diff options
| author | Steffan Karger <steffan@karger.me> | 2015-05-04 21:06:38 +0200 |
|---|---|---|
| committer | Gert Doering <gert@greenie.muc.de> | 2015-05-09 16:03:52 +0200 |
| commit | d0f26fb524744a63615a1bf4e7ddcefcd102b328 (patch) | |
| tree | 319a376d06db9c00a53dfe6a769eeba9c5731ca3 /src/openvpn/gremlin.c | |
| parent | 5f66f907cfc57b89110c08e50c7aab228e090911 (diff) | |
| download | openvpn-d0f26fb524744a63615a1bf4e7ddcefcd102b328.tar.gz openvpn-d0f26fb524744a63615a1bf4e7ddcefcd102b328.tar.xz openvpn-d0f26fb524744a63615a1bf4e7ddcefcd102b328.zip | |
polarssl: disable 1/n-1 record splitting
Disable record splitting (for now). OpenVPN assumes records are sent
unfragmented, which is no longer a valid assumption when record splitting
is enabled (which polarssl/mbedtls did in 1.3.10, see trac #524).
Changing the code to deal with record splitting will require intrusive
changes that need thorough review and testing. Since OpenVPN is not
susceptible to BEAST (the data transmitted over the control channel is
very hard to influence for a remote attacker), we can just disable record
splitting as a quick fix. This gives us the time to develop a proper
solution in the mean time, and test that thoroughly.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1430766398-17209-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9646
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Diffstat (limited to 'src/openvpn/gremlin.c')
0 files changed, 0 insertions, 0 deletions