Add support for building with shared OpenSSL lacking SSLv3. #101
Conversation
| method = SSLv3_client_method(); | ||
| #else | ||
| return env->ThrowError("SSLv3 methods disabled"); | ||
| #endif | ||
| } else if (strcmp(*sslmethod, "SSLv23_method") == 0) { | ||
| method = SSLv23_method(); |
There was a problem hiding this comment.
Does SSLv23_method() still exist when OPENSSL_NO_SSL3 is defined?
|
@indutny Can you take a look? You've worked on this most recently. |
|
I wonder if we could forward-port the similar commit from joyent/node: nodejs/node-v0.x-archive@d601c76 |
|
Actually, on a second thought, I don't want it to be done using |
|
@bk2204 could you please take a look at https://github.com/iojs/io.js/blob/v0.12/CONTRIBUTING.md#commit and format your commit message according to it. |
Some distributions disable SSLv3 due to POODLE. In such a case, disable the specific SSLv3 methods and throw an exception, much like the code already does for SSLv2. The SSLv23* code is retained because this is OpenSSL's terminology for "no version in particular".
|
Sure. Sorry about that. |
|
As I'm about to explain in my new commit message, SSLv23 is OpenSSL's terminology for "any version of SSL or TLS whatsoever". It's generally what you want to use, since you want it to negotiate the highest protocol supported by both sides. If SSLv3 is disabled, that will be any TLS version. |
|
Looks good. |
Some distributions disable SSLv3 due to POODLE. In such a case, disable the specific SSLv3 methods and throw an exception, much like the code already does for SSLv2. The SSLv23* code is retained because this is OpenSSL's terminology for "no version in particular". Reviewed-By: Fedor Indutny <fedor@indutny.com> PR-URL: #101
|
Landed in ac18ebd, thank you! |
Some distributions are disabling SSLv3 due to the POODLE attack. For example, the OpenSSL in Debian experimental has removed support for SSLv3_method and friends. If OpenSSL has SSLv3 disabled, throw an exception, just like when SSLv2 is disabled.