tls_schannel: don't force RC4 for TLS handshake
Leave default configuration. A particular server closes tcp connection during negotiation otherwise. tls_schannel is still broken and tls_read() fails with SEC_E_UNSUPPORTED_FUNCTION error.
This commit is contained in:
@@ -125,10 +125,16 @@ tls_t *tls_new(xmpp_ctx_t *ctx, sock_t sock)
|
||||
memset(&scred, 0, sizeof(scred));
|
||||
scred.dwVersion = SCHANNEL_CRED_VERSION;
|
||||
/*scred.grbitEnabledProtocols = SP_PROT_TLS1_CLIENT;*/
|
||||
/* Remote server closes connection with forced RC4.
|
||||
The below lines are commented to leave default system configuration */
|
||||
#if 0
|
||||
/* Something down the line doesn't like AES, so force it to RC4 */
|
||||
algs[0] = CALG_RC4;
|
||||
scred.cSupportedAlgs = 1;
|
||||
scred.palgSupportedAlgs = algs;
|
||||
#else
|
||||
(void)algs;
|
||||
#endif
|
||||
|
||||
ret = tls->sft->AcquireCredentialsHandleA(NULL, UNISP_NAME,
|
||||
SECPKG_CRED_OUTBOUND, NULL, &scred, NULL, NULL, &(tls->hcred), NULL);
|
||||
@@ -354,6 +360,7 @@ int tls_start(tls_t *tls)
|
||||
|
||||
if (ret != SEC_E_OK) {
|
||||
tls->lasterror = ret;
|
||||
xmpp_error(tls->ctx, "TLSS", "Schannel error 0x%lx", (unsigned long)ret);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user