diff options
| author | Vladislav Grishenko <themiron@mail.ru> | 2018-06-05 21:48:55 +0500 |
|---|---|---|
| committer | Vladislav Grishenko <themiron@mail.ru> | 2018-06-05 22:42:49 +0500 |
| commit | 9dd52874d21025adc27fa6e0fedebbb805d8c398 (patch) | |
| tree | 01aa1d5496573852c3e99f5a4809f18376c9b553 /accel-pppd | |
| parent | cd576ac7a628c5e5036b504f53435f1013a9f824 (diff) | |
| download | accel-ppp-9dd52874d21025adc27fa6e0fedebbb805d8c398.tar.gz accel-ppp-9dd52874d21025adc27fa6e0fedebbb805d8c398.zip | |
sstp: add ssl-dhparam option for DHE ciphers
Diffstat (limited to 'accel-pppd')
| -rw-r--r-- | accel-pppd/accel-ppp.conf | 1 | ||||
| -rw-r--r-- | accel-pppd/accel-ppp.conf.5 | 3 | ||||
| -rw-r--r-- | accel-pppd/ctrl/sstp/sstp.c | 24 |
3 files changed, 28 insertions, 0 deletions
diff --git a/accel-pppd/accel-ppp.conf b/accel-pppd/accel-ppp.conf index 1d38ea15..3d097f59 100644 --- a/accel-pppd/accel-ppp.conf +++ b/accel-pppd/accel-ppp.conf @@ -112,6 +112,7 @@ verbose=1 #cert-hash-sha1= #cert-hash-sha256= #accept=ssl,proxy +#ssl-dhparam=/etc/ssl/dhparam.pem #ssl-ciphers=DEFAULT #ssl-prefer-server-ciphers=0 #ssl-ca-file=/etc/ssl/sstp-ca.crt diff --git a/accel-pppd/accel-ppp.conf.5 b/accel-pppd/accel-ppp.conf.5 index 4c1bee76..7439de19 100644 --- a/accel-pppd/accel-ppp.conf.5 +++ b/accel-pppd/accel-ppp.conf.5 @@ -681,6 +681,9 @@ Specifies incoming connection acceptance mode. .B proxy - enable PROXY protocol 1 & 2 support. .TP +.BI "ssl-dhparam=" pemfile +Specifies a file with DH parameters for DHE ciphers. +.TP .BI "ssl-ciphers=" string Specifies the enabled ciphers. The ciphers are specified in the format understood by the OpenSSL library. .TP diff --git a/accel-pppd/ctrl/sstp/sstp.c b/accel-pppd/ctrl/sstp/sstp.c index 2fc26623..aadf746a 100644 --- a/accel-pppd/ctrl/sstp/sstp.c +++ b/accel-pppd/ctrl/sstp/sstp.c @@ -2368,6 +2368,9 @@ static void ssl_load_config(struct sstp_serv_t *serv, const char *servername) #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS | #endif +#ifndef OPENSSL_NO_DH + SSL_OP_SINGLE_DH_USE | +#endif SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION); @@ -2376,6 +2379,27 @@ static void ssl_load_config(struct sstp_serv_t *serv, const char *servername) SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER); SSL_CTX_set_read_ahead(ssl_ctx, 1); +#ifndef OPENSSL_NO_DH + opt = conf_get_opt("sstp", "ssl-dhparam"); + if (opt) { + DH *dh; + + if (BIO_read_filename(in, opt) <= 0) { + log_error("sstp: SSL dhparam error: %s\n", ERR_error_string(ERR_get_error(), NULL)); + goto error; + } + + dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL); + if (dh == NULL) { + log_error("sstp: SSL dhparam error: %s\n", ERR_error_string(ERR_get_error(), NULL)); + goto error; + } + + SSL_CTX_set_tmp_dh(ssl_ctx, dh); + DH_free(dh); + } +#endif + opt = conf_get_opt("sstp", "ssl-ciphers"); if (opt && SSL_CTX_set_cipher_list(ssl_ctx, opt) != 1) { log_error("sstp: SSL cipher list error: %s\n", ERR_error_string(ERR_get_error(), NULL)); |