From 2a699bc6e94b8223d900e8880ad628aebf17ab6d Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Mon, 6 Feb 2012 22:12:06 +0100 Subject: CURLOPT_SSL_OPTIONS: added Allow an appliction to set libcurl specific SSL options. The first and only options supported right now is CURLSSLOPT_ALLOW_BEAST. It will make libcurl to disable any work-arounds the underlying SSL library may have to address a known security flaw in the SSL3 and TLS1.0 protocol versions. This is a reaction to us unconditionally removing that behavior after this security advisory: http://curl.haxx.se/docs/adv_20120124B.html ... it did however cause a lot of programs to fail because of old servers not liking this work-around. Now programs can opt to decrease the security in order to interoperate with old servers better. --- lib/urldata.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'lib/urldata.h') diff --git a/lib/urldata.h b/lib/urldata.h index a959bc716..5725ba86b 100644 --- a/lib/urldata.h +++ b/lib/urldata.h @@ -1508,6 +1508,8 @@ struct UserDefined { bool ftp_skip_ip; /* skip the IP address the FTP server passes on to us */ bool connect_only; /* make connection, let application use the socket */ + bool ssl_enable_beast; /* especially allow this flaw for interoperability's + sake*/ long ssh_auth_types; /* allowed SSH auth types */ bool http_te_skip; /* pass the raw body data to the user, even when transfer-encoded (chunked, compressed) */ -- cgit v1.2.3