Klaus Demo nginx / 1456129
SSL: fixed SSL_clear_options() usage with OpenSSL 1.1.0+. In OpenSSL 1.1.0 the SSL_CTRL_CLEAR_OPTIONS macro was removed, so conditional compilation test on it results in SSL_clear_options() and SSL_CTX_clear_options() not being used. Notably, this caused "ssl_prefer_server_ciphers off" to not work in SNI-based virtual servers if server preference was switched on in the default server. It looks like the only possible fix is to test OPENSSL_VERSION_NUMBER explicitly. Maxim Dounin 3 years ago
2 changed file(s) with 2 addition(s) and 2 deletion(s). Raw diff Collapse all Expand all
294294
295295 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
296296
297 #ifdef SSL_CTRL_CLEAR_OPTIONS
297 #if OPENSSL_VERSION_NUMBER >= 0x009080dfL
298298 /* only in 0.9.8m+ */
299299 SSL_CTX_clear_options(ssl->ctx,
300300 SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1);
911911
912912 SSL_set_verify_depth(ssl_conn, SSL_CTX_get_verify_depth(sscf->ssl.ctx));
913913
914 #ifdef SSL_CTRL_CLEAR_OPTIONS
914 #if OPENSSL_VERSION_NUMBER >= 0x009080dfL
915915 /* only in 0.9.8m+ */
916916 SSL_clear_options(ssl_conn, SSL_get_options(ssl_conn) &
917917 ~SSL_CTX_get_options(sscf->ssl.ctx));