Merge pull request #17912 from owncloud/detect-old-openssl-versions

Detect old NSS and OpenSSL versions

2 files changed, 71 insertions, 2 deletions

diff --git a/settings/application.php b/settings/application.php
index a2f25935e12..8da835c18d2 100644
--- a/settings/application.php
+++ b/settings/application.php
@@ -154,7 +154,8 @@ class Application extends App {
 				$c->query('Config'),
 				$c->query('ClientService'),
 				$c->query('URLGenerator'),
-				$c->query('Util')
+				$c->query('Util'),
+				$c->query('L10N')
 			);
 		});
 
diff --git a/settings/controller/checksetupcontroller.php b/settings/controller/checksetupcontroller.php
index 0b4c72acab7..f849e3ed565 100644
--- a/settings/controller/checksetupcontroller.php
+++ b/settings/controller/checksetupcontroller.php
@@ -23,10 +23,12 @@
 
 namespace OC\Settings\Controller;
 
+use GuzzleHttp\Exception\ClientException;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\Http\Client\IClientService;
 use OCP\IConfig;
+use OCP\IL10N;
 use OCP\IRequest;
 use OC_Util;
 use OCP\IURLGenerator;
@@ -43,6 +45,8 @@ class CheckSetupController extends Controller {
 	private $util;
 	/** @var IURLGenerator */
 	private $urlGenerator;
+	/** @var IL10N */
+	private $l10n;
 
 	/**
 	 * @param string $AppName
@@ -51,18 +55,21 @@ class CheckSetupController extends Controller {
 	 * @param IClientService $clientService
 	 * @param IURLGenerator $urlGenerator
 	 * @param \OC_Util $util
+	 * @param IL10N $l10n
 	 */
 	public function __construct($AppName,
 								IRequest $request,
 								IConfig $config,
 								IClientService $clientService,
 								IURLGenerator $urlGenerator,
-								\OC_Util $util) {
+								\OC_Util $util,
+								IL10N $l10n) {
 		parent::__construct($AppName, $request);
 		$this->config = $config;
 		$this->clientService = $clientService;
 		$this->util = $util;
 		$this->urlGenerator = $urlGenerator;
+		$this->l10n = $l10n;
 	}
 
 	/**
@@ -110,6 +117,66 @@ class CheckSetupController extends Controller {
 	}
 
 	/**
+	 * Public for the sake of unit-testing
+	 *
+	 * @return array
+	 */
+	public function getCurlVersion() {
+		return curl_version();
+	}
+
+	/**
+	 * Check if the used  SSL lib is outdated. Older OpenSSL and NSS versions do
+	 * have multiple bugs which likely lead to problems in combination with
+	 * functionalities required by ownCloud such as SNI.
+	 *
+	 * @link https://github.com/owncloud/core/issues/17446#issuecomment-122877546
+	 * @link https://bugzilla.redhat.com/show_bug.cgi?id=1241172
+	 * @return string
+	 */
+	private function isUsedTlsLibOutdated() {
+		$versionString = $this->getCurlVersion();
+		if(isset($versionString['ssl_version'])) {
+			$versionString = $versionString['ssl_version'];
+		} else {
+			return '';
+		}
+
+		$features = (string)$this->l10n->t('installing and updating apps via the app store or Federated Cloud Sharing');
+		if(OC_Util::getEditionString() !== '') {
+			$features = (string)$this->l10n->t('Federated Cloud Sharing');
+		}
+
+		// Check if at least OpenSSL after 1.01d or 1.0.2b
+		if(strpos($versionString, 'OpenSSL/') === 0) {
+			$majorVersion = substr($versionString, 8, 5);
+			$patchRelease = substr($versionString, 13, 6);
+
+			if(($majorVersion === '1.0.1' && ord($patchRelease) < ord('d')) ||
+				($majorVersion === '1.0.2' && ord($patchRelease) < ord('b'))) {
+				return (string) $this->l10n->t('cURL is using an outdated %s version (%s). Please update your operating system or features such as %s will not work reliably.', ['OpenSSL', $versionString, $features]);
+			}
+		}
+
+		// Check if NSS and perform heuristic check
+		if(strpos($versionString, 'NSS/') === 0) {
+			try {
+				$firstClient = $this->clientService->newClient();
+				$firstClient->get('https://www.owncloud.org/');
+
+				$secondClient = $this->clientService->newClient();
+				$secondClient->get('https://owncloud.org/');
+			} catch (ClientException $e) {
+				if($e->getResponse()->getStatusCode() === 400) {
+					return (string) $this->l10n->t('cURL is using an outdated %s version (%s). Please update your operating system or features such as %s will not work reliably.', ['NSS', $versionString, $features]);
+				}
+			}
+		}
+
+		return '';
+	}
+
+	/**
 	 * @return DataResponse
 	 */
 	public function check() {
@@ -121,6 +188,7 @@ class CheckSetupController extends Controller {
 				'memcacheDocs' => $this->urlGenerator->linkToDocs('admin-performance'),
 				'isUrandomAvailable' => $this->isUrandomAvailable(),
 				'securityDocs' => $this->urlGenerator->linkToDocs('admin-security'),
+				'isUsedTlsLibOutdated' => $this->isUsedTlsLibOutdated(),
 			]
 		);
 	}