retronetworking
/
freeswitch
13
0
Fork 0
Code Pull Requests Releases Activity

Any browser (Firefox, Chrome, Opera) that can run Verto can do TLS1.2, We shouldn't lower the bar when we don't need too.

This commit is contained in:
Brian West 2014-07-18 09:10:15 -05:00
parent 86f9029b98
commit 835fae4227
2 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/mod/endpoints/mod_verto/mod_verto.c
View File

@ -150,6 +150,17 @@ static void verto_init_ssl(verto_profile_t *profile)
profile->ssl_ready = 1;
assert(profile->ssl_ctx);
/* Disable SSLv2 */
SSL_CTX_set_options(profile->ssl_ctx, SSL_OP_NO_SSLv2);
/* Disable SSLv3 */
SSL_CTX_set_options(profile->ssl_ctx, SSL_OP_NO_SSLv3);
/* Disable TLSv1 */
SSL_CTX_set_options(profile->ssl_ctx, SSL_OP_NO_TLSv1);
/* Disable TLSv1_1 */
SSL_CTX_set_options(profile->ssl_ctx, SSL_OP_NO_TLSv1_1);
/* Disable Compression CRIME (Compression Ratio Info-leak Made Easy) */
SSL_CTX_set_options(profile->ssl_ctx, SSL_OP_NO_COMPRESSION);
/* set the local certificate from CertFile */
if (!zstr(profile->chain)) {
SSL_CTX_use_certificate_chain_file(profile->ssl_ctx, profile->chain);

14
src/mod/endpoints/mod_verto/ws.c
View File

@ -92,10 +92,20 @@ void init_ssl(void) {
OpenSSL_add_all_algorithms(); /* load & register cryptos */
SSL_load_error_strings(); /* load all error messages */
ws_globals.ssl_method = TLSv1_server_method(); /* create server instance */
ws_globals.ssl_method = SSLv23_server_method(); /* create server instance */
ws_globals.ssl_ctx = SSL_CTX_new(ws_globals.ssl_method); /* create context */
assert(ws_globals.ssl_ctx);
/* Disable SSLv2 */
SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_SSLv2);
/* Disable SSLv3 */
SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_SSLv3);
/* Disable TLSv1 */
SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_TLSv1);
/* Disable TLSv1_1 */
SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_TLSv1_1);
/* Disable Compression CRIME (Compression Ratio Info-leak Made Easy) */
SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_COMPRESSION);
/* set the local certificate from CertFile */
SSL_CTX_use_certificate_file(ws_globals.ssl_ctx, ws_globals.cert, SSL_FILETYPE_PEM);
/* set the private key from KeyFile */