From f47609c1f0f032a4c32a73267bd6ec4d63c15e78 Mon Sep 17 00:00:00 2001 From: Alexander Krotov Date: Tue, 20 Jun 2017 02:10:25 +0300 Subject: [PATCH] Disable insecure SSL/TLS versions --- src/tls_openssl.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/tls_openssl.c b/src/tls_openssl.c index 0e440c1..36fc4b4 100644 --- a/src/tls_openssl.c +++ b/src/tls_openssl.c @@ -77,6 +77,13 @@ tls_t *tls_new(xmpp_ctx_t *ctx, sock_t sock) if (tls->ssl_ctx == NULL) goto err; + SSL_CTX_set_options(tls->ssl_ctx, SSL_OP_ALL); /* Enable bug workarounds. */ + + /* Disable insecure SSL/TLS versions. */ + SSL_CTX_set_options(tls->ssl_ctx, SSL_OP_NO_SSLv2); /* DROWN */ + SSL_CTX_set_options(tls->ssl_ctx, SSL_OP_NO_SSLv3); /* POODLE */ + SSL_CTX_set_options(tls->ssl_ctx, SSL_OP_NO_TLSv1); /* BEAST */ + SSL_CTX_set_client_cert_cb(tls->ssl_ctx, NULL); SSL_CTX_set_mode(tls->ssl_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE); SSL_CTX_set_verify(tls->ssl_ctx, SSL_VERIFY_NONE, NULL);