jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Fix OpenSSL 0.9.8za patch for EAP-FAST support

Browse source 
OpenSSL 0.9.8za added a fix for CVE-2014-0224 and the original fix broke
EAP-FAST support due to forgotten SSL3_FLAGS_CCS_OK marking for
tls_session_secret_cb. Fix for this regression was added into OpenSSL
1.x and newer. The same fix is needed in this backport patch for
0.9.8za.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-12-09 13:19:22 +02:00
parent c1f5bcb96f
commit 471debb0b3
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
patches/openssl-0.9.8za-tls-extensions.patch
View file

@ -12,7 +12,7 @@ command line.
diff -upr openssl-0.9.8za.orig/ssl/s3_clnt.c openssl-0.9.8za/ssl/s3_clnt.c diff -upr openssl-0.9.8za.orig/ssl/s3_clnt.c openssl-0.9.8za/ssl/s3_clnt.c
--- openssl-0.9.8za.orig/ssl/s3_clnt.c 2014-06-05 11:09:26.000000000 +0300 --- openssl-0.9.8za.orig/ssl/s3_clnt.c 2014-06-05 11:09:26.000000000 +0300
+++ openssl-0.9.8za/ssl/s3_clnt.c 2014-06-05 20:37:09.221387312 +0300 +++ openssl-0.9.8za/ssl/s3_clnt.c 2014-06-05 20:37:09.221387312 +0300
@@ -767,6 +767,21 @@ int ssl3_get_server_hello(SSL *s) @@ -767,6 +767,22 @@ int ssl3_get_server_hello(SSL *s)
goto f_err; goto f_err;
} }
@ -27,6 +27,7 @@ diff -upr openssl-0.9.8za.orig/ssl/s3_clnt.c openssl-0.9.8za/ssl/s3_clnt.c
+ { + {
+ s->session->cipher=pref_cipher ? + s->session->cipher=pref_cipher ?
+ pref_cipher : ssl_get_cipher_by_char(s,p+j); + pref_cipher : ssl_get_cipher_by_char(s,p+j);
+ s->s3->flags |= SSL3_FLAGS_CCS_OK;
+ } + }
+ } + }
+#endif /* OPENSSL_NO_TLSEXT */ +#endif /* OPENSSL_NO_TLSEXT */