diff options
| author | Carlos Martín Nieto <cmn@dwim.me> | 2014-10-18 15:52:10 +0200 |
|---|---|---|
| committer | Carlos Martín Nieto <cmn@dwim.me> | 2014-10-24 12:11:02 +0200 |
| commit | 5757c0201264ca87ad68cab547c578c612eac58d (patch) | |
| tree | 2973e9d51994d997bcaffcffeef8b631b1e6c650 | |
| parent | d6b97cbb8713f05bcb5d75e622f27ba40fcd922b (diff) | |
| download | libgit2-5757c0201264ca87ad68cab547c578c612eac58d.tar.gz | |
ssl: dump the SSL ciphers in favour of TLS
All versions of SSL are considered deprecated now, so let's ask OpenSSl
to only use TLSv1. We still ask it to load those ciphers for
compatibility with servers which want to use an older hello but will use
TLS for encryption.
For good measure we also disable compression, which can be exploitable,
if the OpenSSL version supports it.
| -rw-r--r-- | src/global.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/src/global.c b/src/global.c index 5e703e646..f8b387676 100644 --- a/src/global.c +++ b/src/global.c @@ -69,7 +69,20 @@ static void init_ssl(void) #ifdef GIT_SSL SSL_load_error_strings(); OpenSSL_add_ssl_algorithms(); + /* + * Load SSLv{2,3} and TLSv1 so that we can talk with servers + * which use the SSL hellos, which are often used for + * compatibility. We then disable SSL so we only allow OpenSSL + * to speak TLSv1 to perform the encryption itself. + */ git__ssl_ctx = SSL_CTX_new(SSLv23_method()); + SSL_CTX_set_options(git__ssl_ctx, + SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 + /* Older OpenSSL and MacOS OpenSSL doesn't have this */ +# ifdef SSL_OP_NO_COMPRESSION + | SSL_OP_NO_COMPRESSION +# endif + ); SSL_CTX_set_mode(git__ssl_ctx, SSL_MODE_AUTO_RETRY); SSL_CTX_set_verify(git__ssl_ctx, SSL_VERIFY_NONE, NULL); if (!SSL_CTX_set_default_verify_paths(git__ssl_ctx)) { |