Skip to content

Commit

Permalink
Disable the TLS 1.0 version fallback.
Browse files Browse the repository at this point in the history 
Re-enable the SSLFallbackVersionMin admin policy, this time documented for the
TLS 1.0 fallback.

As with when the SSL 3.0 was removed, we for now will continue to attempt
fallbacks beyond the minimum version. But, if they succeed, the connection is
shut off and a dedicated error code is returned. This slightly tweaks the
string for that error code since this isn't in response to, e.g. POODLE, unlike
with SSL 3.0.

(Although, being able to securely negotiate > TLS 1.0 means we don't have to
worry about BEAST, in case the server's not doing record-splitting.)

This does not yet remove the TLS 1.1 fallback leg.

BUG=498998

Review URL: https://codereview.chromium.org/1173193004

Cr-Commit-Position: refs/heads/master@{#334430}
  • Loading branch information
@davidben
davidben authored and Commit bot committed Jun 15, 2015
1 parent b450c04 commit b127ca8
Show file tree
Hide file tree
Showing 5 changed files with 61 additions and 54 deletions.
4 changes: 2 additions & 2 deletions chrome/app/generated_resources.grd
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9551,10 +9551,10 @@ I don't think this site should be blocked!
SSL server probably obsolete.
</message>
<message name="IDS_ERRORPAGES_SUMMARY_SSL_FALLBACK_BEYOND_MINIMUM_VERSION" desc="Summary in the error page for SSL fallback errors.">
Unable to connect securely to the server. This website may have worked previously, but connecting to such sites has now been shown to cause security risks to all users and thus has been disabled for your safety.
Unable to connect securely to the server. This website may have worked previously, but there is a problem with the server. Connecting to such sites weakens security for all users and thus has been disabled.
</message>
<message name="IDS_ERRORPAGES_DETAILS_SSL_FALLBACK_BEYOND_MINIMUM_VERSION" desc="The error message displayed for SSL fallback errors.">
An SSLv3 fallback was able to handshake with the server, but we no longer accept SSLv3 fallbacks due to new attacks against the protocol. The server needs to be updated to support a minimum of TLS 1.0 and preferably TLS 1.2.
A TLS 1.0 fallback was able to handshake with the server, but we no longer accept TLS 1.0 fallbacks. The server needs to be updated to correctly implement version negotiation and preferably support TLS 1.2.
</message>

<message name="IDS_ERRORPAGES_HEADING_SSL_VERSION_OR_CIPHER_MISMATCH" desc="Heading in the error page for SSL cipher and version errors.">
Expand Down
30 changes: 11 additions & 19 deletions components/policy/resources/policy_templates.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7200,18 +7200,12 @@
'schema': {
'type': 'string',
'enum': [
'ssl3',
'tls1',
'tls1.1',
'tls1.2',
],
},
'items': [
{
'name': 'SSLv3',
'value': 'ssl3',
'caption': 'SSL 3.0',
},
{
'name': 'TLSv1',
'value': 'tls1',
Expand All @@ -7229,29 +7223,27 @@
},
],
'supported_on': [
'chrome.*:39-43',
'chrome_os:39-43',
'android:39-43',
'ios:39-43',
'chrome.*:45-47',
'chrome_os:45-47',
'android:45-47',
'ios:45-47',
],
'features': {
'dynamic_refresh': True,
'per_profile': False,
},
'example_value': 'tls1',
'example_value': 'tls1.1',
'id': 280,
'caption': '''Minimum SSL version to fallback to''',
'desc': '''Warning: SSLv3 support will be entirely removed from <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> after version 43 (around July 2015) and this policy will be removed at the same time.

When an SSL/TLS handshake fails, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will retry the connection with a lesser version of SSL/TLS in order to work around bugs in HTTPS servers. This setting configures the version at which this fallback process will stop. If a server performs version negotiation correctly (i.e. without breaking the connection) then this setting doesn't apply. Regardless, the resulting connection must still comply with SSLVersionMin.
'caption': '''Minimum TLS version to fallback to''',
'desc': '''Warning: The TLS 1.0 version fallback will be removed from <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> after version 47 (around January 2016) and the "tls1" option will stop working then.

If this policy is not configured then <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> uses a default minimum version which is SSLv3 in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> 38 and TLS 1.0 in later versions.
When a TLS handshake fails, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will retry the connection with a lesser version of TLS in order to work around bugs in HTTPS servers. This setting configures the version at which this fallback process will stop. If a server performs version negotiation correctly (i.e. without breaking the connection) then this setting doesn't apply. Regardless, the resulting connection must still comply with SSLVersionMin.

Otherwise it may be set to one of the following values: "sslv3", "tls1", "tls1.1" or "tls1.2". A setting of "tls1" protects against attacks on SSLv3 but is already the default. A more likely situation is that compatibility with a buggy server must be maintained and thus this needs to be set to "sslv3". That potentially opens up all connections to SSLv3 attacks since a network attacker can induce fallbacks. Thus this is a stopgap measure and the server should be rapidly fixed.
If this policy is not configured then <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> uses a default minimum version which is TLS 1.0 in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> 44 and TLS 1.1 in later versions. Note this does not disable support for TLS 1.0, only whether <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will work around buggy servers which cannot negotiate versions correctly.

A setting of "tls1.2" disables all fallback but this may have a significant compatibility impact.
Otherwise it may be set to one of the following values: "tls1", "tls1.1" or "tls1.2". If compatibility with a buggy server must be maintained, this may be set to "tls1". This is a stopgap measure and the server should be rapidly fixed.

Note that, despite the number, "sslv3" is an earlier version than "tls1".''',
A setting of "tls1.2" disables all fallback but this may have a significant compatibility impact.''',
},
{
'name': 'ContextualSearchEnabled',
Expand Down
1 change: 1 addition & 0 deletions net/socket/ssl_client_socket_unittest.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2944,6 +2944,7 @@ TEST_F(SSLClientSocketTest, FallbackShardSessionCache) {
SSLConfig ssl_config;
SSLConfig fallback_ssl_config;
fallback_ssl_config.version_max = SSL_PROTOCOL_VERSION_TLS1;
fallback_ssl_config.version_fallback_min = SSL_PROTOCOL_VERSION_TLS1;
fallback_ssl_config.version_fallback = true;

// Connect with a fallback config from the test server to add an entry to the
Expand Down
2 changes: 1 addition & 1 deletion net/ssl/ssl_config.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ namespace net {

const uint16 kDefaultSSLVersionMin = SSL_PROTOCOL_VERSION_TLS1;

const uint16 kDefaultSSLVersionFallbackMin = SSL_PROTOCOL_VERSION_TLS1;
const uint16 kDefaultSSLVersionFallbackMin = SSL_PROTOCOL_VERSION_TLS1_1;

SSLConfig::CertAndStatus::CertAndStatus() : cert_status(0) {}

Expand Down
78 changes: 46 additions & 32 deletions net/url_request/url_request_unittest.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8037,32 +8037,70 @@ class HTTPSFallbackTest : public testing::Test {
scoped_ptr<URLRequest> request_;
};

// Tests TLSv1.1 -> TLSv1 fallback. Verifies that we don't fall back more
// than necessary.
TEST_F(HTTPSFallbackTest, TLSv1Fallback) {
// Tests the TLS 1.0 fallback doesn't happen.
TEST_F(HTTPSFallbackTest, TLSv1NoFallback) {
SpawnedTestServer::SSLOptions ssl_options(
SpawnedTestServer::SSLOptions::CERT_OK);
ssl_options.tls_intolerant =
SpawnedTestServer::SSLOptions::TLS_INTOLERANT_TLS1_1;

ASSERT_NO_FATAL_FAILURE(DoFallbackTest(ssl_options));
ExpectConnection(SSL_CONNECTION_VERSION_TLS1);
ExpectFailure(ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION);
}

// Tests the TLS 1.1 fallback.
TEST_F(HTTPSFallbackTest, TLSv1_1Fallback) {
if (SSLClientSocket::GetMaxSupportedSSLVersion() <
SSL_CONNECTION_VERSION_TLS1_2) {
return;
}

SpawnedTestServer::SSLOptions ssl_options(
SpawnedTestServer::SSLOptions::CERT_OK);
ssl_options.tls_intolerant =
SpawnedTestServer::SSLOptions::TLS_INTOLERANT_TLS1_2;

ASSERT_NO_FATAL_FAILURE(DoFallbackTest(ssl_options));
ExpectConnection(SSL_CONNECTION_VERSION_TLS1_1);
}

// Tests that the TLS 1.1 fallback triggers on closed connections.
TEST_F(HTTPSFallbackTest, TLSv1_1FallbackClosed) {
if (SSLClientSocket::GetMaxSupportedSSLVersion() <
SSL_CONNECTION_VERSION_TLS1_2) {
return;
}

SpawnedTestServer::SSLOptions ssl_options(
SpawnedTestServer::SSLOptions::CERT_OK);
ssl_options.tls_intolerant =
SpawnedTestServer::SSLOptions::TLS_INTOLERANT_TLS1_2;
ssl_options.tls_intolerance_type =
SpawnedTestServer::SSLOptions::TLS_INTOLERANCE_CLOSE;

ASSERT_NO_FATAL_FAILURE(DoFallbackTest(ssl_options));
ExpectConnection(SSL_CONNECTION_VERSION_TLS1_1);
}

// This test is disabled on Android because the remote test server doesn't cause
// a TCP reset.
#if !defined(OS_ANDROID)
// Tests fallback to TLS 1.0 on connection reset.
TEST_F(HTTPSFallbackTest, TLSv1FallbackReset) {
// Tests fallback to TLS 1.1 on connection reset.
TEST_F(HTTPSFallbackTest, TLSv1_1FallbackReset) {
if (SSLClientSocket::GetMaxSupportedSSLVersion() <
SSL_CONNECTION_VERSION_TLS1_2) {
return;
}

SpawnedTestServer::SSLOptions ssl_options(
SpawnedTestServer::SSLOptions::CERT_OK);
ssl_options.tls_intolerant =
SpawnedTestServer::SSLOptions::TLS_INTOLERANT_TLS1_1;
SpawnedTestServer::SSLOptions::TLS_INTOLERANT_TLS1_2;
ssl_options.tls_intolerance_type =
SpawnedTestServer::SSLOptions::TLS_INTOLERANCE_RESET;

ASSERT_NO_FATAL_FAILURE(DoFallbackTest(ssl_options));
ExpectConnection(SSL_CONNECTION_VERSION_TLS1);
ExpectConnection(SSL_CONNECTION_VERSION_TLS1_1);
}
#endif // !OS_ANDROID

Expand Down Expand Up @@ -8109,30 +8147,6 @@ TEST_F(HTTPSFallbackTest, FallbackSCSVClosed) {
ExpectFailure(ERR_CONNECTION_CLOSED);
}

// Tests that the SSLv3 fallback doesn't happen.
TEST_F(HTTPSFallbackTest, SSLv3Fallback) {
SpawnedTestServer::SSLOptions ssl_options(
SpawnedTestServer::SSLOptions::CERT_OK);
ssl_options.tls_intolerant =
SpawnedTestServer::SSLOptions::TLS_INTOLERANT_ALL;

ASSERT_NO_FATAL_FAILURE(DoFallbackTest(ssl_options));
ExpectFailure(ERR_SSL_VERSION_OR_CIPHER_MISMATCH);
}

// Tests that the TLSv1 fallback triggers on closed connections.
TEST_F(HTTPSFallbackTest, SSLv3FallbackClosed) {
SpawnedTestServer::SSLOptions ssl_options(
SpawnedTestServer::SSLOptions::CERT_OK);
ssl_options.tls_intolerant =
SpawnedTestServer::SSLOptions::TLS_INTOLERANT_TLS1_1;
ssl_options.tls_intolerance_type =
SpawnedTestServer::SSLOptions::TLS_INTOLERANCE_CLOSE;

ASSERT_NO_FATAL_FAILURE(DoFallbackTest(ssl_options));
ExpectConnection(SSL_CONNECTION_VERSION_TLS1);
}

// Test that fallback probe connections don't cause sessions to be cached.
TEST_F(HTTPSRequestTest, FallbackProbeNoCache) {
SpawnedTestServer::SSLOptions ssl_options(
Expand Down

0 comments on commit b127ca8

Please sign in to comment.