From owner-svn-src-all@FreeBSD.ORG Wed Mar 25 18:56:38 2015 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id B55672B7; Wed, 25 Mar 2015 18:56:38 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 9FEA71C8; Wed, 25 Mar 2015 18:56:38 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t2PIucxP038710; Wed, 25 Mar 2015 18:56:38 GMT (envelope-from jkim@FreeBSD.org) Received: (from jkim@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t2PIuaMv038702; Wed, 25 Mar 2015 18:56:36 GMT (envelope-from jkim@FreeBSD.org) Message-Id: <201503251856.t2PIuaMv038702@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: jkim set sender to jkim@FreeBSD.org using -f From: Jung-uk Kim Date: Wed, 25 Mar 2015 18:56:36 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r280630 - in head: lib/libfetch sys/sys usr.bin/fetch X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Mar 2015 18:56:38 -0000 Author: jkim Date: Wed Mar 25 18:56:36 2015 New Revision: 280630 URL: https://svnweb.freebsd.org/changeset/base/280630 Log: Remove defunct SSLv2 support from fetch(1) and fetch(3). Modified: head/lib/libfetch/common.c head/lib/libfetch/fetch.3 head/sys/sys/param.h head/usr.bin/fetch/fetch.1 head/usr.bin/fetch/fetch.c Modified: head/lib/libfetch/common.c ============================================================================== --- head/lib/libfetch/common.c Wed Mar 25 18:02:06 2015 (r280629) +++ head/lib/libfetch/common.c Wed Mar 25 18:56:36 2015 (r280630) @@ -672,9 +672,7 @@ fetch_ssl_setup_transport_layer(SSL_CTX { long ssl_ctx_options; - ssl_ctx_options = SSL_OP_ALL | SSL_OP_NO_TICKET; - if (getenv("SSL_ALLOW_SSL2") == NULL) - ssl_ctx_options |= SSL_OP_NO_SSLv2; + ssl_ctx_options = SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_TICKET; if (getenv("SSL_ALLOW_SSL3") == NULL) ssl_ctx_options |= SSL_OP_NO_SSLv3; if (getenv("SSL_NO_TLS1") != NULL) Modified: head/lib/libfetch/fetch.3 ============================================================================== --- head/lib/libfetch/fetch.3 Wed Mar 25 18:02:06 2015 (r280629) +++ head/lib/libfetch/fetch.3 Wed Mar 25 18:56:36 2015 (r280630) @@ -26,7 +26,7 @@ .\" .\" $FreeBSD$ .\" -.Dd October 15, 2014 +.Dd March 25, 2015 .Dt FETCH 3 .Os .Sh NAME @@ -441,10 +441,8 @@ By default allows TLSv1 and newer when negotiating the connecting with the remote peer. You can change this behavior by setting the -.Ev SSL_ALLOW_SSL2 -and .Ev SSL_ALLOW_SSL3 -environment variables to allow SSLv2 and SSLv3, respectively, and +environment variable to allow SSLv3 and .Ev SSL_NO_TLS1 , .Ev SSL_NO_TLS1_1 and .Ev SSL_NO_TLS1_2 @@ -646,8 +644,6 @@ which proxies should not be used. Same as .Ev NO_PROXY , for compatibility. -.It Ev SSL_ALLOW_SSL2 -Allow SSL version 2 when negotiating the connection (not recommended). .It Ev SSL_ALLOW_SSL3 Allow SSL version 3 when negotiating the connection (not recommended). .It Ev SSL_CA_CERT_FILE Modified: head/sys/sys/param.h ============================================================================== --- head/sys/sys/param.h Wed Mar 25 18:02:06 2015 (r280629) +++ head/sys/sys/param.h Wed Mar 25 18:56:36 2015 (r280630) @@ -58,7 +58,7 @@ * in the range 5 to 9. */ #undef __FreeBSD_version -#define __FreeBSD_version 1100066 /* Master, propagated to newvers */ +#define __FreeBSD_version 1100067 /* Master, propagated to newvers */ /* * __FreeBSD_kernel__ indicates that this system uses the kernel of FreeBSD, Modified: head/usr.bin/fetch/fetch.1 ============================================================================== --- head/usr.bin/fetch/fetch.1 Wed Mar 25 18:02:06 2015 (r280629) +++ head/usr.bin/fetch/fetch.1 Wed Mar 25 18:56:36 2015 (r280630) @@ -30,7 +30,7 @@ .\" .\" $FreeBSD$ .\" -.Dd January 28, 2014 +.Dd March 25, 2015 .Dt FETCH 1 .Os .Sh NAME @@ -39,7 +39,6 @@ .Sh SYNOPSIS .Nm .Op Fl 146AadFlMmnPpqRrsUv -.Op Fl -allow-sslv2 .Op Fl B Ar bytes .Op Fl -bind-address= Ns Ar host .Op Fl -ca-cert= Ns Ar file @@ -113,9 +112,6 @@ Some broken Web sites will return a redi error when the requested object does not exist. .It Fl a , -retry Automatically retry the transfer upon soft failures. -.It Fl -allow-sslv2 -[SSL] -Allow SSL version 2 when negotiating the connection. .It Fl B Ar bytes , Fl -buffer-size= Ns Ar bytes Specify the read buffer size in bytes. The default is 16,384 bytes. @@ -350,7 +346,6 @@ for a description of additional environm .Ev NETRC , .Ev NO_PROXY , .Ev no_proxy , -.Ev SSL_ALLOW_SSL2 , .Ev SSL_CA_CERT_FILE , .Ev SSL_CA_CERT_PATH , .Ev SSL_CLIENT_CERT_FILE , Modified: head/usr.bin/fetch/fetch.c ============================================================================== --- head/usr.bin/fetch/fetch.c Wed Mar 25 18:02:06 2015 (r280629) +++ head/usr.bin/fetch/fetch.c Wed Mar 25 18:56:36 2015 (r280630) @@ -102,7 +102,6 @@ enum options OPTION_HTTP_REFERER, OPTION_HTTP_USER_AGENT, OPTION_NO_PROXY, - OPTION_SSL_ALLOW_SSL2, OPTION_SSL_CA_CERT_FILE, OPTION_SSL_CA_CERT_PATH, OPTION_SSL_CLIENT_CERT_FILE, @@ -154,7 +153,6 @@ static struct option longopts[] = { "referer", required_argument, NULL, OPTION_HTTP_REFERER }, { "user-agent", required_argument, NULL, OPTION_HTTP_USER_AGENT }, { "no-proxy", required_argument, NULL, OPTION_NO_PROXY }, - { "allow-sslv2", no_argument, NULL, OPTION_SSL_ALLOW_SSL2 }, { "ca-cert", required_argument, NULL, OPTION_SSL_CA_CERT_FILE }, { "ca-path", required_argument, NULL, OPTION_SSL_CA_CERT_PATH }, { "cert", required_argument, NULL, OPTION_SSL_CLIENT_CERT_FILE }, @@ -845,17 +843,17 @@ static void usage(void) { fprintf(stderr, "%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n", -"usage: fetch [-146AadFlMmnPpqRrsUv] [--allow-sslv2] [-B bytes]", -" [--bind-address=host] [--ca-cert=file] [--ca-path=dir] [--cert=file]", -" [--crl=file] [-i file] [--key=file] [-N file] [--no-passive]", -" [--no-proxy=list] [--no-sslv3] [--no-tlsv1] [--no-verify-hostname]", -" [--no-verify-peer] [-o file] [--referer=URL] [-S bytes] [-T seconds]", +"usage: fetch [-146AadFlMmnPpqRrsUv] [-B bytes] [--bind-address=host]", +" [--ca-cert=file] [--ca-path=dir] [--cert=file] [--crl=file]", +" [-i file] [--key=file] [-N file] [--no-passive] [--no-proxy=list]", +" [--no-sslv3] [--no-tlsv1] [--no-verify-hostname] [--no-verify-peer]", +" [-o file] [--referer=URL] [-S bytes] [-T seconds]", " [--user-agent=agent-string] [-w seconds] URL ...", -" fetch [-146AadFlMmnPpqRrsUv] [--allow-sslv2] [-B bytes]", -" [--bind-address=host] [--ca-cert=file] [--ca-path=dir] [--cert=file]", -" [--crl=file] [-i file] [--key=file] [-N file] [--no-passive]", -" [--no-proxy=list] [--no-sslv3] [--no-tlsv1] [--no-verify-hostname]", -" [--no-verify-peer] [-o file] [--referer=URL] [-S bytes] [-T seconds]", +" fetch [-146AadFlMmnPpqRrsUv] [-B bytes] [--bind-address=host]", +" [--ca-cert=file] [--ca-path=dir] [--cert=file] [--crl=file]", +" [-i file] [--key=file] [-N file] [--no-passive] [--no-proxy=list]", +" [--no-sslv3] [--no-tlsv1] [--no-verify-hostname] [--no-verify-peer]", +" [-o file] [--referer=URL] [-S bytes] [-T seconds]", " [--user-agent=agent-string] [-w seconds] -h host -f file [-c dir]"); } @@ -1004,9 +1002,6 @@ main(int argc, char *argv[]) case OPTION_NO_PROXY: setenv("NO_PROXY", optarg, 1); break; - case OPTION_SSL_ALLOW_SSL2: - setenv("SSL_ALLOW_SSL2", "", 1); - break; case OPTION_SSL_CA_CERT_FILE: setenv("SSL_CA_CERT_FILE", optarg, 1); break;