diff options
| author | Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> | 2014-11-29 19:32:32 +0900 |
|---|---|---|
| committer | Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> | 2014-11-29 19:33:50 +0900 |
| commit | 71d842431885f4ef5e5948c3464ad81c6bd8531e (patch) | |
| tree | 71bc7f2fc0d167ba9da4cba971a19a3377c8ad94 /src/LibsslTLSContext.cc | |
| parent | bb6fae2f00823f44f4d6f013a2d3077aeeab9c59 (diff) | |
LibsslTLSContext: Disable SSLv3 and enable ECDHE cipher suites
Diffstat (limited to 'src/LibsslTLSContext.cc')
| -rw-r--r-- | src/LibsslTLSContext.cc | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/src/LibsslTLSContext.cc b/src/LibsslTLSContext.cc index 413607d0..9053e66a 100644 --- a/src/LibsslTLSContext.cc +++ b/src/LibsslTLSContext.cc @@ -100,23 +100,33 @@ OpenSSLTLSContext::OpenSSLTLSContext(TLSSessionSide side) ERR_error_string(ERR_get_error(), nullptr))); return; } - // Disable SSLv2 and enable all workarounds for buggy servers - SSL_CTX_set_options(sslCtx_, SSL_OP_ALL | SSL_OP_NO_SSLv2 + // Disable SSLv2/3 and enable all workarounds for buggy servers + SSL_CTX_set_options(sslCtx_, SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 + | SSL_OP_SINGLE_ECDH_USE #ifdef SSL_OP_NO_COMPRESSION | SSL_OP_NO_COMPRESSION #endif // SSL_OP_NO_COMPRESSION ); SSL_CTX_set_mode(sslCtx_, SSL_MODE_AUTO_RETRY); SSL_CTX_set_mode(sslCtx_, SSL_MODE_ENABLE_PARTIAL_WRITE); - #ifdef SSL_MODE_RELEASE_BUFFERS +#ifdef SSL_MODE_RELEASE_BUFFERS /* keep memory usage low */ SSL_CTX_set_mode(sslCtx_, SSL_MODE_RELEASE_BUFFERS); - #endif +#endif if(SSL_CTX_set_cipher_list(sslCtx_, "HIGH:!aNULL:!eNULL") == 0) { good_ = false; A2_LOG_ERROR(fmt("SSL_CTX_set_cipher_list() failed. Cause: %s", ERR_error_string(ERR_get_error(), nullptr))); } + + auto ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); + if(ecdh == nullptr) { + A2_LOG_WARN(fmt("Failed to enable ECDHE cipher suites. Cause: %s", + ERR_error_string(ERR_get_error(), nullptr))); + } else { + SSL_CTX_set_tmp_ecdh(sslCtx_, ecdh); + EC_KEY_free(ecdh); + } } OpenSSLTLSContext::~OpenSSLTLSContext() |