Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
btwise
openssl
提交
31db43df
O
openssl
项目概览
btwise
/
openssl
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
DevOps
流水线
流水线任务
计划
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
O
openssl
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
DevOps
DevOps
流水线
流水线任务
计划
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
流水线任务
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
31db43df
编写于
6月 15, 2009
作者:
D
Dr. Stephen Henson
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Update from 0.9.8-stable.
上级
512cab01
变更
2
显示空白变更内容
内联
并排
Showing
2 changed file
with
10 addition
and
8 deletion
+10
-8
CHANGES
CHANGES
+5
-0
crypto/x509/x509_vfy.c
crypto/x509/x509_vfy.c
+5
-8
未找到文件。
CHANGES
浏览文件 @
31db43df
...
@@ -793,6 +793,11 @@
...
@@ -793,6 +793,11 @@
Changes between 0.9.8k and 0.9.8l [xx XXX xxxx]
Changes between 0.9.8k and 0.9.8l [xx XXX xxxx]
*) Don't check self signed certificate signatures in X509_verify_cert():
it just wastes time without adding any security. As a useful side effect
self signed root CAs with non-FIPS digests are now usable in FIPS mode.
[Steve Henson]
*) In dtls1_process_out_of_seq_message() the check if the current message
*) In dtls1_process_out_of_seq_message() the check if the current message
is already buffered was missing. For every new message was memory
is already buffered was missing. For every new message was memory
allocated, allowing an attacker to perform an denial of service attack
allocated, allowing an attacker to perform an denial of service attack
...
...
crypto/x509/x509_vfy.c
浏览文件 @
31db43df
...
@@ -1609,7 +1609,11 @@ static int internal_verify(X509_STORE_CTX *ctx)
...
@@ -1609,7 +1609,11 @@ static int internal_verify(X509_STORE_CTX *ctx)
while
(
n
>=
0
)
while
(
n
>=
0
)
{
{
ctx
->
error_depth
=
n
;
ctx
->
error_depth
=
n
;
if
(
!
xs
->
valid
)
/* Skip signature check for self signed certificates. It
* doesn't add any security and just wastes time.
*/
if
(
!
xs
->
valid
&&
xs
!=
xi
)
{
{
if
((
pkey
=
X509_get_pubkey
(
xi
))
==
NULL
)
if
((
pkey
=
X509_get_pubkey
(
xi
))
==
NULL
)
{
{
...
@@ -1619,13 +1623,6 @@ static int internal_verify(X509_STORE_CTX *ctx)
...
@@ -1619,13 +1623,6 @@ static int internal_verify(X509_STORE_CTX *ctx)
if
(
!
ok
)
goto
end
;
if
(
!
ok
)
goto
end
;
}
}
else
if
(
X509_verify
(
xs
,
pkey
)
<=
0
)
else
if
(
X509_verify
(
xs
,
pkey
)
<=
0
)
/* XXX For the final trusted self-signed cert,
* this is a waste of time. That check should
* optional so that e.g. 'openssl x509' can be
* used to detect invalid self-signatures, but
* we don't verify again and again in SSL
* handshakes and the like once the cert has
* been declared trusted. */
{
{
ctx
->
error
=
X509_V_ERR_CERT_SIGNATURE_FAILURE
;
ctx
->
error
=
X509_V_ERR_CERT_SIGNATURE_FAILURE
;
ctx
->
current_cert
=
xs
;
ctx
->
current_cert
=
xs
;
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录