diff options
| author | Daniel Lowrey <rdlowrey@gmail.com> | 2013-01-30 14:45:31 -0500 |
|---|---|---|
| committer | Lars Strojny <lstrojny@php.net> | 2013-01-31 00:31:10 +0100 |
| commit | 4a01ddfb5569da1b87dd4cac95c3f709fb607396 (patch) | |
| tree | ada82bf77cbde930bfec12aac47dc5189cf39cf3 /ext/soap/php_xml.c | |
| parent | bb4d11b405ae1f37a8b0e4db630e80c5678f0746 (diff) | |
| download | php-git-4a01ddfb5569da1b87dd4cac95c3f709fb607396.tar.gz | |
Added ssl context option, "disable_compression"
The CRIME attack vector exploits TLS compression. This patch adds a stream context option
allowing servers to disable TLS compression for versions of OpenSSL >= 1.0.0 (which first
introduced the SSL_OP_NO_COMPRESSION option). A summary rundown of the CRIME attack can
be found at https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls
Thanks to @DaveRandom for pointing out the relevant section of code.
Diffstat (limited to 'ext/soap/php_xml.c')
0 files changed, 0 insertions, 0 deletions