github/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

TLS: new method to specify SSL/TLS version

Browse Source 
SSL/TLS protocols only listed in ssl_protocols should be used.
The name "ssl_protocols" comes from nginx.

Resolves #428.
This commit is contained in:
Koichiro IWAO
2016-12-13 15:49:13 +09:00
committed by metalefty
parent 657f6f3756
commit e94ab10e14
8 changed files with 49 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libxrdp/xrdp_rdp.c
+33 -2
View File
@@ -18,6 +18,7 @@
* rdp layer
*/
#include <openssl/ssl.h>
#include "libxrdp.h"
#include "log.h"
@@ -44,6 +45,8 @@ xrdp_rdp_read_config(struct xrdp_client_info *client_info)
char *item = (char *)NULL;
char *value = (char *)NULL;
char cfg_file[256];
char *tmp = (char *)NULL;
int tmp_length = 0;
/* initialize (zero out) local variables: */
g_memset(cfg_file, 0, sizeof(char) * 256);
@@ -160,9 +163,37 @@ xrdp_rdp_read_config(struct xrdp_client_info *client_info)
client_info->use_fast_path = 0;
}
}
else if (g_strcasecmp(item, "disableSSLv3") == 0)
else if (g_strcasecmp(item, "ssl_protocols") == 0)
{
client_info->disableSSLv3 = g_text2bool(value);
/* put leading/trailing space to properly detect "TLSv1" without regex */
tmp_length = g_strlen(value) + 3;
tmp = g_new(char, tmp_length);
g_snprintf(tmp, tmp_length, "%s%s%s", " ", value, " ");
/* disable all protocols first, enable later */
client_info->ssl_protocols =
SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2;
if (g_pos(tmp, " TLSv1.2 ") >= 0)
{
log_message(LOG_LEVEL_DEBUG, "TLSv1.2 enabled");
client_info->ssl_protocols &= ~SSL_OP_NO_TLSv1_2;
}
if (g_pos(tmp, " TLSv1.1 ") >= 0)
{
log_message(LOG_LEVEL_DEBUG, "TLSv1.1 enabled");
client_info->ssl_protocols &= ~SSL_OP_NO_TLSv1_1;
}
if (g_pos(tmp, " TLSv1 ") >= 0)
{
log_message(LOG_LEVEL_DEBUG, "TLSv1 enabled");
client_info->ssl_protocols &= ~SSL_OP_NO_TLSv1;
}
if (g_pos(tmp, " SSLv3 ") >= 0)
{
log_message(LOG_LEVEL_DEBUG, "SSLv3 enabled");
client_info->ssl_protocols &= ~SSL_OP_NO_SSLv3;
}
}
else if (g_strcasecmp(item, "tls_ciphers") == 0)
{