Commit 4f11c747 authored by Matt Caswell's avatar Matt Caswell
Browse files

Choose a safer value for SSL_OP_ALLOW_NO_DHE_KEX 



1.1.0 included the previous value for SSL_OP_ALLOW_NO_DHE_KEX in
SSL_OP_ALL. This might cause binary compatibility issues. We should choose
a value that is not in SSL_OP_ALL.

Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3833)
parent 4e2bd9cb

include/openssl/ssl.h

+3 −3
Original line number Diff line number Diff line
@@ -282,14 +282,14 @@ typedef int (*SSL_custom_ext_parse_cb_ex) (SSL *s, unsigned int ext_type, 
/* Typedef for verification callback */

typedef int (*SSL_verify_cb)(int preverify_ok, X509_STORE_CTX *x509_ctx);



/* In TLSv1.3 allow a non-(ec)dhe based kex_mode */

# define SSL_OP_ALLOW_NO_DHE_KEX                         0x00000001U



/* Allow initial connection to servers that don't support RI */

# define SSL_OP_LEGACY_SERVER_CONNECT                    0x00000004U

# define SSL_OP_TLSEXT_PADDING                           0x00000010U

# define SSL_OP_SAFARI_ECDHE_ECDSA_BUG                   0x00000040U



/* In TLSv1.3 allow a non-(ec)dhe based kex_mode */

# define SSL_OP_ALLOW_NO_DHE_KEX                         0x00000400U



/*

 * Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added in

 * OpenSSL 0.9.6d.  Usually (depending on the application protocol) the