netutils/vsftpd
1
0
Fork 0
mirror of https://github.com/InfrastructureServices/vsftpd.git synced 2025-04-19 01:24:02 +03:00
Code

add option to disable TLSv1.3

Browse Source
This commit is contained in:
Artem Egorenkov 2022-02-09 15:58:21 +01:00
parent aa87e83ebf
commit e81c284128
6 changed files with 23 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
features.c
View File

@ -22,7 +22,7 @@ handle_feat(struct vsf_session* p_sess)
{
vsf_cmdio_write_raw(p_sess, " AUTH SSL\r\n");
}
if (tunable_tlsv1 || tunable_tlsv1_1 || tunable_tlsv1_2)
if (tunable_tlsv1 || tunable_tlsv1_1 || tunable_tlsv1_2 || tunable_tlsv1_3)
{
vsf_cmdio_write_raw(p_sess, " AUTH TLS\r\n");
}

1
parseconf.c
View File

@ -87,6 +87,7 @@ parseconf_bool_array[] =
{ "ssl_tlsv1", &tunable_tlsv1 },
{ "ssl_tlsv1_1", &tunable_tlsv1_1 },
{ "ssl_tlsv1_2", &tunable_tlsv1_2 },
{ "ssl_tlsv1_3", &tunable_tlsv1_3 },
{ "tilde_user_enable", &tunable_tilde_user_enable },
{ "force_anon_logins_ssl", &tunable_force_anon_logins_ssl },
{ "force_anon_data_ssl", &tunable_force_anon_data_ssl },

4
ssl.c
View File

@ -185,6 +185,10 @@ ssl_init(struct vsf_session* p_sess)
{
options |= SSL_OP_NO_TLSv1_2;
}
if (!tunable_tlsv1_3)
{
options |= SSL_OP_NO_TLSv1_3;
}
SSL_CTX_set_options(p_ctx, options);
if (tunable_rsa_cert_file)
{

4
tunables.c
View File

@ -68,6 +68,7 @@ int tunable_sslv3;
int tunable_tlsv1;
int tunable_tlsv1_1;
int tunable_tlsv1_2;
int tunable_tlsv1_3;
int tunable_tilde_user_enable;
int tunable_force_anon_logins_ssl;
int tunable_force_anon_data_ssl;
@ -218,8 +219,9 @@ tunables_load_defaults()
tunable_sslv3 = 0;
tunable_tlsv1 = 0;
tunable_tlsv1_1 = 0;
/* Only TLSv1.2 is enabled by default */
/* Only TLSv1.2 and TLSv1.3 are enabled by default */
tunable_tlsv1_2 = 1;
tunable_tlsv1_3 = 1;
tunable_tilde_user_enable = 0;
tunable_force_anon_logins_ssl = 0;
tunable_force_anon_data_ssl = 0;

1
tunables.h
View File

@ -69,6 +69,7 @@ extern int tunable_sslv3; /* Allow SSLv3 */
extern int tunable_tlsv1; /* Allow TLSv1 */
extern int tunable_tlsv1_1; /* Allow TLSv1.1 */
extern int tunable_tlsv1_2; /* Allow TLSv1.2 */
extern int tunable_tlsv1_3; /* Allow TLSv1.3 */
extern int tunable_tilde_user_enable; /* Support e.g. ~chris */
extern int tunable_force_anon_logins_ssl; /* Require anon logins use SSL */
extern int tunable_force_anon_data_ssl; /* Require anon data uses SSL */

18
vsftpd.conf.5
View File

@ -555,7 +555,7 @@ Default: YES
Only applies if
.BR ssl_enable
is activated. If enabled, this option will permit SSL v2 protocol connections.
TLS v1.2 connections are preferred.
TLS v1.2 and TLS v1.3 connections are preferred.
Default: NO
.TP
@ -563,7 +563,7 @@ Default: NO
Only applies if
.BR ssl_enable
is activated. If enabled, this option will permit SSL v3 protocol connections.
TLS v1.2 connections are preferred.
TLS v1.2 and TLS v1.3 connections are preferred.
Default: NO
.TP
@ -571,7 +571,7 @@ Default: NO
Only applies if
.BR ssl_enable
is activated. If enabled, this option will permit TLS v1 protocol connections.
TLS v1.2 connections are preferred.
TLS v1.2 and TLS v1.3 connections are preferred.
Default: NO
.TP
@ -579,7 +579,7 @@ Default: NO
Only applies if
.BR ssl_enable
is activated. If enabled, this option will permit TLS v1.1 protocol connections.
TLS v1.2 connections are preferred.
TLS v1.2 and TLS v1.3 connections are preferred.
Default: NO
.TP
@ -587,7 +587,15 @@ Default: NO
Only applies if
.BR ssl_enable
is activated. If enabled, this option will permit TLS v1.2 protocol connections.
TLS v1.2 connections are preferred.
TLS v1.2 and TLS v1.3 connections are preferred.
Default: YES
.TP
.B ssl_tlsv1_3
Only applies if
.BR ssl_enable
is activated. If enabled, this option will permit TLS v1.3 protocol connections.
TLS v1.2 and TLS v1.3 connections are preferred.
Default: YES
.TP