aboutsummaryrefslogtreecommitdiff
path: root/openssl/src
diff options
context:
space:
mode:
authorAlex Crichton <[email protected]>2017-09-14 17:55:06 -0700
committerAlex Crichton <[email protected]>2017-09-14 19:15:00 -0700
commit68a30c29c9efadebc694c4fa2c6c6c090ee93369 (patch)
tree2726edc8c7cf3cdc1673162cde9703fabdf2067e /openssl/src
parentFix build note for MinGW (diff)
downloadrust-openssl-68a30c29c9efadebc694c4fa2c6c6c090ee93369.tar.xz
rust-openssl-68a30c29c9efadebc694c4fa2c6c6c090ee93369.zip
Set SSL_MODE_RELEASE_BUFFERS by default
Closes #696
Diffstat (limited to 'openssl/src')
-rw-r--r--openssl/src/ssl/connector.rs12
1 files changed, 11 insertions, 1 deletions
diff --git a/openssl/src/ssl/connector.rs b/openssl/src/ssl/connector.rs
index 6469c59e..4e807b88 100644
--- a/openssl/src/ssl/connector.rs
+++ b/openssl/src/ssl/connector.rs
@@ -5,6 +5,7 @@ use error::ErrorStack;
use ssl::{self, SslMethod, SslContextBuilder, SslContext, Ssl, SSL_VERIFY_PEER, SslStream,
HandshakeError};
use pkey::PKeyRef;
+use version;
use x509::X509Ref;
#[cfg(ossl101)]
@@ -39,8 +40,17 @@ fn ctx(method: SslMethod) -> Result<SslContextBuilder, ErrorStack> {
opts |= ssl::SSL_OP_CIPHER_SERVER_PREFERENCE;
ctx.set_options(opts);
- let mode = ssl::SSL_MODE_AUTO_RETRY | ssl::SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER |
+ let mut mode = ssl::SSL_MODE_AUTO_RETRY |
+ ssl::SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER |
ssl::SSL_MODE_ENABLE_PARTIAL_WRITE;
+
+ // This is quite a useful optimization for saving memory, but historically
+ // caused CVEs in OpenSSL pre-1.0.1h, according to
+ // https://bugs.python.org/issue25672
+ if version::number() >= 0x1000108f {
+ mode |= ssl::SSL_MODE_RELEASE_BUFFERS;
+ }
+
ctx.set_mode(mode);
Ok(ctx)