445options were added in OpenSSL 3.0.
     446
     447The B<SSL_OP_> constants and the corresponding parameter and return values
     448of the affected functions were changed to C<uint64_t> type in OpenSSL 3.0.
     449For that reason it is no longer possible use the B<SSL_OP_> macro values
     450in preprocessor C<#if> conditions. However it is still possible to test
     451whether these macros are defined or not.
     452
    369453=head1 COPYRIGHT
    370454
    371 Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved.
    372 
    373 Licensed under the OpenSSL license (the "License").  You may not use
     455Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved.
     456
     457Licensed under the Apache License 2.0 (the "License").  You may not use
    374458this file except in compliance with the License.  You can obtain a copy
    375459in the file LICENSE in the source distribution or at
Note: See TracChangeset for help on using the changeset viewer.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette