summary refs log tree commit diff
path: root/synapse/crypto/context_factory.py
diff options
context:
space:
mode:
authorRichard van der Hoff <1389908+richvdh@users.noreply.github.com>2020-08-07 15:14:29 +0100
committerGitHub <noreply@github.com>2020-08-07 15:14:29 +0100
commitde6f892065a1aa8f9afe77a80df62d4df81fe975 (patch)
tree5cee1bdbd8e3f0bb0060abedb9813eb0f74df6e4 /synapse/crypto/context_factory.py
parentDon't log OPTIONS request at INFO (#8049) (diff)
downloadsynapse-de6f892065a1aa8f9afe77a80df62d4df81fe975.tar.xz
Add a comment about SSLv23_METHOD (#8043)
Diffstat (limited to 'synapse/crypto/context_factory.py')
-rw-r--r--synapse/crypto/context_factory.py8
1 files changed, 8 insertions, 0 deletions
diff --git a/synapse/crypto/context_factory.py b/synapse/crypto/context_factory.py
index a5a2a7815d..777c0f00b1 100644
--- a/synapse/crypto/context_factory.py
+++ b/synapse/crypto/context_factory.py
@@ -48,6 +48,14 @@ class ServerContextFactory(ContextFactory):
     connections."""
 
     def __init__(self, config):
+        # TODO: once pyOpenSSL exposes TLS_METHOD and SSL_CTX_set_min_proto_version,
+        # switch to those (see https://github.com/pyca/cryptography/issues/5379).
+        #
+        # note that, despite the confusing name, SSLv23_METHOD does *not* enforce SSLv2
+        # or v3, but is a synonym for TLS_METHOD, which allows the client and server
+        # to negotiate an appropriate version of TLS constrained by the version options
+        # set with context.set_options.
+        #
         self._context = SSL.Context(SSL.SSLv23_METHOD)
         self.configure_context(self._context, config)