diff options
| author | delphij <delphij@FreeBSD.org> | 2016-11-02 07:09:31 +0000 |
|---|---|---|
| committer | delphij <delphij@FreeBSD.org> | 2016-11-02 07:09:31 +0000 |
| commit | 3944e88fda9dc9f4f391a06b18cd7583f783e8ec (patch) | |
| tree | 5cca8739187f8c673b933eacfd69fa8bae7bf991 /crypto/openssl/ssl/ssl_locl.h | |
| parent | bb8c1d3b5e1d1ff2b26db3fcd0ca74e6418a4908 (diff) | |
| download | FreeBSD-src-3944e88fda9dc9f4f391a06b18cd7583f783e8ec.zip FreeBSD-src-3944e88fda9dc9f4f391a06b18cd7583f783e8ec.tar.gz | |
Backport OpenSSL commit af58be768ebb690f78530f796e92b8ae5c9a4401:
Don't allow too many consecutive warning alerts
Certain warning alerts are ignored if they are received. This can mean that
no progress will be made if one peer continually sends those warning alerts.
Implement a count so that we abort the connection if we receive too many.
Issue reported by Shi Lei.
This is a direct commit to stable/10 and stable/9.
Security: CVE-2016-8610
Diffstat (limited to 'crypto/openssl/ssl/ssl_locl.h')
| -rw-r--r-- | crypto/openssl/ssl/ssl_locl.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/crypto/openssl/ssl/ssl_locl.h b/crypto/openssl/ssl/ssl_locl.h index 7b1fd1f..8ab2755 100644 --- a/crypto/openssl/ssl/ssl_locl.h +++ b/crypto/openssl/ssl/ssl_locl.h @@ -389,6 +389,8 @@ */ # define SSL_MAX_DIGEST 6 +# define MAX_WARN_ALERT_COUNT 5 + # define TLS1_PRF_DGST_MASK (0xff << TLS1_PRF_DGST_SHIFT) # define TLS1_PRF_DGST_SHIFT 10 |
