From b79b996ff7859f06635034179dfe231beb2e3b63 Mon Sep 17 00:00:00 2001 From: deuce <> Date: Thu, 23 Jan 2020 17:10:55 +0000 Subject: [PATCH] Disable all TLS_RSA suites since some secirity tests will auto-fail when they're enabled even if there is no usable oracle (ie: ssllabs.com). This is easier than explaining to everyone who worries about it. Hopefully there's nothing left that requires TLS_RSA suites from the client. --- 3rdp/build/GNUmakefile | 3 ++- 3rdp/build/cl-no-RSA-suites.patch | 11 +++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 3rdp/build/cl-no-RSA-suites.patch diff --git a/3rdp/build/GNUmakefile b/3rdp/build/GNUmakefile index dfffc1e727..257e9a2919 100644 --- a/3rdp/build/GNUmakefile +++ b/3rdp/build/GNUmakefile @@ -67,7 +67,7 @@ $(CRYPT_SRC): | $(3RDPSRCDIR) $(CRYPT_IDIR): | $(3RDPODIR) $(QUIET)$(IFNOTEXIST) mkdir $(CRYPT_IDIR) -$(CRYPTLIB_BUILD): $(3RDP_ROOT)$(DIRSEP)dist/cryptlib.zip $(3RDP_ROOT)$(DIRSEP)build/terminal-params.patch $(3RDP_ROOT)$(DIRSEP)build/cl-mingw32-static.patch $(3RDP_ROOT)$(DIRSEP)build/cl-ranlib.patch $(3RDP_ROOT)$(DIRSEP)build/cl-win32-noasm.patch $(3RDP_ROOT)$(DIRSEP)build/cl-zz-country.patch $(3RDP_ROOT)$(DIRSEP)build/cl-algorithms.patch $(3RDP_ROOT)$(DIRSEP)build/cl-allow-duplicate-ext.patch $(3RDP_ROOT)$(DIRSEP)build/cl-macosx-minver.patch $(3RDP_ROOT)$(DIRSEP)build/cl-endian.patch $(3RDP_ROOT)$(DIRSEP)build/cl-cryptodev.patch $(3RDP_ROOT)$(DIRSEP)build/cl-posix-me-gently.patch $(3RDP_ROOT)$(DIRSEP)build/cl-tpm-linux.patch $(3RDP_ROOT)$(DIRSEP)build/cl-PAM-noprompts.patch $(3RDP_ROOT)$(DIRSEP)build/cl-zlib.patch $(3RDP_ROOT)$(DIRSEP)build/Dynamic-linked-static-lib.patch $(3RDP_ROOT)$(DIRSEP)build/SSL-fix.patch $(3RDP_ROOT)$(DIRSEP)build/cl-bigger-maxattribute.patch $(3RDP_ROOT)$(DIRSEP)build/cl-vcxproj.patch $(3RDP_ROOT)$(DIRSEP)build/cl-mingw-vcver.patch $(3RDP_ROOT)$(DIRSEP)build/cl-win32-build-fix.patch $(3RDP_ROOT)$(DIRSEP)build/cl-gcc-non-const-time-val.patch $(3RDP_ROOT)$(DIRSEP)build/cl-no-odbc.patch $(3RDP_ROOT)$(DIRSEP)build/cl-suites.patch $(3RDP_ROOT)$(DIRSEP)build/cl-noasm-defines.patch $(3RDP_ROOT)$(DIRSEP)build/cl-bn-noasm64-fix.patch | $(CRYPT_SRC) $(CRYPT_IDIR) +$(CRYPTLIB_BUILD): $(3RDP_ROOT)$(DIRSEP)dist/cryptlib.zip $(3RDP_ROOT)$(DIRSEP)build/terminal-params.patch $(3RDP_ROOT)$(DIRSEP)build/cl-mingw32-static.patch $(3RDP_ROOT)$(DIRSEP)build/cl-ranlib.patch $(3RDP_ROOT)$(DIRSEP)build/cl-win32-noasm.patch $(3RDP_ROOT)$(DIRSEP)build/cl-zz-country.patch $(3RDP_ROOT)$(DIRSEP)build/cl-algorithms.patch $(3RDP_ROOT)$(DIRSEP)build/cl-allow-duplicate-ext.patch $(3RDP_ROOT)$(DIRSEP)build/cl-macosx-minver.patch $(3RDP_ROOT)$(DIRSEP)build/cl-endian.patch $(3RDP_ROOT)$(DIRSEP)build/cl-cryptodev.patch $(3RDP_ROOT)$(DIRSEP)build/cl-posix-me-gently.patch $(3RDP_ROOT)$(DIRSEP)build/cl-tpm-linux.patch $(3RDP_ROOT)$(DIRSEP)build/cl-PAM-noprompts.patch $(3RDP_ROOT)$(DIRSEP)build/cl-zlib.patch $(3RDP_ROOT)$(DIRSEP)build/Dynamic-linked-static-lib.patch $(3RDP_ROOT)$(DIRSEP)build/SSL-fix.patch $(3RDP_ROOT)$(DIRSEP)build/cl-bigger-maxattribute.patch $(3RDP_ROOT)$(DIRSEP)build/cl-vcxproj.patch $(3RDP_ROOT)$(DIRSEP)build/cl-mingw-vcver.patch $(3RDP_ROOT)$(DIRSEP)build/cl-win32-build-fix.patch $(3RDP_ROOT)$(DIRSEP)build/cl-gcc-non-const-time-val.patch $(3RDP_ROOT)$(DIRSEP)build/cl-no-odbc.patch $(3RDP_ROOT)$(DIRSEP)build/cl-suites.patch $(3RDP_ROOT)$(DIRSEP)build/cl-noasm-defines.patch $(3RDP_ROOT)$(DIRSEP)build/cl-bn-noasm64-fix.patch $(3RDP_ROOT)$(DIRSEP)build/cl-no-RSA-suites.patch | $(CRYPT_SRC) $(CRYPT_IDIR) @echo Creating $@ ... $(QUIET)-rm -rf $(CRYPT_SRC)/* $(QUIET)unzip -oa $(3RDPDISTDIR)$(DIRSEP)cryptlib.zip -d $(CRYPT_SRC) @@ -97,6 +97,7 @@ $(CRYPTLIB_BUILD): $(3RDP_ROOT)$(DIRSEP)dist/cryptlib.zip $(3RDP_ROOT)$(DIRSEP)b $(QUIET)patch -p0 -d $(CRYPT_SRC) < cl-suites.patch $(QUIET)patch -p0 -d $(CRYPT_SRC) < cl-noasm-defines.patch $(QUIET)patch -p0 -d $(CRYPT_SRC) < cl-bn-noasm64-fix.patch + $(QUIET)patch -p0 -d $(CRYPT_SRC) < cl-no-RSA-suites.patch ifeq ($(CC),mingw32-gcc) $(QUIET)cd $(CRYPT_SRC) && env - PATH="$(PATH)" CC="$(CC)" AR="$(AR)" RANLIB="$(RANLIB)" make directories $(QUIET)cd $(CRYPT_SRC) && env - PATH="$(PATH)" CC="$(CC)" AR="$(AR)" RANLIB="$(RANLIB)" make toolscripts diff --git a/3rdp/build/cl-no-RSA-suites.patch b/3rdp/build/cl-no-RSA-suites.patch new file mode 100644 index 0000000000..4ae39b85b4 --- /dev/null +++ b/3rdp/build/cl-no-RSA-suites.patch @@ -0,0 +1,11 @@ +--- misc/config.h.orig 2020-01-23 11:58:21.156148000 -0500 ++++ misc/config.h 2020-01-23 11:59:42.599159000 -0500 +@@ -684,7 +684,7 @@ + 64-bit systems, which by definition are going to be fairly recent */ + + #ifndef SYSTEM_64BIT +- #define USE_RSA_SUITES ++// #define USE_RSA_SUITES + #endif /* SYSTEM_64BIT */ + + /* This now leads to a second problem, as of 2018 many public web servers -- GitLab