Allow for conditional compilation of SSL 2.0 client hello support

This allows to completely remove SSL 2.0 support by calling configure
with the '--disable-ssl2-support' option.

Relates #97

diff --git a/configure.ac b/configure.ac
index 6ab9cdcbf7ec5ca7b27c47f10b240803f0cbce75..ff47b6289a8c7922311f0516ef0ec9965c8f3e72 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -942,7 +942,8 @@ AC_MSG_NOTICE([Optional features:
 (note that included applications might not compile properly
 if features are disabled)
 
-  SSL3 support:         $ac_enable_ssl3
+  SSL3.0 support:       $ac_enable_ssl3
+  SSL2.0 client hello:  $ac_enable_ssl2
   DTLS-SRTP support:    $ac_enable_srtp
   ALPN support:         $ac_enable_alpn
   OCSP support:         $ac_enable_ocsp

diff --git a/lib/buffers.c b/lib/buffers.c
index e43a0c4b5d920816e89c575e94c8441dcc220551..f0faa709aebc29d3f307af368df1876aa0dd8428 100644 (file)
--- a/lib/buffers.c
+++ b/lib/buffers.c
@@ -887,6 +887,7 @@ parse_handshake_header(gnutls_session_t session, mbuffer_st * bufel,
        dataptr = _mbuffer_get_udata_ptr(bufel);
 
        /* if reading a client hello of SSLv2 */
+#ifdef ENABLE_SSL2
        if (unlikely
            (!IS_DTLS(session)
             && bufel->htype == GNUTLS_HANDSHAKE_CLIENT_HELLO_V2)) {
@@ -903,7 +904,9 @@ parse_handshake_header(gnutls_session_t session, mbuffer_st * bufel,
                hsk->sequence = 0;
                hsk->start_offset = 0;
                hsk->end_offset = hsk->length;
-       } else {                /* TLS or DTLS handshake headers */
+       } else
+#endif
+       {               /* TLS or DTLS handshake headers */
 
 
                hsk->htype = dataptr[0];
@@ -1075,7 +1078,10 @@ inline static int cmp_hsk_types(gnutls_handshake_description_t expected,
                                gnutls_handshake_description_t recvd)
 {
        if ((expected != GNUTLS_HANDSHAKE_CLIENT_HELLO
-            || recvd != GNUTLS_HANDSHAKE_CLIENT_HELLO_V2)
+#ifdef ENABLE_SSL2
+            || recvd != GNUTLS_HANDSHAKE_CLIENT_HELLO_V2
+#endif
+            )
            && (expected != recvd))
                return 0;
 

diff --git a/lib/debug.c b/lib/debug.c
index 6ab12c6943494a0f2f0c3c51bfcdbefe456832fc..252f2470a69eb98d9d5868f05605e9fa54cfb59f 100644 (file)
--- a/lib/debug.c
+++ b/lib/debug.c
@@ -90,9 +90,11 @@ const char
        case GNUTLS_HANDSHAKE_CLIENT_HELLO:
                return "CLIENT HELLO";
                break;
+#ifdef ENABLE_SSL2
        case GNUTLS_HANDSHAKE_CLIENT_HELLO_V2:
                return "SSL2 CLIENT HELLO";
                break;
+#endif
        case GNUTLS_HANDSHAKE_SERVER_HELLO:
                return "SERVER HELLO";
                break;

diff --git a/lib/handshake.c b/lib/handshake.c
index 0f65a67c2cd8c4e88936cadbfcd8517bb7439ce0..965698e3ca243e99f3a1a286b6b970d4a8f194f0 100644 (file)
--- a/lib/handshake.c
+++ b/lib/handshake.c
@@ -1469,12 +1469,14 @@ _gnutls_recv_handshake(gnutls_session_t session,
        case GNUTLS_HANDSHAKE_CLIENT_HELLO_V2:
        case GNUTLS_HANDSHAKE_CLIENT_HELLO:
        case GNUTLS_HANDSHAKE_SERVER_HELLO:
+#ifdef ENABLE_SSL2
                if (hsk.htype == GNUTLS_HANDSHAKE_CLIENT_HELLO_V2)
                        ret =
                            _gnutls_read_client_hello_v2(session,
                                                         hsk.data.data,
                                                         hsk.data.length);
                else
+#endif
                        ret =
                            recv_hello(session, hsk.data.data,
                                        hsk.data.length);

diff --git a/lib/record.c b/lib/record.c
index aae1a1443a85d4f1daa36b345d1c53b22132be5f..ad609676622a7ca69d194fc5c8a09084cd7b4b31 100644 (file)
--- a/lib/record.c
+++ b/lib/record.c
@@ -61,7 +61,9 @@ struct tls_record_st {
        uint16_t packet_size;   /* header_size + length */
        content_type_t type;
        uint16_t epoch;         /* valid in DTLS only */
+#ifdef ENABLE_SSL2
        unsigned v2:1;          /* whether an SSLv2 client hello */
+#endif
        /* the data */
 };
 
@@ -948,6 +950,7 @@ record_read_headers(gnutls_session_t session,
         * version 2 message 
         */
 
+#ifdef ENABLE_SSL2
        if (htype == GNUTLS_HANDSHAKE_CLIENT_HELLO
            && type == GNUTLS_HANDSHAKE && headers[0] > 127
            && !(IS_DTLS(session))) {
@@ -977,9 +980,13 @@ record_read_headers(gnutls_session_t session,
                     session, _gnutls_packet2str(record->type),
                     record->length);
 
-       } else {
+       } else
+#endif
+       {
                /* dtls version 1.0 and TLS version 1.x */
+#ifdef ENABLE_SSL2
                record->v2 = 0;
+#endif
 
                record->type = headers[0];
                record->version[0] = headers[1];
@@ -1290,9 +1297,12 @@ _gnutls_recv_in_buffers(gnutls_session_t session, content_type_t type,
                goto begin;
        }
 
+#ifdef ENABLE_SSL2
        if (record.v2) {
                decrypted->htype = GNUTLS_HANDSHAKE_CLIENT_HELLO_V2;
-       } else {
+       } else
+#endif
+       {
                uint8_t *p = _mbuffer_get_udata_ptr(decrypted);
                decrypted->htype = p[0];
        }

diff --git a/lib/sslv2_compat.c b/lib/sslv2_compat.c
index f742a098d8a6ccfb9e1552d89835928eaab4de4f..f85fb8c163626bee8ea4b1d65d018ebaa7f16efd 100644 (file)
--- a/lib/sslv2_compat.c
+++ b/lib/sslv2_compat.c
@@ -41,6 +41,7 @@
 #include "sslv2_compat.h"
 #include "constate.h"
 
+#ifdef ENABLE_SSL2
 /* This selects the best supported ciphersuite from the ones provided */
 static int
 _gnutls_handshake_select_v2_suite(gnutls_session_t session,
@@ -254,3 +255,4 @@ _gnutls_read_client_hello_v2(gnutls_session_t session, uint8_t * data,
 
        return sret;
 }
+#endif

diff --git a/m4/hooks.m4 b/m4/hooks.m4
index 9d057951d9171272da7021bf4bc489cccc5c4924..08499cdcd9425ea6b7a8092249fe1bfbde6b85b8 100644 (file)
--- a/m4/hooks.m4
+++ b/m4/hooks.m4
@@ -155,6 +155,21 @@ LIBTASN1_MINIMUM=4.3
   fi
   AM_CONDITIONAL(ENABLE_SSL3, test "$ac_enable_ssl3" != "no")
 
+  ac_enable_ssl2=yes
+  AC_MSG_CHECKING([whether to disable the SSL 2.0 client hello])
+  AC_ARG_ENABLE(ssl2-support,
+    AS_HELP_STRING([--disable-ssl2-support],
+                   [disable support for the SSL 2.0 client hello]),
+    ac_enable_ssl2=$enableval)
+  if test x$ac_enable_ssl2 != xno; then
+   AC_MSG_RESULT(no)
+   AC_DEFINE([ENABLE_SSL2], 1, [enable SSL2.0 support for client hello])
+  else
+   ac_full=0
+   AC_MSG_RESULT(yes)
+  fi
+  AM_CONDITIONAL(ENABLE_SSL3, test "$ac_enable_ssl2" != "no")
+
   ac_enable_srtp=yes
   AC_MSG_CHECKING([whether to disable DTLS-SRTP extension])
   AC_ARG_ENABLE(dtls-srtp-support,