diff options
| author |   jsing <jsing@openbsd.org> | 2014-09-29 15:31:38 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2014-09-29 15:31:38 +0000 |
| commit | eea642eeeb93b6d7761be98dd196d4c0434a57a6 (patch) | |
| tree | f2cbdac6d15c434676a33e1b2f5c6eb044f88944 | |
| parent | Add an option that allows the enabled SSL protocols to be explicitly (diff) | |
| download | wireguard-openbsd-eea642eeeb93b6d7761be98dd196d4c0434a57a6.tar.xz wireguard-openbsd-eea642eeeb93b6d7761be98dd196d4c0434a57a6.zip | |
Move cipher configuration handling to the shared SSL configuration function
so that applies to both the ressl client and server.
| -rw-r--r-- | lib/libressl/ressl.c | 13 | ||||
| -rw-r--r-- | lib/libressl/ressl_server.c | 10 |
2 files changed, 13 insertions, 10 deletions
diff --git a/lib/libressl/ressl.c b/lib/libressl/ressl.c index 516afa53d6e..b85fe044155 100644 --- a/lib/libressl/ressl.c +++ b/lib/libressl/ressl.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ressl.c,v 1.15 2014/09/29 15:11:29 jsing Exp $ */ +/* $OpenBSD: ressl.c,v 1.16 2014/09/29 15:31:38 jsing Exp $ */ /* * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> * @@ -182,7 +182,18 @@ ressl_configure_ssl(struct ressl *ctx) if ((ctx->config->protocols & RESSL_PROTOCOL_TLSv1_2) == 0) SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_2); + if (ctx->config->ciphers != NULL) { + if (SSL_CTX_set_cipher_list(ctx->ssl_ctx, + ctx->config->ciphers) != 1) { + ressl_set_error(ctx, "failed to set ciphers"); + goto err; + } + } + return (0); + +err: + return (-1); } void diff --git a/lib/libressl/ressl_server.c b/lib/libressl/ressl_server.c index e2dc7cf0882..33ac8fc33dd 100644 --- a/lib/libressl/ressl_server.c +++ b/lib/libressl/ressl_server.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ressl_server.c,v 1.8 2014/09/29 15:11:29 jsing Exp $ */ +/* $OpenBSD: ressl_server.c,v 1.9 2014/09/29 15:31:38 jsing Exp $ */ /* * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> * @@ -62,14 +62,6 @@ ressl_configure_server(struct ressl *ctx) if (ressl_configure_keypair(ctx) != 0) goto err; - if (ctx->config->ciphers != NULL) { - if (SSL_CTX_set_cipher_list(ctx->ssl_ctx, - ctx->config->ciphers) != 1) { - ressl_set_error(ctx, "failed to set ciphers"); - goto err; - } - } - if (ctx->config->ecdhcurve != NID_undef) { if ((ecdh_key = EC_KEY_new_by_curve_name( ctx->config->ecdhcurve)) == NULL) { |