pxcloud/spice
6
0
Fork 0
mirror of https://gitlab.uni-freiburg.de/opensourcevdi/spice synced 2026-08-20 04:53:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ssl: Drop support for older OpenSSL versions

Browse Source 
SSL_OP_NO_COMPRESSION was introduced in OpenSSL_0_9_8k, which is no
longer supported. This commit raises the minimum OpenSSL version to
1.0.0, which is also out of support.

Signed-off-by: Christophe Fergeau <cfergeau@redhat.com>
Acked-by: Frediano Ziglio <fziglio@redhat.com>
This commit is contained in:
Christophe Fergeau 2017-12-07 17:47:27 +01:00
parent dd8e205aaf
commit 7ff434b104
2 changed files with 4 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
configure.ac
View File

@ -186,7 +186,7 @@ if test "x$enable_celt051" = "xyes"; then
AS_VAR_APPEND([SPICE_REQUIRES], [" celt051 >= $CELT051_REQUIRED"]))
fi
PKG_CHECK_MODULES(SSL, openssl)
PKG_CHECK_MODULES(SSL, openssl >= 1.0.0)
AC_SUBST(SSL_CFLAGS)
AC_SUBST(SSL_LIBS)
AS_VAR_APPEND([SPICE_REQUIRES], [" openssl"])

22
server/reds.c
View File

@ -2819,15 +2819,12 @@ static gpointer openssl_global_init(gpointer arg)
static int reds_init_ssl(RedsState *reds)
{
static GOnce openssl_once = G_ONCE_INIT;
#if OPENSSL_VERSION_NUMBER >= 0x10000000L
const SSL_METHOD *ssl_method;
#else
SSL_METHOD *ssl_method;
#endif
int return_code;
/* When some other SSL/TLS version becomes obsolete, add it to this
/* Limit connection to TLSv1 only.
* When some other SSL/TLS version becomes obsolete, add it to this
* variable. */
long ssl_options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
long ssl_options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION;
/* Global system initialization*/
g_once(&openssl_once, openssl_global_init, NULL);
@ -2841,10 +2838,6 @@ static int reds_init_ssl(RedsState *reds)
return -1;
}
/* Limit connection to TLSv1 only */
#ifdef SSL_OP_NO_COMPRESSION
ssl_options |= SSL_OP_NO_COMPRESSION;
#endif
SSL_CTX_set_options(reds->ctx, ssl_options);
/* Load our keys and certificates*/
@ -2877,10 +2870,6 @@ static int reds_init_ssl(RedsState *reds)
return -1;
}
#if (OPENSSL_VERSION_NUMBER < 0x00905100L)
SSL_CTX_set_verify_depth(reds->ctx, 1);
#endif
if (strlen(reds->config->ssl_parameters.dh_key_file) > 0) {
if (load_dh_params(reds->ctx, reds->config->ssl_parameters.dh_key_file) < 0) {
return -1;
@ -2894,11 +2883,6 @@ static int reds_init_ssl(RedsState *reds)
}
}
#ifndef SSL_OP_NO_COMPRESSION
STACK *cmp_stack = SSL_COMP_get_compression_methods();
sk_zero(cmp_stack);
#endif
return 0;
}