From ac76c832925b786e188fc2c45da5fb7ae5128df3 Mon Sep 17 00:00:00 2001 From: Julien Vehent Date: Wed, 21 May 2014 09:39:17 -0400 Subject: Set SSL options to sane default and enfore server cipher preferences Original PR #856 --- src/modules/extra/m_ssl_openssl.cpp | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src/modules/extra/m_ssl_openssl.cpp') diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp index 9ebc0de9d..d8ea16bdf 100644 --- a/src/modules/extra/m_ssl_openssl.cpp +++ b/src/modules/extra/m_ssl_openssl.cpp @@ -103,6 +103,9 @@ namespace OpenSSL Context(SSL_CTX* context) : ctx(context) { + // Sane default options for OpenSSL see https://www.openssl.org/docs/ssl/SSL_CTX_set_options.html + // and when choosing a cipher, use the server's preferences instead of the client preferences. + SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION | SSL_OP_CIPHER_SERVER_PREFERENCE); SSL_CTX_set_mode(ctx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER); SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify); -- cgit v1.2.3