]> granicus.if.org Git - php/commit
Added ssl context option, "disable_compression"
authorDaniel Lowrey <rdlowrey@gmail.com>
Wed, 30 Jan 2013 19:45:31 +0000 (14:45 -0500)
committerLars Strojny <lstrojny@php.net>
Wed, 30 Jan 2013 23:31:10 +0000 (00:31 +0100)
commit4a01ddfb5569da1b87dd4cac95c3f709fb607396
treeada82bf77cbde930bfec12aac47dc5189cf39cf3
parentbb4d11b405ae1f37a8b0e4db630e80c5678f0746
Added ssl context option, "disable_compression"

The CRIME attack vector exploits TLS compression. This patch adds a stream context option
allowing servers to disable TLS compression for versions of OpenSSL >= 1.0.0 (which first
introduced the SSL_OP_NO_COMPRESSION option). A summary rundown of the CRIME attack can
be found at https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls

Thanks to @DaveRandom for pointing out the relevant section of code.
ext/openssl/xp_ssl.c