Support internal "only TLS/1.0" option for tlscheck.

Expand CBC filter on macOS.

Add support for --tls10 and --no-cbc options with tlscheck.

diff --git a/cups/http-private.h b/cups/http-private.h
index 7c39c045a6f32720c79c280daddb790187b6b479..00afed0df123382687ff4076eb8068514d19d1af 100644 (file)
--- a/cups/http-private.h
+++ b/cups/http-private.h
@@ -185,6 +185,7 @@ extern "C" {
 #define _HTTP_TLS_ALLOW_DH     4       /* Allow DH/DHE key negotiation */
 #define _HTTP_TLS_DENY_TLS10   16      /* Deny TLS 1.0 */
 #define _HTTP_TLS_DENY_CBC     32      /* Deny CBC cipher suites */
+#define _HTTP_TLS_ONLY_TLS10    64      /* Only use TLS 1.0 */
 
 
 /*

diff --git a/cups/tls-darwin.c b/cups/tls-darwin.c
index df952cb2987b4a7dc2cf77679fd4b2339dde4794..d2d3687a1134998afcb2b2419ecd8efd684598a7 100644 (file)
--- a/cups/tls-darwin.c
+++ b/cups/tls-darwin.c
@@ -1227,6 +1227,12 @@ _httpTLSStart(http_t *http)              /* I - HTTP connection */
 
     error = SSLSetProtocolVersionMin(http->tls, minProtocol);
     DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMin(%d), error=%d", minProtocol, (int)error));
+
+    if (!error && (tls_options & _HTTP_TLS_ONLY_TLS10))
+    {
+      error = SSLSetProtocolVersionMax(http->tls, kTLSProtocol1);
+      DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMax(kTLSProtocol1), error=%d", (int)error));
+    }
   }
 
 #  if HAVE_SSLSETENABLEDCIPHERS
@@ -1369,6 +1375,9 @@ _httpTLSStart(http_t *http)               /* I - HTTP connection */
           case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 :
           case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 :
           case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 :
+          case TLS_RSA_WITH_3DES_EDE_CBC_SHA :
+          case TLS_RSA_WITH_AES_128_CBC_SHA :
+          case TLS_RSA_WITH_AES_256_CBC_SHA :
               if (tls_options & _HTTP_TLS_DENY_CBC)
              {
                DEBUG_printf(("4_httpTLSStart: Excluding CBC cipher suite %d", supported[i]));

diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index d77e20789c37c7020929f223baa9344a64d5fe98..3f13760b2b0c3b40d3dd6e947331dda57ca6321f 100644 (file)
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -1509,6 +1509,8 @@ _httpTLSStart(http_t *http)               /* I - Connection to server */
     strlcat(priority_string, ":+VERS-TLS-ALL:-VERS-TLS1.0:-VERS-SSL3.0", sizeof(priority_string));
   else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
     strlcat(priority_string, ":+VERS-TLS-ALL", sizeof(priority_string));
+  else if (tls_options & _HTTP_TLS_ONLY_TLS10)
+    strlcat(priority_string, ":-VERS-TLS-ALL:-VERS-SSL3.0:+VERS-TLS1.0", sizeof(priority_string));
   else
     strlcat(priority_string, ":+VERS-TLS-ALL:-VERS-SSL3.0", sizeof(priority_string));
 

diff --git a/cups/tlscheck.c b/cups/tlscheck.c
index 32cbcca17017ac430c897728d7db3d7a57b0e84b..997e7aaf7efa75844eb1600c87343bcce49ed712 100644 (file)
--- a/cups/tlscheck.c
+++ b/cups/tlscheck.c
@@ -1,7 +1,7 @@
 /*
  * TLS check program for CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
+ * Copyright 2007-2017 by Apple Inc.
  * Copyright 1997-2006 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -82,10 +82,18 @@ main(int  argc,                             /* I - Number of command-line arguments */
     {
       tls_options |= _HTTP_TLS_ALLOW_DH;
     }
+    else if (!strcmp(argv[i], "--no-cbc"))
+    {
+      tls_options |= _HTTP_TLS_DENY_CBC;
+    }
     else if (!strcmp(argv[i], "--no-tls10"))
     {
       tls_options |= _HTTP_TLS_DENY_TLS10;
     }
+    else if (!strcmp(argv[i], "--tls10"))
+    {
+      tls_options |= _HTTP_TLS_ONLY_TLS10;
+    }
     else if (!strcmp(argv[i], "--rc4"))
     {
       tls_options |= _HTTP_TLS_ALLOW_RC4;
@@ -729,8 +737,10 @@ usage(void)
   puts("");
   puts("Options:");
   puts("  --dh        Allow DH/DHE key exchange");
+  puts("  --no-cbc    Disable CBC cipher suites");
   puts("  --no-tls10  Disable TLS/1.0");
   puts("  --rc4       Allow RC4 encryption");
+  puts("  --tls10     Only use TLS/1.0");
   puts("  --verbose   Be verbose");
   puts("  -4          Connect using IPv4 addresses only");
   puts("  -6          Connect using IPv6 addresses only");