Allowing the user to use less secure ssl versions for older servers. (#…

…92)
ingwarsw · Nov 14, 2024 · 3c80063 · 3c80063
1 parent c7fa593
commit 3c80063
Show file tree

Hide file tree

Showing 4 changed files with 17 additions and 1 deletion.
diff --git a/lib/tf/tf-help b/lib/tf/tf-help
@@ -8462,10 +8462,12 @@ Protocols
     /set ssl_continue
     /set ssl_depth
     /set ssl_verbose
+    /set ssl_insecure
 
   See: [1mprotocols[22;0m, [1mfeatures[22;0m, [1mconnect[22;0m, [1maddworld[22;0m, [1mworlds[22;0m, [1mfields[22;0m, [1mlistsockets[22;0m, 
   [1mspecial variables[22;0m, [1mssl_ca_dir[22;0m, [1mssl_ca_file[22;0m, [1mssl_continue[22;0m, [1mssl_depth[22;0m, 
-  [1mssl_verbose[22;0m
+  [1mssl_verbose[22;0m, [1mssl_insecure[22;0m
+
 
 &firewall
 &proxy
@@ -9551,6 +9553,11 @@ Special global variables
   [1mssl_verbose[22m=on
           Show cert chain when connecting.
 
+#ssl_insecure
+#%ssl_insecure
+  [1mssl_insecure[22m=on
+          Allow older less secure TLSv1 routines.
+
 #start_color
 #%start_color
 #start_color_*

diff --git a/src/globals.h b/src/globals.h
@@ -247,6 +247,7 @@ enum Vars {
 #define ssl_continue	getintvar(VAR_ssl_continue)
 #define ssl_depth	getintvar(VAR_ssl_depth)
 #define ssl_verbose	getintvar(VAR_ssl_verbose)
+#define ssl_insecure getintvar(VAR_ssl_insecure)
 #define status_attr	getattrvar(VAR_stat_attr)
 #define status_fields	getstdvar(VAR_stat_fields)
 #define status_height	getintvar(VAR_stat_height)

diff --git a/src/socket.c b/src/socket.c
@@ -677,11 +677,18 @@ static void init_ssl(void)
     SSL_load_error_strings();
     SSL_library_init();
     /* XXX seed PRNG */
+    if( ssl_insecure ) {
+    ssl_ctx = SSL_CTX_new(TLSv1_client_method());
+    } else {
     ssl_ctx = SSL_CTX_new(SSLv23_client_method());
+    }
     if (!ssl_ctx) {
 	ssl_err("SSL_CTX_new");
 	return;
     }
+    if( ssl_insecure ) {
+        SSL_CTX_set_security_level(ssl_ctx,0);
+    }
     if (!SSL_CTX_set_cipher_list(ssl_ctx, "ALL")) {
 	ssl_err("SSL_CTX_set_cipher_list");
 	return;

diff --git a/src/varlist.h b/src/varlist.h
@@ -154,6 +154,7 @@ varstr (VAR_ssl_ca_file,"ssl_ca_file",	NULL,		NULL)
 varflag(VAR_ssl_continue,"ssl_continue",TRUE,		NULL)
 varint (VAR_ssl_depth,	"ssl_depth",	10,		NULL)
 varflag(VAR_ssl_verbose,"ssl_verbose",	TRUE,		NULL)
+varflag(VAR_ssl_insecure,"ssl_insecure",TRUE,       NULL)
 varstr (VAR_stat_attr,	"status_attr",	NULL,		ch_status_attr)
 varstr (VAR_stat_fields,"status_fields",NULL,		ch_status_fields)
 varpos (VAR_stat_height,"status_height",1,		ch_status_height)