generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Disable SHA-2 ciphersuites in < TLS 1.2 connections.

Browse Source 
(TLS 1.2 clients could end up negotiating these with an OpenSSL server
with TLS 1.2 disabled, which is problematic.)

Submitted by: Adam Langley
This commit is contained in:
Bodo Möller 2012-04-17 15:21:29 +00:00
parent 48e0f6667b
commit bb3add20f3
2 changed files with 16 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@ -54,6 +54,9 @@
Changes between 1.0.1 and 1.0.1a [xx XXX xxxx] Changes between 1.0.1 and 1.0.1a [xx XXX xxxx]
*) Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
[Adam Langley]
*) Workarounds for some broken servers that "hang" if a client hello *) Workarounds for some broken servers that "hang" if a client hello
record length exceeds 255 bytes: record length exceeds 255 bytes:

26
ssl/s3_lib.c
View File

@ -1076,7 +1076,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aRSA, SSL_aRSA,
SSL_eNULL, SSL_eNULL,
SSL_SHA256, SSL_SHA256,
SSL_SSLV3, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS, SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
0, 0,
@ -1092,7 +1092,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aRSA, SSL_aRSA,
SSL_AES128, SSL_AES128,
SSL_SHA256, SSL_SHA256,
SSL_TLSV1, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128, 128,
@ -1108,7 +1108,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aRSA, SSL_aRSA,
SSL_AES256, SSL_AES256,
SSL_SHA256, SSL_SHA256,
SSL_TLSV1, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256, 256,
@ -1124,7 +1124,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aDH, SSL_aDH,
SSL_AES128, SSL_AES128,
SSL_SHA256, SSL_SHA256,
SSL_TLSV1, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128, 128,
@ -1140,7 +1140,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aDH, SSL_aDH,
SSL_AES128, SSL_AES128,
SSL_SHA256, SSL_SHA256,
SSL_TLSV1, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128, 128,
@ -1156,7 +1156,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aDSS, SSL_aDSS,
SSL_AES128, SSL_AES128,
SSL_SHA256, SSL_SHA256,
SSL_TLSV1, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128, 128,
@ -1390,7 +1390,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aRSA, SSL_aRSA,
SSL_AES128, SSL_AES128,
SSL_SHA256, SSL_SHA256,
SSL_TLSV1, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128, 128,
@ -1406,7 +1406,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aDH, SSL_aDH,
SSL_AES256, SSL_AES256,
SSL_SHA256, SSL_SHA256,
SSL_TLSV1, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256, 256,
@ -1422,7 +1422,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aDH, SSL_aDH,
SSL_AES256, SSL_AES256,
SSL_SHA256, SSL_SHA256,
SSL_TLSV1, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256, 256,
@ -1438,7 +1438,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aDSS, SSL_aDSS,
SSL_AES256, SSL_AES256,
SSL_SHA256, SSL_SHA256,
SSL_TLSV1, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256, 256,
@ -1454,7 +1454,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aRSA, SSL_aRSA,
SSL_AES256, SSL_AES256,
SSL_SHA256, SSL_SHA256,
SSL_TLSV1, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256, 256,
@ -1470,7 +1470,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aNULL, SSL_aNULL,
SSL_AES128, SSL_AES128,
SSL_SHA256, SSL_SHA256,
SSL_TLSV1, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128, 128,
@ -1486,7 +1486,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_aNULL, SSL_aNULL,
SSL_AES256, SSL_AES256,
SSL_SHA256, SSL_SHA256,
SSL_TLSV1, SSL_TLSV1_2,
SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF, SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256, 256,