Revert "with --allow-insecure-crypto, additionally attempt to disable insecure system...

This reverts commit 4e07eecaf04a48c3253a5dfd69d817673194e154.

diff --git a/gnutls.c b/gnutls.c
index 8420ef4e2ea07982fd72fdb2a25091afb07cb607..926e286a681cdf2c833a3398e3d36a6ef801607d 100644 (file)
--- a/gnutls.c
+++ b/gnutls.c
@@ -78,23 +78,12 @@ const char *openconnect_get_tls_library_version()
 
 int can_enable_insecure_crypto()
 {
-       int ret = 0;
-
-       if (setenv("GNUTLS_SYSTEM_PRIORITY_FILE", DEVNULL, 1) < 0)
-               return -errno;
-
-       gnutls_global_deinit();
-       ret = openconnect_init_ssl();
-       if (ret)
-               return ret;
-
        /* XX: As of GnuTLS 3.6.13, no released version has (yet) removed 3DES/RC4 from default builds,
         * but like OpenSSL (removed in 1.1.0) it may happen. */
        if (gnutls_cipher_get_id("3DES-CBC") == GNUTLS_CIPHER_UNKNOWN ||
            gnutls_cipher_get_id("ARCFOUR-128") == GNUTLS_CIPHER_UNKNOWN)
-               ret = -ENOENT;
-
-       return ret;
+               return -ENOENT;
+       return 0;
 }
 
 /* Helper functions for reading/writing lines over TLS/DTLS. */

diff --git a/library.c b/library.c
index e4bea9d048c891008b5d295b2dbe076795872c6d..13cb6e68e22793ed9cbd2c38260acb3defd87f49 100644 (file)
--- a/library.c
+++ b/library.c
@@ -1010,8 +1010,10 @@ void openconnect_set_pfs(struct openconnect_info *vpninfo, unsigned val)
 int openconnect_set_allow_insecure_crypto(struct openconnect_info *vpninfo, unsigned val)
 {
        int ret = can_enable_insecure_crypto();
+       if (ret)
+               return ret;
        vpninfo->allow_insecure_crypto = val;
-       return ret;
+       return 0;
 }
 
 void openconnect_set_cancel_fd(struct openconnect_info *vpninfo, int fd)

diff --git a/main.c b/main.c
index a0809defeea812371e89998073367bebe0b0d26c..36c683ce2b899f5f3a55de232b43cb8da8ab0e13 100644 (file)
--- a/main.c
+++ b/main.c
@@ -955,7 +955,6 @@ static void usage(void)
        printf("      --no-http-keepalive         %s\n", _("Disable HTTP connection re-use"));
        printf("      --no-xmlpost                %s\n", _("Do not attempt XML POST authentication"));
        printf("      --allow-insecure-crypto     %s\n", _("Allow use of the ancient, insecure 3DES and RC4 ciphers"));
-       printf("                                  %s\n", _("(and attempt to override OS crypto policies)"));
 
        printf("\n");
 
@@ -1722,12 +1721,9 @@ int main(int argc, char **argv)
                        openconnect_set_pfs(vpninfo, 1);
                        break;
                case OPT_ALLOW_INSECURE_CRYPTO:
-                       ret = openconnect_set_allow_insecure_crypto(vpninfo, 1);
-                       if (ret == -ENOENT)
-                               fprintf(stderr, _("WARNING: cannot enable insecure 3DES and/or RC4 ciphers, because the library\n"
+                       if (openconnect_set_allow_insecure_crypto(vpninfo, 1)) {
+                               fprintf(stderr, _("Cannot enable insecure 3DES or RC4 ciphers, because the library\n"
                                                  "%s no longer supports them.\n"), openconnect_get_tls_library_version());
-                       else if (ret < 0) {
-                               fprintf(stderr, _("Unknown error while enabling insecure crypto.\n"));
                                exit(1);
                        }
                        break;

diff --git a/openconnect-internal.h b/openconnect-internal.h
index 34715a5916d647dd2292489f2aed44fa7ac174d8..86c79145db84c2abc8e752c0670777cc94bd8a38 100644 (file)
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -49,15 +49,6 @@
 
 #include "openconnect.h"
 
-/* Equivalent of "/dev/null" on Windows.
- * See https://stackoverflow.com/a/44163934
- */
-#ifdef _WIN32
-#define DEVNULL "NUL"
-#else
-#define DEVNULL "/dev/null"
-#endif
-
 #if defined(OPENCONNECT_OPENSSL)
 #include <openssl/ssl.h>
 #include <openssl/err.h>
@@ -1240,7 +1231,7 @@ int do_gen_hotp_code(struct openconnect_info *vpninfo,
                     struct oc_auth_form *form,
                     struct oc_form_opt *opt);
 
-int set_oidc_token(struct openconnect_info *vpninfo,
+int set_oidc_token(struct openconnect_info *vpninfo, 
                     const char *token_str);
 
 /* stoken.c */

diff --git a/openconnect.8.in b/openconnect.8.in
index e9a358a34e7341d3a8653ec7b958209733adc344..0f8f69d371f98bf888b9275b05bb8e095db2440f 100644 (file)
--- a/openconnect.8.in
+++ b/openconnect.8.in
@@ -476,11 +476,8 @@ The ancient, broken 3DES and RC4 ciphers are insecure; we explicitly
 disable them by default. However, some still-in-use VPN servers can't do
 any better.
 
-This option
-.B attempts
-to enable use of these insecure ciphers, as well as
-the use of SHA1 for server certificate validation, and to override any
-other system policies regarding minimum crypto requirements.
+This option enables use of these insecure ciphers, as well as the use
+of SHA1 for server certificate validation.
 .TP
 .B \-\-non\-inter
 Do not expect user input; exit if it is required.

diff --git a/openssl.c b/openssl.c
index e33585446fc1eb0e3d486a82f71c1fd09f813268..8a1c393b16e46520d9ed20b65552e086a33101ae 100644 (file)
--- a/openssl.c
+++ b/openssl.c
@@ -63,23 +63,10 @@ const char *openconnect_get_tls_library_version()
 
 int can_enable_insecure_crypto()
 {
-       int ret = 0;
-
-       if (setenv("OPENSSL_CONF", DEVNULL, 1) < 0)
-               return -errno;
-
-       /* FIXME: deinitialize and reinitialize library, as is done for GnuTLS,
-        * to ensure that updated value is used.
-        *
-        * Cleaning up and reinitalizing OpenSSL appears to be complex:
-        *   https://wiki.openssl.org/index.php/Library_Initialization#Cleanup
-        */
-
        if (EVP_des_ede3_cbc() == NULL ||
            EVP_rc4() == NULL)
-               ret = -ENOENT;
-
-       return ret;
+               return -ENOENT;
+       return 0;
 }
 
 int openconnect_sha1(unsigned char *result, void *data, int len)