diff options
| author |   markus <markus@openbsd.org> | 2002-09-10 16:31:53 +0000 |
|---|---|---|
| committer | markus <markus@openbsd.org> | 2002-09-10 16:31:53 +0000 |
| commit | 1f9308f95cf5f2eb77b454500c9bb49d76673ef3 (patch) | |
| tree | c6825952eba2bd0bea9ff46656b25ab7eea8284b /lib/libssl/t1_enc.c | |
| parent | Update list of supported CMD and Promise devices. (diff) | |
| download | wireguard-openbsd-1f9308f95cf5f2eb77b454500c9bb49d76673ef3.tar.xz wireguard-openbsd-1f9308f95cf5f2eb77b454500c9bb49d76673ef3.zip | |
merge openssl-0.9.7-beta3, tested on vax by miod@
Diffstat (limited to 'lib/libssl/t1_enc.c')
| -rw-r--r-- | lib/libssl/t1_enc.c | 27 |
1 files changed, 19 insertions, 8 deletions
diff --git a/lib/libssl/t1_enc.c b/lib/libssl/t1_enc.c index b80525f3bad..5290bf66659 100644 --- a/lib/libssl/t1_enc.c +++ b/lib/libssl/t1_enc.c @@ -110,10 +110,10 @@ */ #include <stdio.h> +#include "ssl_locl.h" #include <openssl/comp.h> #include <openssl/evp.h> #include <openssl/hmac.h> -#include "ssl_locl.h" #include <openssl/md5.h> static void tls1_P_hash(const EVP_MD *md, const unsigned char *sec, @@ -483,14 +483,25 @@ printf("\nkey block\n"); { int z; for (z=0; z<num; z++) printf("%02X%c",p1[z],((z+1)%16)?' ':'\n'); } #endif - /* enable vulnerability countermeasure for CBC ciphers with - * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt) */ - s->s3->need_empty_fragments = 1; -#ifndef NO_RC4 - if ((s->session->cipher != NULL) && ((s->session->cipher->algorithms & SSL_ENC_MASK) == SSL_RC4)) - s->s3->need_empty_fragments = 0; + if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)) + { + /* enable vulnerability countermeasure for CBC ciphers with + * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt) + */ + s->s3->need_empty_fragments = 1; + + if (s->session->cipher != NULL) + { + if ((s->session->cipher->algorithms & SSL_ENC_MASK) == SSL_eNULL) + s->s3->need_empty_fragments = 0; + +#ifndef OPENSSL_NO_RC4 + if ((s->session->cipher->algorithms & SSL_ENC_MASK) == SSL_RC4) + s->s3->need_empty_fragments = 0; #endif - + } + } + return(1); err: SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE); |