forked from pool/openssl
40 lines
1.9 KiB
Diff
40 lines
1.9 KiB
Diff
|
Index: openssl-1.0.1g/ssl/ssl_ciph.c
|
||
|
|
===================================================================
|
||
|
|
--- openssl-1.0.1g.orig/ssl/ssl_ciph.c
|
||
|
|
+++ openssl-1.0.1g/ssl/ssl_ciph.c
|
||
|
|
@@ -1470,7 +1470,17 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
|
||
|
|
*/
|
||
|
|
ok = 1;
|
||
|
|
rule_p = rule_str;
|
||
|
|
- if (strncmp(rule_str,"DEFAULT",7) == 0)
|
||
|
|
+
|
||
|
|
+ if (strncmp(rule_str,"DEFAULT_SUSE",12) == 0)
|
||
|
|
+ {
|
||
|
|
+ ok = ssl_cipher_process_rulestr(SSL_DEFAULT_SUSE_CIPHER_LIST,
|
||
|
|
+ &head, &tail, ca_list);
|
||
|
|
+ rule_p += 12;
|
||
|
|
+ if (*rule_p == ':')
|
||
|
|
+ rule_p++;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
+ else if (strncmp(rule_str,"DEFAULT",7) == 0)
|
||
|
|
{
|
||
|
|
ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
|
||
|
|
&head, &tail, ca_list);
|
||
|
|
Index: openssl-1.0.1g/ssl/ssl.h
|
||
|
|
===================================================================
|
||
|
|
--- openssl-1.0.1g.orig/ssl/ssl.h
|
||
|
|
+++ openssl-1.0.1g/ssl/ssl.h
|
||
|
|
@@ -331,7 +331,10 @@ extern "C" {
|
||
|
|
/* The following cipher list is used by default.
|
||
|
|
* It also is substituted when an application-defined cipher list string
|
||
|
|
* starts with 'DEFAULT'. */
|
||
|
|
-#define SSL_DEFAULT_CIPHER_LIST "ALL:!aNULL:!eNULL:!SSLv2:!EXPORT:!LOW"
|
||
|
|
+#define SSL_DEFAULT_CIPHER_LIST "ALL:!aNULL:!eNULL:!SSLv2:!EXPORT:!RC2:!DES"
|
||
|
|
+#define SSL_DEFAULT_SUSE_CIPHER_LIST "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:"\
|
||
|
|
+ "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:"\
|
||
|
|
+ "AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:DES-CBC3-SHA"
|
||
|
|
/* As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always
|
||
|
|
* starts with a reasonable order, and all we have to do for DEFAULT is
|
||
|
|
* throwing out anonymous and unencrypted ciphersuites!
|