diff options
| author | Joel Sing <jsing@cvs.openbsd.org> | 2018-01-27 15:17:14 +0000 |
|---|---|---|
| committer | Joel Sing <jsing@cvs.openbsd.org> | 2018-01-27 15:17:14 +0000 |
| commit | c4a2c96763fe51a37d4972731dc19084bdcb80d1 (patch) | |
| tree | 1f54e5961744c98075a11b6479534546090e5b79 /lib | |
| parent | 8f08fd7bda4379f0a7aca6543461e373ef96169c (diff) | |
Clarify the comment re the F5 EC curves extension bug.
Also reference the knowledge base article instead of a discussion thread.
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libssl/ssl_tlsext.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/lib/libssl/ssl_tlsext.c b/lib/libssl/ssl_tlsext.c index d43ebc67756..d0764af3c01 100644 --- a/lib/libssl/ssl_tlsext.c +++ b/lib/libssl/ssl_tlsext.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_tlsext.c,v 1.18 2017/11/28 16:46:14 jsing Exp $ */ +/* $OpenBSD: ssl_tlsext.c,v 1.19 2018/01/27 15:17:13 jsing Exp $ */ /* * Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org> * Copyright (c) 2017 Doug Hogan <doug@openbsd.org> @@ -271,11 +271,12 @@ tlsext_ec_serverhello_parse(SSL *s, CBS *cbs, int *alert) /* * Servers should not send this extension per the RFC. * - * However, F5 sends it by mistake (case ID 492780) so we need to skip - * over it. This bug is from at least 2014 but as of 2017, there - * are still large sites with this bug in production. + * However, certain F5 BIG-IP systems incorrectly send it. This bug is + * from at least 2014 but as of 2017, there are still large sites with + * this unpatched in production. As a result, we need to currently skip + * over the extension and ignore its content: * - * https://devcentral.f5.com/questions/disable-supported-elliptic-curves-extension-from-server + * https://support.f5.com/csp/article/K37345003 */ if (!CBS_skip(cbs, CBS_len(cbs))) { *alert = TLS1_AD_INTERNAL_ERROR; |