diff options
| author | Jay Satiro <raysatiro@yahoo.com> | 2014-10-24 13:41:56 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2014-10-24 13:41:56 +0200 |
| commit | ec783dc142129d3860e542b443caaa78a6172d56 (patch) | |
| tree | 7062b5f480575be59252816c9877823fbde143c9 /lib/vtls/openssl.c | |
| parent | 2b042574917aeff4d366dec23a7d007913cbe755 (diff) | |
SSL: Remove SSLv3 from SSL default due to POODLE attack
- Remove SSLv3 from SSL default in darwinssl, schannel, cyassl, nss,
openssl effectively making the default TLS 1.x. axTLS is not affected
since it supports only TLS, and gnutls is not affected since it already
defaults to TLS 1.x.
- Update CURLOPT_SSLVERSION doc
Diffstat (limited to 'lib/vtls/openssl.c')
| -rw-r--r-- | lib/vtls/openssl.c | 16 |
1 files changed, 6 insertions, 10 deletions
diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c index 29cc78cad..f42ebd896 100644 --- a/lib/vtls/openssl.c +++ b/lib/vtls/openssl.c @@ -1649,16 +1649,6 @@ ossl_connect_step1(struct connectdata *conn, #endif switch(data->set.ssl.version) { - case CURL_SSLVERSION_DEFAULT: - ctx_options |= SSL_OP_NO_SSLv2; -#ifdef USE_TLS_SRP - if(data->set.ssl.authtype == CURL_TLSAUTH_SRP) { - infof(data, "Set version TLSv1.x for SRP authorisation\n"); - ctx_options |= SSL_OP_NO_SSLv3; - } -#endif - break; - case CURL_SSLVERSION_SSLv3: ctx_options |= SSL_OP_NO_SSLv2; ctx_options |= SSL_OP_NO_TLSv1; @@ -1668,6 +1658,12 @@ ossl_connect_step1(struct connectdata *conn, #endif break; + case CURL_SSLVERSION_DEFAULT: +#ifdef USE_TLS_SRP + if(data->set.ssl.authtype == CURL_TLSAUTH_SRP) { + infof(data, "Set version TLSv1.x for SRP authorisation\n"); + } +#endif case CURL_SSLVERSION_TLSv1: ctx_options |= SSL_OP_NO_SSLv2; ctx_options |= SSL_OP_NO_SSLv3; |