[openssl-users] BEAST and SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS

[Jakob Bohm]

On 22/07/2015 14:12, jonetsu wrote:
> Hello,
>
>
> Our Nessus version  6.4.1 is detecting a BEAST vulnerability against OpenSSL 1.0.1e.  The source code defines SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS as 0x00000800L and several tests are made for this value in the code.  The CHANGES mentions though that this had some side effects, the option now being part of SSL_OP_ALL.  It would look like, from the scan, that the fragments are not enabled by default, could it be ?
Yep, for some silly reason,
SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS was/is included in
the default value SSL_OP_ALL.  This is in the same
header as SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS.

The proper solution, as just about everybody knows
by now would have been to insert 1-byte fragments
(known as the 1/n-1 solution) which some other
SSL/TLS implementations do.


Enjoy

Jakob
-- 
Jakob Bohm, CIO, Partner, WiseMo A/S.  http://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark.  Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20150722/f7985bdb/attachment.html>