Skip to content

Commit

Permalink
cut legacy checks for openssl alpn support
Browse files Browse the repository at this point in the history
Summary: Since v1.1.0, openssl always has alpn support. In particular, openssl no longer can be built without tlxext and no longer can export `OPENSSL_NO_TLSEXT`.

Reviewed By: abakiaydin

Differential Revision: D55332108

fbshipit-source-id: ad475474ffa71cb655575b331128923247739abd
  • Loading branch information
yfeldblum authored and facebook-github-bot committed Mar 29, 2024
1 parent 1b2c1b0 commit fff09b4
Showing 1 changed file with 0 additions and 4 deletions.
4 changes: 0 additions & 4 deletions mcrouter/lib/network/ThreadLocalSSLContextProvider.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -282,11 +282,9 @@ std::shared_ptr<SSLContext> createServerSSLContext(
sslContext->setVerificationOption(
folly::SSLContext::VerifyClientCertificate::IF_PRESENTED);
}
#if FOLLY_OPENSSL_HAS_ALPN
// servers can always negotiate this - it is up to the client to do so.
sslContext->setAdvertisedNextProtocols(
{kMcSecurityTlsToPlaintextProto.str()});
#endif
return sslContext;
}

Expand Down Expand Up @@ -318,7 +316,6 @@ std::shared_ptr<SSLContext> createClientSSLContext(
// TODO: When enabling TLS 1.3, set TLS 1.3 ciphersuites from SSLCommonOptions
auto ciphers = folly::ssl::SSLCommonOptions::ciphers();
std::vector<std::string> cVec(ciphers.begin(), ciphers.end());
#if FOLLY_OPENSSL_HAS_ALPN
if (mech == SecurityMech::TLS_TO_PLAINTEXT) {
// Prepend ECDHE-RSA-NULL-SHA to make it obvious from the ClientHello
// that we may not be using encryption. For this to work, we must set
Expand All @@ -333,7 +330,6 @@ std::shared_ptr<SSLContext> createClientSSLContext(
// Thrift's Rocket transport requires an ALPN
context->setAdvertisedNextProtocols({"rs"});
}
#endif
// note we use setCipherSuites instead of setClientOptions since client
// options will enable false start by default.
folly::ssl::setCipherSuites(*context, cVec);
Expand Down

0 comments on commit fff09b4

Please sign in to comment.