denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls: Support a maximum TLS version to negotiate using TLS socket abstraction

Browse Source
This commit is contained in:
Martin Willi
2014-04-01 14:28:55 +02:00
parent 5313880261
commit e15f64cc81
6 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/tls_test.c
+2 -2
View File
@@ -105,7 +105,7 @@ static int run_client(host_t *host, identification_t *server,
close(fd); close(fd);
return 1; return 1;
} }
tls = tls_socket_create(FALSE, server, client, fd, cache, TRUE); tls = tls_socket_create(FALSE, server, client, fd, cache, TLS_1_2, TRUE);
if (!tls) if (!tls)
{ {
close(fd); close(fd);
@@ -162,7 +162,7 @@ static int serve(host_t *host, identification_t *server,
} }
DBG1(DBG_TLS, "%#H connected", host); DBG1(DBG_TLS, "%#H connected", host);
tls = tls_socket_create(TRUE, server, NULL, cfd, cache, TRUE); tls = tls_socket_create(TRUE, server, NULL, cfd, cache, TLS_1_2, TRUE);
if (!tls) if (!tls)
{ {
close(fd); close(fd);
src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c
+1 -1
View File
@@ -877,7 +877,7 @@ static bool soap_init(private_tnc_ifmap_soap_t *this)
/* open TLS socket */ /* open TLS socket */
this->tls = tls_socket_create(FALSE, server_id, client_id, this->fd, this->tls = tls_socket_create(FALSE, server_id, client_id, this->fd,
NULL, FALSE); NULL, TLS_1_2, FALSE);
if (!this->tls) if (!this->tls)
{ {
DBG1(DBG_TNC, "creating TLS socket failed"); DBG1(DBG_TNC, "creating TLS socket failed");
src/libpttls/pt_tls_client.c
+1 -1
View File
@@ -85,7 +85,7 @@ static bool make_connection(private_pt_tls_client_t *this)
} }
this->tls = tls_socket_create(FALSE, this->server, this->client, fd, this->tls = tls_socket_create(FALSE, this->server, this->client, fd,
NULL, FALSE); NULL, TLS_1_2, FALSE);
if (!this->tls) if (!this->tls)
{ {
close(fd); close(fd);
src/libpttls/pt_tls_server.c
+1 -1
View File
@@ -532,7 +532,7 @@ pt_tls_server_t *pt_tls_server_create(identification_t *server, int fd,
.destroy = _destroy, .destroy = _destroy,
}, },
.state = PT_TLS_SERVER_VERSION, .state = PT_TLS_SERVER_VERSION,
.tls = tls_socket_create(TRUE, server, NULL, fd, NULL, FALSE), .tls = tls_socket_create(TRUE, server, NULL, fd, NULL, TLS_1_2, FALSE),
.tnccs = (tls_t*)tnccs, .tnccs = (tls_t*)tnccs,
.auth = auth, .auth = auth,
); );
src/libtls/tls_socket.c
+2 -1
View File
@@ -407,7 +407,7 @@ METHOD(tls_socket_t, destroy, void,
*/ */
tls_socket_t *tls_socket_create(bool is_server, identification_t *server, tls_socket_t *tls_socket_create(bool is_server, identification_t *server,
identification_t *peer, int fd, tls_cache_t *cache, identification_t *peer, int fd, tls_cache_t *cache,
bool nullok) tls_version_t max_version, bool nullok)
{ {
private_tls_socket_t *this; private_tls_socket_t *this;
tls_purpose_t purpose; tls_purpose_t purpose;
@@ -448,6 +448,7 @@ tls_socket_t *tls_socket_create(bool is_server, identification_t *server,
free(this); free(this);
return NULL; return NULL;
} }
this->tls->set_version(this->tls, max_version);
return &this->public; return &this->public;
} }
src/libtls/tls_socket.h
+2 -1
View File
@@ -104,11 +104,12 @@ struct tls_socket_t {
* @param peer client identity, NULL for no client authentication * @param peer client identity, NULL for no client authentication
* @param fd socket to read/write from * @param fd socket to read/write from
* @param cache session cache to use, or NULL * @param cache session cache to use, or NULL
* @param max_version maximun TLS version to negotiate
* @param nullok accept NULL encryption ciphers * @param nullok accept NULL encryption ciphers
* @return TLS socket wrapper * @return TLS socket wrapper
*/ */
tls_socket_t *tls_socket_create(bool is_server, identification_t *server, tls_socket_t *tls_socket_create(bool is_server, identification_t *server,
identification_t *peer, int fd, tls_cache_t *cache, identification_t *peer, int fd, tls_cache_t *cache,
bool nullok); tls_version_t max_version, bool nullok);
#endif /** TLS_SOCKET_H_ @}*/ #endif /** TLS_SOCKET_H_ @}*/