GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 16:57:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

Do not enforce safe negotiation on the main TLS channel.

Browse Source 
This is only set when in CISCO compatibility mode, as CISCO clients
come from the past.
This commit is contained in:
Nikos Mavrogiannopoulos
2014-02-14 21:34:02 +01:00
parent 452ff7973a
commit dd3bd9dcdd
1 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/tlslib.c
View File

@@ -545,11 +545,17 @@ struct key_cb_data * cdata;
return 0; return 0;
} }
/* Allow clients to rehandshake even if they don't support safe
* renegotiation */
#define ADDITIONAL_FLAGS ":%UNSAFE_RENEGOTIATION"
/* reload key files etc. */ /* reload key files etc. */
void tls_global_init_certs(main_server_st* s) void tls_global_init_certs(main_server_st* s)
{ {
int ret; int ret;
const char* perr; const char* perr;
char *tmp;
unsigned len;
if (s->config->tls_debug) { if (s->config->tls_debug) {
gnutls_global_set_log_function(tls_log_func); gnutls_global_set_log_function(tls_log_func);
@@ -608,11 +614,27 @@ const char* perr;
verify_certificate_cb); verify_certificate_cb);
} }
ret = gnutls_priority_init(&s->creds.cprio, s->config->priorities, &perr); if (s->config->cisco_client_compat) {
len = strlen(s->config->priorities);
tmp = malloc(len+sizeof(ADDITIONAL_FLAGS));
if (tmp == NULL) {
mslog(s, NULL, LOG_ERR, "memory error");
exit(1);
}
memcpy(tmp, s->config->priorities, len);
memcpy(&tmp[len], ADDITIONAL_FLAGS, sizeof(ADDITIONAL_FLAGS)); /* includes terminating zero */
} else {
tmp = strdup(s->config->priorities);
}
ret = gnutls_priority_init(&s->creds.cprio, tmp, &perr);
if (ret == GNUTLS_E_PARSING_ERROR) if (ret == GNUTLS_E_PARSING_ERROR)
mslog(s, NULL, LOG_ERR, "error in TLS priority string: %s", perr); mslog(s, NULL, LOG_ERR, "error in TLS priority string: %s", perr);
GNUTLS_FATAL_ERR(ret); GNUTLS_FATAL_ERR(ret);
free(tmp);
if (s->config->ocsp_response != NULL) { if (s->config->ocsp_response != NULL) {
ret = gnutls_certificate_set_ocsp_status_request_file(s->creds.xcred, ret = gnutls_certificate_set_ocsp_status_request_file(s->creds.xcred,
s->config->ocsp_response, 0); s->config->ocsp_response, 0);