wolfcrypt: Remove sslv2 support, at best was a stub and condition other older methods on WC config define #366
Conversation
…er older methods on WC config define
| if (!wget_strcasecmp_ascii(config.secure_protocol, "SSLv2")) { | ||
| method = SSLv2_client_method(); | ||
| } else if (!wget_strcasecmp_ascii(config.secure_protocol, "SSLv3")) { | ||
| if (!wget_strcasecmp_ascii(config.secure_protocol, "SSLv3") || !wget_strcasecmp_ascii(config.secure_protocol, "SSL")) { |
There was a problem hiding this comment.
| if (!wget_strcasecmp_ascii(config.secure_protocol, "SSLv3") || !wget_strcasecmp_ascii(config.secure_protocol, "SSL")) { | |
| if (!wget_strncasecmp_ascii(config.secure_protocol, "SSL", 3)) { |
There was a problem hiding this comment.
I can make this change, only issue is if someone specifies SSLv2 it won't tell them invalid option but they also won't get what they ask for. I assumed we would prefer fall to the default case of Missing TLS method. Confirm this is desired instead?
There was a problem hiding this comment.
You raise a good point. I just compared the WolfSSL code with our OpenSSL and GnuTLS implementations, that why I suggested the above. IMO, all three should behave semantically the same. But I now realize that the docs need to be changed and maybe in a follow-up PR, we need a bit of code deduplication.
So yes, please change the code as suggested above.
I take care of the docs later, and print a warning that SSLv3 is used instead of SSLv2 (if explicitly requested).
On modern wolfcrypt builds SSLv2_client_method only exists as a stub and only if #NO_OLD_TLS is not defined. I don't think SSLV2 was actually supported any time recently by it, so I have removed it completely. Otherwise you get a compiler error.
I also conditioned the other older ones (SSLv3->TLS V1.1) on the wolfcrypt NO_OLD_TLS flag not being defined as with it defined they are disabled per: https://www.wolfssl.com/documentation/manuals/wolfssl/chapter02.html. This way someone doesn't try to use SSLv3 for example and not understand why its not working, now it would return missing method error.
Finally, Added an SSL alias for SSLv3 as the comment at the top mentions this is how to specify V3, (guessing openssl copy) so to make the behavior match the comment (and I assume openssl) added the alias.
Happily gets my autobuild working https://github.com/mitchcapper/WIN64LinuxBuild/actions/workflows/tool_wget2_build.yml