Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
btwise
openssl
提交
9fb6fd34
O
openssl
项目概览
btwise
/
openssl
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
DevOps
流水线
流水线任务
计划
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
O
openssl
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
DevOps
DevOps
流水线
流水线任务
计划
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
流水线任务
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
9fb6fd34
编写于
1月 27, 2010
作者:
D
Dr. Stephen Henson
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
reword RI description
上级
c2963f5b
变更
2
隐藏空白更改
内联
并排
Showing
2 changed file
with
32 addition
and
22 deletion
+32
-22
crypto/engine/engine.h
crypto/engine/engine.h
+3
-0
doc/ssl/SSL_CTX_set_options.pod
doc/ssl/SSL_CTX_set_options.pod
+29
-22
未找到文件。
crypto/engine/engine.h
浏览文件 @
9fb6fd34
...
...
@@ -678,6 +678,7 @@ typedef struct st_dynamic_fns {
* can be fully instantiated with IMPLEMENT_DYNAMIC_CHECK_FN(). */
typedef
unsigned
long
(
*
dynamic_v_check_fn
)(
unsigned
long
ossl_version
);
#define IMPLEMENT_DYNAMIC_CHECK_FN() \
OPENSSL_EXPORT unsigned long v_check(unsigned long v); \
OPENSSL_EXPORT unsigned long v_check(unsigned long v) { \
if(v >= OSSL_DYNAMIC_OLDEST) return OSSL_DYNAMIC_VERSION; \
return 0; }
...
...
@@ -700,6 +701,8 @@ typedef unsigned long (*dynamic_v_check_fn)(unsigned long ossl_version);
typedef
int
(
*
dynamic_bind_engine
)(
ENGINE
*
e
,
const
char
*
id
,
const
dynamic_fns
*
fns
);
#define IMPLEMENT_DYNAMIC_BIND_FN(fn) \
OPENSSL_EXPORT \
int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);
OPENSSL_EXPORT
\
int
bind_engine
(
ENGINE
*
e
,
const
char
*
id
,
const
dynamic_fns
*
fns
)
{
\
if
(
ENGINE_get_static_state
()
==
fns
->
static_state
)
goto
skip_cbs
;
\
...
...
doc/ssl/SSL_CTX_set_options.pod
浏览文件 @
9fb6fd34
...
...
@@ -237,24 +237,30 @@ OpenSSL 0.9.8m and later always attempts to use secure renegotiation as
described in draft-ietf-tls-renegotiation (FIXME: replace by RFC). This
counters the prefix attack described in CVE-2009-3555 and elsewhere.
The deprecated and highly broken SSLv2 protocol does not support secure
renegotiation at all: its use is B<strongly> discouraged.
This attack has far reaching consequences which application writers should be
aware of. In the description below an implementation supporting secure
renegotiation is referred to as I<patched>. A server not supporting secure
renegotiation is referred to as I<unpatched>.
The following sections describe the operations permitted by OpenSSL's secure
renegotiation implementation.
=head2 Patched client and server
Connections and renegotiation
will always succeed
.
Connections and renegotiation
are always permitted by OpenSSL implementations
.
=head2 Unpatched client and patched server
=head2 Unpatched client and patched
OpenSSL
server
The initial connection suceeds but client renegotiation is denied
with a
B<no_renegotiation> warning alert if TLS v1.0 is used or a fatal
The initial connection suceeds but client renegotiation is denied
by the
server with a
B<no_renegotiation> warning alert if TLS v1.0 is used or a fatal
B<handshake_failure> alert in SSL v3.0.
If the patched
server attempts to renegotiate a fatal B<handshake_failure>
alert is sent. This is because the server code may be unaware of th
e
unpatched nature of the client.
If the patched
OpenSSL server attempts to renegotiate a fatal
B<handshake_failure> alert is sent. This is because the server code may b
e
un
aware of the un
patched nature of the client.
If the option B<SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION> is set then
renegotiation B<always> succeeds.
...
...
@@ -263,32 +269,33 @@ B<NB:> a bug in OpenSSL clients earlier than 0.9.8m (all of which are
unpatched) will result in the connection hanging if it receives a
B<no_renegotiation> alert. OpenSSL versions 0.9.8m and later will regard
a B<no_renegotiation> alert as fatal and respond with a fatal
B<handshake_failure> alert.
B<handshake_failure> alert. This is because the OpenSSL API currently has
no provision to indicate to an application that a renegotiation attempt
was refused.
=head2 Patched client and unpatched server.
=head2 Patched
OpenSSL
client and unpatched server.
If the option B<SSL_OP_LEGACY_SERVER_CONNECT> is set then initial connections
to unpatched servers succeed. This option is currently set by default eve
n
though it has security implications: otherwise it would be impossible to
connect to unpatched servers i.e. all of them initially and this is clearly not
acceptable.
between patched OpenSSL clients and unpatched servers succeed. This optio
n
is currently set by default even though it has security implications: otherwise
it would be impossible to connect to unpatched servers (i.e. all of them
initially) and this is clearly not
acceptable.
As more servers become patched the option B<SSL_OP_LEGACY_SERVER_CONNECT> will
B<not> be set by default in a future version of OpenSSL.
Applications that want to ensure they can connect to unpatched servers shoul
d
always B<set> B<SSL_OP_LEGACY_SERVER_CONNECT>
OpenSSL client applications wishing to ensure they can connect to unpatche
d
servers should
always B<set> B<SSL_OP_LEGACY_SERVER_CONNECT>
Applications that want to ensure they can B<not> connect to unpatched servers
(and thus avoid any security issues) should always B<clear>
OpenSSL client applications that want to ensure they can B<not> connect to
unpatched servers
(and thus avoid any security issues) should always B<clear>
B<SSL_OP_LEGACY_SERVER_CONNECT> using SSL_CTX_clear_options() or
SSL_clear_options().
The function SSL_get_secure_renegotiation_support() indicates whether the peer
supports secure renegotiation.
The deprecated and highly broken SSLv2 protocol does not support secure
renegotiation at all: its use is B<strongly> discouraged.
Renegotiation between a patched OpenSSL client and unpatched server follows
the same scheme as between an unpatched client and a patched OpenSSL server:
i.e. it is not permitted unless the option
B<SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION> is set.
=head1 RETURN VALUES
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录