Commit 6e6646b
tls: check result of SSL_CTX_set_*_proto_version
These functions generally should not fail, but we also shouldn't ignore
potential failures entirely since security properties of the application
might depend on successful configuration.
This also is consistent with the existing CHECKs in SetMinProto() and
SetMaxProto().
PR-URL: #53459
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>1 parent 71af3e8 commit 6e6646b
1 file changed
Lines changed: 2 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -540,8 +540,8 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) { | |||
| 540 | 540 | SSL_SESS_CACHE_NO_INTERNAL | | |
| 541 | 541 | SSL_SESS_CACHE_NO_AUTO_CLEAR); | |
| 542 | 542 | ||
| 543 | - SSL_CTX_set_min_proto_version(sc->ctx_.get(), min_version); | ||
| 544 | - SSL_CTX_set_max_proto_version(sc->ctx_.get(), max_version); | ||
| 543 | + CHECK(SSL_CTX_set_min_proto_version(sc->ctx_.get(), min_version)); | ||
| 544 | + CHECK(SSL_CTX_set_max_proto_version(sc->ctx_.get(), max_version)); | ||
| 545 | 545 | ||
| 546 | 546 | // OpenSSL 1.1.0 changed the ticket key size, but the OpenSSL 1.0.x size was | |
| 547 | 547 | // exposed in the public API. To retain compatibility, install a callback | |
0 commit comments