Clarify distro-agnostic OpenSSL 1.0 check and non-portable comment

Co-authored-by: Jeremy Barton <jbarton@microsoft.com>

diff --git a/src/libraries/Native/Unix/System.Security.Cryptography.Native/pal_ssl.c b/src/libraries/Native/Unix/System.Security.Cryptography.Native/pal_ssl.c
index cd949db..c0dbf05 100644 (file)
--- a/src/libraries/Native/Unix/System.Security.Cryptography.Native/pal_ssl.c
+++ b/src/libraries/Native/Unix/System.Security.Cryptography.Native/pal_ssl.c
@@ -43,13 +43,7 @@ static int32_t g_config_specified_ciphersuites = 0;
 
 static void DetectCiphersuiteConfiguration()
 {
-    // This routine will always produce g_config_specified_ciphersuites = 1 on OpenSSL 1.0.x,
-    // so if we're building direct for 1.0.x (the only time NEED_OPENSSL_1_1 is undefined) then
-    // just omit all the code here.
-    //
-    // The method uses OpenSSL 1.0.x API, except for the fallback function SSL_CTX_config, to
-    // make the portable version easier.
-#ifdef NEED_OPENSSL_1_1
+#ifdef FEATURE_DISTRO_AGNOSTIC_SSL
 
     if (API_EXISTS(SSL_state))
     {
@@ -59,6 +53,16 @@ static void DetectCiphersuiteConfiguration()
         return;
     }
 
+#endif
+
+    // This routine will always produce g_config_specified_ciphersuites = 1 on OpenSSL 1.0.x,
+    // so if we're building direct for 1.0.x (the only time NEED_OPENSSL_1_1 is undefined) then
+    // just omit all the code here.
+    //
+    // The method uses OpenSSL 1.0.x API, except for the fallback function SSL_CTX_config, to
+    // make the portable version easier.
+#ifdef NEED_OPENSSL_1_1
+
     // Check to see if there's a registered default CipherString. If not, we will use our own.
     SSL_CTX* ctx = SSL_CTX_new(TLS_method());
     assert(ctx != NULL);
@@ -113,8 +117,7 @@ static void DetectCiphersuiteConfiguration()
 
 #else
 
-    // The Fedora, RHEL, and CentOS builds replace the normal defaults (with a configuration model).
-    // Consider their non-portable builds to always have specified ciphersuites in config.
+    // OpenSSL 1.0 does not support CipherSuites so there is no way for caller to override default
     g_config_specified_ciphersuites = 1;
 
 #endif