From: Szilárd Pfeiffer Date: Mon, 4 Sep 2017 08:10:12 +0000 (+0200) Subject: OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag X-Git-Tag: v2.5_beta1~593 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5fd8e94d311825571931414064e4d13ed808f9b5;p=thirdparty%2Fopenvpn.git OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag * safe bet to say that server admins are better at updating their configs than client users are and if client do want to restrict their ciphers, they should simply evict the ciphers they don't want from their cipher suite * mbed TLS and OpenSSL behave more similar with the SSL_OP_CIPHER_SERVER_PREFERENCE flag Signed-off-by: Szilárd Pfeiffer Acked-by: Steffan Karger Message-Id: <20170904081012.1975-1-coroner@pfeifferszilard.hu> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15356.html Signed-off-by: David Sommerseth --- diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index 597c62d85..92a662b5a 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -252,6 +252,9 @@ tls_ctx_set_options(struct tls_root_ctx *ctx, unsigned int ssl_flags) { sslopt |= SSL_OP_NO_TLSv1_2; } +#endif +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE + sslopt |= SSL_OP_CIPHER_SERVER_PREFERENCE; #endif sslopt |= SSL_OP_NO_COMPRESSION; SSL_CTX_set_options(ctx->ctx, sslopt);