changeset 8b9b9ea9a20d in /home/hg/repos/python-nbxmpp
details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=8b9b9ea9a20d description: [fedor] ephemeral key exchange and enable TLS 1.1 and TLS 1.2 when connecting using client cert authentification. Fixes #8
diffstat:
nbxmpp/tls_nb.py | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-)
diffs (26 lines):
diff -r 6c7a69499a8d -r 8b9b9ea9a20d nbxmpp/tls_nb.py --- a/nbxmpp/tls_nb.py Mon Sep 09 16:56:14 2013 +0200 +++ b/nbxmpp/tls_nb.py Sun Nov 03 13:47:50 2013 +0100 @@ -359,8 +359,11 @@ conn = tcpsock._owner._caller # FIXME make a checkbox for Client Cert / SSLv23 / TLSv1 # If we are going to use a client cert/key pair for authentication, - # we choose TLSv1 method. - tcpsock._sslContext = OpenSSL.SSL.Context(OpenSSL.SSL.TLSv1_METHOD) + # we choose TLSv1* method. + tcpsock._sslContext = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD) + flags = (OpenSSL.SSL.OP_NO_SSLv2 | OpenSSL.SSL.OP_NO_SSLv3 + | OpenSSL.SSL.OP_SINGLE_DH_USE) + tcpsock._sslContext.set_options(flags) log.debug('Using client cert and key from %s' % conn.client_cert) try: p12 = OpenSSL.crypto.load_pkcs12(open(conn.client_cert).read(), @@ -389,7 +392,7 @@ else: # See http://docs.python.org/dev/library/ssl.html tcpsock._sslContext = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD) - flags = OpenSSL.SSL.OP_NO_SSLv2 + flags = OpenSSL.SSL.OP_NO_SSLv2 | OpenSSL.SSL.OP_SINGLE_DH_USE try: flags |= OpenSSL.SSL.OP_NO_TICKET except AttributeError as e: