crypto: disable SSLv3 if shared OpenSSL lacks it

bk2204 · bk2204 · commit 10f63cd38e47 · 2014-12-07T16:03:50.000Z
Some distributions disable SSLv3 due to POODLE.  In such a case, disable
the specific SSLv3 methods and throw an exception, much like the code
already does for SSLv2.  The SSLv23* code is retained because this is
OpenSSL's terminology for "no version in particular".
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
@@ -326,11 +326,23 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
       return env->ThrowError("SSLv2 methods disabled");
 #endif
     } else if (strcmp(*sslmethod, "SSLv3_method") == 0) {
+#ifndef OPENSSL_NO_SSL3
       method = SSLv3_method();
+#else
+      return env->ThrowError("SSLv3 methods disabled");
+#endif
     } else if (strcmp(*sslmethod, "SSLv3_server_method") == 0) {
+#ifndef OPENSSL_NO_SSL3
       method = SSLv3_server_method();
+#else
+      return env->ThrowError("SSLv3 methods disabled");
+#endif
     } else if (strcmp(*sslmethod, "SSLv3_client_method") == 0) {
+#ifndef OPENSSL_NO_SSL3
       method = SSLv3_client_method();
+#else
+      return env->ThrowError("SSLv3 methods disabled");
+#endif
     } else if (strcmp(*sslmethod, "SSLv23_method") == 0) {
       method = SSLv23_method();
     } else if (strcmp(*sslmethod, "SSLv23_server_method") == 0) {
