Git-Mirrors/RetroShare
1
0
Fork 0
mirror of https://github.com/RetroShare/RetroShare.git synced 2025-08-03 11:54:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge pull request #279 from cavebeat/single_dh_op

Browse source 
added openSSL option SSL_OP_SINGLE_DH_USE regarding CVE-2016-0701
This commit is contained in:
Cyril Soler 2016-02-14 13:33:27 -05:00
commit 3ab7c89660
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
libretroshare/src/pqi/authssl.cc
View file

@ -334,6 +334,13 @@ static int initLib = 0;
sslctx = SSL_CTX_new(SSLv23_method());
SSL_CTX_set_options(sslctx,SSL_OP_NO_SSLv3) ;
//SSL_OP_SINGLE_DH_USE CVE-2016-0701
//https://www.openssl.org/docs/manmaster/ssl/SSL_CTX_set_options.html
//If "strong" primes were used, it is not strictly necessary to generate a new DH key during each handshake but it is also recommended. SSL_OP_SINGLE_DH_USE should therefore be enabled whenever temporary/ephemeral DH parameters are used.
//SSL_CTX_set_options() adds the options set via bitmask in options to ctx. Options already set before are not cleared!
SSL_CTX_set_options(sslctx,SSL_OP_SINGLE_DH_USE) ;
// Setup cipher lists:
//
// std::string cipherString = "HIGH:!DSS:!aNULL:!3DES";