|
 |
a5ef24 |
diff -up openssl-1.0.1e/doc/ssl/SSL_COMP_add_compression_method.pod.env-zlib openssl-1.0.1e/doc/ssl/SSL_COMP_add_compression_method.pod
|
|
|
a5ef24 |
--- openssl-1.0.1e/doc/ssl/SSL_COMP_add_compression_method.pod.env-zlib 2013-02-11 16:02:48.000000000 +0100
|
|
|
a5ef24 |
+++ openssl-1.0.1e/doc/ssl/SSL_COMP_add_compression_method.pod 2013-02-19 16:32:51.000000000 +0100
|
|
|
a5ef24 |
@@ -47,6 +47,13 @@ Once the identities of the compression m
|
|
|
a5ef24 |
been standardized, the compression API will most likely be changed. Using
|
|
|
a5ef24 |
it in the current state is not recommended.
|
|
|
a5ef24 |
|
|
|
a5ef24 |
+It is also not recommended to use compression if data transfered contain
|
|
|
a5ef24 |
+untrusted parts that can be manipulated by an attacker as he could then
|
|
|
a5ef24 |
+get information about the encrypted data. See the CRIME attack. For
|
|
|
a5ef24 |
+that reason the default loading of the zlib compression method is
|
|
|
a5ef24 |
+disabled and enabled only if the environment variable B<OPENSSL_DEFAULT_ZLIB>
|
|
|
a5ef24 |
+is present during the library initialization.
|
|
|
a5ef24 |
+
|
|
|
a5ef24 |
=head1 RETURN VALUES
|
|
|
a5ef24 |
|
|
|
a5ef24 |
SSL_COMP_add_compression_method() may return the following values:
|
|
|
a5ef24 |
diff -up openssl-1.0.1e/ssl/ssl_ciph.c.env-zlib openssl-1.0.1e/ssl/ssl_ciph.c
|
|
|
a5ef24 |
--- openssl-1.0.1e/ssl/ssl_ciph.c.env-zlib 2013-02-11 16:26:04.000000000 +0100
|
|
|
a5ef24 |
+++ openssl-1.0.1e/ssl/ssl_ciph.c 2013-02-19 16:37:36.163545085 +0100
|
|
|
a5ef24 |
@@ -140,6 +140,8 @@
|
|
|
a5ef24 |
* OTHERWISE.
|
|
|
a5ef24 |
*/
|
|
|
a5ef24 |
|
|
|
a5ef24 |
+/* for secure_getenv */
|
|
|
a5ef24 |
+#define _GNU_SOURCE
|
|
|
a5ef24 |
#include <stdio.h>
|
|
|
a5ef24 |
#include <openssl/objects.h>
|
|
|
a5ef24 |
#ifndef OPENSSL_NO_COMP
|
|
|
a5ef24 |
@@ -455,7 +457,7 @@ static void load_builtin_compressions(vo
|
|
|
a5ef24 |
|
|
|
a5ef24 |
MemCheck_off();
|
|
|
a5ef24 |
ssl_comp_methods=sk_SSL_COMP_new(sk_comp_cmp);
|
|
|
a5ef24 |
- if (ssl_comp_methods != NULL)
|
|
|
a5ef24 |
+ if (ssl_comp_methods != NULL && secure_getenv("OPENSSL_DEFAULT_ZLIB") != NULL)
|
|
|
a5ef24 |
{
|
|
|
a5ef24 |
comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
|
|
|
a5ef24 |
if (comp != NULL)
|