adam/znc
1
0
Fork 0
mirror of https://github.com/znc/znc.git synced 2026-08-06 08:52:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update Csocket to aefa339

Browse Source 
> Support ECDHE exchange if available in OpenSSL
> add openssl's fix for POODLE bug in server mode.
> Give Csocket consumers the ability to disable less desirable protocols
This commit is contained in:
J-P Nurmi
2014-10-26 11:53:18 +01:00
parent a888d38511
commit 9a8786377b
2 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/znc/Csocket.h
+14
View File
@@ -603,6 +603,15 @@ public:
TLS12 = 6
};
enum EDisableProtocol
{
EDP_None = 0, //!< disable nothing
EDP_SSLv2 = 1, //!< disable SSL verion 2
EDP_SSLv3 = 2, //!< disable SSL verion 3
EDP_TLSv1 = 4, //!< disable TLS verion 1
EDP_SSL = (EDP_SSLv2|EDP_SSLv3)
};
enum ECONState
{
CST_START = 0,
@@ -840,6 +849,8 @@ public:
void SetSSL( bool b );
#ifdef HAVE_LIBSSL
//! bitwise setter, @see EDisableProtocol
void DisableSSLProtocols( u_int uDisableOpts ) { m_uDisableProtocols = uDisableOpts; }
//! Set the cipher type ( openssl cipher [to see ciphers available] )
void SetCipher( const CS_STRING & sCipher );
const CS_STRING & GetCipher() const;
@@ -1078,6 +1089,8 @@ private:
//! shrink sendbuff by removing m_uSendBufferPos bytes from m_sSend
void ShrinkSendBuff();
void IncBuffPos( size_t uBytes );
//! checks for configured protocol disabling
void CheckDisabledProtocols();
// NOTE! if you add any new members, be sure to add them to Copy()
uint16_t m_uPort;
@@ -1106,6 +1119,7 @@ private:
SSL * m_ssl;
SSL_CTX * m_ssl_ctx;
uint32_t m_iRequireClientCertFlags;
u_int m_uDisableProtocols;
FPCertVerifyCB m_pCerVerifyCB;
src/Csocket.cpp
+46
View File
@@ -1341,6 +1341,24 @@ bool Csock::AcceptSSL()
return( false );
}
void Csock::CheckDisabledProtocols()
{
#ifdef HAVE_LIBSSL
if( m_ssl_ctx && m_uDisableProtocols > 0 )
{
long uCTXOptions = 0;
if( EDP_SSLv2 & m_uDisableProtocols )
uCTXOptions |= SSL_OP_NO_SSLv2;
if( EDP_SSLv3 & m_uDisableProtocols )
uCTXOptions |= SSL_OP_NO_SSLv3;
if( EDP_TLSv1 & m_uDisableProtocols )
uCTXOptions |= SSL_OP_NO_TLSv1;
if( uCTXOptions )
SSL_CTX_set_options( m_ssl_ctx, uCTXOptions );
}
#endif /* HAVE_LIBSSL */
}
bool Csock::SSLClientSetup()
{
#ifdef HAVE_LIBSSL
@@ -1444,6 +1462,8 @@ bool Csock::SSLClientSetup()
}
}
CheckDisabledProtocols();
m_ssl = SSL_new( m_ssl_ctx );
if( !m_ssl )
return( false );
@@ -1599,18 +1619,43 @@ bool Csock::SSLServerSetup()
ERR_clear_error();
}
// Errors for the following block are non-fatal (ECDHE is nice to have
// but not a requirement)
#if defined( SSL_CTX_set_ecdh_auto )
// Auto-select sensible curve
if( !SSL_CTX_set_ecdh_auto( m_ssl_ctx , 1 ) )
ERR_clear_error();
#elif defined( SSL_CTX_set_tmp_ecdh )
// Use a standard, widely-supported curve
EC_KEY * ecdh = EC_KEY_new_by_curve_name( NID_X9_62_prime256v1 );
if( ecdh )
{
if( !SSL_CTX_set_tmp_ecdh( m_ssl_ctx, ecdh ) )
ERR_clear_error();
EC_KEY_free( ecdh );
}
else
ERR_clear_error();
#endif
if( SSL_CTX_set_cipher_list( m_ssl_ctx, m_sCipherType.c_str() ) <= 0 )
{
CS_DEBUG( "Could not assign cipher [" << m_sCipherType << "]" );
return( false );
}
CheckDisabledProtocols();
//
// setup the SSL
m_ssl = SSL_new( m_ssl_ctx );
if( !m_ssl )
return( false );
#if defined( SSL_MODE_SEND_FALLBACK_SCSV )
SSL_set_mode( m_ssl, SSL_MODE_SEND_FALLBACK_SCSV );
#endif /* SSL_MODE_SEND_FALLBACK_SCSV */
// Call for client Verification
SSL_set_rfd( m_ssl, ( int )m_iReadSock );
SSL_set_wfd( m_ssl, ( int )m_iWriteSock );
@@ -2761,6 +2806,7 @@ void Csock::Init( const CS_STRING & sHostname, uint16_t uPort, int iTimeout )
m_ssl = NULL;
m_ssl_ctx = NULL;
m_iRequireClientCertFlags = 0;
m_uDisableProtocols = 0;
#endif /* HAVE_LIBSSL */
m_iTcount = 0;
m_iReadSock = CS_INVALID_SOCK;