diff options
| author | Alex Crichton <[email protected]> | 2017-09-14 17:55:06 -0700 |
|---|---|---|
| committer | Alex Crichton <[email protected]> | 2017-09-14 19:15:00 -0700 |
| commit | 68a30c29c9efadebc694c4fa2c6c6c090ee93369 (patch) | |
| tree | 2726edc8c7cf3cdc1673162cde9703fabdf2067e /openssl/src | |
| parent | Fix build note for MinGW (diff) | |
| download | rust-openssl-68a30c29c9efadebc694c4fa2c6c6c090ee93369.tar.xz rust-openssl-68a30c29c9efadebc694c4fa2c6c6c090ee93369.zip | |
Set SSL_MODE_RELEASE_BUFFERS by default
Closes #696
Diffstat (limited to 'openssl/src')
| -rw-r--r-- | openssl/src/ssl/connector.rs | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/openssl/src/ssl/connector.rs b/openssl/src/ssl/connector.rs index 6469c59e..4e807b88 100644 --- a/openssl/src/ssl/connector.rs +++ b/openssl/src/ssl/connector.rs @@ -5,6 +5,7 @@ use error::ErrorStack; use ssl::{self, SslMethod, SslContextBuilder, SslContext, Ssl, SSL_VERIFY_PEER, SslStream, HandshakeError}; use pkey::PKeyRef; +use version; use x509::X509Ref; #[cfg(ossl101)] @@ -39,8 +40,17 @@ fn ctx(method: SslMethod) -> Result<SslContextBuilder, ErrorStack> { opts |= ssl::SSL_OP_CIPHER_SERVER_PREFERENCE; ctx.set_options(opts); - let mode = ssl::SSL_MODE_AUTO_RETRY | ssl::SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER | + let mut mode = ssl::SSL_MODE_AUTO_RETRY | + ssl::SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER | ssl::SSL_MODE_ENABLE_PARTIAL_WRITE; + + // This is quite a useful optimization for saving memory, but historically + // caused CVEs in OpenSSL pre-1.0.1h, according to + // https://bugs.python.org/issue25672 + if version::number() >= 0x1000108f { + mode |= ssl::SSL_MODE_RELEASE_BUFFERS; + } + ctx.set_mode(mode); Ok(ctx) |