[Pound Mailing List] [Patch] Wrong use of Fallback SCSV / TLS1.3 interoperability

This is a multi-part message in MIME format.

------=OPENWEBMAIL_ATT_0.934331851636188
Content-Type: text/plain;
	charset=iso-8859-1

Hi,

we just ran into problems after a backend server was upgraded to support TLS
1.3 while the openssl pound runs with only supports TLS up to 1.2. The
connection failed with "tlsv1 alert inappropriate fallback". It turned out
that pound incorrectly sets SSL_MODE_SEND_FALLBACK_SCSV on backend
connections. A client should set this flag only after a connection with a
server failed and the client now retries with a lower TLS version. It must not
be used by clients like pound, which rely on the TLS version negotiation built
into the TLS protocol. So just drop the three lines in config.c (patch attached).

[1] https://tools.ietf.org/html/rfc7507#section-1
[2]
https://github.com/openssl/openssl/blob/1d97c8435171a7af575f73c526d79e1ef0ee5960/ssl/ssl.h#L672
[3]
https://security.stackexchange.com/questions/70988/why-do-browsers-probe-and-fallback-or-why-ssl-mode-send-fallback-scsv

Regards,
Frank

------=OPENWEBMAIL_ATT_0.934331851636188
Content-Type: text/x-patch;
	name="pound-2.8-fallback_scsv.diff"
Content-Disposition: attachment; filename="pound-2.8-fallback_scsv.diff"
Content-Transfer-Encoding: base64

LS0tIGNvbmZpZy5jLm9yaWcJMjAxOC0wNS0xMSAxMjoxNjowNS4wMDAwMDAwMDAgKzAyMDAKKysr
IGNvbmZpZy5jCTIwMTgtMTItMjIgMjM6MTk6NTMuOTEyMjAzMTg4ICswMTAwCkBAIC0zNDcsOSAr
MzQ3LDYgQEAKICAgICAgICAgICAgIFNTTF9DVFhfc2V0X2FwcF9kYXRhKHJlcy0+Y3R4LCByZXMp
OwogICAgICAgICAgICAgU1NMX0NUWF9zZXRfdmVyaWZ5KHJlcy0+Y3R4LCBTU0xfVkVSSUZZX05P
TkUsIE5VTEwpOwogICAgICAgICAgICAgU1NMX0NUWF9zZXRfbW9kZShyZXMtPmN0eCwgU1NMX01P
REVfQVVUT19SRVRSWSk7Ci0jaWZkZWYgU1NMX01PREVfU0VORF9GQUxMQkFDS19TQ1NWCi0gICAg
ICAgICAgICBTU0xfQ1RYX3NldF9tb2RlKHJlcy0+Y3R4LCBTU0xfTU9ERV9TRU5EX0ZBTExCQUNL
X1NDU1YpOwotI2VuZGlmCiAgICAgICAgICAgICBTU0xfQ1RYX3NldF9vcHRpb25zKHJlcy0+Y3R4
LCBTU0xfT1BfQUxMKTsKICNpZmRlZiAgU1NMX09QX05PX0NPTVBSRVNTSU9OCiAgICAgICAgICAg
ICBTU0xfQ1RYX3NldF9vcHRpb25zKHJlcy0+Y3R4LCBTU0xfT1BfTk9fQ09NUFJFU1NJT04pOwo=

------=OPENWEBMAIL_ATT_0.934331851636188--

--
To unsubscribe send an email with subject unsubscribe to [email protected]
Please contact [email protected] for questions.