diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2018-11-20 23:48:30 +0100 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2018-11-20 23:50:34 +0100 |
| commit | f48d5059d14eb095f56351af567cbd79fc136330 (patch) | |
| tree | cf201aa606e60a8f0e7204cba8f9bc3e3c9f63d6 | |
| parent | 6765e6d9e6a32bb4fc666d744cb57e2d55d4e13b (diff) | |
| download | curl-bagder/disable-reneg.tar.gz | |
openssl: disable TLS renegotiationbagder/disable-reneg
Since we're close to feature freeze, this change disables this feature
with an #ifdef. Define ALLOW_RENEG at build-time to enable.
This could be converted to a bit for CURLOPT_SSL_OPTIONS to let
applications opt-in this.
Concern-raised-by: David Benjamin
Fixes #3283
| -rw-r--r-- | lib/vtls/openssl.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c index 2f67595f2..b60716a90 100644 --- a/lib/vtls/openssl.c +++ b/lib/vtls/openssl.c @@ -82,6 +82,13 @@ #include "curl_memory.h" #include "memdebug.h" +/* Uncomment the ALLOW_RENEG line to a real #define if you want to allow TLS + renegotiatings when built with BoringSSL. Renegotiating is non-compliant + with HTTP/2 and "an extremely dangerous protocol feature". Beware. + +#define ALLOW_RENEG 1 + */ + #ifndef OPENSSL_VERSION_NUMBER #error "OPENSSL_VERSION_NUMBER not defined" #endif @@ -2604,7 +2611,7 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex) SSL_set_tlsext_status_type(BACKEND->handle, TLSEXT_STATUSTYPE_ocsp); #endif -#ifdef OPENSSL_IS_BORINGSSL +#if defined(OPENSSL_IS_BORINGSSL) && defined(ALLOW_RENEG) SSL_set_renegotiate_mode(BACKEND->handle, ssl_renegotiate_freely); #endif |