Disable old and unsecure ciphers in TLS driver

Disable:
- export ciphers - broken by design, 40 and 56 bit encryption
- low encryption ciphers - 56 and 64 bit encryption
- SSLv2 ciphers - some ciphers using MD5 MAC

diff --git a/src/tls/tls_drv.c b/src/tls/tls_drv.c
index da11b50a43e320585b951d98d5c624649cd3195f..4096a48fbf766cb5b7cd5808faeb48df1c90d006 100644 (file)
--- a/src/tls/tls_drv.c
+++ b/src/tls/tls_drv.c
@@ -44,6 +44,8 @@ typedef unsigned __int32 uint32_t;
 #define SSL_OP_NO_TICKET 0
 #endif
 
+#define CIPHERS "DEFAULT:!EXPORT:!LOW:!SSLv2"
+
 /*
  * R15B changed several driver callbacks to use ErlDrvSizeT and
  * ErlDrvSSizeT typedefs instead of int.
@@ -356,6 +358,8 @@ static ErlDrvSSizeT tls_drv_control(ErlDrvData handle,
 
            SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_TICKET);
 
+           SSL_CTX_set_cipher_list(ctx, CIPHERS);
+
            SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
            SSL_CTX_set_default_verify_paths(ctx);
 #ifdef SSL_MODE_RELEASE_BUFFERS