| 1 |
stephdl |
1.1 |
diff -Nur qpsmtpd-0.84/plugins/tls qpsmtpd-0.84_bz9162/plugins/tls |
| 2 |
|
|
--- qpsmtpd-0.84/plugins/tls 2016-01-07 18:52:04.588735630 +0100 |
| 3 |
|
|
+++ qpsmtpd-0.84_bz9162/plugins/tls 2016-01-07 18:56:14.294727154 +0100 |
| 4 |
|
|
@@ -57,6 +57,14 @@ |
| 5 |
|
|
and put a suitable string in config/tls_ciphers (e.g. "DEFAULT" or |
| 6 |
|
|
"HIGH:MEDIUM") |
| 7 |
|
|
|
| 8 |
|
|
+=head1 SSL/TLS protocols versions |
| 9 |
|
|
+ |
| 10 |
|
|
+By default, SSLv2 and SSLv3 are not accepted, leaving only TLSv1, |
| 11 |
|
|
+TLSv1.1 or TLSv1.2 enabled. You can customize this in config/tls_protocols |
| 12 |
|
|
+For example, this will also disabled TLSv1, leaving only TLSv1.1 and TLSv1.2 |
| 13 |
|
|
+ |
| 14 |
|
|
+SSLv23:!SSLv2:!SSLv3:!TLSv1 |
| 15 |
|
|
+ |
| 16 |
|
|
=cut |
| 17 |
|
|
|
| 18 |
|
|
use IO::Socket::SSL 0.98; # qw(debug1 debug2 debug3 debug4); |
| 19 |
|
|
@@ -74,6 +82,7 @@ |
| 20 |
|
|
$self->tls_key($key); |
| 21 |
|
|
$self->tls_ca($ca); |
| 22 |
|
|
$self->tls_ciphers($self->qp->config('tls_ciphers') || 'HIGH'); |
| 23 |
|
|
+ $self->tls_protocols($self->qp->config('tls_protocols') || 'SSLv23:!SSLv2:!SSLv3'); |
| 24 |
|
|
|
| 25 |
|
|
Qpsmtpd->varlog(LOGINFO, "init", "tls", "ciphers: ".$self->tls_ciphers); |
| 26 |
|
|
|
| 27 |
|
|
@@ -84,7 +93,7 @@ |
| 28 |
|
|
SSL_key_file => $self->tls_key, |
| 29 |
|
|
SSL_ca_file => $self->tls_ca, |
| 30 |
|
|
SSL_cipher_list => $self->tls_ciphers, |
| 31 |
|
|
- SSL_version => 'SSLv23:!SSLv2:!SSLv3:!TLSv1', |
| 32 |
|
|
+ SSL_version => $self->tls_protocols, |
| 33 |
|
|
SSL_server => 1 |
| 34 |
|
|
) or die "Could not create SSL context: $!"; |
| 35 |
|
|
# now extract the password... |
| 36 |
|
|
@@ -203,7 +212,7 @@ |
| 37 |
|
|
SSL_key_file => $self->tls_key, |
| 38 |
|
|
SSL_ca_file => $self->tls_ca, |
| 39 |
|
|
SSL_cipher_list => $self->tls_ciphers, |
| 40 |
|
|
- SSL_version => 'SSLv23:!SSLv2:!SSLv3:!TLSv1', |
| 41 |
|
|
+ SSL_version => $self->tls_protocols, |
| 42 |
|
|
SSL_server => 1, |
| 43 |
|
|
SSL_reuse_ctx => $self->ssl_context, |
| 44 |
|
|
) or die "Could not create SSL socket: $!"; |
| 45 |
|
|
@@ -260,6 +269,12 @@ |
| 46 |
|
|
$self->{_tls_ciphers}; |
| 47 |
|
|
} |
| 48 |
|
|
|
| 49 |
|
|
+sub tls_protocols { |
| 50 |
|
|
+ my $self = shift; |
| 51 |
|
|
+ @_ and $self->{_tls_protocols} = shift; |
| 52 |
|
|
+ $self->{_tls_protocols}; |
| 53 |
|
|
+} |
| 54 |
|
|
+ |
| 55 |
|
|
sub ssl_context { |
| 56 |
|
|
my $self = shift; |
| 57 |
|
|
@_ and $self->{_ssl_ctx} = shift; |
Parent Directory
| 
Revision Log
| 
Revision Graph
