Page MenuHomeFreeBSD

security/openssl: Fix No-SSLv3 option
ClosedPublic

Authored by brnrd on Jan 13 2016, 1:52 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, May 11, 2:30 PM
Unknown Object (File)
Mon, Apr 29, 8:29 AM
Unknown Object (File)
Fri, Apr 26, 5:28 AM
Unknown Object (File)
Mon, Apr 22, 5:06 PM
Unknown Object (File)
Apr 3 2024, 12:38 AM
Unknown Object (File)
Mar 28 2024, 11:57 PM
Unknown Object (File)
Mar 28 2024, 9:28 PM
Unknown Object (File)
Feb 1 2024, 8:23 AM
Subscribers
None

Details

Summary

Proposed commit log

security/openssl: Fix No-SSLv3 option

  - This change adds `no-ssl3-method` to config args
  - Bump portrevision

Testing with security/openssl buillt with SSL3 option disabled [1]
revealed that the openssl binary and the libraries still support SSLv3
connections and methods. With the added no-ssl3-method argument passed
to the config script, the binary no longer supports the -ssl3 option
and ports requiring SSLv3 methods fail on undefined references to
methods.

PR:		203693 [1]
Reviewed_by:	koobs (mentor), feld (mentor, ports-secteam), dinoex (maintainer)
Approved by:	(mentor), (ports-secteam), (maintainer)
MFH:		2016Q1
Differential_Revision:	D4924
Test Plan
  • portlint -AC (no change)
  • poudriere testport
  • test openssl s_client -ssl3 and existence of SSLv3_ methods in headers

Test connecting to SSLv3 enabled endpoint

/usr/local/bin/openssl s_client -connect google.com:443 -ssl3
unknown option -ssl3

Testing building a port requiring SSLv3 methods

--- ftimes ---
cc -o ftimes analyze.o cmpmode.o compare.o decode.o decoder.o develop.o dig.o  digmode.o error.o fsinfo.o ftimes.o getmode.o http.o madmode.o map.o mapmode.o mask.o md5.o message.o options.o properties.o sha1.o sha256.o socket.o ssl.o support.o time.o url.o version.o -O2 -fno-strict-aliasing -pipe -march=native  -fstack-protector -Wall -DUNIX -DHAVE_CONFIG_H -DXMAGIC_PREFIX='"/usr/local"'   -lm   -L/usr/local/lib -lpcre   -L/usr/local/lib -lssl -lcrypto
ssl.o: In function `SslInitializeCTX':
ssl.c:(.text+0x469): undefined reference to `SSLv3_client_method'
cc: error: linker command failed with exit code 1 (use -v to see invocation)
*** [ftimes] Error code 1

Diff Detail

Repository
rP FreeBSD ports repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

brnrd retitled this revision from to security/openssl: Fix No-SSLv3 option.
brnrd updated this object.
brnrd edited the test plan for this revision. (Show Details)
brnrd added reviewers: koobs, feld.
koobs requested changes to this revision.Jan 13 2016, 1:54 PM
koobs edited edge metadata.

In your commit log, please add a description of your findings and investigation that necessitated this change.

This revision now requires changes to proceed.Jan 13 2016, 1:54 PM
brnrd edited the test plan for this revision. (Show Details)
brnrd edited edge metadata.
brnrd updated this object.
In D4924#104262, @koobs wrote:

In your commit log, please add a description of your findings and investigation that necessitated this change.

Done

brnrd updated this object.
feld edited edge metadata.
koobs edited edge metadata.

LGTM, except Differential_Revision needs to go last.

This revision is now accepted and ready to land.Jan 13 2016, 4:05 PM
koobs edited edge metadata.
This revision was automatically updated to reflect the committed changes.