Commit b1fd4e1a authored by Alex Guzman's avatar Alex Guzman Committed by Facebook Github Bot

Disable renegotiation in OpenSSL 1.1.x

Summary: Adds option to wangle's SSLContextManager to disable renegotiation explicitly and makes folly's AsyncSSLSocket report rejected renegotiations from 1.1.x

Reviewed By: siyengar

Differential Revision: D13633405

fbshipit-source-id: 2b0fc5af4a12795efb52795d64b18b7b6c87e334
parent 2ea73e0b
......@@ -1694,6 +1694,12 @@ void AsyncSSLSocket::sslInfoCallback(const SSL* ssl, int where, int ret) {
if (sslSocket->handshakeComplete_ && (where & SSL_CB_HANDSHAKE_START)) {
sslSocket->renegotiateAttempted_ = true;
}
if (sslSocket->handshakeComplete_ && (where & SSL_CB_WRITE_ALERT)) {
const char *desc = SSL_alert_desc_string(ret);
if (desc && strcmp(desc, "NR") == 0) {
sslSocket->renegotiateAttempted_ = true;
}
}
if (where & SSL_CB_READ_ALERT) {
const char* type = SSL_alert_type_string(ret);
if (type) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment