diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/node_crypto.cc | 18 | ||||
-rw-r--r-- | src/node_crypto_clienthello.cc | 6 |
2 files changed, 10 insertions, 14 deletions
diff --git a/src/node_crypto.cc b/src/node_crypto.cc index 26ac54bf36..c088fe25db 100644 --- a/src/node_crypto.cc +++ b/src/node_crypto.cc @@ -288,6 +288,10 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) { if (args.Length() == 1 && args[0]->IsString()) { const node::Utf8Value sslmethod(env->isolate(), args[0]); + // Note that SSLv2 and SSLv3 are disallowed but SSLv2_method and friends + // are still accepted. They are OpenSSL's way of saying that all known + // protocols are supported unless explicitly disabled (which we do below + // for SSLv2 and SSLv3.) if (strcmp(*sslmethod, "SSLv2_method") == 0) { return env->ThrowError("SSLv2 methods disabled"); } else if (strcmp(*sslmethod, "SSLv2_server_method") == 0) { @@ -295,23 +299,11 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) { } else if (strcmp(*sslmethod, "SSLv2_client_method") == 0) { return env->ThrowError("SSLv2 methods disabled"); } else if (strcmp(*sslmethod, "SSLv3_method") == 0) { -#ifndef OPENSSL_NO_SSL3 - method = SSLv3_method(); -#else return env->ThrowError("SSLv3 methods disabled"); -#endif } else if (strcmp(*sslmethod, "SSLv3_server_method") == 0) { -#ifndef OPENSSL_NO_SSL3 - method = SSLv3_server_method(); -#else return env->ThrowError("SSLv3 methods disabled"); -#endif } else if (strcmp(*sslmethod, "SSLv3_client_method") == 0) { -#ifndef OPENSSL_NO_SSL3 - method = SSLv3_client_method(); -#else return env->ThrowError("SSLv3 methods disabled"); -#endif } else if (strcmp(*sslmethod, "SSLv23_method") == 0) { method = SSLv23_method(); } else if (strcmp(*sslmethod, "SSLv23_server_method") == 0) { @@ -346,7 +338,9 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) { // Disable SSLv2 in the case when method == SSLv23_method() and the // cipher list contains SSLv2 ciphers (not the default, should be rare.) // The bundled OpenSSL doesn't have SSLv2 support but the system OpenSSL may. + // SSLv3 is disabled because it's susceptible to downgrade attacks (POODLE.) SSL_CTX_set_options(sc->ctx_, SSL_OP_NO_SSLv2); + SSL_CTX_set_options(sc->ctx_, SSL_OP_NO_SSLv3); // SSL session cache configuration SSL_CTX_set_session_cache_mode(sc->ctx_, diff --git a/src/node_crypto_clienthello.cc b/src/node_crypto_clienthello.cc index 34507858c9..8fbc3161f8 100644 --- a/src/node_crypto_clienthello.cc +++ b/src/node_crypto_clienthello.cc @@ -61,13 +61,15 @@ void ClientHelloParser::ParseHeader(const uint8_t* data, size_t avail) { // Check hello protocol version. Protocol tuples that we know about: // - // (3,0) SSL v3.0 // (3,1) TLS v1.0 // (3,2) TLS v1.1 // (3,3) TLS v1.2 // - if (data[body_offset_ + 4] != 0x03 || data[body_offset_ + 5] > 0x03) + if (data[body_offset_ + 4] != 0x03 || + data[body_offset_ + 5] < 0x01 || + data[body_offset_ + 5] > 0x03) { goto fail; + } if (data[body_offset_] == kClientHello) { if (state_ == kTLSHeader) { |