zynk/irssi
2
0
Fork 0
mirror of https://github.com/irssi/irssi.git synced 2026-08-23 18:42:53 +02:00
Code Issues Projects Releases Packages Wiki Activity

network-openssl: if -ssl_ciphers is not passed to /SERVER, fallback to an explicit list of ciphersuites. Disable Compression and TLS session tickets in SSL contexts. Print the SSL server suite after the connection to the server has been established.

Browse source
This commit is contained in:
Samuel Hoffman 2015-07-01 21:45:37 -04:00
commit 2b987b1ea7
3 changed files with 15 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/core/network-openssl.c
View file

@ -460,7 +460,8 @@ static GIOChannel *irssi_ssl_get_iochannel(GIOChannel *handle, int port, SERVER_
const char *mypass = server->connrec->ssl_pass;
const char *cafile = server->connrec->ssl_cafile;
const char *capath = server->connrec->ssl_capath;
const char *ciphers = server->connrec->ssl_ciphers;
const char *ciphers = server->connrec->ssl_ciphers != NULL ? server->connrec->ssl_ciphers : "kEECDH+HIGH:kEDH+HIGH:HIGH:!RC4:!aNULL";
gboolean verify = server->connrec->ssl_verify;
g_return_val_if_fail(handle != NULL, NULL);
@ -476,7 +477,10 @@ static GIOChannel *irssi_ssl_get_iochannel(GIOChannel *handle, int port, SERVER_
g_error("Could not allocate memory for SSL context");
return NULL;
}
SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3);
SSL_CTX_set_options(ctx, SSL_OP_NO_COMPRESSION);
SSL_CTX_set_options(ctx, SSL_OP_NO_TICKET);
SSL_CTX_set_default_passwd_cb(ctx, get_pem_password_callback);
SSL_CTX_set_default_passwd_cb_userdata(ctx, (void *)mypass);
if (ciphers && *ciphers) {
@ -611,6 +615,10 @@ int irssi_ssl_handshake(GIOChannel *handle)
return -1;
}
ret = !chan->verify || irssi_ssl_verify(chan->ssl, chan->ctx, chan->server->connrec->address, chan->port, cert, chan->server);
SSL_CIPHER *c = SSL_get_cipher(chan->ssl);
if(c)
chan->server->connrec->ssl_current_cipher = (char *)c;
X509_free(cert);
return ret ? 0 : -1;
}

1
src/core/server-connect-rec.h
View file

@ -29,6 +29,7 @@ char *ssl_pass;
char *ssl_cafile;
char *ssl_capath;
char *ssl_ciphers;
char *ssl_current_cipher; /* cipher selected during handshake */
GIOChannel *connect_handle; /* connect using this handle */

4
src/fe-common/core/fe-server.c
View file

@ -316,6 +316,10 @@ static void sig_server_connected(SERVER_REC *server)
printformat(server, NULL, MSGLEVEL_CLIENTNOTICE,
TXT_CONNECTION_ESTABLISHED, server->connrec->address);
if(server->connrec->use_ssl)
printtext(NULL, NULL, MSGLEVEL_CLIENTNOTICE,
"Using ciphersuite %s", server->connrec->ssl_current_cipher);
}
static void sig_connect_failed(SERVER_REC *server, gchar *msg)