New option SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS for disabling CBC

vulnerability workaround (included in SSL_OP_ALL).

PR: #90

diff --git a/CHANGES b/CHANGES
index a3d53f1161261fc80610598ee57c7a0e89d78405..655517a4b2b6df17740d72902877087cb80a2937 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,19 @@
   *) Fix EVP_dsa_sha macro.
      [Nils Larsch]
 
+  *) New option
+          SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
+     for disabling the SSL 3.0/TLS 1.0 CBC vulnerability countermeasure
+     that was added in OpenSSL 0.9.6d.
+
+     As the countermeasure turned out to be incompatible with some
+     broken SSL implementations, the new option is part of SSL_OP_ALL.
+     SSL_OP_ALL is usually employed when compatibility with weird SSL
+     implementations is desired (e.g. '-bugs' option to 's_client' and
+     's_server'), so the new option is automatically set in many
+     applications.
+     [Bodo Moeller]
+
  Changes between 0.9.6c and 0.9.6d  [9 May 2002]
 
   *) Fix crypto/asn1/a_sign.c so that 'parameters' is omitted (not

diff --git a/doc/ssl/SSL_CTX_set_options.pod b/doc/ssl/SSL_CTX_set_options.pod
index 5842a31fa438082193ba9ef8355d4eecbb11a155..320fc930744c3d507d7c3c71e8c296681e348b2f 100644 (file)
--- a/doc/ssl/SSL_CTX_set_options.pod
+++ b/doc/ssl/SSL_CTX_set_options.pod
@@ -112,14 +112,22 @@ only understands up to SSLv3. In this case the client must still use the
 same SSLv3.1=TLSv1 announcement. Some clients step down to SSLv3 with respect
 to the server's answer and violate the version rollback protection.)
 
+=item SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
+
+Disables a countermeasure against a SSL 3.0/TLS 1.0 protocol
+vulnerability affecting CBC ciphers, which cannot be handled by some
+broken SSL implementations.  This option has no effect for connections
+using other ciphers.
+
 =item SSL_OP_ALL
 
 All of the above bug workarounds.
 
 =back
 
-It is save and recommended to use SSL_OP_ALL to enable the bug workaround
-options.
+It is usually safe to use B<SSL_OP_ALL> to enable the bug workaround
+options if compatibility with somewhat broken implementations is
+desired.
 
 The following B<modifying> options are available:
 
@@ -199,4 +207,9 @@ L<dhparam(1)|dhparam(1)>
 
 SSL_OP_TLS_ROLLBACK_BUG has been added in OpenSSL 0.9.6.
 
+B<SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS> has been added in OpenSSL 0.9.6e.
+Versions up to OpenSSL 0.9.6c do not include the countermeasure that
+can be disabled with this option (in OpenSSL 0.9.6d, it was always
+enabled).
+
 =cut

diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index d9a161ad8b65b0173e407065d2e501f3b699b00c..1944814ca70812b93645bd9a6c9582c67205f239 100644 (file)
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -361,13 +361,18 @@ int ssl3_setup_key_block(SSL *s)
        
        ssl3_generate_key_block(s,p,num);
        
-       /* enable vulnerability countermeasure for CBC ciphers with
-        * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt) */
-       s->s3->need_empty_fragments = 1;
+       if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
+               {
+               /* enable vulnerability countermeasure for CBC ciphers with
+                * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt)
+                */
+               s->s3->need_empty_fragments = 1;
+
 #ifndef NO_RC4
-       if ((s->session->cipher != NULL) && ((s->session->cipher->algorithms & SSL_ENC_MASK) == SSL_RC4))
-               s->s3->need_empty_fragments = 0;
+               if ((s->session->cipher != NULL) && ((s->session->cipher->algorithms & SSL_ENC_MASK) == SSL_RC4))
+                       s->s3->need_empty_fragments = 0;
 #endif
+               }
                
        return(1);
 err:

diff --git a/ssl/ssl.h b/ssl/ssl.h
index a63854533b0ebe21319a6b08eefd794a8ab876ad..4b8131ce64795a3261198b5425c6e7e4a803b725 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -350,6 +350,7 @@ typedef struct ssl_session_st
        struct ssl_session_st *prev,*next;
        } SSL_SESSION;
 
+
 #define SSL_OP_MICROSOFT_SESS_ID_BUG                   0x00000001L
 #define SSL_OP_NETSCAPE_CHALLENGE_BUG                  0x00000002L
 #define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG                0x00000008L
@@ -361,11 +362,27 @@ typedef struct ssl_session_st
 #define SSL_OP_TLS_BLOCK_PADDING_BUG                   0x00000200L
 #define SSL_OP_TLS_ROLLBACK_BUG                                0x00000400L
 
+/* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added
+ * in OpenSSL 0.9.6d.  Usually (depending on the application protocol)
+ * the workaround is not needed.  Unfortunately some broken SSL/TLS
+ * implementations cannot handle it at all, which is why we include
+ * it in SSL_OP_ALL. */
+#define SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS              0x00000800L /* added in 0.9.6e */
+
+/* SSL_OP_ALL: various bug workarounds that should be rather harmless */
+#define SSL_OP_ALL                                     0x000FFFFFL
+
+/* As server, disallow session resumption on renegotiation */
+#define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION  0x00010000L
 /* If set, always create a new key when using tmp_dh parameters */
 #define SSL_OP_SINGLE_DH_USE                           0x00100000L
 /* Set to also use the tmp_rsa key when doing RSA operations. */
 #define SSL_OP_EPHEMERAL_RSA                           0x00200000L
 
+#define SSL_OP_NO_SSLv2                                        0x01000000L
+#define SSL_OP_NO_SSLv3                                        0x02000000L
+#define SSL_OP_NO_TLSv1                                        0x04000000L
+
 /* The next flag deliberately changes the ciphertest, this is a check
  * for the PKCS#1 attack */
 #define SSL_OP_PKCS1_CHECK_1                           0x08000000L
@@ -374,11 +391,7 @@ typedef struct ssl_session_st
 /* SSL_OP_NON_EXPORT_FIRST looks utterly broken .. */
 #define SSL_OP_NON_EXPORT_FIRST                        0x40000000L
 #define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG         0x80000000L
-#define SSL_OP_ALL                                     0x000FFFFFL
 
-#define SSL_OP_NO_SSLv2                                        0x01000000L
-#define SSL_OP_NO_SSLv3                                        0x02000000L
-#define SSL_OP_NO_TLSv1                                        0x04000000L
 
 /* Allow SSL_write(..., n) to return r with 0 < r < n (i.e. report success
  * when just a single record has been written): */
@@ -392,6 +405,7 @@ typedef struct ssl_session_st
  * is blocking: */
 #define SSL_MODE_AUTO_RETRY 0x00000004L
 
+
 /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,
  * they cannot be used to clear bits. */
 

diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index b752e891c347e38597f8f3d14c4e5a09adf4153c..000bfa72481dc748b17dce1eee9767b50ff6af20 100644 (file)
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -433,13 +433,18 @@ printf("\nkey block\n");
 { int z; for (z=0; z<num; z++) printf("%02X%c",p1[z],((z+1)%16)?' ':'\n'); }
 #endif
 
-       /* enable vulnerability countermeasure for CBC ciphers with
-        * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt) */
-       s->s3->need_empty_fragments = 1;
+       if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
+               {
+               /* enable vulnerability countermeasure for CBC ciphers with
+                * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt)
+                */
+               s->s3->need_empty_fragments = 1;
+
 #ifndef NO_RC4
-       if ((s->session->cipher != NULL) && ((s->session->cipher->algorithms & SSL_ENC_MASK) == SSL_RC4))
-               s->s3->need_empty_fragments = 0;
+               if ((s->session->cipher != NULL) && ((s->session->cipher->algorithms & SSL_ENC_MASK) == SSL_RC4))
+                       s->s3->need_empty_fragments = 0;
 #endif
+               }
                
        return(1);
 err: