Index: openssl/patches/paddingext.patch |
diff --git a/openssl/patches/paddingext.patch b/openssl/patches/paddingext.patch |
new file mode 100644 |
index 0000000000000000000000000000000000000000..b098c820262ae872a2915df792ce93dd8acd1046 |
--- /dev/null |
+++ b/openssl/patches/paddingext.patch |
@@ -0,0 +1,65 @@ |
+From 61a9671951205d66382556b2502993ffc9201f59 Mon Sep 17 00:00:00 2001 |
+From: Adam Langley <agl@chromium.org> |
+Date: Wed, 11 Dec 2013 16:25:17 -0500 |
+Subject: [PATCH 57/57] Add padding extension. |
+ |
+This change adds a padding extension, when needed, in order to work |
+around bugs in F5 terminators. |
+--- |
+ ssl/t1_lib.c | 20 ++++++++++++++++++++ |
+ ssl/tls1.h | 4 ++++ |
+ 2 files changed, 24 insertions(+) |
+ |
+diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c |
+index 5578056..f9ad9d9 100644 |
+--- a/ssl/t1_lib.c |
++++ b/ssl/t1_lib.c |
+@@ -695,6 +695,31 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha |
+ } |
+ #endif |
+ |
++ /* Add padding to workaround bugs in F5 terminators. |
++ * See https://tools.ietf.org/html/draft-agl-tls-padding-02 */ |
++ { |
++ int hlen = ret - (unsigned char *)s->init_buf->data; |
++ /* The code in s23_clnt.c to build ClientHello messages includes the |
++ * 5-byte record header in the buffer, while the code in s3_clnt.c does |
++ * not. */ |
++ if (s->state == SSL23_ST_CW_CLNT_HELLO_A) |
++ hlen -= 5; |
++ if (hlen > 0xff && hlen < 0x200) |
++ { |
++ hlen = 0x200 - hlen; |
++ if (hlen >= 4) |
++ hlen -= 4; |
++ else |
++ hlen = 0; |
++ |
++ s2n(TLSEXT_TYPE_padding, ret); |
++ s2n(hlen, ret); |
++ memset(ret, 0, hlen); |
++ ret += hlen; |
++ } |
++ } |
++ |
++ |
+ if ((extdatalen = ret-p-2)== 0) |
+ return p; |
+ |
+diff --git a/ssl/tls1.h b/ssl/tls1.h |
+index ecf5da7..df8f482 100644 |
+--- a/ssl/tls1.h |
++++ b/ssl/tls1.h |
+@@ -255,6 +255,10 @@ extern "C" { |
+ #define TLSEXT_TYPE_channel_id 30031 |
+ #define TLSEXT_TYPE_channel_id_new 30032 |
+ |
++/* See https://tools.ietf.org/html/draft-agl-tls-padding-02 |
++ * Number not yet IANA assigned. */ |
++#define TLSEXT_TYPE_padding 35655 |
++ |
+ /* NameType value from RFC 3546 */ |
+ #define TLSEXT_NAMETYPE_host_name 0 |
+ /* status request value from RFC 3546 */ |
+-- |
+1.8.5.1 |