Hi,

You've probably heard it already. SSL was hacked and broken. You can
read about it at
http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/.
Some more commentary at
http://blogs.cisco.com/security/beat-the-beast-with-tls/

As it turns out, OpenSSL people implemented a fix for this almost 10
years ago. Details at http://www.openssl.org/~bodo/tls-cbc.txt

Attached is a patch against 1.0.6 which introduces
"ssl_dont_insert_empty_fragments" flag to control whether this
workaround is enabled or not. Currently, it was hardcoded to disabled.
This patch makes it optional.

Note: this patch breaks certain old browsers which choke on the
workaround. This was tested with IE6.

Comments?

Cheers,
Srebrenko
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel