ARCHIVE/rippled
1
0
Fork 0
mirror of https://github.com/XRPLF/rippled.git synced 2025-12-06 17:27:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enable EDH only for anonymous SSL contexts

Browse Source 
Enabling EDH breaks compatibility with some versions of IE. Disabling
EDH is an acceptable workaround.
This commit is contained in:
JoelKatz
2015-06-01 14:55:09 -07:00
committed by Vinnie Falco
parent a3d5a97df6
commit 3028ffd083
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/ripple/basics/impl/make_SSLContext.cpp
View File

@@ -284,7 +284,7 @@ error_message (std::string const& what,
static static
void void
initCommon (boost::asio::ssl::context& context) initCommon (boost::asio::ssl::context& context, bool anonymous)
{ {
context.set_options ( context.set_options (
boost::asio::ssl::context::default_workarounds | boost::asio::ssl::context::default_workarounds |
@@ -292,9 +292,14 @@ initCommon (boost::asio::ssl::context& context)
boost::asio::ssl::context::no_sslv3 | boost::asio::ssl::context::no_sslv3 |
boost::asio::ssl::context::single_dh_use); boost::asio::ssl::context::single_dh_use);
SSL_CTX_set_tmp_dh_callback ( if (anonymous)
context.native_handle (), {
tmp_dh_handler); // EDH breaks compatibility with some versions of IE
// So we do not enable EDH except for the anonymous context
SSL_CTX_set_tmp_dh_callback (
context.native_handle (),
tmp_dh_handler);
}
SSL_CTX_set_info_callback ( SSL_CTX_set_info_callback (
context.native_handle (), context.native_handle (),
@@ -306,7 +311,7 @@ void
initAnonymous ( initAnonymous (
boost::asio::ssl::context& context, std::string const& cipherList) boost::asio::ssl::context& context, std::string const& cipherList)
{ {
initCommon(context); initCommon(context, true);
int const result = SSL_CTX_set_cipher_list ( int const result = SSL_CTX_set_cipher_list (
context.native_handle (), context.native_handle (),
cipherList.c_str ()); cipherList.c_str ());
@@ -332,7 +337,7 @@ void
initAuthenticated (boost::asio::ssl::context& context, initAuthenticated (boost::asio::ssl::context& context,
std::string key_file, std::string cert_file, std::string chain_file) std::string key_file, std::string cert_file, std::string chain_file)
{ {
initCommon (context); initCommon (context, false);
SSL_CTX* const ssl = context.native_handle (); SSL_CTX* const ssl = context.native_handle ();