From: Steffan Karger Date: Sat, 1 Mar 2014 14:36:15 +0000 (+0100) Subject: Disable unsupported TLS cipher modes by default, cleans --show-tls output. X-Git-Tag: v2.4_alpha1~459 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f8c4e88280b060ee8aa77ac5d00133848689694b;p=thirdparty%2Fopenvpn.git Disable unsupported TLS cipher modes by default, cleans --show-tls output. This explicitly disables a number of tls ciphers that OpenVPN has currently no support for. OpenSSL will automatically detect this during negotiation, but --show-tls would erroneously show a number of unsupported ciphers. Signed-off-by: Steffan Karger Acked-by: Arne Schwabe Message-Id: <1393684575-28112-3-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8318 Signed-off-by: Gert Doering --- diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index 2da7ebafa..0b63e2607 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -219,8 +219,8 @@ tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers) { if (ciphers == NULL) { - /* Use sane default */ - if(!SSL_CTX_set_cipher_list(ctx->ctx, "DEFAULT:!EXP")) + /* Use sane default (disable export, and unsupported cipher modes) */ + if(!SSL_CTX_set_cipher_list(ctx->ctx, "DEFAULT:!EXP:!PSK:!SRP")) msg(M_SSLERR, "Failed to set default TLS cipher list."); return; }