svn commit: r362818 - in head/secure/lib: libcrypto libssl

[Conrad Meyer]

Author: cem
Date: Wed Jul  1 00:59:28 2020
New Revision: 362818
URL: https://svnweb.freebsd.org/changeset/base/362818

Log:
  Replace OPENSSL_NO_SSL3_METHODs with dummies
  
  SSLv3 has been deprecated since 2015 (and broken since 2014: "POODLE"); it
  should not have shipped in FreeBSD 11 (2016) or 12 (2018).  No one should use
  it, and if they must, they can use some implementation outside of base.
  
  There are three symbols removed with OPENSSL_NO_SSL3_METHOD:
  
  SSLv3_client_method
  SSLv3_method
  SSLv3_server_method
  
  These symbols exist to request an explicit SSLv3 connection to a server.
  There is no good reason for an application to link or invoke these symbols
  instead of TLS_method(), et al (née SSLv23_method, et al).  Applications
  that do so have broken cryptography.
  
  Define these symbols for some pedantic definition of ABI stability, but
  remove the functionality again (r361392) after r362620.
  
  Reviewed by:	gordon, jhb (earlier-but-equivalent version both)
  Discussed with:	bjk, kib
  Differential Revision:	https://reviews.freebsd.org/D25493

Added:
  head/secure/lib/libssl/dummy_abi.c   (contents, props changed)
Modified:
  head/secure/lib/libcrypto/opensslconf.h.in
  head/secure/lib/libssl/Makefile

Modified: head/secure/lib/libcrypto/opensslconf.h.in
==============================================================================
--- head/secure/lib/libcrypto/opensslconf.h.in	Wed Jul  1 00:33:16 2020	(r362817)
+++ head/secure/lib/libcrypto/opensslconf.h.in	Wed Jul  1 00:59:28 2020	(r362818)
@@ -79,6 +79,9 @@ extern "C" {
 #ifndef OPENSSL_NO_SSL3
 # define OPENSSL_NO_SSL3
 #endif
+#ifndef OPENSSL_NO_SSL3_METHOD
+# define OPENSSL_NO_SSL3_METHOD
+#endif
 #ifndef OPENSSL_NO_UBSAN
 # define OPENSSL_NO_UBSAN
 #endif

Modified: head/secure/lib/libssl/Makefile
==============================================================================
--- head/secure/lib/libssl/Makefile	Wed Jul  1 00:33:16 2020	(r362817)
+++ head/secure/lib/libssl/Makefile	Wed Jul  1 00:59:28 2020	(r362818)
@@ -22,6 +22,8 @@ SRCS+=	ssl3_record.c ssl3_record_tls13.c
 SRCS+=	extensions.c extensions_clnt.c extensions_cust.c extensions_srvr.c
 SRCS+=	statem.c statem_clnt.c statem_dtls.c statem_lib.c statem_srvr.c
 
+SRCS+=	dummy_abi.c
+
 LIBADD=	crypto
 
 CFLAGS+=	-I${LCRYPTO_SRC}/ssl

Added: head/secure/lib/libssl/dummy_abi.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/secure/lib/libssl/dummy_abi.c	Wed Jul  1 00:59:28 2020	(r362818)
@@ -0,0 +1,46 @@
+/* This file is in the public domain. */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <stdbool.h>
+#include <unistd.h>
+
+#include <openssl/ssl.h>
+
+static inline void
+__SSLv3_dummy_method_impl(void)
+{
+	static const char warning[] = "SSLv3 use is deprecated.\n";
+	static bool once = false;
+
+	if (once)
+		return;
+
+	once = true;
+	write(STDERR_FILENO, warning, sizeof(warning) - 1);
+}
+
+const SSL_METHOD *
+__SSLv3_method_fbsd12(void)
+{
+	__SSLv3_dummy_method_impl();
+	return (NULL);
+}
+__sym_compat(SSLv3_method, __SSLv3_method_fbsd12, OPENSSL_1_1_0);
+
+const SSL_METHOD *
+__SSLv3_client_method_fbsd12(void)
+{
+	__SSLv3_dummy_method_impl();
+	return (NULL);
+}
+__sym_compat(SSLv3_client_method, __SSLv3_client_method_fbsd12, OPENSSL_1_1_0);
+
+const SSL_METHOD *
+__SSLv3_server_method_fbsd12(void)
+{
+	__SSLv3_dummy_method_impl();
+	return (NULL);
+}
+__sym_compat(SSLv3_server_method, __SSLv3_server_method_fbsd12, OPENSSL_1_1_0);