Skip to content

Commit ac18ebd

Browse files
bk2204indutny
authored andcommitted
crypto: disable SSLv3 if shared OpenSSL lacks it
Some distributions disable SSLv3 due to POODLE. In such a case, disable the specific SSLv3 methods and throw an exception, much like the code already does for SSLv2. The SSLv23* code is retained because this is OpenSSL's terminology for "no version in particular". Reviewed-By: Fedor Indutny <[email protected]> PR-URL: #101
1 parent 21a679a commit ac18ebd

File tree

1 file changed

+12
-0
lines changed

1 file changed

+12
-0
lines changed

src/node_crypto.cc

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -328,11 +328,23 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
328328
return env->ThrowError("SSLv2 methods disabled");
329329
#endif
330330
} else if (strcmp(*sslmethod, "SSLv3_method") == 0) {
331+
#ifndef OPENSSL_NO_SSL3
331332
method = SSLv3_method();
333+
#else
334+
return env->ThrowError("SSLv3 methods disabled");
335+
#endif
332336
} else if (strcmp(*sslmethod, "SSLv3_server_method") == 0) {
337+
#ifndef OPENSSL_NO_SSL3
333338
method = SSLv3_server_method();
339+
#else
340+
return env->ThrowError("SSLv3 methods disabled");
341+
#endif
334342
} else if (strcmp(*sslmethod, "SSLv3_client_method") == 0) {
343+
#ifndef OPENSSL_NO_SSL3
335344
method = SSLv3_client_method();
345+
#else
346+
return env->ThrowError("SSLv3 methods disabled");
347+
#endif
336348
} else if (strcmp(*sslmethod, "SSLv23_method") == 0) {
337349
method = SSLv23_method();
338350
} else if (strcmp(*sslmethod, "SSLv23_server_method") == 0) {

0 commit comments

Comments
 (0)