From 2b987b1ea77a61f475d33cf895906b2a3a8493b7 Mon Sep 17 00:00:00 2001 From: Samuel Hoffman Date: Wed, 1 Jul 2015 21:45:37 -0400 Subject: [PATCH] network-openssl: if -ssl_ciphers is not passed to /SERVER, fallback to an explicit list of ciphersuites. Disable Compression and TLS session tickets in SSL contexts. Print the SSL server suite after the connection to the server has been established. --- src/core/network-openssl.c | 12 ++++++++++-- src/core/server-connect-rec.h | 1 + src/fe-common/core/fe-server.c | 4 ++++ 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/src/core/network-openssl.c b/src/core/network-openssl.c index 465c4154..03575358 100644 --- a/src/core/network-openssl.c +++ b/src/core/network-openssl.c @@ -460,7 +460,8 @@ static GIOChannel *irssi_ssl_get_iochannel(GIOChannel *handle, int port, SERVER_ const char *mypass = server->connrec->ssl_pass; const char *cafile = server->connrec->ssl_cafile; const char *capath = server->connrec->ssl_capath; - const char *ciphers = server->connrec->ssl_ciphers; + const char *ciphers = server->connrec->ssl_ciphers != NULL ? server->connrec->ssl_ciphers : "kEECDH+HIGH:kEDH+HIGH:HIGH:!RC4:!aNULL"; + gboolean verify = server->connrec->ssl_verify; g_return_val_if_fail(handle != NULL, NULL); @@ -476,7 +477,10 @@ static GIOChannel *irssi_ssl_get_iochannel(GIOChannel *handle, int port, SERVER_ g_error("Could not allocate memory for SSL context"); return NULL; } - SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); + SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2); + SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3); + SSL_CTX_set_options(ctx, SSL_OP_NO_COMPRESSION); + SSL_CTX_set_options(ctx, SSL_OP_NO_TICKET); SSL_CTX_set_default_passwd_cb(ctx, get_pem_password_callback); SSL_CTX_set_default_passwd_cb_userdata(ctx, (void *)mypass); if (ciphers && *ciphers) { @@ -611,6 +615,10 @@ int irssi_ssl_handshake(GIOChannel *handle) return -1; } ret = !chan->verify || irssi_ssl_verify(chan->ssl, chan->ctx, chan->server->connrec->address, chan->port, cert, chan->server); + + SSL_CIPHER *c = SSL_get_cipher(chan->ssl); + if(c) + chan->server->connrec->ssl_current_cipher = (char *)c; X509_free(cert); return ret ? 0 : -1; } diff --git a/src/core/server-connect-rec.h b/src/core/server-connect-rec.h index 80c5761b..0b6f927a 100644 --- a/src/core/server-connect-rec.h +++ b/src/core/server-connect-rec.h @@ -29,6 +29,7 @@ char *ssl_pass; char *ssl_cafile; char *ssl_capath; char *ssl_ciphers; +char *ssl_current_cipher; /* cipher selected during handshake */ GIOChannel *connect_handle; /* connect using this handle */ diff --git a/src/fe-common/core/fe-server.c b/src/fe-common/core/fe-server.c index 429e6dac..16d510cc 100644 --- a/src/fe-common/core/fe-server.c +++ b/src/fe-common/core/fe-server.c @@ -316,6 +316,10 @@ static void sig_server_connected(SERVER_REC *server) printformat(server, NULL, MSGLEVEL_CLIENTNOTICE, TXT_CONNECTION_ESTABLISHED, server->connrec->address); + + if(server->connrec->use_ssl) + printtext(NULL, NULL, MSGLEVEL_CLIENTNOTICE, + "Using ciphersuite %s", server->connrec->ssl_current_cipher); } static void sig_connect_failed(SERVER_REC *server, gchar *msg)