diff options
| author | simon <simon@FreeBSD.org> | 2010-12-02 22:36:51 +0000 |
|---|---|---|
| committer | simon <simon@FreeBSD.org> | 2010-12-02 22:36:51 +0000 |
| commit | ae03beb758270fb19d741c93f7bfde88a6635612 (patch) | |
| tree | b5613f06a47ca8522264b520b04a27a5fa0ff300 /ssl | |
| parent | 94e5505da619159032deac31ce95e6677cb94508 (diff) | |
| download | FreeBSD-src-ae03beb758270fb19d741c93f7bfde88a6635612.zip FreeBSD-src-ae03beb758270fb19d741c93f7bfde88a6635612.tar.gz | |
Import OpenSSL 0.9.8q.
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/s3_clnt.c | 3 | ||||
| -rw-r--r-- | ssl/s3_srvr.c | 5 |
2 files changed, 8 insertions, 0 deletions
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index f0995b9..a7cb7a1 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -814,8 +814,11 @@ int ssl3_get_server_hello(SSL *s) s->session->cipher_id = s->session->cipher->id; if (s->hit && (s->session->cipher_id != c->id)) { +/* Workaround is now obsolete */ +#if 0 if (!(s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG)) +#endif { al=SSL_AD_ILLEGAL_PARAMETER; SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED); diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c index e696450..e2d570f 100644 --- a/ssl/s3_srvr.c +++ b/ssl/s3_srvr.c @@ -927,6 +927,10 @@ int ssl3_get_client_hello(SSL *s) break; } } +/* Disabled because it can be used in a ciphersuite downgrade + * attack: CVE-2010-4180. + */ +#if 0 if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1)) { /* Special case as client bug workaround: the previously used cipher may @@ -941,6 +945,7 @@ int ssl3_get_client_hello(SSL *s) j = 1; } } +#endif if (j == 0) { /* we need to have the cipher in the cipher |
