From fe25e767070f46e37e0c27418db13632d5145bbf Mon Sep 17 00:00:00 2001 From: Michael Lamb Date: Mon, 2 Dec 2013 14:35:08 -0800 Subject: [PATCH] adium: UI addtions to disable BEAST mitigations Added UI elements (hidden for <10.8 users) to enable/disable BEAST mitigations in Mavericks (if Adium is patched) --- .../adium-1.5.8-disable-ssl-mitigation.patch | 38 ++++++++++++---------- src/adium/ESPurpleSIPEAccount.h | 2 ++ src/adium/ESPurpleSIPEAccount.m | 5 +++ src/adium/ESSIPEAccountViewController.h | 1 + src/adium/ESSIPEAccountViewController.m | 16 +++++++++ src/adium/English.lproj/ESSIPEAccountView.xib | 26 ++++++++++----- src/adium/PurpleDefaultsSIPE.plist | 2 ++ 7 files changed, 64 insertions(+), 26 deletions(-) diff --git a/contrib/adium-patches/adium-1.5.8-disable-ssl-mitigation.patch b/contrib/adium-patches/adium-1.5.8-disable-ssl-mitigation.patch index 007a6a9e..91876905 100644 --- a/contrib/adium-patches/adium-1.5.8-disable-ssl-mitigation.patch +++ b/contrib/adium-patches/adium-1.5.8-disable-ssl-mitigation.patch @@ -1,32 +1,34 @@ -diff -r 9c8daca7bb8b Plugins/Purple Service/libpurple_extensions/ssl-cdsa.c ---- a/Plugins/Purple Service/libpurple_extensions/ssl-cdsa.c Wed Oct 23 16:08:03 2013 +0200 -+++ b/Plugins/Purple Service/libpurple_extensions/ssl-cdsa.c Sat Nov 16 14:28:04 2013 +0200 -@@ -37,6 +37,7 @@ +diff --git a/Plugins/Purple Service/libpurple_extensions/ssl-cdsa.c b/Plugins/Purple Service/libpurple_extensions/ssl-cdsa.c +--- a/Plugins/Purple Service/libpurple_extensions/ssl-cdsa.c ++++ b/Plugins/Purple Service/libpurple_extensions/ssl-cdsa.c +@@ -52,6 +52,7 @@ + #define PURPLE_SSL_CONNECTION_IS_VALID(gsc) (g_list_find(connections, (gsc)) != NULL) - //#define CDSA_DEBUG + #define PURPLE_SSL_CDSA_BUGGY_TLS_WORKAROUND "ssl_cdsa_buggy_tls_workaround" ++#define PURPLE_SSL_CDSA_BEAST_TLS_WORKAROUND "ssl_cdsa_beast_tls_workaround" -+#import - #import - #import - -@@ -504,6 +505,20 @@ + /* + * query_cert_chain - callback for letting the user review the certificate before accepting it +@@ -504,6 +505,21 @@ protoErr = SSLSetProtocolVersionEnabled(cdsa_data->ssl_ctx, kTLSProtocol1, true); } -+ if (!strcmp(purple_account_get_protocol_id(account),"prpl-sipe")) { -+ purple_debug_info("cdsa", "Explicitly disabling SSL BEAST mitigation for Microsoft Lync 2010 connections\n"); -+ -+ OSStatus protoErr; -+#if __MAC_OS_X_VERSION_MAX_ALLOWED <= 1090 -+#define kSSLSessionOptionSendOneByteRecord 4 /* appears in 10.9 */ ++#if MAC_OS_X_VERSION_MAX_ALLOWED <= MAC_OS_X_VERSION_10_9 ++ #define kSSLSessionOptionSendOneByteRecord 4 /* Appears in 10.9 */ +#endif -+ ++ ++ if (purple_account_get_bool(account, PURPLE_SSL_CDSA_BEAST_TLS_WORKAROUND, false)) { ++ purple_debug_info("cdsa", "Explicitly disabling SSL BEAST mitigation for broken server implementations\n"); ++ ++ OSStatus protoErr; + protoErr = SSLSetSessionOption(cdsa_data->ssl_ctx, kSSLSessionOptionSendOneByteRecord, false); + if (protoErr != noErr) { + purple_debug_info("cdsa", "SSLSetSessionOption failed to disable SSL BEAST mitigation\n"); + } + } -+ ++ ++ if(gsc->host) { /* * Set the peer's domain name so CDSA can check the certificate's CN + diff --git a/src/adium/ESPurpleSIPEAccount.h b/src/adium/ESPurpleSIPEAccount.h index 6c9c2700..a890989d 100644 --- a/src/adium/ESPurpleSIPEAccount.h +++ b/src/adium/ESPurpleSIPEAccount.h @@ -23,7 +23,9 @@ #define KEY_SIPE_DONT_PUBLISH @"SIPE:Dont Publish" #define KEY_SIPE_AUTH_SCHEME @"SIPE:Authentication Scheme" #define KEY_SIPE_AUTODISCOVER @"SIPE:Autodiscover" +#define KEY_SIPE_BEAST_DISABLE @"SIPE:BEAST Disable" +#define PURPLE_SSL_CDSA_BEAST_TLS_WORKAROUND "ssl_cdsa_beast_tls_workaround" // TODO: Remove when sipe_status_activity_to_token calls work #define SIPE_ACTIVITY_NUM_TYPES 17 diff --git a/src/adium/ESPurpleSIPEAccount.m b/src/adium/ESPurpleSIPEAccount.m index a2b9f01f..a5bdd843 100644 --- a/src/adium/ESPurpleSIPEAccount.m +++ b/src/adium/ESPurpleSIPEAccount.m @@ -133,6 +133,11 @@ extern void AILog(NSString *fmt, ...); BOOL dontPublish = [[self preferenceForKey:KEY_SIPE_DONT_PUBLISH group:GROUP_ACCOUNT_STATUS] boolValue]; purple_account_set_bool(account, "dont-publish", dontPublish); + // Disable BEAST mitigations that apple added + BOOL beastDisable = [[self preferenceForKey:KEY_SIPE_BEAST_DISABLE group:GROUP_ACCOUNT_STATUS] boolValue]; + purple_account_set_bool(account, PURPLE_SSL_CDSA_BEAST_TLS_WORKAROUND, beastDisable); + + // Connection preferences id connType = [self preferenceForKey:KEY_SIPE_CONNECTION_TYPE group:GROUP_ACCOUNT_STATUS]; if([connType isKindOfClass:[NSNumber class]]) diff --git a/src/adium/ESSIPEAccountViewController.h b/src/adium/ESSIPEAccountViewController.h index 750fd215..e2a450e0 100644 --- a/src/adium/ESSIPEAccountViewController.h +++ b/src/adium/ESSIPEAccountViewController.h @@ -25,6 +25,7 @@ IBOutlet NSButton *checkBox_autoDiscover; IBOutlet NSButton *checkBox_singleSignOn; IBOutlet NSButton *checkbox_dontPublish; + IBOutlet NSButton *checkbox_beastDisable; IBOutlet NSPopUpButton *popup_connectionType; IBOutlet NSPopUpButton *popup_authenticationScheme; diff --git a/src/adium/ESSIPEAccountViewController.m b/src/adium/ESSIPEAccountViewController.m index 3d5cf0f2..c5c5bc37 100644 --- a/src/adium/ESSIPEAccountViewController.m +++ b/src/adium/ESSIPEAccountViewController.m @@ -62,6 +62,19 @@ nil]; [popup_connectionType selectItemWithTitle:[connTypeDict objectForKey:(connType ? connType : @"auto")]]; + // Gotta define these here, because they're not yet in the 10.9 SDK. :( +#define NSAppKitVersionNumber10_8 1187 +#define NSAppKitVersionNumber10_8_5 1187.4 +#define NSAppKitVersionNumber10_9 1265 + + // BEAST mitigation for Mavericks users + if (floor(NSAppKitVersionNumber) <= NSAppKitVersionNumber10_8) { + // We are not running on Mavericks - Don't display BEAST mitigation configuration option + [checkbox_beastDisable setHidden:YES]; + } else { + [checkbox_beastDisable setState:[[account preferenceForKey:KEY_SIPE_BEAST_DISABLE group:GROUP_ACCOUNT_STATUS] boolValue]]; + } + NSString *authType = [account preferenceForKey:KEY_SIPE_AUTH_SCHEME group:GROUP_ACCOUNT_STATUS]; NSDictionary *authTypeDict = [NSDictionary dictionaryWithObjectsAndKeys: @"NTLM",@"ntlm", @@ -90,6 +103,9 @@ [account setPreference:[NSNumber numberWithBool:[checkbox_dontPublish state]] forKey:KEY_SIPE_DONT_PUBLISH group:GROUP_ACCOUNT_STATUS]; + + [account setPreference:[NSNumber numberWithBool:[checkbox_beastDisable state]] + forKey:KEY_SIPE_BEAST_DISABLE group:GROUP_ACCOUNT_STATUS]; [account setPreference: ([[textField_userAgent stringValue] length] ? [textField_userAgent stringValue] : nil) diff --git a/src/adium/English.lproj/ESSIPEAccountView.xib b/src/adium/English.lproj/ESSIPEAccountView.xib index 150ba91a..58e1f4a2 100644 --- a/src/adium/English.lproj/ESSIPEAccountView.xib +++ b/src/adium/English.lproj/ESSIPEAccountView.xib @@ -1,12 +1,14 @@ + + @@ -27,14 +29,14 @@ - + - + - + @@ -122,23 +124,31 @@ + - + - + @@ -237,10 +247,10 @@ - + - +