aniani/icecast-server
1
0
Fork 0
mirror of https://gitlab.xiph.org/xiph/icecast-server.git synced 2024-12-04 14:46:30 -05:00
Code

Update: Require at least OpenSSL 1.1.0 and TLS 1.2

Browse Source 
See: #2432
This commit is contained in:
Philipp Schafft 2022-03-20 17:29:58 +00:00
parent 7053afb8d4
commit 6f16abf1df
2 changed files with 2 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
configure.ac
View File

@ -210,7 +210,7 @@ PKG_HAVE_WITH_MODULES([CURL], [libcurl], [
dnl dnl
dnl openssl dnl openssl
dnl dnl
PKG_HAVE_WITH_MODULES([OPENSSL], [openssl], [ PKG_HAVE_WITH_MODULES([OPENSSL], [openssl >= 1.1.0], [
CFLAGS="${CFLAGS} ${OPENSSL_CFLAGS}" CFLAGS="${CFLAGS} ${OPENSSL_CFLAGS}"
LIBS="${LIBS} ${OPENSSL_LIBS}" LIBS="${LIBS} ${OPENSSL_LIBS}"
]) ])

14
src/tls.c
View File

@ -56,17 +56,10 @@ struct tls_tag {
void tls_initialize(void) void tls_initialize(void)
{ {
#if OPENSSL_VERSION_NUMBER < 0x10100000L
SSL_load_error_strings(); /* readable error messages */
SSL_library_init(); /* initialize library */
#endif
} }
void tls_shutdown(void) void tls_shutdown(void)
{ {
#if OPENSSL_VERSION_NUMBER < 0x10100000L
ERR_free_strings();
#endif
} }
tls_ctx_t *tls_ctx_new(const char *cert_file, const char *key_file, const char *cipher_list) tls_ctx_t *tls_ctx_new(const char *cert_file, const char *key_file, const char *cipher_list)
@ -83,13 +76,8 @@ tls_ctx_t *tls_ctx_new(const char *cert_file, const char *key_file, const char *
ctx->refc = 1; ctx->refc = 1;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
ctx->ctx = SSL_CTX_new(SSLv23_server_method());
ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3; // Disable SSLv2 and SSLv3
#else
ctx->ctx = SSL_CTX_new(TLS_server_method()); ctx->ctx = SSL_CTX_new(TLS_server_method());
SSL_CTX_set_min_proto_version(ctx->ctx, TLS1_VERSION); SSL_CTX_set_min_proto_version(ctx->ctx, TLS1_2_VERSION);
#endif
#ifdef SSL_OP_NO_COMPRESSION #ifdef SSL_OP_NO_COMPRESSION
ssl_opts |= SSL_OP_NO_COMPRESSION; // Never use compression ssl_opts |= SSL_OP_NO_COMPRESSION; // Never use compression