From 6b6a579925a75bda0039b7ae99fda6b24776d8a0 Mon Sep 17 00:00:00 2001 From: Attila Molnar Date: Mon, 9 Feb 2015 21:18:32 +0100 Subject: [PATCH 1/2] openssl: Disable session tickets --- libratbox/src/openssl.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libratbox/src/openssl.c b/libratbox/src/openssl.c index 9a9b52d55..bac3ea1e6 100644 --- a/libratbox/src/openssl.c +++ b/libratbox/src/openssl.c @@ -315,6 +315,9 @@ rb_init_ssl(void) SSL_CTX_set_options(ssl_server_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_CIPHER_SERVER_PREFERENCE #ifdef SSL_OP_SINGLE_DH_USE | SSL_OP_SINGLE_DH_USE +#endif +#ifdef SSL_OP_NO_TICKET + | SSL_OP_NO_TICKET #endif ); SSL_CTX_set_verify(ssl_server_ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_accept_all_cb); @@ -343,6 +346,11 @@ rb_init_ssl(void) get_ssl_error(ERR_get_error())); ret = 0; } + +#ifdef SSL_OP_NO_TICKET + SSL_CTX_set_options(ssl_client_ctx, SSL_OP_NO_TICKET); +#endif + return ret; } From 989652e7a820a949fef6653da4aec05cc058f15c Mon Sep 17 00:00:00 2001 From: Attila Molnar Date: Mon, 9 Feb 2015 21:19:09 +0100 Subject: [PATCH 2/2] openssl: Disable session caching --- libratbox/src/openssl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libratbox/src/openssl.c b/libratbox/src/openssl.c index bac3ea1e6..bd9df6286 100644 --- a/libratbox/src/openssl.c +++ b/libratbox/src/openssl.c @@ -321,8 +321,7 @@ rb_init_ssl(void) #endif ); SSL_CTX_set_verify(ssl_server_ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_accept_all_cb); - SSL_CTX_set_session_id_context(ssl_server_ctx, - (const unsigned char *)"libratbox", 9); + SSL_CTX_set_session_cache_mode(ssl_server_ctx, SSL_SESS_CACHE_OFF); SSL_CTX_set_cipher_list(ssl_server_ctx, "EECDH+HIGH:EDH+HIGH:HIGH:!aNULL"); /* Set ECDHE on OpenSSL 1.00+, but make sure it's actually available because redhat are dicks