From ad7deda14d7c868eab6de05e4ee46735e4e93069 Mon Sep 17 00:00:00 2001 From: Martin Prikryl Date: Tue, 16 May 2023 13:55:56 +0000 Subject: [PATCH] Removing support for SSL 3.0 It does not work after upgrade to OpenSSL 3. While it should still be supported (by OpenSSL), it's not safe and noone uses it according to the usage statistics, so unless many complain, it's not worth trying to fix it. Only downsize is that currently the connection times out, instead of failing gracefully. Source commit: 4aeed919bdb18c7d58d5ec8ba1c6b21adbee5167 --- source/core/SessionData.h | 2 +- source/core/SessionInfo.cpp | 2 -- source/forms/SiteAdvanced.cpp | 25 +++++++++++-------------- source/forms/SiteAdvanced.dfm | 22 ++++++++++------------ source/forms/SiteAdvanced.h | 8 ++++---- 5 files changed, 26 insertions(+), 33 deletions(-) diff --git a/source/core/SessionData.h b/source/core/SessionData.h index 2a691ab0e..a73648ff0 100644 --- a/source/core/SessionData.h +++ b/source/core/SessionData.h @@ -33,7 +33,7 @@ extern const wchar_t * PingTypeNames; enum TPingType { ptOff, ptNullPacket, ptDummyCommand }; enum TAddressFamily { afAuto, afIPv4, afIPv6 }; enum TFtps { ftpsNone, ftpsImplicit, ftpsExplicitSsl, ftpsExplicitTls }; -// ssl2 has no effect now +// ssl2 and ssh3 are equivalent of tls10 now enum TTlsVersion { ssl2 = 2, ssl3 = 3, tls10 = 10, tls11 = 11, tls12 = 12, tls13 = 13 }; // has to match libs3 S3UriStyle enum TS3UrlStyle { s3usVirtualHost, s3usPath }; diff --git a/source/core/SessionInfo.cpp b/source/core/SessionInfo.cpp index f625a92fc..7e0206232 100644 --- a/source/core/SessionInfo.cpp +++ b/source/core/SessionInfo.cpp @@ -1078,9 +1078,7 @@ UnicodeString __fastcall TSessionLog::GetTlsVersionName(TTlsVersion TlsVersion) default: DebugFail(); case ssl2: - return "SSLv2"; case ssl3: - return "SSLv3"; case tls10: return "TLSv1.0"; case tls11: diff --git a/source/forms/SiteAdvanced.cpp b/source/forms/SiteAdvanced.cpp index 710de7f10..2d495d9b6 100644 --- a/source/forms/SiteAdvanced.cpp +++ b/source/forms/SiteAdvanced.cpp @@ -411,7 +411,7 @@ void __fastcall TSiteAdvancedDialog::LoadSession() // connection/tls/ssl page MinTlsVersionCombo->ItemIndex = TlsVersionToIndex(FSessionData->MinTlsVersion); MaxTlsVersionCombo->ItemIndex = TlsVersionToIndex(FSessionData->MaxTlsVersion); - SslSessionReuseCheck->Checked = FSessionData->SslSessionReuse; + SslSessionReuseCheck2->Checked = FSessionData->SslSessionReuse; TlsCertificateFileEdit->Text = FSessionData->TlsCertificateFile; // Note page @@ -688,7 +688,7 @@ void __fastcall TSiteAdvancedDialog::SaveSession(TSessionData * SessionData) // connection/tls/ssl page SessionData->MinTlsVersion = IndexToTlsVersion(MinTlsVersionCombo->ItemIndex); SessionData->MaxTlsVersion = IndexToTlsVersion(MaxTlsVersionCombo->ItemIndex); - SessionData->SslSessionReuse = SslSessionReuseCheck->Checked; + SessionData->SslSessionReuse = SslSessionReuseCheck2->Checked; SessionData->TlsCertificateFile = TlsCertificateFileEdit->Text; // Note page @@ -1061,8 +1061,8 @@ void __fastcall TSiteAdvancedDialog::UpdateControls() // connection/ssl/tls SslSheet->Enabled = Ssl; - // TLS/SSL session reuse is not configurable for WebDAV/S3 yet - SslSessionReuseCheck->Enabled = SslSheet->Enabled && FtpProtocol; + // TLS session reuse is not configurable for WebDAV/S3 yet + SslSessionReuseCheck2->Enabled = SslSheet->Enabled && FtpProtocol; TlsAuthenticationGroup->Visible = Ssl && (FtpProtocol || WebDavProtocol); // encryption sheet @@ -1533,14 +1533,12 @@ TTlsVersion __fastcall TSiteAdvancedDialog::IndexToTlsVersion(int Index) default: DebugFail(); case 0: - return ssl3; - case 1: return tls10; - case 2: + case 1: return tls11; - case 3: + case 2: return tls12; - case 4: + case 3: return tls13; } } @@ -1553,15 +1551,14 @@ int __fastcall TSiteAdvancedDialog::TlsVersionToIndex(TTlsVersion TlsVersion) DebugFail(); case ssl2: case ssl3: - return 0; case tls10: - return 1; + return 0; case tls11: - return 2; + return 1; case tls12: - return 3; + return 2; case tls13: - return 4; + return 3; } } //--------------------------------------------------------------------------- diff --git a/source/forms/SiteAdvanced.dfm b/source/forms/SiteAdvanced.dfm index f06b565ed..ede370dd2 100644 --- a/source/forms/SiteAdvanced.dfm +++ b/source/forms/SiteAdvanced.dfm @@ -1889,31 +1889,31 @@ object SiteAdvancedDialog: TSiteAdvancedDialog DesignSize = ( 401 382) - object SslGroup: TGroupBox + object TlsGroup: TGroupBox Left = 0 Top = 6 Width = 393 Height = 99 Anchors = [akLeft, akTop, akRight] - Caption = 'TLS/SSL options' + Caption = 'TLS options' TabOrder = 0 DesignSize = ( 393 99) - object Label1: TLabel + object MinTlsVersionLabel: TLabel Left = 12 Top = 20 - Width = 123 + Width = 102 Height = 13 - Caption = 'Mi&nimum TLS/SSL version:' + Caption = 'Mi&nimum TLS version:' FocusControl = MinTlsVersionCombo end - object Label2: TLabel + object MaxTlsVersionLabel: TLabel Left = 12 Top = 44 - Width = 127 + Width = 106 Height = 13 - Caption = 'Ma&ximum TLS/SSL version:' + Caption = 'Ma&ximum TLS version:' FocusControl = MaxTlsVersionCombo end object MinTlsVersionCombo: TComboBox @@ -1926,7 +1926,6 @@ object SiteAdvancedDialog: TSiteAdvancedDialog TabOrder = 0 OnChange = MinTlsVersionComboChange Items.Strings = ( - 'SSL 3.0' 'TLS 1.0' 'TLS 1.1' 'TLS 1.2' @@ -1942,19 +1941,18 @@ object SiteAdvancedDialog: TSiteAdvancedDialog TabOrder = 1 OnChange = MaxTlsVersionComboChange Items.Strings = ( - 'SSL 3.0' 'TLS 1.0' 'TLS 1.1' 'TLS 1.2' 'TLS 1.3') end - object SslSessionReuseCheck: TCheckBox + object SslSessionReuseCheck2: TCheckBox Left = 12 Top = 68 Width = 365 Height = 17 Anchors = [akLeft, akTop, akRight] - Caption = '&Reuse TLS/SSL session ID for data connections' + Caption = '&Reuse TLS session ID for data connections' TabOrder = 2 OnClick = DataChange end diff --git a/source/forms/SiteAdvanced.h b/source/forms/SiteAdvanced.h index 721a12987..646320177 100644 --- a/source/forms/SiteAdvanced.h +++ b/source/forms/SiteAdvanced.h @@ -225,12 +225,12 @@ __published: TImageList *ColorImageList; TButton *ColorButton; TTabSheet *SslSheet; - TGroupBox *SslGroup; - TLabel *Label1; + TGroupBox *TlsGroup; + TLabel *MinTlsVersionLabel; TComboBox *MinTlsVersionCombo; - TLabel *Label2; + TLabel *MaxTlsVersionLabel; TComboBox *MaxTlsVersionCombo; - TCheckBox *SslSessionReuseCheck; + TCheckBox *SslSessionReuseCheck2; TLabel *BugWinAdjLabel; TComboBox *BugWinAdjCombo; TButton *ProxyAutodetectButton;