[READ-ONLY] Mirror of https://github.com/VibeDevelopers/Comet.
GNUTLS: Provide a default priority string, disable TLSv1.0 in it
The user can still override this choice with the ssl_cipher_list option
in ircd.conf -- this is the only backend that will allow you to do so.
Aaron Jones
(Dec 30, 2016, 5:59 PM UTC)
5bcd4c7c
1175ff83
+46
-3
+10
-3
librb/src/gnutls.c
+10
-3
librb/src/gnutls.c
···
32
32
#include <stdbool.h>
33
33
34
34
#include <gnutls/gnutls.h>
35
+
35
36
#include <gnutls/abstract.h>
36
37
#include <gnutls/x509.h>
37
38
···
40
41
#else
41
42
# include <gnutls/crypto.h>
42
43
#endif
44
+
45
+
#include "gnutls_ratbox.h"
43
46
44
47
typedef enum
45
48
{
···
158
161
}
159
162
160
163
gnutls_init((gnutls_session_t *) F->ssl, init_flags);
161
-
gnutls_set_default_priority(SSL_P(F));
162
164
gnutls_credentials_set(SSL_P(F), GNUTLS_CRD_CERTIFICATE, server_cert_key);
163
165
gnutls_dh_set_prime_bits(SSL_P(F), 2048);
164
-
gnutls_priority_set(SSL_P(F), default_priority);
165
166
166
167
gnutls_transport_set_ptr(SSL_P(F), (gnutls_transport_ptr_t) F);
167
168
gnutls_transport_set_pull_function(SSL_P(F), rb_sock_net_recv);
168
169
gnutls_transport_set_push_function(SSL_P(F), rb_sock_net_xmit);
170
+
171
+
if (gnutls_priority_set(SSL_P(F), default_priority) != GNUTLS_E_SUCCESS)
172
+
gnutls_set_default_priority(SSL_P(F));
169
173
170
174
if(dir == RB_FD_TLS_DIRECTION_IN)
171
175
gnutls_certificate_server_set_request(SSL_P(F), GNUTLS_CERT_REQUEST);
···
483
487
484
488
int
485
489
rb_setup_ssl_server(const char *const certfile, const char *keyfile,
486
-
const char *const dhfile, const char *const cipherlist)
490
+
const char *const dhfile, const char *cipherlist)
487
491
{
488
492
if(certfile == NULL)
489
493
{
···
493
497
494
498
if(keyfile == NULL)
495
499
keyfile = certfile;
500
+
501
+
if(cipherlist == NULL)
502
+
cipherlist = rb_gnutls_default_priority_str;
496
503
497
504
498
505
gnutls_datum_t *const d_cert = rb_load_file_into_datum_t(certfile);
+36
librb/src/gnutls_ratbox.h
+36
librb/src/gnutls_ratbox.h
···
1
+
/*
2
+
* libratbox: a library used by ircd-ratbox and other things
3
+
* gnutls_ratbox.h: embedded data for GNUTLS backend
4
+
*
5
+
* Copyright (C) 2007-2008 ircd-ratbox development team
6
+
* Copyright (C) 2007-2008 Aaron Sethman <androsyn@ratbox.org>
7
+
*
8
+
* This program is free software; you can redistribute it and/or modify
9
+
* it under the terms of the GNU General Public License as published by
10
+
* the Free Software Foundation; either version 2 of the License, or
11
+
* (at your option) any later version.
12
+
*
13
+
* This program is distributed in the hope that it will be useful,
14
+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
15
+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16
+
* GNU General Public License for more details.
17
+
*
18
+
* You should have received a copy of the GNU General Public License
19
+
* along with this program; if not, write to the Free Software
20
+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
21
+
* USA
22
+
*
23
+
*/
24
+
25
+
static const char rb_gnutls_default_priority_str[] = ""
26
+
"+SECURE256:"
27
+
"+SECURE128:"
28
+
"!RSA:"
29
+
"+NORMAL:"
30
+
"!ARCFOUR-128:"
31
+
"!3DES-CBC:"
32
+
"!MD5:"
33
+
"VERS-TLS-ALL:"
34
+
"!VERS-TLS1.0:"
35
+
"!VERS-SSL3.0:"
36
+
"%SAFE_RENEGOTIATION";