devs/libstrophe-gh
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Disable insecure SSL/TLS versions

Browse Source
This commit is contained in:
Alexander Krotov
2017-06-20 02:10:25 +03:00
committed by Dmitry Podgorny
parent 443b4d3116
commit f47609c1f0
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/tls_openssl.c
View File

@@ -77,6 +77,13 @@ tls_t *tls_new(xmpp_ctx_t *ctx, sock_t sock)
if (tls->ssl_ctx == NULL) if (tls->ssl_ctx == NULL)
goto err; goto err;
SSL_CTX_set_options(tls->ssl_ctx, SSL_OP_ALL); /* Enable bug workarounds. */
/* Disable insecure SSL/TLS versions. */
SSL_CTX_set_options(tls->ssl_ctx, SSL_OP_NO_SSLv2); /* DROWN */
SSL_CTX_set_options(tls->ssl_ctx, SSL_OP_NO_SSLv3); /* POODLE */
SSL_CTX_set_options(tls->ssl_ctx, SSL_OP_NO_TLSv1); /* BEAST */
SSL_CTX_set_client_cert_cb(tls->ssl_ctx, NULL); SSL_CTX_set_client_cert_cb(tls->ssl_ctx, NULL);
SSL_CTX_set_mode(tls->ssl_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE); SSL_CTX_set_mode(tls->ssl_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
SSL_CTX_set_verify(tls->ssl_ctx, SSL_VERIFY_NONE, NULL); SSL_CTX_set_verify(tls->ssl_ctx, SSL_VERIFY_NONE, NULL);