romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-30 18:47:29 +03:00
Code Issues Projects Releases Packages Wiki Activity

openssl: drop more legacy cruft

Browse source 
- drop `ALLOW_RENEG` undocumented (insecure) build-time option.
- drop unnecessary check for `OPENSSL_VERSION_NUMBER`.
  It's present in all supported OpenSSL versions and forks.

Follow-up to 80c10c5d5d #18351
Follow-up to 59311bd3df #3293 #3283

Closes #18359
This commit is contained in:
Viktor Szakats 2025-08-22 16:42:06 +02:00
parent bfbee798ca
commit db08e86cfb
No known key found for this signature in database
GPG key ID: B5ABD165E2AEF201
1 changed files with 0 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

16
lib/vtls/openssl.c
View file

@ -135,17 +135,6 @@ static void ossl_provider_cleanup(struct Curl_easy *data);
#include "../curl_memory.h"
#include "../memdebug.h"
/* Uncomment the ALLOW_RENEG line to a real #define if you want to allow TLS
renegotiations when built with BoringSSL. Renegotiating is non-compliant
with HTTP/2 and "an extremely dangerous protocol feature". Beware.
#define ALLOW_RENEG 1
*/
#ifndef OPENSSL_VERSION_NUMBER
#error "OPENSSL_VERSION_NUMBER not defined"
#endif
#if defined(USE_OPENSSL_ENGINE) || defined(OPENSSL_HAS_PROVIDERS)
#include <openssl/ui.h>
#endif
@ -3933,11 +3922,6 @@ static CURLcode ossl_init_ssl(struct ossl_ctx *octx,
SSL_set_tlsext_status_type(octx->ssl, TLSEXT_STATUSTYPE_ocsp);
#endif
#if (defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)) && \
defined(ALLOW_RENEG)
SSL_set_renegotiate_mode(octx->ssl, ssl_renegotiate_freely);
#endif
SSL_set_connect_state(octx->ssl);
octx->server_cert = NULL;