This is a follow-up to #1977160: Integrate this patch: allow calling code to specify sslv2 sslv3 tls. It uses the latest approach as listed in #1879970-29: drupal_http_request fails when remote server is using openssl v1.0.0.
It fixes a bug that is causing issues for linkchecker running against servers using an older version of OpenSSL. Not all uses of httprl are for a pre-known endpoint i.e. linkchecker. And by default httprl (nor D7 core) validates the SSL cert. So, let's disable SNI since it isn't needed. If someone wants to use it, they are already going to have to configure a stream_context.
| Comment | File | Size | Author |
|---|---|---|---|
| #10 | httprl-2337071-target-openssl-sni-disable.patch | 845 bytes | mikeytown2 |
| #1 | httprl-disable_SNI-2337071-1.patch | 978 bytes | heddn |
Comments
Comment #1
heddnComment #3
mikeytown2 commentedPushed to 6.x & 7.x
Comment #6
hass commentedShouldn't this not made depended on the broken openssl versions? Other non-broken ones should validate the certificate all times. This is security wise very risky as it allows to inject code and man in the middle attacks.
Comment #7
heddnFrom my research, Drupal core nor httprl has any support for SNI. We could probably open a feature request to add that support in both places. But I don't think we should back out this change until that support is added. Some discussion about is already in core's queue #1879970: drupal_http_request fails when remote server is using openssl v1.0.0.
Comment #10
mikeytown2 commentedLooks like the effected versions are from 1.0.0i to 1.0.1b
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665452
OPENSSL_VERSION_NUMBER format
0x1000009f = 1[0].0[0].0[0]i
0x1000102f = 1[0].0[0].1[0]b
http://stackoverflow.com/questions/9693614/how-to-check-if-installed-ope...
Patch should now only disable SNI checking if the openssl version in within that range.