changeset 93e04118f0c9 in /home/hg/repos/python-nbxmpp
details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=93e04118f0c9 description: [fedor] ephemeral key exchange and enable TLS 1.1 and TLS 1.2 when connecting using client cert authentification. Fixes #8
diffstat:
nbxmpp/tls_nb.py | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-)
diffs (26 lines):
diff -r cabaea232b6e -r 93e04118f0c9 nbxmpp/tls_nb.py --- a/nbxmpp/tls_nb.py Mon Sep 09 16:56:14 2013 +0200 +++ b/nbxmpp/tls_nb.py Sun Nov 03 13:47:50 2013 +0100 @@ -355,8 +355,11 @@ conn = tcpsock._owner._caller # FIXME make a checkbox for Client Cert / SSLv23 / TLSv1 # If we are going to use a client cert/key pair for authentication, - # we choose TLSv1 method. - tcpsock._sslContext = OpenSSL.SSL.Context(OpenSSL.SSL.TLSv1_METHOD) + # we choose TLSv1* method. + tcpsock._sslContext = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD) + flags = (OpenSSL.SSL.OP_NO_SSLv2 | OpenSSL.SSL.OP_NO_SSLv3 + | OpenSSL.SSL.OP_SINGLE_DH_USE) + tcpsock._sslContext.set_options(flags) log.debug('Using client cert and key from %s' % conn.client_cert) try: p12 = OpenSSL.crypto.load_pkcs12(open(conn.client_cert).read(), @@ -385,7 +388,7 @@ else: # See http://docs.python.org/dev/library/ssl.html tcpsock._sslContext = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD) - flags = OpenSSL.SSL.OP_NO_SSLv2 + flags = OpenSSL.SSL.OP_NO_SSLv2 | OpenSSL.SSL.OP_SINGLE_DH_USE try: flags |= OpenSSL.SSL.OP_NO_TICKET except AttributeError, e: