Skip to content

Warn about non-conformance when using old TLS versions. #11213

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anhu wants to merge 1 commit into
base: master
Choose a base branch
from
+15 −3
Open

Warn about non-conformance when using old TLS versions. #11213

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6013,7 +6013,7 @@ AC_ARG_ENABLE([errorqueue],

# SSLv3
AC_ARG_ENABLE([sslv3],
[AS_HELP_STRING([--enable-sslv3],[Enable SSL version 3.0 (default: disabled)])],
[AS_HELP_STRING([--enable-sslv3],[Enable SSL version 3.0 (default: disabled). WARNING: SSL 3.0 is deprecated by RFC 7568 and its use violates RFC 9846 and RFC 8996; such a build is not conformant with RFC 9846, RFC 8996 or RFC 9325])],
[ ENABLED_SSLV3=$enableval ],
[ ENABLED_SSLV3=no]
)
Expand All @@ -6030,24 +6030,26 @@ fi
if test "$ENABLED_SSLV3" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALLOW_SSLV3"
AC_MSG_WARN([SSL 3.0 (WOLFSSL_ALLOW_SSLV3) is enabled. SSL 3.0 is deprecated by RFC 7568 and RFC 8996, and RFC 9846 states it MUST NOT be negotiated for any reason. This build is NOT conformant with RFC 9846, RFC 8996 or RFC 9325.])
fi

# TLSv1.0
AC_ARG_ENABLE([tlsv10],
[AS_HELP_STRING([--enable-tlsv10],[Enable old TLS versions 1.0 (default: disabled)])],
[AS_HELP_STRING([--enable-tlsv10],[Enable old TLS version 1.0 (default: disabled). WARNING: TLS 1.0 is deprecated by RFC 8996 and its use violates RFC 9846; such a build is not conformant with RFC 9846, RFC 8996 or RFC 9325])],
[ ENABLED_TLSV10=$enableval ],
[ ENABLED_TLSV10=no ]
)

if test "$ENABLED_TLSV10" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALLOW_TLSV10"
AC_MSG_WARN([TLS 1.0 (WOLFSSL_ALLOW_TLSV10) is enabled. TLS 1.0 is deprecated by RFC 8996, and RFC 9846 states it MUST NOT be negotiated for any reason. This build is NOT conformant with RFC 9846, RFC 8996 or RFC 9325.])
fi


# OLD TLS
AC_ARG_ENABLE([oldtls],
[AS_HELP_STRING([--enable-oldtls],[Enable old TLS versions < 1.2 (default: disabled)])],
[AS_HELP_STRING([--enable-oldtls],[Enable old TLS versions < 1.2 (default: disabled). WARNING: TLS 1.1 and earlier are deprecated by RFC 8996, and RFC 9846 states that SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 MUST NOT be negotiated for any reason; such a build is not conformant with RFC 9846, RFC 8996 or RFC 9325])],
[ ENABLED_OLD_TLS=$enableval ],
[ ENABLED_OLD_TLS=no ]
)
Expand Down Expand Up @@ -14087,3 +14089,13 @@ echo "Note: Make sure your application includes \"wolfssl/options.h\" before any
echo " You can define \"WOLFSSL_USE_OPTIONS_H\" in your application to include this automatically."
fi
if test "$ENABLED_OLD_TLS" = "yes"
then
echo ""
echo "WARNING: This build enables old TLS versions (< 1.2). TLS 1.1 and earlier"
echo " are deprecated by RFC 8996, and RFC 9846 states that"
echo " SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 MUST NOT be negotiated for"
echo " any reason. This build is NOT conformant with RFC 9846, RFC 8996"
echo " or RFC 9325."
fi
Loading