- rel 1; new mod_logdb patch from author; works here

[packages/ejabberd.git] / ejabberd-no_sslv3_or_3des.patch

--- a/deps/fast_tls/c_src/fast_tls_drv.c~	2016-07-08 11:19:35.000000000 +0200
+++ b/deps/fast_tls/c_src/fast_tls_drv.c	2016-08-04 16:52:34.323491442 +0200
@@ -56,7 +56,7 @@ typedef unsigned __int32 uint32_t;
 #define SSL_OP_NO_TICKET 0
 #endif
 
-#define CIPHERS "DEFAULT:!EXPORT:!LOW:!RC4:!SSLv2"
+#define CIPHERS "DEFAULT:!EXPORT:!LOW:!RC4:!SSLv2:!3DES"
 
 /* Wrappers around driver_alloc() that check  */
 /* for OOM.                                   */
@@ -711,13 +711,13 @@ static ErlDrvSSizeT tls_drv_control(ErlD
 	 SSL_set_bio(d->ssl, d->bio_read, d->bio_write);
 
 	 if (command == SET_CERTIFICATE_FILE_ACCEPT) {
-	    options |= (SSL_OP_NO_TICKET|SSL_OP_ALL|SSL_OP_NO_SSLv2);
+	    options |= (SSL_OP_NO_TICKET|SSL_OP_ALL|SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3);
 
 	    SSL_set_options(d->ssl, options);
 
 	    SSL_set_accept_state(d->ssl);
 	 } else {
-	    options |= (SSL_OP_NO_TICKET|SSL_OP_NO_SSLv2);
+	    options |= (SSL_OP_NO_TICKET|SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3);
 
 	    SSL_set_options(d->ssl, options);