details: http://hg.nginx.org/nginx/rev/b40af2fd1c16
branches:
changeset: 6255:b40af2fd1c16
user: Maxim Dounin <mdounin@mdounin.ru>
date: Thu Sep 24 17:19:08 2015 +0300
description:
SSL: compatibility with OpenSSL master branch.

RAND_pseudo_bytes() is deprecated in the OpenSSL master branch, so the only
use was changed to RAND_bytes(). Access to internal structures is no longer
possible, so now we don't try to set SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS even
if it's defined.

diffstat:

src/event/ngx_event_openssl.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)

diffs (28 lines):

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -1158,6 +1158,7 @@ ngx_ssl_handshake(ngx_connection_t *c)
c->recv_chain = ngx_ssl_recv_chain;
c->send_chain = ngx_ssl_send_chain;

+#if OPENSSL_VERSION_NUMBER < 0x10100000L
#ifdef SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS

/* initial handshake done, disable renegotiation (CVE-2009-3555) */
@@ -1166,6 +1167,7 @@ ngx_ssl_handshake(ngx_connection_t *c)
}

#endif
+#endif

return NGX_OK;
}
@@ -2861,7 +2863,7 @@ ngx_ssl_session_ticket_key_callback(ngx_
ngx_hex_dump(buf, key[0].name, 16) - buf, buf,
SSL_session_reused(ssl_conn) ? "reused" : "new");

- RAND_pseudo_bytes(iv, 16);
+ RAND_bytes(iv, 16);
EVP_EncryptInit_ex(ectx, EVP_aes_128_cbc(), NULL, key[0].aes_key, iv);
HMAC_Init_ex(hctx, key[0].hmac_key, 16,
ngx_ssl_session_ticket_md(), NULL);

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel