Attachment 947662 Details for Bug 1153052 – evolution-data-server-3.10.4-poodle-enable-tls-for-ssl.patch ][

[patch] evolution-data-server-3.10.4-poodle-enable-tls-for-ssl.patch ][

evolution-data-server-3.10.4-poodle-enable-tls-for-ssl.patch (text/plain), 4.05 KB, created by Milan Crha on 2014-10-16 15:28:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Milan Crha

Created: 2014-10-16 15:28:12 UTC

Size: 4.05 KB

patch

obsolete

>diff -up evolution-data-server-3.10.4/camel/camel-network-service.c.poodle-enable-tls-for-ssl evolution-data-server-3.10.4/camel/camel-network-service.c
>--- evolution-data-server-3.10.4/camel/camel-network-service.c.poodle-enable-tls-for-ssl	2014-10-16 17:23:12.445495018 +0200
>+++ evolution-data-server-3.10.4/camel/camel-network-service.c	2014-10-16 17:23:17.187494840 +0200
>@@ -328,7 +328,8 @@ network_service_connect_sync (CamelNetwo
> 			stream = camel_tcp_stream_ssl_new (
> 				session, host,
> 				CAMEL_TCP_STREAM_SSL_ENABLE_SSL2 |
>-				CAMEL_TCP_STREAM_SSL_ENABLE_SSL3);
>+				CAMEL_TCP_STREAM_SSL_ENABLE_SSL3 |
>+				CAMEL_TCP_STREAM_SSL_ENABLE_TLS);
> 			break;
> 
> 		default:
>diff -up evolution-data-server-3.10.4/camel/camel-tcp-stream-ssl.c.poodle-enable-tls-for-ssl evolution-data-server-3.10.4/camel/camel-tcp-stream-ssl.c
>--- evolution-data-server-3.10.4/camel/camel-tcp-stream-ssl.c.poodle-enable-tls-for-ssl	2013-12-08 19:42:50.000000000 +0100
>+++ evolution-data-server-3.10.4/camel/camel-tcp-stream-ssl.c	2014-10-16 17:14:29.590514659 +0200
>@@ -43,6 +43,8 @@
> #include <sslerr.h>
> #include "nss.h"    /* Don't use <> here or it will include the system nss.h instead */
> #include <ssl.h>
>+#include <sslt.h>
>+#include <sslproto.h>
> #include <cert.h>
> #include <certdb.h>
> #include <pk11func.h>
>@@ -545,6 +547,9 @@ enable_ssl (CamelTcpStreamSSL *ssl,
> {
> 	PRFileDesc *ssl_fd;
> 	static gchar v2_enabled = -1;
>+#if NSS_VMAJOR > 3 || (NSS_VMAJOR == 3 && NSS_VMINOR >= 14)
>+	SSLVersionRange versionStreamSup, versionStream;
>+#endif
> 
> 	g_assert (fd != NULL);
> 
>@@ -575,6 +580,7 @@ enable_ssl (CamelTcpStreamSSL *ssl,
> 		SSL_OptionSet (ssl_fd, SSL_V2_COMPATIBLE_HELLO, PR_FALSE);
> 	}
> 
>+#if NSS_VMAJOR < 3 || (NSS_VMAJOR == 3 && NSS_VMINOR < 14)
> 	if (ssl->priv->flags & CAMEL_TCP_STREAM_SSL_ENABLE_SSL3)
> 		SSL_OptionSet (ssl_fd, SSL_ENABLE_SSL3, PR_TRUE);
> 	else
>@@ -585,6 +591,29 @@ enable_ssl (CamelTcpStreamSSL *ssl,
> 	else
> 		SSL_OptionSet (ssl_fd, SSL_ENABLE_TLS, PR_FALSE);
> 
>+#else
>+	SSL_VersionRangeGetSupported (ssl_variant_stream, &versionStreamSup);
>+
>+	if (ssl->priv->flags & CAMEL_TCP_STREAM_SSL_ENABLE_SSL3)
>+		versionStream.min = SSL_LIBRARY_VERSION_3_0;
>+	else
>+		versionStream.min = SSL_LIBRARY_VERSION_TLS_1_0;
>+
>+	if (ssl->priv->flags & CAMEL_TCP_STREAM_SSL_ENABLE_TLS)
>+		versionStream.max = versionStreamSup.max;
>+	else
>+		versionStream.max = SSL_LIBRARY_VERSION_3_0;
>+
>+	if (versionStream.max < versionStream.min) {
>+		PRUint16 tmp;
>+
>+		tmp = versionStream.max;
>+		versionStream.max = versionStream.min;
>+		versionStream.min = tmp;
>+	}
>+
>+	SSL_VersionRangeSet (ssl_fd, &versionStream);
>+#endif
> 	SSL_SetURL (ssl_fd, ssl->priv->expected_host);
> 
> 	/* NSS provides a default implementation for the SSL_GetClientAuthDataHook callback
>diff -up evolution-data-server-3.10.4/camel/camel.c.poodle-enable-tls-for-ssl evolution-data-server-3.10.4/camel/camel.c
>--- evolution-data-server-3.10.4/camel/camel.c.poodle-enable-tls-for-ssl	2013-12-08 19:42:49.000000000 +0100
>+++ evolution-data-server-3.10.4/camel/camel.c	2014-10-16 17:14:29.590514659 +0200
>@@ -100,6 +100,9 @@ camel_init (const gchar *configdir,
> 		gchar *nss_configdir = NULL;
> 		gchar *nss_sql_configdir = NULL;
> 		SECStatus status = SECFailure;
>+#if NSS_VMAJOR > 3 || (NSS_VMAJOR == 3 && NSS_VMINOR >= 14)
>+		SSLVersionRange versionStream;
>+#endif
> 
> #if NSS_VMAJOR < 3 || (NSS_VMAJOR == 3 && NSS_VMINOR < 14)
> 		/* NSS pre-3.14 has most of the ciphers disabled, thus enable
>@@ -212,8 +215,14 @@ skip_nss_init:
> 
> 		SSL_OptionSetDefault (SSL_ENABLE_SSL2, v2_enabled ? PR_TRUE : PR_FALSE);
> 		SSL_OptionSetDefault (SSL_V2_COMPATIBLE_HELLO, PR_FALSE);
>+#if NSS_VMAJOR < 3 || (NSS_VMAJOR == 3 && NSS_VMINOR < 14)
> 		SSL_OptionSetDefault (SSL_ENABLE_SSL3, PR_TRUE);
>-		SSL_OptionSetDefault (SSL_ENABLE_TLS, PR_TRUE);
>+		SSL_OptionSetDefault (SSL_ENABLE_TLS, PR_TRUE); /* Enable TLSv1.0 */
>+#else
>+		/* Enable all SSL/TLS versions supported by NSS (this API is for SSLv3 and newer). */
>+		SSL_VersionRangeGetSupported (ssl_variant_stream, &versionStream);
>+		SSL_VersionRangeSetDefault (ssl_variant_stream, &versionStream);
>+#endif
> 
> 		PR_Unlock (nss_initlock);
>

Actions: View | Diff

Attachments on bug 1153052: 947229 | 947480 | 947662