curl: ignore options asking for SSLv2 or SSLv3

Instead output a warning about it and continue with the defaults.

These SSL versions are typically not supported by the TLS libraries since a
long time back already since they are inherently insecure and broken. Asking
for them to be used will just cause an error to be returned slightly later.

In the unlikely event that a user's TLS library actually still supports these
protocol versions, this change might make the request a little less insecure.

Closes #6772

diff --git a/docs/cmdline-opts/sslv2.d b/docs/cmdline-opts/sslv2.d
index 773ab691ef70ea455ff99c7c87c4bebaf67aa16c..f9ee99d0d06c61e056cc04ed673f93f4211d039c 100644 (file)
--- a/docs/cmdline-opts/sslv2.d
+++ b/docs/cmdline-opts/sslv2.d
@@ -9,6 +9,5 @@ See-also: http1.1 http2
 Help: Use SSLv2
 Category: tls
 ---
-Forces curl to use SSL version 2 when negotiating with a remote SSL
-server. Sometimes curl is built without SSLv2 support. SSLv2 is widely
-considered insecure (see RFC 6176).
+This option previously asked curl to use SSLv2, but starting in curl 7.77.0 this
+instruction is ignored. SSLv2 is widely considered insecure (see RFC 6176).

diff --git a/docs/cmdline-opts/sslv3.d b/docs/cmdline-opts/sslv3.d
index 7beed8f81e3eb6a966a17a6e02c57da9ad4e152b..e8b2c35e874e4d17b29e4bf715776db136f35d5f 100644 (file)
--- a/docs/cmdline-opts/sslv3.d
+++ b/docs/cmdline-opts/sslv3.d
@@ -9,6 +9,6 @@ See-also: http1.1 http2
 Help: Use SSLv3
 Category: tls
 ---
-Forces curl to use SSL version 3 when negotiating with a remote SSL
-server. Sometimes curl is built without SSLv3 support. SSLv3 is widely
-considered insecure (see RFC 7568).
+This option previously asked curl to use SSLv3, but starting in curl 7.77.0
+this instruction is ignored. SSLv3 is widely considered insecure (see RFC
+7568).

diff --git a/src/tool_getparam.c b/src/tool_getparam.c
index 5de9b0a04ee0a73f069b698ee58d0e90da30fcee..ad89ea312fe556d9988e5976fc51e165bbfd8db9 100644 (file)
--- a/src/tool_getparam.c
+++ b/src/tool_getparam.c
@@ -1306,11 +1306,11 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
       break;
     case '2':
       /* SSL version 2 */
-      config->ssl_version = CURL_SSLVERSION_SSLv2;
+      warnf(global, "Ignores instruction to use SSLv2\n");
       break;
     case '3':
       /* SSL version 3 */
-      config->ssl_version = CURL_SSLVERSION_SSLv3;
+      warnf(global, "Ignores instruction to use SSLv3\n");
       break;
     case '4':
       /* IPv4 */