[src/trunk]: src/crypto/external/bsd/openssl/dist/ssl openssl security patch ...

[drochner <drochner%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/8405606338f9
branches:  trunk
changeset: 759368:8405606338f9
user:      drochner <drochner%NetBSD.org@localhost>
date:      Tue Dec 07 09:10:21 2010 +0000

description:
openssl security patch of the day:
Fix a flaw in the OpenSSL SSL/TLS server code where an old bug
workaround allows malicous clients to modify the stored session cache
ciphersuite. In some cases the ciphersuite can be downgraded to a weaker one
on subsequent connections. See
http://www.openssl.org/news/secadv_20101202.txt
(CVE-2010-4180)

diffstat:

 crypto/external/bsd/openssl/dist/ssl/s3_clnt.c |  3 +++
 crypto/external/bsd/openssl/dist/ssl/s3_srvr.c |  5 +++++
 2 files changed, 8 insertions(+), 0 deletions(-)

diffs (37 lines):

diff -r 89cf584e8b39 -r 8405606338f9 crypto/external/bsd/openssl/dist/ssl/s3_clnt.c
--- a/crypto/external/bsd/openssl/dist/ssl/s3_clnt.c    Tue Dec 07 09:00:23 2010 +0000
+++ b/crypto/external/bsd/openssl/dist/ssl/s3_clnt.c    Tue Dec 07 09:10:21 2010 +0000
@@ -870,8 +870,11 @@
                s->session->cipher_id = s->session->cipher->id;
        if (s->hit && (s->session->cipher_id != c->id))
                {
+/* Workaround is now obsolete */
+#if 0
                if (!(s->options &
                        SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG))
+#endif
                        {
                        al=SSL_AD_ILLEGAL_PARAMETER;
                        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
diff -r 89cf584e8b39 -r 8405606338f9 crypto/external/bsd/openssl/dist/ssl/s3_srvr.c
--- a/crypto/external/bsd/openssl/dist/ssl/s3_srvr.c    Tue Dec 07 09:00:23 2010 +0000
+++ b/crypto/external/bsd/openssl/dist/ssl/s3_srvr.c    Tue Dec 07 09:10:21 2010 +0000
@@ -975,6 +975,10 @@
                                break;
                                }
                        }
+/* Disabled because it can be used in a ciphersuite downgrade
+ * attack: CVE-2010-4180.
+ */
+#if 0
                if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
                        {
                        /* Special case as client bug workaround: the previously used cipher may
@@ -989,6 +993,7 @@
                                j = 1;
                                }
                        }
+#endif
                if (j == 0)
                        {
                        /* we need to have the cipher in the cipher