diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2015-09-24 17:19:08 +0300 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2015-09-24 17:19:08 +0300 |
| commit | 4bab18f63d43887844732732e2d8ba9cc996c44d (patch) | |
| tree | 252cd5185eeab80e7b34e843413bd6e51646e966 /src | |
| parent | 49766257fedf9fc9351d77a8788fa441c1d4f1b9 (diff) | |
| download | nginx-4bab18f63d43887844732732e2d8ba9cc996c44d.tar.gz nginx-4bab18f63d43887844732732e2d8ba9cc996c44d.zip | |
SSL: compatibility with OpenSSL master branch.
RAND_pseudo_bytes() is deprecated in the OpenSSL master branch, so the only
use was changed to RAND_bytes(). Access to internal structures is no longer
possible, so now we don't try to set SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS even
if it's defined.
Diffstat (limited to 'src')
| -rw-r--r-- | src/event/ngx_event_openssl.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c index 1b789e687..e9edf314f 100644 --- a/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c @@ -1158,6 +1158,7 @@ ngx_ssl_handshake(ngx_connection_t *c) c->recv_chain = ngx_ssl_recv_chain; c->send_chain = ngx_ssl_send_chain; +#if OPENSSL_VERSION_NUMBER < 0x10100000L #ifdef SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS /* initial handshake done, disable renegotiation (CVE-2009-3555) */ @@ -1166,6 +1167,7 @@ ngx_ssl_handshake(ngx_connection_t *c) } #endif +#endif return NGX_OK; } @@ -2861,7 +2863,7 @@ ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn, ngx_hex_dump(buf, key[0].name, 16) - buf, buf, SSL_session_reused(ssl_conn) ? "reused" : "new"); - RAND_pseudo_bytes(iv, 16); + RAND_bytes(iv, 16); EVP_EncryptInit_ex(ectx, EVP_aes_128_cbc(), NULL, key[0].aes_key, iv); HMAC_Init_ex(hctx, key[0].hmac_key, 16, ngx_ssl_session_ticket_md(), NULL); |