diff options
| author | Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> | 2014-12-06 00:26:43 +0900 |
|---|---|---|
| committer | Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> | 2014-12-06 17:50:35 +0900 |
| commit | 73d752fb1cd01a9092191c9ac52ddb8fa378065f (patch) | |
| tree | a727e1ce50b9b855c1ed99811c2c4a9c7ecb88ab /src/LibgnutlsTLSSession.cc | |
| parent | 62fba76666648b4d907098675779585a367e6f5e (diff) | |
Add --min-tls-version option
The --min-tls-version option specifies minimum SSL/TLS version to
enable. Possible Values: SSLv3, TLSv1, TLSv1.1, TLSv1.2 Default: TLSv1
Diffstat (limited to 'src/LibgnutlsTLSSession.cc')
| -rw-r--r-- | src/LibgnutlsTLSSession.cc | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/src/LibgnutlsTLSSession.cc b/src/LibgnutlsTLSSession.cc index bbb8d100..deda15a3 100644 --- a/src/LibgnutlsTLSSession.cc +++ b/src/LibgnutlsTLSSession.cc @@ -107,7 +107,20 @@ int GnuTLSSession::init(sock_t sockfd) // It seems err is not error message, but the argument string // which causes syntax error. const char* err; - rv_ = gnutls_priority_set_direct(sslSession_, "SECURE128:-VERS-SSL3.0", &err); + std::string pri = "SECURE128"; + switch(tlsContext_->getMinTLSVersion()) { + case TLS_PROTO_TLS12: + pri += ":-VERS-TLS1.1"; + // fall through + case TLS_PROTO_TLS11: + pri += ":-VERS-TLS1.0"; + // fall through + case TLS_PROTO_TLS10: + pri += ":-VERS-SSL3.0"; + default: + break; + }; + rv_ = gnutls_priority_set_direct(sslSession_, pri.c_str(), &err); if(rv_ != GNUTLS_E_SUCCESS) { return TLS_ERR_ERROR; } |