aboutsummaryrefslogtreecommitdiffstats
path: root/tools/sed
diff options
context:
space:
mode:
authorJo-Philipp Wich <jow@openwrt.org>2015-05-04 08:49:21 +0000
committerJo-Philipp Wich <jow@openwrt.org>2015-05-04 08:49:21 +0000
commita28deda59043d2f77a728ad90ee3731c2efd19b1 (patch)
treef30e66d627c32cfda868dfbd4b0360bbbcedb631 /tools/sed
parentaea93173d1d492b6c9508336ec965aecb09b69e1 (diff)
downloadupstream-a28deda59043d2f77a728ad90ee3731c2efd19b1.tar.gz
upstream-a28deda59043d2f77a728ad90ee3731c2efd19b1.tar.bz2
upstream-a28deda59043d2f77a728ad90ee3731c2efd19b1.zip
openvpn: disable CBC record splitting in PolarSSL/mbedTLS (#19101)
OpenVPN assumes that its control channel messages are sent and received unfragmented, this assumption is broken when CBC record splitting is enabled in mbedTLS. The record splitting is intended as countermeasure against BEAST attacks which do not apply to OpenVPN, therefore we simply disable it until upstream OpenVPN gains the ability to process fragmented control messages. Disabling the splitting also works around a (not remotely triggerable) segmentation fault in mbedTLS. References: * https://dev.openwrt.org/ticket/19101 * https://community.openvpn.net/openvpn/ticket/524 * https://github.com/ARMmbed/mbedtls/pull/185 Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 45602
Diffstat (limited to 'tools/sed')
0 files changed, 0 insertions, 0 deletions