mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-01-30 14:22:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

configure: add option to disable automatic OpenSSL config loading

Browse Source 
Sometimes it may be considered a security risk to load an external
OpenSSL configuration automatically inside curl_global_init(). The
configuration option --disable-ssl-auto-load-config disables this
automatism. The Windows build scripts winbuild/Makefile.vs provide a
corresponding option ENABLE_SSL_AUTO_LOAD_CONFIG accepting a boolean
value.

Setting neither of these options corresponds to the previous behavior
loading the external OpenSSL configuration automatically.

Fixes #2724
Closes #2791
This commit is contained in:
Philipp Waehnert 2018-07-25 11:00:15 +02:00 committed by Daniel Stenberg
parent c515294cec
commit 6684653b68
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
4 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
configure.ac
View File

@ -1876,6 +1876,20 @@ if test "$OPENSSL_ENABLED" = "1"; then
])
fi
dnl ---
dnl Whether the OpenSSL configuration will be loaded automatically
dnl ---
if test X"$OPENSSL_ENABLED" = X"1"; then
AC_ARG_ENABLE(openssl-auto-load-config,
AC_HELP_STRING([--enable-openssl-auto-load-config],[Enable automatic loading of OpenSSL configuration])
AC_HELP_STRING([--disable-openssl-auto-load-config],[Disable automatic loading of OpenSSL configuration]),
[ if test X"$enableval" = X"no"; then
AC_MSG_NOTICE([automatic loading of OpenSSL configuration disabled])
AC_DEFINE(CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG, 1, [if the OpenSSL configuration won't be loaded automatically])
fi
])
fi
dnl ----------------------------------------------------
dnl check for GnuTLS
dnl ----------------------------------------------------

2
lib/vtls/openssl.c
View File

@ -994,9 +994,11 @@ static int Curl_ossl_init(void)
#define CONF_MFLAGS_DEFAULT_SECTION 0x0
#endif
#ifndef CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG
CONF_modules_load_file(NULL, NULL,
CONF_MFLAGS_DEFAULT_SECTION|
CONF_MFLAGS_IGNORE_MISSING_FILE);
#endif
#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && \
!defined(LIBRESSL_VERSION_NUMBER)

6
winbuild/Makefile.vc
View File

@ -53,6 +53,8 @@ CFGSET=true
!MESSAGE ENABLE_IPV6=<yes or no> - Enable IPv6, defaults to yes
!MESSAGE ENABLE_SSPI=<yes or no> - Enable SSPI support, defaults to yes
!MESSAGE ENABLE_WINSSL=<yes or no> - Enable native Windows SSL support, defaults to yes
!MESSAGE ENABLE_OPENSSL_AUTO_LOAD_CONFIG=<yes or no>
!MESSAGE - Whether the OpenSSL configuration will be loaded automatically, defaults to yes
!MESSAGE GEN_PDB=<yes or no> - Generate Program Database (debug symbols for release build)
!MESSAGE DEBUG=<yes or no> - Debug builds
!MESSAGE MACHINE=<x86 or x64> - Target architecture (default x64 on AMD64, x86 on others)
@ -130,6 +132,10 @@ USE_WINSSL = true
USE_WINSSL = false
!ENDIF
!IFNDEF ENABLE_OPENSSL_AUTO_LOAD_CONFIG
ENABLE_OPENSSL_AUTO_LOAD_CONFIG = true
!ENDIF
CONFIG_NAME_LIB = libcurl
!IF "$(WITH_SSL)"=="dll"

3
winbuild/MakefileBuild.vc
View File

@ -152,6 +152,9 @@ SSL_CFLAGS = /DUSE_OPENSSL /I"$(SSL_INC_DIR)"
!IF EXISTS("$(SSL_INC_DIR)\is_boringssl.h")
SSL_CFLAGS = $(SSL_CFLAGS) /DHAVE_BORINGSSL
!ENDIF
!IF "$(ENABLE_OPENSSL_AUTO_LOAD_CONFIG)"=="false"
SSL_CFLAGS = $(SSL_CFLAGS) /DCURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG
!ENDIF
!ENDIF