diff options
| author | cperciva <cperciva@FreeBSD.org> | 2009-12-03 09:18:40 +0000 |
|---|---|---|
| committer | cperciva <cperciva@FreeBSD.org> | 2009-12-03 09:18:40 +0000 |
| commit | e4106d9e8fc87e2ce9e3c00d81098c4ee822ec94 (patch) | |
| tree | 634486f3b4fdeff7825df168fb7cdfa087556d06 /crypto/openssl/ssl/s3_srvr.c | |
| parent | 3cb9e82d646d4d75b9d93dd39dc387aac8732e8c (diff) | |
| download | FreeBSD-src-e4106d9e8fc87e2ce9e3c00d81098c4ee822ec94.zip FreeBSD-src-e4106d9e8fc87e2ce9e3c00d81098c4ee822ec94.tar.gz | |
Disable SSL renegotiation in order to protect against a serious
protocol flaw. [09:15]
Correctly handle failures from unsetenv resulting from a corrupt
environment in rtld-elf. [09:16]
Fix permissions in freebsd-update in order to prevent leakage of
sensitive files. [09:17]
Approved by: so (cperciva)
Security: FreeBSD-SA-09:15.ssl
Security: FreeBSD-SA-09:16.rtld
Security: FreeBSD-SA-09:17.freebsd-udpate
Diffstat (limited to 'crypto/openssl/ssl/s3_srvr.c')
| -rw-r--r-- | crypto/openssl/ssl/s3_srvr.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/crypto/openssl/ssl/s3_srvr.c b/crypto/openssl/ssl/s3_srvr.c index 80b45eb..b2ba9ff 100644 --- a/crypto/openssl/ssl/s3_srvr.c +++ b/crypto/openssl/ssl/s3_srvr.c @@ -718,6 +718,13 @@ int ssl3_get_client_hello(SSL *s) #endif STACK_OF(SSL_CIPHER) *ciphers=NULL; + if (s->new_session) + { + al=SSL_AD_HANDSHAKE_FAILURE; + SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); + goto f_err; + } + /* We do this so that we will respond with our native type. * If we are TLSv1 and we get SSLv3, we will respond with TLSv1, * This down switching should be handled by a different method. |
