From cc89915d8cc8361c29318ee954f4fff14d862cb7 Mon Sep 17 00:00:00 2001 From: Andreas Kotes Date: Tue, 15 Apr 2014 15:26:54 +0200 Subject: use SSLv23_client_method & force cipherstring --- vchat-ssl.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/vchat-ssl.c b/vchat-ssl.c index e571d85..d4a6029 100755 --- a/vchat-ssl.c +++ b/vchat-ssl.c @@ -62,7 +62,7 @@ SSL_CTX * vc_create_sslctx( vc_x509store_t *vc_store ) vc_x509verify_cb_t verify_callback = NULL; /* Explicitly use TLSv1 (or maybe later) */ - if( !(ctx = SSL_CTX_new(TLSv1_client_method())) ) + if( !(ctx = SSL_CTX_new(SSLv23_client_method())) ) VC_CTX_ERR_EXIT(store, ctx); if( !(store = vc_x509store_create(vc_store)) ) @@ -71,8 +71,11 @@ SSL_CTX * vc_create_sslctx( vc_x509store_t *vc_store ) SSL_CTX_set_cert_store(ctx, store); store = NULL; /* Disable some insecure protocols explicitly */ - SSL_CTX_set_options(ctx, SSL_OP_ALL|SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3); - SSL_CTX_set_cipher_list(ctx, "ALL:!ADH:!LOW:!EXP:!MD5:!RC4:@STRENGTH"); + SSL_CTX_set_options(ctx, SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); + if( OPENSSL_VERSION_NUMBER < 0x10000000L ) + SSL_CTX_set_cipher_list(ctx, "DHE-RSA-AES256-SHA"); + else + SSL_CTX_set_cipher_list(ctx, "ECDHE-RSA-AES256-GCM-SHA384"); SSL_CTX_set_verify_depth (ctx, 2); -- cgit v1.2.3