Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ssl: do not enable OpenSSL::SSL::OP_ALL by default #767

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

ssl: do not enable OpenSSL::SSL::OP_ALL by default #767

wants to merge 3 commits into from

Commits on Sep 5, 2024

  1. ssl: improve documentation of SSLContext#options=

    @rhenium
    rhenium committed Sep 5, 2024
    Configuration menu
    Copy the full SHA
    9120fcd View commit details
    Browse the repository at this point in the history

  2. ssl: do not enable OpenSSL::SSL::OP_ALL by default 

    Respect the SSL options set by default by SSL_CTX() and by the
system-wide OpenSSL configuration file.

OpenSSL::SSL::SSLContext#initialize currently adds OpenSSL::SSL::OP_ALL
on top of the default SSL options. Let's stop doing it.

OpenSSL::SSL::OP_ALL is a set of options that changes OpenSSL's behavior
to workaround various TLS implementation bugs. Using it is considered
usually safe, but is not completely harmless.
    @rhenium
    rhenium committed Sep 5, 2024
    Configuration menu
    Copy the full SHA
    00bec0d View commit details
    Browse the repository at this point in the history

  3. ssl: do not clear existing SSL options in SSLContext#set_params 

    Apply SSL options set in DEFAULT_PARAMS without clearing existing
options.

It currently clears options in order to avoid setting one of the
options included in OpenSSL::SSL::OP_ALL unless explicitly specified,
namely OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS. Now that
OpenSSL::SSL::OP_ALL has been removed from SSLContext#initialize, it is
no longer necessary.
    @rhenium
    rhenium committed Sep 5, 2024
    Configuration menu
    Copy the full SHA
    77c3db2 View commit details
    Browse the repository at this point in the history