d0kuhn/mosquitto
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Set SSL_OP_SINGLE_DH_USE to protect against weak dhparam primes.

Browse Source
This commit is contained in:
Roger A. Light 2020-12-01 10:55:00 +00:00
parent b7e6638fd8
commit c2f62f03aa
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/net.c
View File

@ -345,6 +345,11 @@ int net__tls_server_ctx(struct mosquitto__listener *listener)
log__printf(NULL, MOSQ_LOG_ERR, "Error: Unsupported tls_version \"%s\".", listener->tls_version);
return MOSQ_ERR_TLS;
}
/* Use a new key when using temporary/ephemeral DH parameters.
* This shouldn't be necessary, but we can't guarantee that `dhparam` has
* been generated using strong primes.
*/
SSL_CTX_set_options(listener->ssl_ctx, SSL_OP_SINGLE_DH_USE);
#ifdef SSL_OP_NO_COMPRESSION
/* Disable compression */