You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by ma...@apache.org on 2018/03/02 07:53:31 UTC
[trafficserver] branch quic-latest updated: Clear
SSL_OP_ENABLE_MIDDLEBOX_COMPAT option of OpenSSL
This is an automated email from the ASF dual-hosted git repository.
masaori pushed a commit to branch quic-latest
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
The following commit(s) were added to refs/heads/quic-latest by this push:
new e6b5528 Clear SSL_OP_ENABLE_MIDDLEBOX_COMPAT option of OpenSSL
e6b5528 is described below
commit e6b552872ba68acf235577b656752af7b2278713
Author: Masaori Koshiba <ma...@apache.org>
AuthorDate: Thu Mar 1 20:57:54 2018 +0900
Clear SSL_OP_ENABLE_MIDDLEBOX_COMPAT option of OpenSSL
---
iocore/net/QUICNetProcessor.cc | 3 +++
iocore/net/quic/test/test_QUICHandshake.cc | 2 ++
iocore/net/quic/test/test_QUICHandshakeProtocol.cc | 4 ++++
3 files changed, 9 insertions(+)
diff --git a/iocore/net/QUICNetProcessor.cc b/iocore/net/QUICNetProcessor.cc
index 3d7e470..ed329b4 100644
--- a/iocore/net/QUICNetProcessor.cc
+++ b/iocore/net/QUICNetProcessor.cc
@@ -84,6 +84,9 @@ QUICNetProcessor::start(int, size_t stacksize)
SSL_CTX_set_min_proto_version(this->_ssl_ctx, TLS1_3_VERSION);
SSL_CTX_set_max_proto_version(this->_ssl_ctx, TLS1_3_VERSION);
+ // FIXME: OpenSSL (1.1.1-alpha) enable this option by default. But this shoule be removed when OpenSSL disable this by default.
+ SSL_CTX_clear_options(this->_ssl_ctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
+
SSL_CTX_set_alpn_select_cb(this->_ssl_ctx, QUIC::ssl_select_next_protocol, nullptr);
SSL_CTX_set_max_early_data(this->_ssl_ctx, UINT32_C(0xFFFFFFFF));
SSL_CTX_add_custom_ext(this->_ssl_ctx, QUICTransportParametersHandler::TRANSPORT_PARAMETER_ID,
diff --git a/iocore/net/quic/test/test_QUICHandshake.cc b/iocore/net/quic/test/test_QUICHandshake.cc
index 15a342d..daada59 100644
--- a/iocore/net/quic/test/test_QUICHandshake.cc
+++ b/iocore/net/quic/test/test_QUICHandshake.cc
@@ -39,6 +39,7 @@ TEST_CASE("1-RTT handshake ", "[quic]")
SSL_CTX *client_ssl_ctx = SSL_CTX_new(TLS_method());
SSL_CTX_set_min_proto_version(client_ssl_ctx, TLS1_3_VERSION);
SSL_CTX_set_max_proto_version(client_ssl_ctx, TLS1_3_VERSION);
+ SSL_CTX_clear_options(client_ssl_ctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
QUICConnectionId client_conn_id = 0x12345;
@@ -50,6 +51,7 @@ TEST_CASE("1-RTT handshake ", "[quic]")
SSL_CTX *server_ssl_ctx = SSL_CTX_new(TLS_method());
SSL_CTX_set_min_proto_version(server_ssl_ctx, TLS1_3_VERSION);
SSL_CTX_set_max_proto_version(server_ssl_ctx, TLS1_3_VERSION);
+ SSL_CTX_clear_options(server_ssl_ctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
BIO *crt_bio(BIO_new_mem_buf(server_crt, sizeof(server_crt)));
SSL_CTX_use_certificate(server_ssl_ctx, PEM_read_bio_X509(crt_bio, nullptr, nullptr, nullptr));
BIO *key_bio(BIO_new_mem_buf(server_key, sizeof(server_key)));
diff --git a/iocore/net/quic/test/test_QUICHandshakeProtocol.cc b/iocore/net/quic/test/test_QUICHandshakeProtocol.cc
index 789dd0f..0736067 100644
--- a/iocore/net/quic/test/test_QUICHandshakeProtocol.cc
+++ b/iocore/net/quic/test/test_QUICHandshakeProtocol.cc
@@ -62,12 +62,14 @@ TEST_CASE("QUICHndshakeProtocol Cleartext", "[quic]")
SSL_CTX *client_ssl_ctx = SSL_CTX_new(TLS_method());
SSL_CTX_set_min_proto_version(client_ssl_ctx, TLS1_3_VERSION);
SSL_CTX_set_max_proto_version(client_ssl_ctx, TLS1_3_VERSION);
+ SSL_CTX_clear_options(client_ssl_ctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
QUICHandshakeProtocol *client = new QUICTLS(SSL_new(client_ssl_ctx), NET_VCONNECTION_OUT);
// Server
SSL_CTX *server_ssl_ctx = SSL_CTX_new(TLS_method());
SSL_CTX_set_min_proto_version(server_ssl_ctx, TLS1_3_VERSION);
SSL_CTX_set_max_proto_version(server_ssl_ctx, TLS1_3_VERSION);
+ SSL_CTX_clear_options(server_ssl_ctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
BIO *crt_bio(BIO_new_mem_buf(server_crt, sizeof(server_crt)));
SSL_CTX_use_certificate(server_ssl_ctx, PEM_read_bio_X509(crt_bio, nullptr, nullptr, nullptr));
BIO *key_bio(BIO_new_mem_buf(server_key, sizeof(server_key)));
@@ -120,12 +122,14 @@ TEST_CASE("QUICHandshakeProtocol 1-RTT", "[quic]")
SSL_CTX *client_ssl_ctx = SSL_CTX_new(TLS_method());
SSL_CTX_set_min_proto_version(client_ssl_ctx, TLS1_3_VERSION);
SSL_CTX_set_max_proto_version(client_ssl_ctx, TLS1_3_VERSION);
+ SSL_CTX_clear_options(client_ssl_ctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
QUICHandshakeProtocol *client = new QUICTLS(SSL_new(client_ssl_ctx), NET_VCONNECTION_OUT);
// Server
SSL_CTX *server_ssl_ctx = SSL_CTX_new(TLS_method());
SSL_CTX_set_min_proto_version(server_ssl_ctx, TLS1_3_VERSION);
SSL_CTX_set_max_proto_version(server_ssl_ctx, TLS1_3_VERSION);
+ SSL_CTX_clear_options(server_ssl_ctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
BIO *crt_bio(BIO_new_mem_buf(server_crt, sizeof(server_crt)));
SSL_CTX_use_certificate(server_ssl_ctx, PEM_read_bio_X509(crt_bio, nullptr, nullptr, nullptr));
BIO *key_bio(BIO_new_mem_buf(server_key, sizeof(server_key)));
--
To stop receiving notification emails like this one, please contact
masaori@apache.org.