pxcloud/spice
5
0
Fork 0
mirror of https://gitlab.uni-freiburg.de/opensourcevdi/spice synced 2025-12-27 15:45:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Use TLS version 1.0 or better

Browse Source 
When creating a TLS socket, both spice-server and spice-gtk currently
call SSL_CTX_new(TLSv1_method()). The TLSv1_method() function set the
protocol version to TLS 1.0 exclusively. The correct way to support
multiple protocol versions is to call SSLv23_method() in spite of its
scary name. This method will enable all SSL/TLS protocol versions. The
protocol suite may be further narrowed down by setting respective
SSL_OP_NO_<version_code> options of SSL context.  This possibility is
used in this patch in order to block use of SSLv3 that is enabled by
default in openssl for client sockets as of now but spice has never used
it.
This commit is contained in:
David Jaša 2013-11-27 17:45:49 +01:00 committed by Christophe Fergeau
parent f4f033a09c
commit 4fc9ba5f27
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
server/reds.c
View File

@ -3221,6 +3221,8 @@ static int reds_init_ssl(void)
SSL_METHOD *ssl_method;
#endif
int return_code;
/* When some other SSL/TLS version becomes obsolete, add it to this
* variable. */
long ssl_options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
/* Global system initialization*/
@ -3228,7 +3230,8 @@ static int reds_init_ssl(void)
SSL_load_error_strings();
/* Create our context*/
ssl_method = TLSv1_method();
/* SSLv23_method() handles TLSv1.x in addition to SSLv2/v3 */
ssl_method = SSLv23_method();
reds->ctx = SSL_CTX_new(ssl_method);
if (!reds->ctx) {
spice_warning("Could not allocate new SSL context");