|
 |
22d06c |
diff -up evolution-data-server-3.8.5/camel/camel.c.poodle-enable-tls-for-ssl evolution-data-server-3.8.5/camel/camel.c
|
|
|
22d06c |
--- evolution-data-server-3.8.5/camel/camel.c.poodle-enable-tls-for-ssl 2013-08-11 00:00:52.000000000 +0200
|
|
|
22d06c |
+++ evolution-data-server-3.8.5/camel/camel.c 2014-11-12 15:45:10.939371073 +0100
|
|
|
22d06c |
@@ -100,6 +100,9 @@ camel_init (const gchar *configdir,
|
|
|
22d06c |
gchar *nss_configdir = NULL;
|
|
|
22d06c |
gchar *nss_sql_configdir = NULL;
|
|
|
22d06c |
SECStatus status = SECFailure;
|
|
|
22d06c |
+#if NSS_VMAJOR > 3 || (NSS_VMAJOR == 3 && NSS_VMINOR >= 14)
|
|
|
22d06c |
+ SSLVersionRange versionStream;
|
|
|
22d06c |
+#endif
|
|
|
22d06c |
|
|
|
22d06c |
#if NSS_VMAJOR < 3 || (NSS_VMAJOR == 3 && NSS_VMINOR < 14)
|
|
|
22d06c |
/* NSS pre-3.14 has most of the ciphers disabled, thus enable
|
|
|
22d06c |
@@ -212,8 +215,14 @@ skip_nss_init:
|
|
|
22d06c |
|
|
|
22d06c |
SSL_OptionSetDefault (SSL_ENABLE_SSL2, v2_enabled ? PR_TRUE : PR_FALSE);
|
|
|
22d06c |
SSL_OptionSetDefault (SSL_V2_COMPATIBLE_HELLO, PR_FALSE);
|
|
|
22d06c |
+#if NSS_VMAJOR < 3 || (NSS_VMAJOR == 3 && NSS_VMINOR < 14)
|
|
|
22d06c |
SSL_OptionSetDefault (SSL_ENABLE_SSL3, PR_TRUE);
|
|
|
22d06c |
- SSL_OptionSetDefault (SSL_ENABLE_TLS, PR_TRUE);
|
|
|
22d06c |
+ SSL_OptionSetDefault (SSL_ENABLE_TLS, PR_TRUE); /* Enable TLSv1.0 */
|
|
|
22d06c |
+#else
|
|
|
22d06c |
+ /* Enable all SSL/TLS versions supported by NSS (this API is for SSLv3 and newer). */
|
|
|
22d06c |
+ SSL_VersionRangeGetSupported (ssl_variant_stream, &versionStream);
|
|
|
22d06c |
+ SSL_VersionRangeSetDefault (ssl_variant_stream, &versionStream);
|
|
|
22d06c |
+#endif
|
|
|
22d06c |
|
|
|
22d06c |
PR_Unlock (nss_initlock);
|
|
|
22d06c |
|
|
|
22d06c |
diff -up evolution-data-server-3.8.5/camel/camel-network-service.c.poodle-enable-tls-for-ssl evolution-data-server-3.8.5/camel/camel-network-service.c
|
|
|
22d06c |
--- evolution-data-server-3.8.5/camel/camel-network-service.c.poodle-enable-tls-for-ssl 2014-11-12 15:55:06.542380733 +0100
|
|
|
22d06c |
+++ evolution-data-server-3.8.5/camel/camel-network-service.c 2014-11-12 15:55:19.373322744 +0100
|
|
|
22d06c |
@@ -324,7 +324,8 @@ network_service_connect_sync (CamelNetwo
|
|
|
22d06c |
stream = camel_tcp_stream_ssl_new (
|
|
|
22d06c |
session, host,
|
|
|
22d06c |
CAMEL_TCP_STREAM_SSL_ENABLE_SSL2 |
|
|
|
22d06c |
- CAMEL_TCP_STREAM_SSL_ENABLE_SSL3);
|
|
|
22d06c |
+ CAMEL_TCP_STREAM_SSL_ENABLE_SSL3 |
|
|
|
22d06c |
+ CAMEL_TCP_STREAM_SSL_ENABLE_TLS);
|
|
|
22d06c |
break;
|
|
|
22d06c |
|
|
|
22d06c |
default:
|
|
|
22d06c |
diff -up evolution-data-server-3.8.5/camel/camel-tcp-stream-ssl.c.poodle-enable-tls-for-ssl evolution-data-server-3.8.5/camel/camel-tcp-stream-ssl.c
|
|
|
22d06c |
--- evolution-data-server-3.8.5/camel/camel-tcp-stream-ssl.c.poodle-enable-tls-for-ssl 2013-08-11 00:00:52.000000000 +0200
|
|
|
22d06c |
+++ evolution-data-server-3.8.5/camel/camel-tcp-stream-ssl.c 2014-11-12 15:45:10.939371073 +0100
|
|
|
22d06c |
@@ -43,6 +43,8 @@
|
|
|
22d06c |
#include <sslerr.h>
|
|
|
22d06c |
#include "nss.h" /* Don't use <> here or it will include the system nss.h instead */
|
|
|
22d06c |
#include <ssl.h>
|
|
|
22d06c |
+#include <sslt.h>
|
|
|
22d06c |
+#include <sslproto.h>
|
|
|
22d06c |
#include <cert.h>
|
|
|
22d06c |
#include <certdb.h>
|
|
|
22d06c |
#include <pk11func.h>
|
|
|
22d06c |
@@ -545,6 +547,9 @@ enable_ssl (CamelTcpStreamSSL *ssl,
|
|
|
22d06c |
{
|
|
|
22d06c |
PRFileDesc *ssl_fd;
|
|
|
22d06c |
static gchar v2_enabled = -1;
|
|
|
22d06c |
+#if NSS_VMAJOR > 3 || (NSS_VMAJOR == 3 && NSS_VMINOR >= 14)
|
|
|
22d06c |
+ SSLVersionRange versionStreamSup, versionStream;
|
|
|
22d06c |
+#endif
|
|
|
22d06c |
|
|
|
22d06c |
g_assert (fd != NULL);
|
|
|
22d06c |
|
|
|
22d06c |
@@ -575,6 +580,7 @@ enable_ssl (CamelTcpStreamSSL *ssl,
|
|
|
22d06c |
SSL_OptionSet (ssl_fd, SSL_V2_COMPATIBLE_HELLO, PR_FALSE);
|
|
|
22d06c |
}
|
|
|
22d06c |
|
|
|
22d06c |
+#if NSS_VMAJOR < 3 || (NSS_VMAJOR == 3 && NSS_VMINOR < 14)
|
|
|
22d06c |
if (ssl->priv->flags & CAMEL_TCP_STREAM_SSL_ENABLE_SSL3)
|
|
|
22d06c |
SSL_OptionSet (ssl_fd, SSL_ENABLE_SSL3, PR_TRUE);
|
|
|
22d06c |
else
|
|
|
22d06c |
@@ -585,6 +591,29 @@ enable_ssl (CamelTcpStreamSSL *ssl,
|
|
|
22d06c |
else
|
|
|
22d06c |
SSL_OptionSet (ssl_fd, SSL_ENABLE_TLS, PR_FALSE);
|
|
|
22d06c |
|
|
|
22d06c |
+#else
|
|
|
22d06c |
+ SSL_VersionRangeGetSupported (ssl_variant_stream, &versionStreamSup);
|
|
|
22d06c |
+
|
|
|
22d06c |
+ if (ssl->priv->flags & CAMEL_TCP_STREAM_SSL_ENABLE_SSL3)
|
|
|
22d06c |
+ versionStream.min = SSL_LIBRARY_VERSION_3_0;
|
|
|
22d06c |
+ else
|
|
|
22d06c |
+ versionStream.min = SSL_LIBRARY_VERSION_TLS_1_0;
|
|
|
22d06c |
+
|
|
|
22d06c |
+ if (ssl->priv->flags & CAMEL_TCP_STREAM_SSL_ENABLE_TLS)
|
|
|
22d06c |
+ versionStream.max = versionStreamSup.max;
|
|
|
22d06c |
+ else
|
|
|
22d06c |
+ versionStream.max = SSL_LIBRARY_VERSION_3_0;
|
|
|
22d06c |
+
|
|
|
22d06c |
+ if (versionStream.max < versionStream.min) {
|
|
|
22d06c |
+ PRUint16 tmp;
|
|
|
22d06c |
+
|
|
|
22d06c |
+ tmp = versionStream.max;
|
|
|
22d06c |
+ versionStream.max = versionStream.min;
|
|
|
22d06c |
+ versionStream.min = tmp;
|
|
|
22d06c |
+ }
|
|
|
22d06c |
+
|
|
|
22d06c |
+ SSL_VersionRangeSet (ssl_fd, &versionStream);
|
|
|
22d06c |
+#endif
|
|
|
22d06c |
SSL_SetURL (ssl_fd, ssl->priv->expected_host);
|
|
|
22d06c |
|
|
|
22d06c |
/* NSS provides a default implementation for the SSL_GetClientAuthDataHook callback
|