Rev 158 | Details | Compare with Previous | Last modification | View Log | RSS feed
| Rev | Author | Line No. | Line |
|---|---|---|---|
| 158 | magnus | 1 | Description: Disable SSL 3.0 on client as well as server side |
| 2 | Author: Magnus Holmgren <holmgren@debian.org> |
||
| 3 | |||
| 4 | --- a/lib/ssl.c |
||
| 5 | +++ b/lib/ssl.c |
||
| 6 | @@ -387,12 +387,16 @@ void ssl_context_init(struct ssl_config |
||
| 7 | SSL_load_error_strings(); |
||
| 8 | |||
| 9 | /* Set up client context: only used by accountd */ |
||
| 10 | - client_ctx = SSL_CTX_new(SSLv3_client_method()); |
||
| 11 | + client_ctx = SSL_CTX_new(SSLv23_client_method()); |
||
| 12 | SSL_CTX_set_session_cache_mode(client_ctx, SSL_SESS_CACHE_BOTH); |
||
| 13 | SSL_CTX_set_info_callback(client_ctx, info_callback); |
||
| 14 | #ifdef SSL_MODE_AUTO_RETRY |
||
| 15 | SSL_CTX_set_mode(client_ctx, SSL_MODE_AUTO_RETRY); |
||
| 16 | #endif |
||
| 17 | + /* SSLv2 now obsolete */ |
||
| 18 | + SSL_CTX_set_options(client_ctx, SSL_OP_NO_SSLv2); |
||
| 19 | + /* SSLv3 now also obsolete */ |
||
| 20 | + SSL_CTX_set_options(client_ctx, SSL_OP_NO_SSLv3); |
||
| 21 | |||
| 22 | if (SSL_CTX_need_tmp_RSA(client_ctx)) |
||
| 23 | SSL_CTX_set_tmp_rsa_callback(client_ctx, rsa_callback); |
||
| 24 | @@ -420,6 +424,8 @@ void ssl_context_init(struct ssl_config |
||
| 25 | |||
| 26 | /* SSLv2 now obsolete */ |
||
| 27 | SSL_CTX_set_options(server_ctx, SSL_OP_NO_SSLv2); |
||
| 28 | + /* SSLv3 now also obsolete */ |
||
| 29 | + SSL_CTX_set_options(server_ctx, SSL_OP_NO_SSLv3); |
||
| 30 | |||
| 31 | /* Start off with the session cache disabled */ |
||
| 32 | SSL_CTX_set_session_cache_mode(server_ctx, SSL_SESS_CACHE_OFF); |
||
| 33 | @@ -625,6 +631,12 @@ void *ssl_start_server(int fd, unsigned |
||
| 34 | case TLS1_VERSION: |
||
| 35 | ver = "TLSv1"; |
||
| 36 | break; |
||
| 37 | + case TLS1_1_VERSION: |
||
| 38 | + ver = "TLSv1.1"; |
||
| 39 | + break; |
||
| 40 | + case TLS1_2_VERSION: |
||
| 41 | + ver = "TLSv1.2"; |
||
| 42 | + break; |
||
| 43 | default: |
||
| 44 | ver = "UNKNOWN"; |
||
| 45 | } |
||
| 46 | @@ -678,6 +690,12 @@ void *ssl_start_client(int fd, unsigned |
||
| 47 | case TLS1_VERSION: |
||
| 48 | ver = "TLSv1"; |
||
| 49 | break; |
||
| 50 | + case TLS1_1_VERSION: |
||
| 51 | + ver = "TLSv1.1"; |
||
| 52 | + break; |
||
| 53 | + case TLS1_2_VERSION: |
||
| 54 | + ver = "TLSv1.2"; |
||
| 55 | + break; |
||
| 56 | default: |
||
| 57 | ver = "UNKNOWN"; |
||
| 58 | } |