diff options
| author | Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> | 2014-12-06 00:26:43 +0900 |
|---|---|---|
| committer | Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> | 2014-12-06 17:50:35 +0900 |
| commit | 73d752fb1cd01a9092191c9ac52ddb8fa378065f (patch) | |
| tree | a727e1ce50b9b855c1ed99811c2c4a9c7ecb88ab /src/LibsslTLSContext.cc | |
| parent | 62fba76666648b4d907098675779585a367e6f5e (diff) | |
Add --min-tls-version option
The --min-tls-version option specifies minimum SSL/TLS version to
enable. Possible Values: SSLv3, TLSv1, TLSv1.1, TLSv1.2 Default: TLSv1
Diffstat (limited to 'src/LibsslTLSContext.cc')
| -rw-r--r-- | src/LibsslTLSContext.cc | 25 |
1 files changed, 20 insertions, 5 deletions
diff --git a/src/LibsslTLSContext.cc b/src/LibsslTLSContext.cc index 3ecac860..70c13a60 100644 --- a/src/LibsslTLSContext.cc +++ b/src/LibsslTLSContext.cc @@ -81,12 +81,12 @@ namespace { namespace aria2 { -TLSContext* TLSContext::make(TLSSessionSide side) +TLSContext* TLSContext::make(TLSSessionSide side, TLSVersion minVer) { - return new OpenSSLTLSContext(side); + return new OpenSSLTLSContext(side, minVer); } -OpenSSLTLSContext::OpenSSLTLSContext(TLSSessionSide side) +OpenSSLTLSContext::OpenSSLTLSContext(TLSSessionSide side, TLSVersion minVer) : sslCtx_(nullptr), side_(side), verifyPeer_(true) @@ -100,8 +100,23 @@ OpenSSLTLSContext::OpenSSLTLSContext(TLSSessionSide side) ERR_error_string(ERR_get_error(), nullptr))); return; } - // Disable SSLv2/3 and enable all workarounds for buggy servers - SSL_CTX_set_options(sslCtx_, SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 + + long ver_opts = 0; + switch(minVer) { + case TLS_PROTO_TLS12: + ver_opts |= SSL_OP_NO_TLSv1_1; + // fall through + case TLS_PROTO_TLS11: + ver_opts |= SSL_OP_NO_TLSv1; + // fall through + case TLS_PROTO_TLS10: + ver_opts |= SSL_OP_NO_SSLv3; + default: + break; + }; + + // Disable SSLv2 and enable all workarounds for buggy servers + SSL_CTX_set_options(sslCtx_, SSL_OP_ALL | SSL_OP_NO_SSLv2 | ver_opts #ifdef SSL_OP_SINGLE_ECDH_USE | SSL_OP_SINGLE_ECDH_USE #endif // SSL_OP_SINGLE_ECDH_USE |