psyc-mirrors/psyclpc
1
0
Fork 0
mirror of git://git.psyced.org/git/psyclpc synced 2024-08-15 03:20:16 +00:00
Code Issues Releases Wiki Activity

fippo thinks we should enforce forward secrecy

Browse source
This commit is contained in:
psyc://psyced.org/~lynX 2013-08-28 21:50:42 +02:00
parent 76c91004b3
commit 8c159ce372
1 changed files with 24 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
src/pkg-tls.c
View file

@ -518,12 +518,33 @@ tls_global_init (void)
, time_stamp()); , time_stamp());
goto ssl_init_err; goto ssl_init_err;
} }
#ifdef SSL_CTRL_SET_TMP_ECDH
do {
EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
if (ecdh == NULL) {
debug_message("%s TLS: Error setting ECDHE parameters:\n"
, time_stamp());
goto ssl_init_err;
} else {
debug_message("%s: TLS: using ECDHE, yai\n"
, time_stamp());
}
SSL_CTX_set_tmp_ecdh(context,ecdh);
EC_KEY_free(ecdh);
} while (0);
#endif
/* Avoid small subgroup attacks */ /* Avoid small subgroup attacks */
/* do not do SSLv2 */ /* do not do SSLv2 */
SSL_CTX_set_options(context, SSL_OP_SINGLE_DH_USE); SSL_CTX_set_options(context, SSL_OP_SINGLE_DH_USE);
SSL_CTX_set_options(context, SSL_OP_NO_SSLv2); SSL_CTX_set_options(context, SSL_OP_NO_SSLv2);
if (SSL_CTX_set_cipher_list(context, "HIGH:!DSS:!aNULL@STRENGTH") != 1) {
debug_message("SSL_CTX_set_cipher_list failed."
, time_stamp());
goto ssl_init_err;
}
/* OpenSSL successfully initialised */ /* OpenSSL successfully initialised */
tls_available = MY_TRUE; tls_available = MY_TRUE;
return; return;
@ -1548,14 +1569,14 @@ f_tls_query_connection_info (svalue_t *sp)
#ifdef HAS_OPENSSL #ifdef HAS_OPENSSL
put_c_string(&(rc->item[TLS_CIPHER]) put_c_string(&(rc->item[TLS_CIPHER])
, SSL_get_cipher(ip->tls_session)); , SSL_get_cipher(ip->tls_session));
put_number(&(rc->item[TLS_COMP]), 0); put_number(&(rc->item[TLS_COMP]), ip->tls_session->session->compress_meth);
put_number(&(rc->item[TLS_KX]), 0); put_number(&(rc->item[TLS_KX]), 0);
put_number(&(rc->item[TLS_MAC]), 0); put_number(&(rc->item[TLS_MAC]), 0);
put_c_string(&(rc->item[TLS_PROT]) put_c_string(&(rc->item[TLS_PROT])
, SSL_get_version(ip->tls_session)); , SSL_get_version(ip->tls_session));
/* warning: this session id is binary .. maybe fix it someday */ /* warning: this session id is binary .. maybe fix it someday */
put_c_string(&(rc->item[TLS_SESSION]) put_c_n_string(&(rc->item[TLS_SESSION])
, (char*) ip->tls_session->session->session_id); , (char*) ip->tls_session->session->session_id, ip->tls_session->session->session_id_length);
#elif defined(HAS_GNUTLS) #elif defined(HAS_GNUTLS)
put_number(&(rc->item[TLS_CIPHER]) put_number(&(rc->item[TLS_CIPHER])
, gnutls_cipher_get(ip->tls_session)); , gnutls_cipher_get(ip->tls_session));