Skip to content

Commit

Permalink
crypto: disable SSLv3 if shared OpenSSL lacks it
Browse files Browse the repository at this point in the history
Some distributions disable SSLv3 due to POODLE.  In such a case, disable
the specific SSLv3 methods and throw an exception, much like the code
already does for SSLv2.  The SSLv23* code is retained because this is
OpenSSL's terminology for "no version in particular".
  • Loading branch information
bk2204 committed Dec 7, 2014
1 parent b928303 commit 10f63cd
Showing 1 changed file with 12 additions and 0 deletions.
12 changes: 12 additions & 0 deletions src/node_crypto.cc
Original file line number Diff line number Diff line change
Expand Up @@ -326,11 +326,23 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
return env->ThrowError("SSLv2 methods disabled");
#endif
} else if (strcmp(*sslmethod, "SSLv3_method") == 0) {
#ifndef OPENSSL_NO_SSL3
method = SSLv3_method();
#else
return env->ThrowError("SSLv3 methods disabled");
#endif
} else if (strcmp(*sslmethod, "SSLv3_server_method") == 0) {
#ifndef OPENSSL_NO_SSL3
method = SSLv3_server_method();
#else
return env->ThrowError("SSLv3 methods disabled");
#endif
} else if (strcmp(*sslmethod, "SSLv3_client_method") == 0) {
#ifndef OPENSSL_NO_SSL3
method = SSLv3_client_method();
#else
return env->ThrowError("SSLv3 methods disabled");
#endif
} else if (strcmp(*sslmethod, "SSLv23_method") == 0) {
method = SSLv23_method();
} else if (strcmp(*sslmethod, "SSLv23_server_method") == 0) {
Expand Down

0 comments on commit 10f63cd

Please sign in to comment.