diff options
| author | Juraj Somorovsky <[email protected]> | 2016-05-09 00:48:13 +0200 |
|---|---|---|
| committer | Juraj Somorovsky <[email protected]> | 2016-05-11 07:55:02 +0200 |
| commit | 7c7fcecbe6a94ffaba5752175d8da5e33fbf0d7b (patch) | |
| tree | 5ed7b29e5d3441c26b8aa6b5520ab589f9e05377 /src/lib/tls/tls_policy.cpp | |
| parent | 6d327f879c608908ca2c6b9b99f7fd74d498b4ef (diff) | |
Encrypt-then-MAC extension (RFC 7366)
Introduced a countermeasure against the logjam attack
Short TLS records (AES-CBC) now return BAD_RECORD_MAC
Fixed a compatibility problem with OpenSSL and TLS 1.0 (BEAST countermeasure)
Diffstat (limited to 'src/lib/tls/tls_policy.cpp')
| -rw-r--r-- | src/lib/tls/tls_policy.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/lib/tls/tls_policy.cpp b/src/lib/tls/tls_policy.cpp index b98f1106c..fdc6ba862 100644 --- a/src/lib/tls/tls_policy.cpp +++ b/src/lib/tls/tls_policy.cpp @@ -194,6 +194,7 @@ bool Policy::allow_dtls12() const { return true; } bool Policy::include_time_in_hello_random() const { return true; } bool Policy::hide_unknown_users() const { return false; } bool Policy::server_uses_own_ciphersuite_preferences() const { return true; } +bool Policy::negotiate_encrypt_then_mac() const { return true; } // 1 second initial timeout, 60 second max - see RFC 6347 sec 4.2.4.1 size_t Policy::dtls_initial_timeout() const { return 1*1000; } @@ -379,6 +380,7 @@ void Policy::print(std::ostream& o) const print_bool(o, "allow_server_initiated_renegotiation", allow_server_initiated_renegotiation()); print_bool(o, "hide_unknown_users", hide_unknown_users()); print_bool(o, "server_uses_own_ciphersuite_preferences", server_uses_own_ciphersuite_preferences()); + print_bool(o, "negotiate_encrypt_then_mac", negotiate_encrypt_then_mac()); o << "session_ticket_lifetime = " << session_ticket_lifetime() << '\n'; o << "dh_group = " << dh_group() << '\n'; o << "minimum_dh_group_size = " << minimum_dh_group_size() << '\n'; |