Felix Fietkau
15 years ago
parent
524303b849
commit
3e49e0c87a
@ -1,139 +0,0 @@ |
|||||||
--- a/ssl/d1_clnt.c
|
|
||||||
+++ b/ssl/d1_clnt.c
|
|
||||||
@@ -130,7 +130,7 @@ static int dtls1_get_hello_verify(SSL *s
|
|
||||||
|
|
||||||
static SSL_METHOD *dtls1_get_client_method(int ver)
|
|
||||||
{
|
|
||||||
- if (ver == DTLS1_VERSION)
|
|
||||||
+ if (ver == DTLS1_VERSION || ver == DTLS1_BAD_VER)
|
|
||||||
return(DTLSv1_client_method());
|
|
||||||
else
|
|
||||||
return(NULL);
|
|
||||||
@@ -181,7 +181,8 @@ int dtls1_connect(SSL *s)
|
|
||||||
s->server=0;
|
|
||||||
if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
|
|
||||||
|
|
||||||
- if ((s->version & 0xff00 ) != (DTLS1_VERSION & 0xff00))
|
|
||||||
+ if ((s->version & 0xff00 ) != (DTLS1_VERSION & 0xff00) &&
|
|
||||||
+ (s->version & 0xff00 ) != (DTLS1_BAD_VER & 0xff00))
|
|
||||||
{
|
|
||||||
SSLerr(SSL_F_DTLS1_CONNECT, ERR_R_INTERNAL_ERROR);
|
|
||||||
ret = -1;
|
|
||||||
--- a/ssl/d1_lib.c
|
|
||||||
+++ b/ssl/d1_lib.c
|
|
||||||
@@ -187,7 +187,10 @@ void dtls1_free(SSL *s)
|
|
||||||
void dtls1_clear(SSL *s)
|
|
||||||
{
|
|
||||||
ssl3_clear(s);
|
|
||||||
- s->version=DTLS1_VERSION;
|
|
||||||
+ if (s->options & SSL_OP_CISCO_ANYCONNECT)
|
|
||||||
+ s->version=DTLS1_BAD_VER;
|
|
||||||
+ else
|
|
||||||
+ s->version=DTLS1_VERSION;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
--- a/ssl/d1_pkt.c
|
|
||||||
+++ b/ssl/d1_pkt.c
|
|
||||||
@@ -987,15 +987,17 @@ start:
|
|
||||||
if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)
|
|
||||||
{
|
|
||||||
struct ccs_header_st ccs_hdr;
|
|
||||||
+ int ccs_hdr_len = DTLS1_CCS_HEADER_LENGTH;
|
|
||||||
|
|
||||||
dtls1_get_ccs_header(rr->data, &ccs_hdr);
|
|
||||||
|
|
||||||
/* 'Change Cipher Spec' is just a single byte, so we know
|
|
||||||
* exactly what the record payload has to look like */
|
|
||||||
/* XDTLS: check that epoch is consistent */
|
|
||||||
- if ( (s->client_version == DTLS1_BAD_VER && rr->length != 3) ||
|
|
||||||
- (s->client_version != DTLS1_BAD_VER && rr->length != DTLS1_CCS_HEADER_LENGTH) ||
|
|
||||||
- (rr->off != 0) || (rr->data[0] != SSL3_MT_CCS))
|
|
||||||
+ if (s->client_version == DTLS1_BAD_VER || s->version == DTLS1_BAD_VER)
|
|
||||||
+ ccs_hdr_len = 3;
|
|
||||||
+
|
|
||||||
+ if ((rr->length != ccs_hdr_len) || (rr->off != 0) || (rr->data[0] != SSL3_MT_CCS))
|
|
||||||
{
|
|
||||||
i=SSL_AD_ILLEGAL_PARAMETER;
|
|
||||||
SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);
|
|
||||||
@@ -1311,7 +1313,7 @@ int do_dtls1_write(SSL *s, int type, con
|
|
||||||
#if 0
|
|
||||||
/* 'create_empty_fragment' is true only when this function calls itself */
|
|
||||||
if (!clear && !create_empty_fragment && !s->s3->empty_fragment_done
|
|
||||||
- && SSL_version(s) != DTLS1_VERSION)
|
|
||||||
+ && SSL_version(s) != DTLS1_VERSION && SSL_version(s) != DTLS1_BAD_VER)
|
|
||||||
{
|
|
||||||
/* countermeasure against known-IV weakness in CBC ciphersuites
|
|
||||||
* (see http://www.openssl.org/~bodo/tls-cbc.txt)
|
|
||||||
--- a/ssl/s3_clnt.c
|
|
||||||
+++ b/ssl/s3_clnt.c
|
|
||||||
@@ -708,7 +708,7 @@ int ssl3_get_server_hello(SSL *s)
|
|
||||||
|
|
||||||
if (!ok) return((int)n);
|
|
||||||
|
|
||||||
- if ( SSL_version(s) == DTLS1_VERSION)
|
|
||||||
+ if ( SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
|
|
||||||
{
|
|
||||||
if ( s->s3->tmp.message_type == DTLS1_MT_HELLO_VERIFY_REQUEST)
|
|
||||||
{
|
|
||||||
--- a/ssl/ssl.h
|
|
||||||
+++ b/ssl/ssl.h
|
|
||||||
@@ -510,6 +510,8 @@ typedef struct ssl_session_st
|
|
||||||
#define SSL_OP_COOKIE_EXCHANGE 0x00002000L
|
|
||||||
/* Don't use RFC4507 ticket extension */
|
|
||||||
#define SSL_OP_NO_TICKET 0x00004000L
|
|
||||||
+/* Use Cisco's "speshul" version of DTLS_BAD_VER (as client) */
|
|
||||||
+#define SSL_OP_CISCO_ANYCONNECT 0x00008000L
|
|
||||||
|
|
||||||
/* As server, disallow session resumption on renegotiation */
|
|
||||||
#define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION 0x00010000L
|
|
||||||
--- a/ssl/ssl_lib.c
|
|
||||||
+++ b/ssl/ssl_lib.c
|
|
||||||
@@ -995,7 +995,8 @@ long SSL_ctrl(SSL *s,int cmd,long larg,v
|
|
||||||
s->max_cert_list=larg;
|
|
||||||
return(l);
|
|
||||||
case SSL_CTRL_SET_MTU:
|
|
||||||
- if (SSL_version(s) == DTLS1_VERSION)
|
|
||||||
+ if (SSL_version(s) == DTLS1_VERSION ||
|
|
||||||
+ SSL_version(s) == DTLS1_BAD_VER)
|
|
||||||
{
|
|
||||||
s->d1->mtu = larg;
|
|
||||||
return larg;
|
|
||||||
--- a/ssl/ssl_sess.c
|
|
||||||
+++ b/ssl/ssl_sess.c
|
|
||||||
@@ -211,6 +211,11 @@ int ssl_get_new_session(SSL *s, int sess
|
|
||||||
ss->ssl_version=TLS1_VERSION;
|
|
||||||
ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
|
|
||||||
}
|
|
||||||
+ else if (s->version == DTLS1_BAD_VER)
|
|
||||||
+ {
|
|
||||||
+ ss->ssl_version=DTLS1_BAD_VER;
|
|
||||||
+ ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
|
|
||||||
+ }
|
|
||||||
else if (s->version == DTLS1_VERSION)
|
|
||||||
{
|
|
||||||
ss->ssl_version=DTLS1_VERSION;
|
|
||||||
--- a/ssl/t1_enc.c
|
|
||||||
+++ b/ssl/t1_enc.c
|
|
||||||
@@ -765,10 +765,10 @@ int tls1_mac(SSL *ssl, unsigned char *md
|
|
||||||
HMAC_CTX_init(&hmac);
|
|
||||||
HMAC_Init_ex(&hmac,mac_sec,EVP_MD_size(hash),hash,NULL);
|
|
||||||
|
|
||||||
- if (ssl->version == DTLS1_VERSION && ssl->client_version != DTLS1_BAD_VER)
|
|
||||||
+ if (ssl->version == DTLS1_BAD_VER ||
|
|
||||||
+ (ssl->version == DTLS1_VERSION && ssl->client_version != DTLS1_BAD_VER))
|
|
||||||
{
|
|
||||||
unsigned char dtlsseq[8],*p=dtlsseq;
|
|
||||||
-
|
|
||||||
s2n(send?ssl->d1->w_epoch:ssl->d1->r_epoch, p);
|
|
||||||
memcpy (p,&seq[2],6);
|
|
||||||
|
|
||||||
@@ -793,7 +793,7 @@ printf("rec=");
|
|
||||||
{unsigned int z; for (z=0; z<rec->length; z++) printf("%02X ",buf[z]); printf("\n"); }
|
|
||||||
#endif
|
|
||||||
|
|
||||||
- if ( SSL_version(ssl) != DTLS1_VERSION)
|
|
||||||
+ if ( SSL_version(ssl) != DTLS1_VERSION && SSL_version(ssl) != DTLS1_BAD_VER)
|
|
||||||
{
|
|
||||||
for (i=7; i>=0; i--)
|
|
||||||
{
|
|
||||||
@ -1,23 +0,0 @@ |
|||||||
--- a/Makefile.org
|
|
||||||
+++ b/Makefile.org
|
|
||||||
@@ -333,15 +333,15 @@ build_crypto:
|
|
||||||
dir=crypto; target=all; $(BUILD_ONE_CMD)
|
|
||||||
build_fips:
|
|
||||||
@dir=fips; target=all; [ -z "$(FIPSCANLIB)" ] || $(BUILD_ONE_CMD)
|
|
||||||
-build_ssl:
|
|
||||||
+build_ssl: build_crypto
|
|
||||||
@dir=ssl; target=all; $(BUILD_ONE_CMD)
|
|
||||||
-build_engines:
|
|
||||||
+build_engines: build_crypto
|
|
||||||
@dir=engines; target=all; $(BUILD_ONE_CMD)
|
|
||||||
-build_apps:
|
|
||||||
+build_apps: build_libs
|
|
||||||
@dir=apps; target=all; $(BUILD_ONE_CMD)
|
|
||||||
-build_tests:
|
|
||||||
+build_tests: build_libs
|
|
||||||
@dir=test; target=all; $(BUILD_ONE_CMD)
|
|
||||||
-build_tools:
|
|
||||||
+build_tools: build_libs
|
|
||||||
@dir=tools; target=all; $(BUILD_ONE_CMD)
|
|
||||||
|
|
||||||
all_testapps: build_libs build_testapps
|
|
||||||
@ -1,23 +0,0 @@ |
|||||||
--- a/config
|
|
||||||
+++ b/config
|
|
||||||
@@ -399,8 +399,11 @@ exit 0
|
|
||||||
# this is where the translation occurs into SSLeay terms
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
+# figure out if gcc is available and if so we use it otherwise
|
|
||||||
+# we fallback to whatever cc does on the system
|
|
||||||
GCCVER=`(gcc -dumpversion) 2>/dev/null`
|
|
||||||
if [ "$GCCVER" != "" ]; then
|
|
||||||
+ CC=gcc
|
|
||||||
# then strip off whatever prefix egcs prepends the number with...
|
|
||||||
# Hopefully, this will work for any future prefixes as well.
|
|
||||||
GCCVER=`echo $GCCVER | LC_ALL=C sed 's/^[a-zA-Z]*\-//'`
|
|
||||||
@@ -409,6 +412,8 @@ if [ "$GCCVER" != "" ]; then
|
|
||||||
# major and minor version numbers.
|
|
||||||
# peak single digit before and after first dot, e.g. 2.95.1 gives 29
|
|
||||||
GCCVER=`echo $GCCVER | sed 's/\([0-9]\)\.\([0-9]\).*/\1\2/'`
|
|
||||||
+else
|
|
||||||
+ CC=cc
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Only set CC if not supplied already
|
|
||||||
@ -1,37 +0,0 @@ |
|||||||
--- a/Makefile.org
|
|
||||||
+++ b/Makefile.org
|
|
||||||
@@ -357,7 +357,7 @@ libcrypto$(SHLIB_EXT): libcrypto.a $(SHA
|
|
||||||
$(AR) libcrypto.a fips/fipscanister.o ; \
|
|
||||||
else \
|
|
||||||
if [ "$(FIPSCANLIB)" = "libcrypto" ]; then \
|
|
||||||
- FIPSLD_CC=$(CC); CC=fips/fipsld; \
|
|
||||||
+ FIPSLD_CC="$(CC)"; CC=fips/fipsld; \
|
|
||||||
export CC FIPSLD_CC; \
|
|
||||||
fi; \
|
|
||||||
$(MAKE) -e SHLIBDIRS='crypto' build-shared; \
|
|
||||||
@@ -380,7 +380,7 @@ libssl$(SHLIB_EXT): libcrypto$(SHLIB_EXT
|
|
||||||
fips/fipscanister.o: build_fips
|
|
||||||
libfips$(SHLIB_EXT): fips/fipscanister.o
|
|
||||||
@if [ "$(SHLIB_TARGET)" != "" ]; then \
|
|
||||||
- FIPSLD_CC=$(CC); CC=fips/fipsld; export CC FIPSLD_CC; \
|
|
||||||
+ FIPSLD_CC="$(CC)"; CC=fips/fipsld; export CC FIPSLD_CC; \
|
|
||||||
$(MAKE) -f Makefile.shared -e $(BUILDENV) \
|
|
||||||
CC=$${CC} LIBNAME=fips THIS=$@ \
|
|
||||||
LIBEXTRAS=fips/fipscanister.o \
|
|
||||||
--- a/apps/Makefile
|
|
||||||
+++ b/apps/Makefile
|
|
||||||
@@ -153,12 +153,12 @@ $(EXE): progs.h $(E_OBJ) $(PROGRAM).o $(
|
|
||||||
shlib_target=; if [ -n "$(SHARED_LIBS)" ]; then \
|
|
||||||
shlib_target="$(SHLIB_TARGET)"; \
|
|
||||||
elif [ -n "$(FIPSCANLIB)" ]; then \
|
|
||||||
- FIPSLD_CC=$(CC); CC=$(TOP)/fips/fipsld; export CC FIPSLD_CC; \
|
|
||||||
+ FIPSLD_CC="$(CC)"; CC=$(TOP)/fips/fipsld; export CC FIPSLD_CC; \
|
|
||||||
fi; \
|
|
||||||
LIBRARIES="$(LIBSSL) $(LIBKRB5) $(LIBCRYPTO)" ; \
|
|
||||||
[ "x$(FIPSCANLIB)" = "xlibfips" ] && LIBRARIES="$$LIBRARIES -lfips"; \
|
|
||||||
$(MAKE) -f $(TOP)/Makefile.shared -e \
|
|
||||||
- CC=$${CC} APPNAME=$(EXE) OBJECTS="$(PROGRAM).o $(E_OBJ)" \
|
|
||||||
+ CC="$${CC}" APPNAME=$(EXE) OBJECTS="$(PROGRAM).o $(E_OBJ)" \
|
|
||||||
LIBDEPS="$(PEX_LIBS) $$LIBRARIES $(EX_LIBS)" \
|
|
||||||
link_app.$${shlib_target}
|
|
||||||
-(cd ..; \
|
|
||||||
@ -1,44 +0,0 @@ |
|||||||
http://rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guest
|
|
||||||
|
|
||||||
--- a/crypto/pqueue/pqueue.c
|
|
||||||
+++ b/crypto/pqueue/pqueue.c
|
|
||||||
@@ -234,3 +234,17 @@ pqueue_next(pitem **item)
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+int
|
|
||||||
+pqueue_size(pqueue_s *pq)
|
|
||||||
+{
|
|
||||||
+ pitem *item = pq->items;
|
|
||||||
+ int count = 0;
|
|
||||||
+
|
|
||||||
+ while(item != NULL)
|
|
||||||
+ {
|
|
||||||
+ count++;
|
|
||||||
+ item = item->next;
|
|
||||||
+ }
|
|
||||||
+ return count;
|
|
||||||
+}
|
|
||||||
--- a/crypto/pqueue/pqueue.h
|
|
||||||
+++ b/crypto/pqueue/pqueue.h
|
|
||||||
@@ -91,5 +91,6 @@ pitem *pqueue_iterator(pqueue pq);
|
|
||||||
pitem *pqueue_next(piterator *iter);
|
|
||||||
|
|
||||||
void pqueue_print(pqueue pq);
|
|
||||||
+int pqueue_size(pqueue pq);
|
|
||||||
|
|
||||||
#endif /* ! HEADER_PQUEUE_H */
|
|
||||||
--- a/ssl/d1_pkt.c
|
|
||||||
+++ b/ssl/d1_pkt.c
|
|
||||||
@@ -167,6 +167,10 @@ dtls1_buffer_record(SSL *s, record_pqueu
|
|
||||||
DTLS1_RECORD_DATA *rdata;
|
|
||||||
pitem *item;
|
|
||||||
|
|
||||||
+ /* Limit the size of the queue to prevent DOS attacks */
|
|
||||||
+ if (pqueue_size(queue->q) >= 100)
|
|
||||||
+ return 0;
|
|
||||||
+
|
|
||||||
rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
|
|
||||||
item = pitem_new(priority, rdata);
|
|
||||||
if (rdata == NULL || item == NULL)
|
|
||||||
@ -1,22 +0,0 @@ |
|||||||
http://rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guest
|
|
||||||
|
|
||||||
--- a/ssl/d1_both.c
|
|
||||||
+++ b/ssl/d1_both.c
|
|
||||||
@@ -561,7 +561,16 @@ dtls1_process_out_of_seq_message(SSL *s,
|
|
||||||
if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len)
|
|
||||||
goto err;
|
|
||||||
|
|
||||||
- if (msg_hdr->seq <= s->d1->handshake_read_seq)
|
|
||||||
+ /* Try to find item in queue, to prevent duplicate entries */
|
|
||||||
+ pq_64bit_init(&seq64);
|
|
||||||
+ pq_64bit_assign_word(&seq64, msg_hdr->seq);
|
|
||||||
+ item = pqueue_find(s->d1->buffered_messages, seq64);
|
|
||||||
+ pq_64bit_free(&seq64);
|
|
||||||
+
|
|
||||||
+ /* Discard the message if sequence number was already there, is
|
|
||||||
+ * too far in the future or the fragment is already in the queue */
|
|
||||||
+ if (msg_hdr->seq <= s->d1->handshake_read_seq ||
|
|
||||||
+ msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL)
|
|
||||||
{
|
|
||||||
unsigned char devnull [256];
|
|
||||||
|
|
||||||
@ -1,19 +0,0 @@ |
|||||||
--- a/ssl/d1_both.c
|
|
||||||
+++ b/ssl/d1_both.c
|
|
||||||
@@ -519,6 +519,7 @@ dtls1_retrieve_buffered_fragment(SSL *s,
|
|
||||||
|
|
||||||
if ( s->d1->handshake_read_seq == frag->msg_header.seq)
|
|
||||||
{
|
|
||||||
+ unsigned long frag_len = frag->msg_header.frag_len;
|
|
||||||
pqueue_pop(s->d1->buffered_messages);
|
|
||||||
|
|
||||||
al=dtls1_preprocess_fragment(s,&frag->msg_header,max);
|
|
||||||
@@ -536,7 +537,7 @@ dtls1_retrieve_buffered_fragment(SSL *s,
|
|
||||||
if (al==0)
|
|
||||||
{
|
|
||||||
*ok = 1;
|
|
||||||
- return frag->msg_header.frag_len;
|
|
||||||
+ return frag_len;
|
|
||||||
}
|
|
||||||
|
|
||||||
ssl3_send_alert(s,SSL3_AL_FATAL,al);
|
|
||||||
@ -1,53 +0,0 @@ |
|||||||
http://bugs.gentoo.org/270305
|
|
||||||
|
|
||||||
fix from upstream
|
|
||||||
|
|
||||||
--- a/ssl/d1_both.c
|
|
||||||
+++ b/ssl/d1_both.c
|
|
||||||
@@ -585,30 +585,31 @@ dtls1_process_out_of_seq_message(SSL *s,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
- frag = dtls1_hm_fragment_new(frag_len);
|
|
||||||
- if ( frag == NULL)
|
|
||||||
- goto err;
|
|
||||||
+ if (frag_len)
|
|
||||||
+ {
|
|
||||||
+ frag = dtls1_hm_fragment_new(frag_len);
|
|
||||||
+ if ( frag == NULL)
|
|
||||||
+ goto err;
|
|
||||||
|
|
||||||
- memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
|
|
||||||
+ memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
|
|
||||||
|
|
||||||
- if (frag_len)
|
|
||||||
- {
|
|
||||||
- /* read the body of the fragment (header has already been read */
|
|
||||||
+ /* read the body of the fragment (header has already been read) */
|
|
||||||
i = s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
|
|
||||||
frag->fragment,frag_len,0);
|
|
||||||
if (i<=0 || (unsigned long)i!=frag_len)
|
|
||||||
goto err;
|
|
||||||
- }
|
|
||||||
|
|
||||||
- pq_64bit_init(&seq64);
|
|
||||||
- pq_64bit_assign_word(&seq64, msg_hdr->seq);
|
|
||||||
+ pq_64bit_init(&seq64);
|
|
||||||
+ pq_64bit_assign_word(&seq64, msg_hdr->seq);
|
|
||||||
|
|
||||||
- item = pitem_new(seq64, frag);
|
|
||||||
- pq_64bit_free(&seq64);
|
|
||||||
- if ( item == NULL)
|
|
||||||
- goto err;
|
|
||||||
+ item = pitem_new(seq64, frag);
|
|
||||||
+ pq_64bit_free(&seq64);
|
|
||||||
+ if ( item == NULL)
|
|
||||||
+ goto err;
|
|
||||||
+
|
|
||||||
+ pqueue_insert(s->d1->buffered_messages, item);
|
|
||||||
+ }
|
|
||||||
|
|
||||||
- pqueue_insert(s->d1->buffered_messages, item);
|
|
||||||
return DTLS1_HM_FRAGMENT_RETRY;
|
|
||||||
|
|
||||||
err:
|
|
||||||
@ -1,59 +0,0 @@ |
|||||||
http://bugs.gentoo.org/280591
|
|
||||||
|
|
||||||
fix from upstream
|
|
||||||
|
|
||||||
http://cvs.openssl.org/chngview?cn=18260
|
|
||||||
|
|
||||||
--- a/crypto/evp/c_alld.c
|
|
||||||
+++ b/crypto/evp/c_alld.c
|
|
||||||
@@ -64,9 +64,6 @@
|
|
||||||
|
|
||||||
void OpenSSL_add_all_digests(void)
|
|
||||||
{
|
|
||||||
-#ifndef OPENSSL_NO_MD2
|
|
||||||
- EVP_add_digest(EVP_md2());
|
|
||||||
-#endif
|
|
||||||
#ifndef OPENSSL_NO_MD4
|
|
||||||
EVP_add_digest(EVP_md4());
|
|
||||||
#endif
|
|
||||||
--- a/crypto/x509/x509_vfy.c
|
|
||||||
+++ b/crypto/x509/x509_vfy.c
|
|
||||||
@@ -986,7 +986,11 @@ static int internal_verify(X509_STORE_CT
|
|
||||||
while (n >= 0)
|
|
||||||
{
|
|
||||||
ctx->error_depth=n;
|
|
||||||
- if (!xs->valid)
|
|
||||||
+
|
|
||||||
+ /* Skip signature check for self signed certificates. It
|
|
||||||
+ * doesn't add any security and just wastes time.
|
|
||||||
+ */
|
|
||||||
+ if (!xs->valid && xs != xi)
|
|
||||||
{
|
|
||||||
if ((pkey=X509_get_pubkey(xi)) == NULL)
|
|
||||||
{
|
|
||||||
@@ -996,13 +1000,6 @@ static int internal_verify(X509_STORE_CT
|
|
||||||
if (!ok) goto end;
|
|
||||||
}
|
|
||||||
else if (X509_verify(xs,pkey) <= 0)
|
|
||||||
- /* XXX For the final trusted self-signed cert,
|
|
||||||
- * this is a waste of time. That check should
|
|
||||||
- * optional so that e.g. 'openssl x509' can be
|
|
||||||
- * used to detect invalid self-signatures, but
|
|
||||||
- * we don't verify again and again in SSL
|
|
||||||
- * handshakes and the like once the cert has
|
|
||||||
- * been declared trusted. */
|
|
||||||
{
|
|
||||||
ctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE;
|
|
||||||
ctx->current_cert=xs;
|
|
||||||
--- a/ssl/ssl_algs.c
|
|
||||||
+++ b/ssl/ssl_algs.c
|
|
||||||
@@ -92,9 +92,6 @@ int SSL_library_init(void)
|
|
||||||
EVP_add_cipher(EVP_seed_cbc());
|
|
||||||
#endif
|
|
||||||
|
|
||||||
-#ifndef OPENSSL_NO_MD2
|
|
||||||
- EVP_add_digest(EVP_md2());
|
|
||||||
-#endif
|
|
||||||
#ifndef OPENSSL_NO_MD5
|
|
||||||
EVP_add_digest(EVP_md5());
|
|
||||||
EVP_add_digest_alias(SN_md5,"ssl2-md5");
|
|
||||||
@ -1,19 +0,0 @@ |
|||||||
--- a/Configure.rej
|
|
||||||
+++ /dev/null
|
|
||||||
@@ -1,16 +0,0 @@
|
|
||||||
-***************
|
|
||||||
-*** 162,167 ****
|
|
||||||
- "debug-ben-openbsd","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_OPENBSD_DEV_CRYPTO -DOPENSSL_NO_ASM -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::",
|
|
||||||
- "debug-ben-openbsd-debug","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_OPENBSD_DEV_CRYPTO -DOPENSSL_NO_ASM -g3 -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::",
|
|
||||||
- "debug-ben-debug", "gcc:$gcc_devteam_warn -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DDEBUG_SAFESTACK -g3 -O2 -pipe::(unknown)::::::",
|
|
||||||
- "debug-ben-strict", "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DCONST_STRICT -O2 -Wall -Wshadow -Werror -Wpointer-arith -Wcast-qual -Wwrite-strings -pipe::(unknown)::::::",
|
|
||||||
- "debug-rse","cc:-DTERMIOS -DL_ENDIAN -pipe -O -g -ggdb3 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}",
|
|
||||||
- "debug-bodo", "gcc:-DL_ENDIAN -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBIO_PAIR_DEBUG -DPEDANTIC -g -march=i486 -pedantic -Wshadow -Wall -Wcast-align -Wstrict-prototypes -Wmissing-prototypes -Wno-long-long -Wundef -Wconversion -pipe::-D_REENTRANT:::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}",
|
|
||||||
---- 162,168 ----
|
|
||||||
- "debug-ben-openbsd","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_OPENBSD_DEV_CRYPTO -DOPENSSL_NO_ASM -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::",
|
|
||||||
- "debug-ben-openbsd-debug","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_OPENBSD_DEV_CRYPTO -DOPENSSL_NO_ASM -g3 -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::",
|
|
||||||
- "debug-ben-debug", "gcc:$gcc_devteam_warn -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DDEBUG_SAFESTACK -g3 -O2 -pipe::(unknown)::::::",
|
|
||||||
-+ "debug-ben-no-renegotiation", "gcc:$gcc_devteam_warn -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DDEBUG_SAFESTACK -DNO_RENEGOTIATION -g3 -O2 -pipe::(unknown)::::::",
|
|
||||||
- "debug-ben-strict", "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DCONST_STRICT -O2 -Wall -Wshadow -Werror -Wpointer-arith -Wcast-qual -Wwrite-strings -pipe::(unknown)::::::",
|
|
||||||
- "debug-rse","cc:-DTERMIOS -DL_ENDIAN -pipe -O -g -ggdb3 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}",
|
|
||||||
- "debug-bodo", "gcc:-DL_ENDIAN -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBIO_PAIR_DEBUG -DPEDANTIC -g -march=i486 -pedantic -Wshadow -Wall -Wcast-align -Wstrict-prototypes -Wmissing-prototypes -Wno-long-long -Wundef -Wconversion -pipe::-D_REENTRANT:::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}",
|
|
||||||
Loading…
Reference in new issue