generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Don't build RC4 ciphersuites into libssl by default

Browse Source 
RC4 based ciphersuites in libssl have been disabled by default. They can
be added back by building OpenSSL with the "enable-weak-ssl-ciphers"
Configure option at compile time.

Reviewed-by: Rich Salz <rsalz@openssl.org>
This commit is contained in:
Matt Caswell
2016-03-03 15:40:51 +00:00
parent f04abe7d50
commit 8b1a5af389
4 changed files with 43 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
ssl/s3_lib.c
View File

@@ -195,6 +195,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
},
/* Cipher 04 */
#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
{
1,
SSL3_TXT_RSA_RC4_128_MD5,
@@ -225,6 +226,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
128,
128,
},
#endif
/* Cipher 07 */
#ifndef OPENSSL_NO_IDEA
@@ -293,6 +295,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
},
/* Cipher 18 */
#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
{
1,
SSL3_TXT_ADH_RC4_128_MD5,
@@ -307,6 +310,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
128,
128,
},
#endif
/* Cipher 1B */
{
@@ -813,6 +817,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
#ifndef OPENSSL_NO_PSK
/* PSK ciphersuites from RFC 4279 */
/* Cipher 8A */
#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
{
1,
TLS1_TXT_PSK_WITH_RC4_128_SHA,
@@ -827,6 +832,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
128,
128,
},
#endif
/* Cipher 8B */
{
@@ -877,6 +883,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
},
/* Cipher 8E */
#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
{
1,
TLS1_TXT_DHE_PSK_WITH_RC4_128_SHA,
@@ -891,6 +898,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
128,
128,
},
#endif
/* Cipher 8F */
{
@@ -941,6 +949,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
},
/* Cipher 92 */
#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
{
1,
TLS1_TXT_RSA_PSK_WITH_RC4_128_SHA,
@@ -955,6 +964,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
128,
128,
},
#endif
/* Cipher 93 */
{
@@ -1646,6 +1656,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
},
/* Cipher C007 */
#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
{
1,
TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
@@ -1660,6 +1671,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
128,
128,
},
#endif
/* Cipher C008 */
{
@@ -1726,6 +1738,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
},
/* Cipher C011 */
#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
{
1,
TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
@@ -1740,6 +1753,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
128,
128,
},
#endif
/* Cipher C012 */
{
@@ -1806,6 +1820,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
},
/* Cipher C016 */
#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
{
1,
TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
@@ -1820,6 +1835,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
128,
128,
},
#endif
/* Cipher C017 */
{
@@ -2152,6 +2168,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
/* PSK ciphersuites from RFC 5489 */
/* Cipher C033 */
#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
{
1,
TLS1_TXT_ECDHE_PSK_WITH_RC4_128_SHA,
@@ -2166,6 +2183,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
128,
128,
},
#endif
/* Cipher C034 */
{