Mercurial > hg > nginx

comparison src/http/ngx_http_request.c @ 7318:3443fe40bdc7

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
SSL: fixed SSL_clear_options() usage with OpenSSL 1.1.0+. In OpenSSL 1.1.0 the SSL_CTRL_CLEAR_OPTIONS macro was removed, so conditional compilation test on it results in SSL_clear_options() and SSL_CTX_clear_options() not being used. Notably, this caused "ssl_prefer_server_ciphers off" to not work in SNI-based virtual servers if server preference was switched on in the default server. It looks like the only possible fix is to test OPENSSL_VERSION_NUMBER explicitly.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 16 Jul 2018 17:47:20 +0300
parents e45f09198dab
children 2b5528023f6b
comparison
equal deleted inserted replaced
7317:6565f0dbe8c5 7318:3443fe40bdc7
910 SSL_set_verify(ssl_conn, SSL_CTX_get_verify_mode(sscf->ssl.ctx), 910 SSL_set_verify(ssl_conn, SSL_CTX_get_verify_mode(sscf->ssl.ctx),
911 SSL_CTX_get_verify_callback(sscf->ssl.ctx)); 911 SSL_CTX_get_verify_callback(sscf->ssl.ctx));
912 912
913 SSL_set_verify_depth(ssl_conn, SSL_CTX_get_verify_depth(sscf->ssl.ctx)); 913 SSL_set_verify_depth(ssl_conn, SSL_CTX_get_verify_depth(sscf->ssl.ctx));
914 914
915 #ifdef SSL_CTRL_CLEAR_OPTIONS 915 #if OPENSSL_VERSION_NUMBER >= 0x009080dfL
916 /* only in 0.9.8m+ */ 916 /* only in 0.9.8m+ */
917 SSL_clear_options(ssl_conn, SSL_get_options(ssl_conn) & 917 SSL_clear_options(ssl_conn, SSL_get_options(ssl_conn) &
918 ~SSL_CTX_get_options(sscf->ssl.ctx)); 918 ~SSL_CTX_get_options(sscf->ssl.ctx));
919 #endif 919 #endif
920 920