Commit 32a76f2c authored by Bodo Möller's avatar Bodo Möller
Browse files

New option SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS for disabling CBC 

vulnerability workaround (included in SSL_OP_ALL).

PR: #90
parent 578c1cde

CHANGES

+13 −0
Original line number Diff line number Diff line
@@ -7,6 +7,19 @@ 
  *) Fix EVP_dsa_sha macro.

     [Nils Larsch]



  *) New option

          SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS

     for disabling the SSL 3.0/TLS 1.0 CBC vulnerability countermeasure

     that was added in OpenSSL 0.9.6d.



     As the countermeasure turned out to be incompatible with some

     broken SSL implementations, the new option is part of SSL_OP_ALL.

     SSL_OP_ALL is usually employed when compatibility with weird SSL

     implementations is desired (e.g. '-bugs' option to 's_client' and

     's_server'), so the new option is automatically set in many

     applications.

     [Bodo Moeller]



 Changes between 0.9.6c and 0.9.6d  [9 May 2002]



  *) Fix crypto/asn1/a_sign.c so that 'parameters' is omitted (not

doc/ssl/SSL_CTX_set_options.pod

+15 −2
Original line number Diff line number Diff line
@@ -112,14 +112,22 @@ only understands up to SSLv3. In this case the client must still use the 
same SSLv3.1=TLSv1 announcement. Some clients step down to SSLv3 with respect

to the server's answer and violate the version rollback protection.)



=item SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS



Disables a countermeasure against a SSL 3.0/TLS 1.0 protocol

vulnerability affecting CBC ciphers, which cannot be handled by some

broken SSL implementations.  This option has no effect for connections

using other ciphers.



=item SSL_OP_ALL



All of the above bug workarounds.



=back



It is save and recommended to use SSL_OP_ALL to enable the bug workaround

options.

It is usually safe to use B<SSL_OP_ALL> to enable the bug workaround

options if compatibility with somewhat broken implementations is

desired.



The following B<modifying> options are available:
@@ -199,4 +207,9 @@ L<dhparam(1)|dhparam(1)> 


SSL_OP_TLS_ROLLBACK_BUG has been added in OpenSSL 0.9.6.



B<SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS> has been added in OpenSSL 0.9.6e.

Versions up to OpenSSL 0.9.6c do not include the countermeasure that

can be disabled with this option (in OpenSSL 0.9.6d, it was always

enabled).



=cut

ssl/s3_enc.c

+10 −5
Original line number Diff line number Diff line
@@ -361,13 +361,18 @@ int ssl3_setup_key_block(SSL *s) 
	

	ssl3_generate_key_block(s,p,num);

	

	if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))

		{

		/* enable vulnerability countermeasure for CBC ciphers with

	 * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt) */

		 * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt)

		 */

		s->s3->need_empty_fragments = 1;



#ifndef NO_RC4

		if ((s->session->cipher != NULL) && ((s->session->cipher->algorithms & SSL_ENC_MASK) == SSL_RC4))

			s->s3->need_empty_fragments = 0;

#endif

 		}

		

	return(1);

err:

ssl/ssl.h

+18 −4
Original line number Diff line number Diff line
@@ -350,6 +350,7 @@ typedef struct ssl_session_st 
	struct ssl_session_st *prev,*next;

	} SSL_SESSION;





#define SSL_OP_MICROSOFT_SESS_ID_BUG			0x00000001L

#define SSL_OP_NETSCAPE_CHALLENGE_BUG			0x00000002L

#define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG		0x00000008L
@@ -361,11 +362,27 @@ typedef struct ssl_session_st 
#define SSL_OP_TLS_BLOCK_PADDING_BUG			0x00000200L

#define SSL_OP_TLS_ROLLBACK_BUG				0x00000400L



/* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added

 * in OpenSSL 0.9.6d.  Usually (depending on the application protocol)

 * the workaround is not needed.  Unfortunately some broken SSL/TLS

 * implementations cannot handle it at all, which is why we include

 * it in SSL_OP_ALL. */

#define SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS              0x00000800L /* added in 0.9.6e */



/* SSL_OP_ALL: various bug workarounds that should be rather harmless */

#define SSL_OP_ALL					0x000FFFFFL



/* As server, disallow session resumption on renegotiation */

#define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION	0x00010000L

/* If set, always create a new key when using tmp_dh parameters */

#define SSL_OP_SINGLE_DH_USE				0x00100000L

/* Set to also use the tmp_rsa key when doing RSA operations. */

#define SSL_OP_EPHEMERAL_RSA				0x00200000L



#define SSL_OP_NO_SSLv2					0x01000000L

#define SSL_OP_NO_SSLv3					0x02000000L

#define SSL_OP_NO_TLSv1					0x04000000L



/* The next flag deliberately changes the ciphertest, this is a check

 * for the PKCS#1 attack */

#define SSL_OP_PKCS1_CHECK_1				0x08000000L
@@ -374,11 +391,7 @@ typedef struct ssl_session_st 
/* SSL_OP_NON_EXPORT_FIRST looks utterly broken .. */

#define SSL_OP_NON_EXPORT_FIRST 			0x40000000L

#define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG		0x80000000L

#define SSL_OP_ALL					0x000FFFFFL



#define SSL_OP_NO_SSLv2					0x01000000L

#define SSL_OP_NO_SSLv3					0x02000000L

#define SSL_OP_NO_TLSv1					0x04000000L



/* Allow SSL_write(..., n) to return r with 0 < r < n (i.e. report success

 * when just a single record has been written): */
@@ -392,6 +405,7 @@ typedef struct ssl_session_st 
 * is blocking: */

#define SSL_MODE_AUTO_RETRY 0x00000004L





/* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,

 * they cannot be used to clear bits. */

ssl/t1_enc.c

+10 −5
Original line number Diff line number Diff line
@@ -433,13 +433,18 @@ printf("\nkey block\n"); 
{ int z; for (z=0; z<num; z++) printf("%02X%c",p1[z],((z+1)%16)?' ':'\n'); }

#endif



	if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))

		{

		/* enable vulnerability countermeasure for CBC ciphers with

	 * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt) */

		 * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt)

		 */

		s->s3->need_empty_fragments = 1;



#ifndef NO_RC4

		if ((s->session->cipher != NULL) && ((s->session->cipher->algorithms & SSL_ENC_MASK) == SSL_RC4))

			s->s3->need_empty_fragments = 0;

#endif

		}

		

	return(1);

err: