1. openvpn
  2. Commit 5fd8e94d311825571931414064e4d13ed808f9b5
Browse code

OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag

* safe bet to say that server admins are better at updating their configs
than client users are and if client do want to restrict their ciphers,
they should simply evict the ciphers they don't want from their cipher
suite
* mbed TLS and OpenSSL behave more similar with the
SSL_OP_CIPHER_SERVER_PREFERENCE flag

Signed-off-by: Szilárd Pfeiffer <coroner@pfeifferszilard.hu>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <20170904081012.1975-1-coroner@pfeifferszilard.hu>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15356.html
Signed-off-by: David Sommerseth <davids@openvpn.net>

Szilárd Pfeiffer authored on 2017/09/04 17:10:12
Showing 1 changed files
src/openvpn/ssl_openssl.c
History View file @ 5fd8e94
... ... 
@@ -253,6 +253,9 @@ tls_ctx_set_options(struct tls_root_ctx *ctx, unsigned int ssl_flags)
253 253 
             sslopt |= SSL_OP_NO_TLSv1_2;
254 254 
         }
255 255 
 #endif
256 
+#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
257 
+        sslopt |= SSL_OP_CIPHER_SERVER_PREFERENCE;
258 
+#endif
256 259 
         sslopt |= SSL_OP_NO_COMPRESSION;
257 260 
         SSL_CTX_set_options(ctx->ctx, sslopt);
258 261 
     }