diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/ngircd/conf.c | 10 | ||||
| -rw-r--r-- | src/ngircd/conf.h | 1 | ||||
| -rw-r--r-- | src/ngircd/conn-ssl.c | 24 |
3 files changed, 34 insertions, 1 deletions
diff --git a/src/ngircd/conf.c b/src/ngircd/conf.c index b10f4905..9ab66e54 100644 --- a/src/ngircd/conf.c +++ b/src/ngircd/conf.c @@ -117,6 +117,9 @@ ConfSSL_Init(void) array_free_wipe(&Conf_SSLOptions.KeyFilePassword); array_free(&Conf_SSLOptions.ListenPorts); + + free(Conf_SSLOptions.CipherList); + Conf_SSLOptions.CipherList = NULL; } /** @@ -432,6 +435,8 @@ Conf_Test( void ) puts("[SSL]"); printf(" CertFile = %s\n", Conf_SSLOptions.CertFile ? Conf_SSLOptions.CertFile : ""); + printf(" CipherList = %s\n", Conf_SSLOptions.CipherList + ? Conf_SSLOptions.CipherList : ""); printf(" DHFile = %s\n", Conf_SSLOptions.DHFile ? Conf_SSLOptions.DHFile : ""); printf(" KeyFile = %s\n", Conf_SSLOptions.KeyFile @@ -1869,6 +1874,11 @@ Handle_SSL(const char *File, int Line, char *Var, char *Arg) ports_parse(&Conf_SSLOptions.ListenPorts, Line, Arg); return; } + if (strcasecmp(Var, "CipherList") == 0) { + assert(Conf_SSLOptions.CipherList == NULL); + Conf_SSLOptions.CipherList = strdup_warn(Arg); + return; + } Config_Error_Section(File, Line, Var, "SSL"); } diff --git a/src/ngircd/conf.h b/src/ngircd/conf.h index 948749de..02d23315 100644 --- a/src/ngircd/conf.h +++ b/src/ngircd/conf.h @@ -75,6 +75,7 @@ struct SSLOptions { char *DHFile; /**< File containing DH parameters */ array ListenPorts; /**< Array of listening SSL ports */ array KeyFilePassword; /**< Key file password */ + char *CipherList; /**< Set SSL cipher list to use */ }; #endif diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 595cb615..059e871d 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -305,6 +305,19 @@ ConnSSL_InitLibrary( void ) if (!ConnSSL_LoadServerKey_openssl(newctx)) goto out; + if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) { + if(SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0 ) { + Log(LOG_ERR, + "Failed to apply SSL cipher list \"%s\"!", + Conf_SSLOptions.CipherList); + goto out; + } else { + Log(LOG_INFO, + "Successfully applied SSL cipher list: \"%s\".", + Conf_SSLOptions.CipherList); + } + } + SSL_CTX_set_options(newctx, SSL_OP_SINGLE_DH_USE|SSL_OP_NO_SSLv2); SSL_CTX_set_mode(newctx, SSL_MODE_ENABLE_PARTIAL_WRITE); SSL_CTX_set_verify(newctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE, @@ -328,6 +341,14 @@ out: return false; } + if(Conf_SSLOptions.CipherList != NULL) { + Log(LOG_ERR, + "Failed to apply SSL cipher list \"%s\": Not implemented for GnuTLS!", + Conf_SSLOptions.CipherList); + array_free(&Conf_SSLOptions.ListenPorts); + return false; + } + err = gnutls_global_init(); if (err) { Log(LOG_ERR, "Failed to initialize GnuTLS: %s", @@ -339,6 +360,7 @@ out: array_free(&Conf_SSLOptions.ListenPorts); return false; } + Log(LOG_INFO, "GnuTLS %s initialized.", gnutls_check_version(NULL)); initialized = true; return true; @@ -368,7 +390,7 @@ ConnSSL_LoadServerKey_gnutls(void) if (array_bytes(&Conf_SSLOptions.KeyFilePassword)) Log(LOG_WARNING, - "Ignoring KeyFilePassword: Not supported by GnuTLS."); + "Ignoring SSL \"KeyFilePassword\": Not supported by GnuTLS."); if (!Load_DH_params()) return false; |