diff options
| author | Richard Levitte <levitte@openssl.org> | 2002-06-25 11:37:40 +0000 |
|---|---|---|
| committer | Richard Levitte <levitte@openssl.org> | 2002-06-25 11:37:40 +0000 |
| commit | 7a4ca7c13c2f01d2ab41c4f2d9ec77273d7c2f96 (patch) | |
| tree | cf33cab7e9a5d031fde08b57bd1e92c0eb185e25 /doc/ssl | |
| parent | 24e565adb5fffb1a87c592655138fa3ead646e99 (diff) | |
| download | openssl-new-7a4ca7c13c2f01d2ab41c4f2d9ec77273d7c2f96.tar.gz | |
Recent changes from HEAD.
Diffstat (limited to 'doc/ssl')
| -rw-r--r-- | doc/ssl/SSL_CTX_set_options.pod | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/doc/ssl/SSL_CTX_set_options.pod b/doc/ssl/SSL_CTX_set_options.pod index c10055c6e7..3b918178fd 100644 --- a/doc/ssl/SSL_CTX_set_options.pod +++ b/doc/ssl/SSL_CTX_set_options.pod @@ -100,14 +100,22 @@ doing a re-connect, always takes the first cipher in the cipher list. ... +=item SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS + +Disables a countermeasure against a SSL 3.0/TLS 1.0 protocol +vulnerability affecting CBC ciphers, which cannot be handled by some +broken SSL implementations. This option has no effect for connections +using other ciphers. + =item SSL_OP_ALL All of the above bug workarounds. =back -It is safe and recommended to use B<SSL_OP_ALL> to enable the bug workaround -options. +It is usually safe to use B<SSL_OP_ALL> to enable the bug workaround +options if compatibility with somewhat broken implementations is +desired. The following B<modifying> options are available: @@ -219,4 +227,9 @@ B<SSL_OP_TLS_ROLLBACK_BUG> has been added in OpenSSL 0.9.6 and was automatically enabled with B<SSL_OP_ALL>. As of 0.9.7, it is no longer included in B<SSL_OP_ALL> and must be explicitly set. +B<SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS> has been added in OpenSSL 0.9.6e. +Versions up to OpenSSL 0.9.6c do not include the countermeasure that +can be disabled with this option (in OpenSSL 0.9.6d, it was always +enabled). + =cut |