romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-23 13:37:17 +03:00
Code Issues Projects Releases Packages Wiki Activity

curl: warn for --ssl use, considered insecure

Browse source 
Closes #9519
This commit is contained in:
Daniel Stenberg 2022-09-16 19:03:49 +02:00
parent 62b8a4dd1c
commit 79e404d039
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/cmdline-opts/ssl.d
View file

@ -6,8 +6,11 @@ Protocols: FTP IMAP POP3 SMTP LDAP
Added: 7.20.0
Category: tls
Example: --ssl pop3://example.com/
See-also: insecure ciphers
See-also: ssl-reqd insecure ciphers
---
Warning: this is considered an insecure option. Consider using --ssl-reqd
instead to be sure curl upgrades to a secure connection.
Try to use SSL/TLS for the connection. Reverts to a non-secure connection if
the server does not support SSL/TLS. See also --ftp-ssl-control and --ssl-reqd
for different levels of encryption required.

3
src/tool_getparam.c
View file

@ -1007,6 +1007,9 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
if(toggle && !(curlinfo->features & CURL_VERSION_SSL))
return PARAM_LIBCURL_DOESNT_SUPPORT;
config->ftp_ssl = toggle;
if(config->ftp_ssl)
warnf(global,
"--ssl is an insecure option, consider --ssl-reqd instead\n");
break;
case 'b': /* --ftp-pasv */
Curl_safefree(config->ftpport);