Merge lp:~ubuntu-branches/ubuntu/precise/openssl/precise-201312110155 into lp:ubuntu/precise/openssl

[Ubuntu Package Importer]

The package importer has detected a possible inconsistency between the package history in the archive and the history in bzr. As the archive is authoritative the importer has made lp:ubuntu/precise/openssl reflect what is in the archive and the old bzr branch has been pushed to lp:~ubuntu-branches/ubuntu/precise/openssl/precise-201312110155. This merge proposal was created so that an Ubuntu developer can review the situations and perform a merge/upload if necessary. There are three typical cases where this can happen.
  1. Where someone pushes a change to bzr and someone else uploads the package without that change. This is the reason that this check is done by the importer. If this appears to be the case then a merge/upload should be done if the changes that were in bzr are still desirable.
  2. The importer incorrectly detected the above situation when someone made a change in bzr and then uploaded it.
  3. The importer incorrectly detected the above situation when someone just uploaded a package and didn't touch bzr.

If this case doesn't appear to be the first situation then set the status of the merge proposal to "Rejected" and help avoid the problem in future by filing a bug at https://bugs.launchpad.net/udd linking to this merge proposal.

(this is an automatically generated message)

Unmerged revisions

80. By Colin Watson on 2012-04-24

releasing version 1.0.1-4ubuntu4

79. By Colin Watson on 2012-04-24

merge 1.0.1-4ubuntu3

78. By Colin Watson on 2012-04-24

Check TLS1_get_client_version rather than TLS1_get_version for client
hello cipher list truncation, in a further attempt to get things working
again for everyone (LP: #986147).

77. By Colin Watson on 2012-04-18

releasing version 1.0.1-4ubuntu2

76. By Colin Watson on 2012-04-18

* Backport more upstream patches to work around TLS 1.2 failures
  (LP #965371):
  - Do not use record version number > TLS 1.0 in initial client hello:
    some (but not all) hanging servers will now work.
  - Truncate the number of ciphers sent in the client hello to 50. Most
    broken servers should now work.
  - Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
* Don't re-enable TLS 1.2 client support by default yet, since more of the
  sites listed in the above bug and its duplicates still fail if I do that
  versus leaving it disabled.

=== modified file 'debian/changelog'
--- debian/changelog	2012-04-19 10:31:06 +0000
+++ debian/changelog	2013-12-11 06:23:47 +0000
@@ -1,12 +1,32 @@
-openssl (1.0.1-4ubuntu3) precise-proposed; urgency=low
-
-  * SECURITY UPDATE: fix various overflows
-    - debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,
-      crypto/buffer.c and crypto/mem.c to verify size of lengths
-    - CVE-2012-2110
-
- -- Jamie Strandboge <[e-mail]>  Thu, 19 Apr 2012 10:31:06 -0500
-
+<<<<<<< TREE
+openssl (1.0.1-4ubuntu3) precise-proposed; urgency=low
+
+  * SECURITY UPDATE: fix various overflows
+    - debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,
+      crypto/buffer.c and crypto/mem.c to verify size of lengths
+    - CVE-2012-2110
+
+ -- Jamie Strandboge <[e-mail]>  Thu, 19 Apr 2012 10:31:06 -0500
+
+=======
+openssl (1.0.1-4ubuntu4) precise-proposed; urgency=low
+
+  * Check TLS1_get_client_version rather than TLS1_get_version for client
+    hello cipher list truncation, in a further attempt to get things working
+    again for everyone (LP: #986147).
+
+ -- Colin Watson <[e-mail]>  Tue, 24 Apr 2012 14:05:50 +0100
+
+openssl (1.0.1-4ubuntu3) precise-proposed; urgency=low
+
+  * SECURITY UPDATE: fix various overflows
+    - debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,
+      crypto/buffer.c and crypto/mem.c to verify size of lengths
+    - CVE-2012-2110
+
+ -- Jamie Strandboge <[e-mail]>  Thu, 19 Apr 2012 10:31:06 -0500
+
+>>>>>>> MERGE-SOURCE
 openssl (1.0.1-4ubuntu2) precise-proposed; urgency=low
 
   * Backport more upstream patches to work around TLS 1.2 failures

=== modified file 'debian/patches/tls12_workarounds.patch'
--- debian/patches/tls12_workarounds.patch	2012-04-18 14:01:08 +0000
+++ debian/patches/tls12_workarounds.patch	2013-12-11 06:23:47 +0000
@@ -55,7 +55,7 @@
 +			 * as hack workaround chop number of supported ciphers
 +			 * to keep it well below this if we use TLS v1.2
 +			 */
-+			if (TLS1_get_version(s) >= TLS1_2_VERSION
++			if (TLS1_get_client_version(s) >= TLS1_2_VERSION
 +				&& i > OPENSSL_MAX_TLS1_2_CIPHER_LENGTH)
 +				i = OPENSSL_MAX_TLS1_2_CIPHER_LENGTH & ~1;
 +#endif

=== modified file 'ssl/s23_clnt.c'
--- ssl/s23_clnt.c	2012-04-18 14:01:08 +0000
+++ ssl/s23_clnt.c	2013-12-11 06:23:47 +0000
@@ -474,7 +474,7 @@
 			 * as hack workaround chop number of supported ciphers
 			 * to keep it well below this if we use TLS v1.2
 			 */
-			if (TLS1_get_version(s) >= TLS1_2_VERSION
+			if (TLS1_get_client_version(s) >= TLS1_2_VERSION
 				&& i > OPENSSL_MAX_TLS1_2_CIPHER_LENGTH)
 				i = OPENSSL_MAX_TLS1_2_CIPHER_LENGTH & ~1;
 #endif