generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

update references to new RI RFC

Browse Source
This commit is contained in:
Dr. Stephen Henson 2010-02-12 21:59:57 +00:00
parent 7366f0b304
commit 81d87a2a28
3 changed files with 14 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
CHANGES
View File

@ -880,14 +880,14 @@
[Steve Henson] [Steve Henson]
*) If client attempts to renegotiate and doesn't support RI respond with *) If client attempts to renegotiate and doesn't support RI respond with
a no_renegotiation alert as required by draft-ietf-tls-renegotiation. a no_renegotiation alert as required by RFC5746. Some renegotiating
Some renegotiating TLS clients will continue a connection gracefully TLS clients will continue a connection gracefully when they receive
when they receive the alert. Unfortunately OpenSSL mishandled the alert. Unfortunately OpenSSL mishandled this alert and would hang
this alert and would hang waiting for a server hello which it will never waiting for a server hello which it will never receive. Now we treat a
receive. Now we treat a received no_renegotiation alert as a fatal received no_renegotiation alert as a fatal error. This is because
error. This is because applications requesting a renegotiation might well applications requesting a renegotiation might well expect it to succeed
expect it to succeed and would have no code in place to handle the server and would have no code in place to handle the server denying it so the
denying it so the only safe thing to do is to terminate the connection. only safe thing to do is to terminate the connection.
[Steve Henson] [Steve Henson]
*) Add ctrl macro SSL_get_secure_renegotiation_support() which returns 1 if *) Add ctrl macro SSL_get_secure_renegotiation_support() which returns 1 if
@ -899,10 +899,9 @@
the updated NID creation version. This should correctly handle UTF8. the updated NID creation version. This should correctly handle UTF8.
[Steve Henson] [Steve Henson]
*) Implement draft-ietf-tls-renegotiation-03. Re-enable *) Implement RFC5746. Re-enable renegotiation but require the extension
renegotiation but require the extension as needed. Unfortunately, as needed. Unfortunately, SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION turns out to be a turns out to be a bad idea. It has been replaced by
bad idea. It has been replaced by
SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION which can be set with SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION which can be set with
SSL_CTX_set_options(). This is really not recommended unless you SSL_CTX_set_options(). This is really not recommended unless you
know what you are doing. know what you are doing.

2
NEWS
View File

@ -7,7 +7,7 @@
Major changes between OpenSSL 0.9.8l and OpenSSL 1.0: Major changes between OpenSSL 0.9.8l and OpenSSL 1.0:
o Support for draft-ietf-tls-renegotiation-03.txt o Support for RFC5746 TLS renegotiation extension.
o RFC3280 path validation: sufficient to process PKITS tests. o RFC3280 path validation: sufficient to process PKITS tests.
o Integrated support for PVK files and keyblobs. o Integrated support for PVK files and keyblobs.
o Change default private key format to PKCS#8. o Change default private key format to PKCS#8.

4
doc/ssl/SSL_CTX_set_options.pod
View File

@ -234,8 +234,8 @@ these options.
=head1 SECURE RENEGOTIATION =head1 SECURE RENEGOTIATION
OpenSSL 0.9.8m and later always attempts to use secure renegotiation as OpenSSL 0.9.8m and later always attempts to use secure renegotiation as
described in draft-ietf-tls-renegotiation (FIXME: replace by RFC). This described in RFC5746. This counters the prefix attack described in
counters the prefix attack described in CVE-2009-3555 and elsewhere. CVE-2009-3555 and elsewhere.
The deprecated and highly broken SSLv2 protocol does not support secure The deprecated and highly broken SSLv2 protocol does not support secure
renegotiation at all: its use is B<strongly> discouraged. renegotiation at all: its use is B<strongly> discouraged.