Commit ed4b5a77 authored by Andrew Huang's avatar Andrew Huang Committed by Facebook GitHub Bot

Add opt-out switch for TLS 1.3 in SSLContext

Summary: Currently doesn't do anything since TLS 1.3 is not yet enabled by default. Once it is, calling disableTLS13() on a context will set the max TLS version to TLS 1.2.

Reviewed By: mingtaoy

Differential Revision: D25642589

fbshipit-source-id: 0e580916b929111ed9721ca142b59eab0ea187df
parent 20f47e6c
...@@ -709,11 +709,17 @@ std::string SSLContext::getErrors(int errnoCopy) { ...@@ -709,11 +709,17 @@ std::string SSLContext::getErrors(int errnoCopy) {
} }
void SSLContext::enableTLS13() { void SSLContext::enableTLS13() {
#if FOLLY_OPENSSL_IS_110 #if FOLLY_OPENSSL_PREREQ(1, 1, 0)
SSL_CTX_set_max_proto_version(ctx_, 0); SSL_CTX_set_max_proto_version(ctx_, 0);
#endif #endif
} }
void SSLContext::disableTLS13() {
#if FOLLY_OPENSSL_PREREQ(1, 1, 0)
SSL_CTX_set_max_proto_version(ctx_, TLS1_2_VERSION);
#endif
}
void SSLContext::setupCtx(SSL_CTX* ctx) { void SSLContext::setupCtx(SSL_CTX* ctx) {
// 1) folly::AsyncSSLSocket wants to unconditionally store a client // 1) folly::AsyncSSLSocket wants to unconditionally store a client
// session, so that is possible to later perform TLS resumption. // session, so that is possible to later perform TLS resumption.
......
...@@ -552,6 +552,11 @@ class SSLContext { ...@@ -552,6 +552,11 @@ class SSLContext {
*/ */
void enableTLS13(); void enableTLS13();
/**
* Disable TLS 1.3 in OpenSSL versions that support it.
*/
void disableTLS13();
/** /**
* Get SSLContext from the ex data of a SSL_CTX. * Get SSLContext from the ex data of a SSL_CTX.
*/ */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment