Merge pull request #10979 from IngelaAndin/ingela/ssl/remove-unsecure-fallback/OTP-20080

Remove insecure renegotiation fallback pre TLS-1.3

Author: IngelaAndin

lib/ssl/doc/guides/ssl_distribution.md

@@ -271,11 +271,6 @@ handling decoding errors and directly verifying signatures.
 For more details see `{verify_fun, Verify}` [in common_option_cert](`t:ssl:common_option_cert/0`)
 
 
-> #### Note {: .info }
-> The legacy command line format for `verify_fun` cannot be used
-> in a `-ssl_dist_optfile` file as described below in
-> [Specifying TLS Options (Legacy)](#specifying-tls-options-legacy).
-
 ## Using TLS distribution over IPv6
 
 It is possible to use TLS distribution over IPv6 instead of IPv4. To do this,
@@ -295,99 +290,3 @@ A node started in this way will only be able to communicate with other nodes
 using TLS distribution over IPv6.
 
 
-## Specifying TLS Options (Legacy)
-
-> #### Note {: .info }
-> The following section describes TLS Option handling prior to OTP 20.2
-> and can only handle a small subset of the actual available options.
-> It is here only for the sake of backwards compatibility .
-
-As in the previous section the PEM file `"/home/me/ssl/erlserver.pem"` contains
-both the server certificate and its private key.
-
-On the `erl` command line you can specify options that the TLS distribution adds
-when creating a socket.
-
-The simplest TLS options in the following list can be specified by adding the
-prefix `server_` or `client_` to the option name:
-
-- `certfile`
-- `keyfile`
-- `password`
-- `cacertfile`
-- `verify`
-- `verify_fun` (write as `{Module, Function, InitialUserState}`)
-- `crl_check`
-- `crl_cache` (write as Erlang term)
-- `reuse_sessions`
-- `secure_renegotiate`
-- `depth`
-- `hibernate_after`
-- `ciphers` (use old string format)
-
-Note that `verify_fun` needs to be written in a different form than the
-corresponding TLS option, since funs are not accepted on the command line.
-
-The server can also take the options `dhfile` and `fail_if_no_peer_cert` (also
-prefixed).
-
-`client_`\-prefixed options are used when the distribution initiates a
-connection to another node. `server_`\-prefixed options are used when accepting
-a connection from a remote node.
-
-Raw socket options, such as `packet` and `size` must not be specified on the
-command line.
-
-The command-line argument for specifying the TLS options is named
-`-ssl_dist_opt` and is to be followed by pairs of SSL options and their values.
-Argument `-ssl_dist_opt` can be repeated any number of times.
-
-An example command line doing the same as the example in the previous section
-can now look as follows (line breaks in the command are for readability, and
-shall not be there when typed):
-
-```text
-$ erl -boot /home/me/ssl/start_ssl -proto_dist inet_tls
-  -ssl_dist_opt server_certfile "/home/me/ssl/erlserver.pem"
-  -ssl_dist_opt server_secure_renegotiate true client_secure_renegotiate true
-  -sname ssl_test
-Erlang (BEAM) emulator version 5.0 [source]
-
-Eshell V5.0  (abort with ^G)
-(ssl_test@myhost)1>
-```
-
-### Setting up Environment to Always Use TLS
-
-A convenient way to specify arguments to Erlang is to use environment variable
-`ERL_FLAGS`. All the flags needed to use the TLS distribution can be specified
-in that variable and are then interpreted as command-line arguments for all
-subsequent invocations of Erlang.
-
-In a Unix (Bourne) shell, it can look as follows (line breaks are for
-readability, they are not to be there when typed):
-
-```erlang
-$ ERL_FLAGS="-boot /home/me/ssl/start_ssl -proto_dist inet_tls
-  -ssl_dist_opt server_certfile /home/me/ssl/erlserver.pem
-  -ssl_dist_opt server_secure_renegotiate true client_secure_renegotiate true"
-$ export ERL_FLAGS
-$ erl -sname ssl_test
-Erlang (BEAM) emulator version 5.0 [source]
-
-Eshell V5.0  (abort with ^G)
-(ssl_test@myhost)1> init:get_arguments().
-[{root,["/usr/local/erlang"]},
- {progname,["erl "]},
- {sname,["ssl_test"]},
- {boot,["/home/me/ssl/start_ssl"]},
- {proto_dist,["inet_tls"]},
- {ssl_dist_opt,["server_certfile","/home/me/ssl/erlserver.pem"]},
- {ssl_dist_opt,["server_secure_renegotiate","true",
-                "client_secure_renegotiate","true"]
- {home,["/home/me"]}]
-```
-
-The `init:get_arguments()` call verifies that the correct arguments are supplied
-to the emulator.
-

lib/ssl/src/ssl.erl

@@ -955,15 +955,13 @@ Options common to client and server side prior to TLS-1.3.
 
   Elliptic curves that can be used in pre TLS-1.3 key exchange.
 
-- **`{secure_renegotiate, SecureRenegotiate}`** - Inter-operate trade-off option
+- **`{secure_renegotiate, SecureRenegotiate}`** - Previous interoperability option
 
-  Specifies whether to reject renegotiation attempt that does not live
-  up to [RFC 5746](http://www.ietf.org/rfc/rfc5746.txt). By default,
-  `SecureRenegotiate` is `true`, meaning that secure renegotiation is
-  enforced. If `SecureRenegotiate` is `false` secure renegotiation
-  will still be used if possible, but it falls back to insecure
-  renegotiation if the peer does not support if [RFC
-  5746](http://www.ietf.org/rfc/rfc5746.txt).
+ Since OTP 29.0 setting this option to false will fail, that is accepting
+ possible fallback to insecure behavior preceding implementation of
+ [RFC 5746](http://www.ietf.org/rfc/rfc5746.txt) is no longer supported.
+ Setting it to true will continue to work but is not necessary, as the default
+ of `true` will now always be enforced.
 
 - **`{user_lookup_fun, {LookupFun, UserState}}`** - PSK/SRP cipher suite option
 
@@ -990,7 +988,7 @@ Options common to client and server side prior to TLS-1.3.
 """.
 
 -type common_option_pre_tls13() :: {eccs, NamedCurves::[named_curve()]} |
-                                   {secure_renegotiate, SecureRenegotiate::boolean()} |
+                                   {secure_renegotiate, SecureRenegotiate::true} |
                                    {user_lookup_fun, {Lookupfun :: fun(), UserState :: any()}}.
 
 -doc(#{group => 

lib/ssl/src/ssl_config.erl

@@ -1353,10 +1353,12 @@ opt_renegotiate(UserOpts, #{versions := Versions} = Opts, _Env) ->
     {_, RA0} = get_opt_pos_int(renegotiate_at, ?DEFAULT_RENEGOTIATE_AT, UserOpts, Opts),
     RA = min(RA0, ?DEFAULT_RENEGOTIATE_AT),  %% Override users choice without notifying ??
 
-    {Where3, SR} = get_opt_bool(secure_renegotiate, true, UserOpts, Opts),
+    {Where3, _} = disable_insecure_fallback(UserOpts, Opts),
     assert_version_dep(Where3 =:= new, secure_renegotiate, Versions, ['tlsv1','tlsv1.1','tlsv1.2']),
 
-    Opts#{secure_renegotiate => SR, key_update_at => KUA, renegotiate_at => RA}.
+    %% Do not include secure_renegotiate as option is no longer needed,
+    %% that is, it is treated as always set to true
+    Opts#{key_update_at => KUA, renegotiate_at => RA}.
 
 opt_reuse_sessions(UserOpts, #{versions := Versions} = Opts, #{role := client}) ->
     {Where1, RUSS} = get_opt_of(reuse_sessions, [true, false, save], true, UserOpts, Opts),
@@ -1388,6 +1390,15 @@ opt_identity(UserOpts, Opts, _Env) ->
     Lookup = handle_user_lookup(UserOpts, Opts),
     Opts#{psk_identity => PSK, srp_identity => SRP, user_lookup_fun => Lookup}.
 
+disable_insecure_fallback(UserOpts, Opts) ->
+    case get_opt_bool(secure_renegotiate, true, UserOpts, Opts) of
+        {_, true} = Result ->
+            Result;
+        {_, What} ->
+            option_error(secure_renegotiate,
+                         {What,
+                          fallback_to_insecure_renegotiation_no_longer_supported})
+    end.
 
 handle_psk(UserOpts, #{versions := Versions} = Opts) ->
     case get_opt_list(psk_identity, undefined, UserOpts, Opts) of