summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/modules/extra/m_ssl_openssl.cpp26
1 files changed, 25 insertions, 1 deletions
diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index 0f4e2d713..f84468da8 100644
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -217,10 +217,20 @@ namespace OpenSSL
bool SetCiphers(const std::string& ciphers)
{
+ // TLSv1 to TLSv1.2 ciphers.
ERR_clear_error();
return SSL_CTX_set_cipher_list(ctx, ciphers.c_str());
}
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+ bool SetCiphersuites(const std::string& ciphers)
+ {
+ // TLSv1.3+ ciphers.
+ ERR_clear_error();
+ return SSL_CTX_set_ciphersuites(ctx, ciphers.c_str());
+ }
+#endif
+
bool SetCerts(const std::string& filename)
{
ERR_clear_error();
@@ -408,7 +418,7 @@ namespace OpenSSL
if (digest == NULL)
throw Exception("Unknown hash type " + hash);
- std::string ciphers = tag->getString("ciphers");
+ const std::string ciphers = tag->getString("ciphers");
if (!ciphers.empty())
{
if ((!ctx.SetCiphers(ciphers)) || (!clictx.SetCiphers(ciphers)))
@@ -418,6 +428,20 @@ namespace OpenSSL
}
}
+ const std::string ciphersuites = tag->getString("ciphersuites");
+ if (!ciphers.empty())
+ {
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+ if ((!ctx.SetCiphersuites(ciphersuites)) || (!clictx.SetCiphersuites(ciphersuites)))
+ {
+ ERR_print_errors_cb(error_callback, this);
+ throw Exception("Can't set ciphersuite list to \"" + ciphersuites + "\" " + lasterr);
+ }
+#else
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "You have configured <sslprofile:ciphersuites> but your version of OpenSSL does not support TLSv1.3+");
+#endif
+ }
+
#ifndef OPENSSL_NO_ECDH
const std::string curvename = tag->getString("ecdhcurve", "prime256v1", 1);
if (!curvename.empty())