[PROTON-719] Disable SSL v3 for Windows SChannel

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: proton-0.8
• Fix Version/s: proton-0.8
• Component/s: proton-j
• Environment: Windows
• Assignee: Clifford Jansen
• Reporter: Clifford Jansen
• Created: 16/Oct/14 17:10
• Updated: 07/Jan/16 11:37
• Resolved: 18/Oct/14 00:19

Description

Windows advisory:

https://technet.microsoft.com/en-us/library/security/3009008.aspx

See especially part 3: "Disable SSL 3.0 in Windows", but note that a similar registry setting exists for CLIENT.

Schannel works differently from openssl: SChannel can override default protocols (in registry), but cannot override "enabled" protocols (also in registry). A user or global administrator can force AMQP 1.0 SChannel connections to succeed during protocol negotiations over SSLv3 despite Proton's best efforts.

Possible solutions on Windows:

1. always fail after the fact if an SSLv3 connection has actually been established

2. succeed for SSLV3 if registry allows it, but log a warning

3. succeed for SSLV3 only if registry allows it and env variable PROTON_SSLV3_UNSAFE=override_by_user

Since SSLv3 is not considered secure, and there are no known legacy AMQP 1.0 that are unable to provide TLS1.0 or above, #1 seems to provide the greatest security without known inconvenience.