Mercurial > hg > nginx

comparison src/event/ngx_event_openssl.c @ 7414:ea3f1f9af72c stable-1.14

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
SSL: fixed SSL_clear_options() usage with OpenSSL 1.1.0+. In OpenSSL 1.1.0 the SSL_CTRL_CLEAR_OPTIONS macro was removed, so conditional compilation test on it results in SSL_clear_options() and SSL_CTX_clear_options() not being used. Notably, this caused "ssl_prefer_server_ciphers off" to not work in SNI-based virtual servers if server preference was switched on in the default server. It looks like the only possible fix is to test OPENSSL_VERSION_NUMBER explicitly.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 16 Jul 2018 17:47:20 +0300
parents 7c00d8dbdb3a
children ce5e87e98772
comparison
equal deleted inserted replaced
7413:7c00d8dbdb3a 7414:ea3f1f9af72c
294 SSL_CTX_set_options(ssl->ctx, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); 294 SSL_CTX_set_options(ssl->ctx, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
295 #endif 295 #endif
296 296
297 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE); 297 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
298 298
299 #ifdef SSL_CTRL_CLEAR_OPTIONS 299 #if OPENSSL_VERSION_NUMBER >= 0x009080dfL
300 /* only in 0.9.8m+ */ 300 /* only in 0.9.8m+ */
301 SSL_CTX_clear_options(ssl->ctx, 301 SSL_CTX_clear_options(ssl->ctx,
302 SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1); 302 SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1);
303 #endif 303 #endif
304 304