kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

[ruby/openssl] ssl: call SSL_CTX_set_ecdh_auto() on OpenSSL 1.0.2 only

Browse source 
SSL_CTX_set_ecdh_auto() exists in OpenSSL 1.1.0 and LibreSSL 2.6.1, but
it is made no-op and the automatic curve selection cannot be disabled.
Wrap it with ifdef to make it clear that it is safe to remove it
completely when we drop support for OpenSSL 1.0.2.

https://github.com/ruby/openssl/commit/2ae8f21234
This commit is contained in:
Kazuki Yamaguchi 2020-08-06 15:24:42 +09:00
parent cd002305f0
commit 50332c4071
1 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
ext/openssl/ossl_ssl.c
View file

@ -93,14 +93,15 @@ ossl_sslctx_s_alloc(VALUE klass)
RTYPEDDATA_DATA(obj) = ctx;
SSL_CTX_set_ex_data(ctx, ossl_sslctx_ex_ptr_idx, (void *)obj);
#if !defined(OPENSSL_NO_EC)
#if !defined(OPENSSL_NO_EC) && OPENSSL_VERSION_NUMBER < 0x10100000 && \
!defined(LIBRESSL_VERSION_NUMBER)
/* We use SSL_CTX_set1_curves_list() to specify the curve used in ECDH. It
* allows to specify multiple curve names and OpenSSL will select
* automatically from them. In OpenSSL 1.0.2, the automatic selection has to
* be enabled explicitly. But OpenSSL 1.1.0 removed the knob and it is
* always enabled. To uniform the behavior, we enable the automatic
* selection also in 1.0.2. Users can still disable ECDH by removing ECDH
* cipher suites by SSLContext#ciphers=. */
* be enabled explicitly. OpenSSL 1.1.0 and LibreSSL 2.6.1 removed the knob
* and it is always enabled. To uniform the behavior, we enable the
* automatic selection also in 1.0.2. Users can still disable ECDH by
* removing ECDH cipher suites by SSLContext#ciphers=. */
if (!SSL_CTX_set_ecdh_auto(ctx, 1))
ossl_raise(eSSLError, "SSL_CTX_set_ecdh_auto");
#endif