diff options
| author | Richard van der Hoff <1389908+richvdh@users.noreply.github.com> | 2020-08-07 15:14:29 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-08-07 15:14:29 +0100 |
| commit | de6f892065a1aa8f9afe77a80df62d4df81fe975 (patch) | |
| tree | 5cee1bdbd8e3f0bb0060abedb9813eb0f74df6e4 | |
| parent | Don't log OPTIONS request at INFO (#8049) (diff) | |
| download | synapse-de6f892065a1aa8f9afe77a80df62d4df81fe975.tar.xz | |
Add a comment about SSLv23_METHOD (#8043)
| -rw-r--r-- | changelog.d/8043.misc | 1 | ||||
| -rw-r--r-- | synapse/crypto/context_factory.py | 8 |
2 files changed, 9 insertions, 0 deletions
diff --git a/changelog.d/8043.misc b/changelog.d/8043.misc new file mode 100644 index 0000000000..683d553666 --- /dev/null +++ b/changelog.d/8043.misc @@ -0,0 +1 @@ +Add a comment to `ServerContextFactory` about the use of `SSLv23_METHOD`. diff --git a/synapse/crypto/context_factory.py b/synapse/crypto/context_factory.py index a5a2a7815d..777c0f00b1 100644 --- a/synapse/crypto/context_factory.py +++ b/synapse/crypto/context_factory.py @@ -48,6 +48,14 @@ class ServerContextFactory(ContextFactory): connections.""" def __init__(self, config): + # TODO: once pyOpenSSL exposes TLS_METHOD and SSL_CTX_set_min_proto_version, + # switch to those (see https://github.com/pyca/cryptography/issues/5379). + # + # note that, despite the confusing name, SSLv23_METHOD does *not* enforce SSLv2 + # or v3, but is a synonym for TLS_METHOD, which allows the client and server + # to negotiate an appropriate version of TLS constrained by the version options + # set with context.set_options. + # self._context = SSL.Context(SSL.SSLv23_METHOD) self.configure_context(self._context, config) |