From beaaab574239846954402396892e04f8dbcbed7f Mon Sep 17 00:00:00 2001 From: Dmitry Podgorny Date: Sat, 3 Sep 2016 16:30:24 +0300 Subject: [PATCH] tls_schannel: don't force RC4 for TLS handshake Leave default configuration. A particular server closes tcp connection during negotiation otherwise. tls_schannel is still broken and tls_read() fails with SEC_E_UNSUPPORTED_FUNCTION error. --- src/tls_schannel.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/tls_schannel.c b/src/tls_schannel.c index ff9695e..49ad9d5 100644 --- a/src/tls_schannel.c +++ b/src/tls_schannel.c @@ -125,10 +125,16 @@ tls_t *tls_new(xmpp_ctx_t *ctx, sock_t sock) memset(&scred, 0, sizeof(scred)); scred.dwVersion = SCHANNEL_CRED_VERSION; /*scred.grbitEnabledProtocols = SP_PROT_TLS1_CLIENT;*/ + /* Remote server closes connection with forced RC4. + The below lines are commented to leave default system configuration */ +#if 0 /* Something down the line doesn't like AES, so force it to RC4 */ algs[0] = CALG_RC4; scred.cSupportedAlgs = 1; scred.palgSupportedAlgs = algs; +#else + (void)algs; +#endif ret = tls->sft->AcquireCredentialsHandleA(NULL, UNISP_NAME, SECPKG_CRED_OUTBOUND, NULL, &scred, NULL, NULL, &(tls->hcred), NULL); @@ -354,6 +360,7 @@ int tls_start(tls_t *tls) if (ret != SEC_E_OK) { tls->lasterror = ret; + xmpp_error(tls->ctx, "TLSS", "Schannel error 0x%lx", (unsigned long)ret); return 0; }