diff options
| author | Benjamin Peterson <benjamin@python.org> | 2016-01-08 05:38:51 (GMT) |
|---|---|---|
| committer | Benjamin Peterson <benjamin@python.org> | 2016-01-08 05:38:51 (GMT) |
| commit | 5db60aa84ea55b7b5623327551d41d51ea22c528 (patch) | |
| tree | 4174a4b12592d7c998689e45679a9417ce373602 /Modules/_ssl.c | |
| parent | 2900995edd00d86e1579e80c939ef67e7c83a5b4 (diff) | |
| parent | 3b1a8b3bbe2ff77975a13255c23a0f0bb4d55ebe (diff) | |
| download | cpython-5db60aa84ea55b7b5623327551d41d51ea22c528.zip cpython-5db60aa84ea55b7b5623327551d41d51ea22c528.tar.gz cpython-5db60aa84ea55b7b5623327551d41d51ea22c528.tar.bz2 | |
merge 3.5 (closes #25672)
Diffstat (limited to 'Modules/_ssl.c')
| -rw-r--r-- | Modules/_ssl.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 5968ed5..529d2f0 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -2219,6 +2219,7 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version) PySSLContext *self; long options; SSL_CTX *ctx = NULL; + unsigned long libver; PySSL_BEGIN_ALLOW_THREADS if (proto_version == PY_SSL_VERSION_TLS1) @@ -2281,6 +2282,22 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version) options |= SSL_OP_NO_SSLv3; SSL_CTX_set_options(self->ctx, options); +#if defined(SSL_MODE_RELEASE_BUFFERS) + /* Set SSL_MODE_RELEASE_BUFFERS. This potentially greatly reduces memory + usage for no cost at all. However, don't do this for OpenSSL versions + between 1.0.1 and 1.0.1h or 1.0.0 and 1.0.0m, which are affected by CVE + 2014-0198. I can't find exactly which beta fixed this CVE, so be + conservative and assume it wasn't fixed until release. We do this check + at runtime to avoid problems from the dynamic linker. + See #25672 for more on this. */ + libver = SSLeay(); + if (!(libver >= 0x10001000UL && libver < 0x1000108fUL) && + !(libver >= 0x10000000UL && libver < 0x100000dfUL)) { + SSL_CTX_set_mode(self->ctx, SSL_MODE_RELEASE_BUFFERS); + } +#endif + + #ifndef OPENSSL_NO_ECDH /* Allow automatic ECDH curve selection (on OpenSSL 1.0.2+), or use prime256v1 by default. This is Apache mod_ssl's initialization |