SSLContext implementation
| 180 | |
| 181 | // SSLContext implementation |
| 182 | SSLContext::SSLContext(const SSLProtocol& protocol) { |
| 183 | if (protocol == SSLTLS) { |
| 184 | ctx_ = SSL_CTX_new(SSLv23_method()); |
| 185 | #ifndef OPENSSL_NO_SSL3 |
| 186 | } else if (protocol == SSLv3) { |
| 187 | ctx_ = SSL_CTX_new(SSLv3_method()); |
| 188 | #endif |
| 189 | } else if (protocol == TLSv1_0) { |
| 190 | ctx_ = SSL_CTX_new(TLSv1_method()); |
| 191 | } else if (protocol == TLSv1_1) { |
| 192 | ctx_ = SSL_CTX_new(TLSv1_1_method()); |
| 193 | } else if (protocol == TLSv1_2) { |
| 194 | ctx_ = SSL_CTX_new(TLSv1_2_method()); |
| 195 | } else { |
| 196 | /// UNKNOWN PROTOCOL! |
| 197 | throw TSSLException("SSL_CTX_new: Unknown protocol"); |
| 198 | } |
| 199 | |
| 200 | if (ctx_ == nullptr) { |
| 201 | string errors; |
| 202 | buildErrors(errors); |
| 203 | throw TSSLException("SSL_CTX_new: " + errors); |
| 204 | } |
| 205 | SSL_CTX_set_mode(ctx_, SSL_MODE_AUTO_RETRY); |
| 206 | |
| 207 | // Disable horribly insecure SSLv2 and SSLv3 protocols but allow a handshake |
| 208 | // with older clients so they get a graceful denial. |
| 209 | if (protocol == SSLTLS) { |
| 210 | SSL_CTX_set_options(ctx_, SSL_OP_NO_SSLv2); |
| 211 | SSL_CTX_set_options(ctx_, SSL_OP_NO_SSLv3); // THRIFT-3164 |
| 212 | } |
| 213 | } |
| 214 | |
| 215 | SSLContext::~SSLContext() { |
| 216 | if (ctx_ != nullptr) { |
no test coverage detected