From: Timo Sirainen <tss@iki.fi>
Date: Tue, 2 Feb 2010 13:00:15 +0000 (+0200)
Subject: login: Now properly disable SSLv2 support.
X-Git-Tag: 2.0.beta3~172
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=19683362167a36d45ae0bf829bf9ed118d2e5174;p=thirdparty%2Fdovecot%2Fcore.git

login: Now properly disable SSLv2 support.

--HG--
branch : HEAD
---

diff --git a/src/login-common/ssl-proxy-openssl.c b/src/login-common/ssl-proxy-openssl.c
index 5be6f9e587..26330ba270 100644
--- a/src/login-common/ssl-proxy-openssl.c
+++ b/src/login-common/ssl-proxy-openssl.c
@@ -917,7 +917,7 @@ ssl_proxy_ctx_init(SSL_CTX *ssl_ctx, const struct login_settings *set)
 	X509_STORE *store;
 	STACK_OF(X509_NAME) *xnames = NULL;
 
-	SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL);
+	SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL | SSL_OP_NO_SSLv2);
 	if (*set->ssl_ca != '\0') {
 		/* set trusted CA certs */
 		store = SSL_CTX_get_cert_store(ssl_ctx);