diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2021-03-22 13:39:37 +0100 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2021-04-19 08:16:02 +0200 |
| commit | eff614fb0242cb37d33f89e2e74a93cef5203aed (patch) | |
| tree | 0b17f5b8bd993f9b9140499bddd76dde9b9750b0 /lib/vtls/wolfssl.c | |
| parent | cf65d4237e097ace65e17580407ce56487823a47 (diff) | |
| download | curl-eff614fb0242cb37d33f89e2e74a93cef5203aed.tar.gz | |
vtls: refuse setting any SSL version
... previously they were supported if a TLS library would (unexpectedly)
still support them, but from this change they will be refused already in
curl_easy_setopt(). SSLv2 and SSLv3 have been known to be insecure for
many years now.
Closes #6773
Diffstat (limited to 'lib/vtls/wolfssl.c')
| -rw-r--r-- | lib/vtls/wolfssl.c | 22 |
1 files changed, 2 insertions, 20 deletions
diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c index c6f428034..21f36504f 100644 --- a/lib/vtls/wolfssl.c +++ b/lib/vtls/wolfssl.c @@ -47,16 +47,6 @@ #endif #endif -/* WOLFSSL_ALLOW_SSLV3 is wolfSSL's build time symbol for enabling SSLv3 in - options.h, but is only seen in >= 3.6.6 since that's when they started - disabling SSLv3 by default. */ -#ifndef WOLFSSL_ALLOW_SSLV3 -#if (LIBWOLFSSL_VERSION_HEX < 0x03006006) || \ - defined(HAVE_WOLFSSLV3_CLIENT_METHOD) -#define WOLFSSL_ALLOW_SSLV3 -#endif -#endif - #include <limits.h> #include "urldata.h" @@ -285,18 +275,10 @@ wolfssl_connect_step1(struct Curl_easy *data, struct connectdata *conn, failf(data, "wolfSSL: TLS 1.3 is not yet supported"); return CURLE_SSL_CONNECT_ERROR; #endif + case CURL_SSLVERSION_SSLv2: case CURL_SSLVERSION_SSLv3: -#ifdef WOLFSSL_ALLOW_SSLV3 - req_method = SSLv3_client_method(); - use_sni(FALSE); -#else - failf(data, "wolfSSL does not support SSLv3"); + failf(data, "SSL versions not supported"); return CURLE_NOT_BUILT_IN; -#endif - break; - case CURL_SSLVERSION_SSLv2: - failf(data, "wolfSSL does not support SSLv2"); - return CURLE_SSL_CONNECT_ERROR; default: failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION"); return CURLE_SSL_CONNECT_ERROR; |