Support server cipher preference
PATCH 1/1 Support server cipher preference
--- doc/openvpn.8 | 4 ++++ src/openvpn/options.c | 17 +++++++++++++++++ src/openvpn/ssl_common.h | 7 ++++--- src/openvpn/ssl_openssl.c | 6 ++++++ 4 files changed, 31 insertions(+), 3 deletions(-)
doc/openvpn.8 +4 -0
@@ -4889,6 +4889,10 @@ when using PolarSSL or OpenSSL. .\"********************************************************* .TP +.B \-\-tls\-prefer\-server\-cipher +Prefer server ciphers over client ciphers during the TLS handshake. +.\"********************************************************* +.TP .B \-\-tls\-timeout n Packet retransmit timeout on TLS control channel if no acknowledgment from remote within
src/openvpn/options.c +17 -0
@@ -598,6 +598,10 @@ static const char usage_message[] =#endif "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n" " : Use --show-tls to see a list of supported TLS ciphers.\n" +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE + "--tls-prefer-server-ciphers: Prefer server ciphers over client ciphers during\n" + " the TLS handshake.\n" +#endif"--tls-timeout n : Packet retransmit timeout on TLS control channel\n" " if no ACK from remote within n seconds (default=%d).\n" "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
@@ -2445,6 +2449,12 @@ options_postprocess_verify_ce(const struct options *options, const struct connec {msg (M_USAGE ,"--opt-verify requires --mode server" ); } +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE +if (options->ssl_flags &SSLF_PREFER_SERVER_CIPHERS ) + { +msg (M_USAGE ,"--tls-prefer-server-ciphers requires --mode server" ); + } +#endif if (options->server_flags &SF_TCP_NODELAY_HELPER ) { msg(M_WARN, "WARNING: setting tcp-nodelay on the client side will not "
@@ -7814,6 +7824,13 @@ add_option(struct options *options,VERIFY_PERMISSION (OPT_P_GENERAL ); options->cipher_list = p[1 ]; } +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE + else if (streq(p[0], "tls-prefer-server-ciphers") && !p[1]) + { +VERIFY_PERMISSION (OPT_P_GENERAL ); + options->ssl_flags |=SSLF_PREFER_SERVER_CIPHERS ; + } +#endif else if (streq(p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir")) || (p[2] && streq(p[1], INLINE_FILE_TAG) ) || !p[2]) && !p[3]) {
src/openvpn/ssl_common.h +4 -3
@@ -322,10 +322,11 @@ struct tls_options#define SSLF_AUTH_USER_PASS_OPTIONAL (1<<3)#define SSLF_OPT_VERIFY (1<<4)#define SSLF_CRL_VERIFY_DIR (1<<5) -#define SSLF_TLS_VERSION_MIN_SHIFT 6 -#define SSLF_TLS_VERSION_MIN_MASK 0xF/* (uses bit positions 6 to 9) */ +#define SSLF_PREFER_SERVER_CIPHERS (1<<6) +#define SSLF_TLS_VERSION_MIN_SHIFT 8 +#define SSLF_TLS_VERSION_MIN_MASK 0xF/* (uses bit positions 7 to 10) */ #define SSLF_TLS_VERSION_MAX_SHIFT 10 -#define SSLF_TLS_VERSION_MAX_MASK 0xF/* (uses bit positions 10 to 13) */ +#define SSLF_TLS_VERSION_MAX_MASK 0xF/* (uses bit positions 11 to 14) */ unsigned int ssl_flags;#ifdef MANAGEMENT_DEF_AUTH
src/openvpn/ssl_openssl.c +6 -0
@@ -253,6 +253,12 @@ tls_ctx_set_options(struct tls_root_ctx *ctx, unsigned int ssl_flags) sslopt |= SSL_OP_NO_TLSv1_2; }#endif +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE +if (ssl_flags &SSLF_PREFER_SERVER_CIPHERS ) + { + sslopt |=SSL_OP_CIPHER_SERVER_PREFERENCE ; + } +#endif sslopt |=SSL_OP_NO_COMPRESSION ;SSL_CTX_set_options (ctx->ctx, sslopt); }
Signature · 1 line
2.13.3
Hi Szilárd,
Quoted 7 lines · Szilárd Pfeiffer
--- doc/openvpn.8 | 4 ++++ src/openvpn/options.c | 17 +++++++++++++++++ src/openvpn/ssl_common.h | 7 ++++--- src/openvpn/ssl_openssl.c | 6 ++++++ 4 files changed, 31 insertions(+), 3 deletions(-)
how about adding some text in the commit message explaining what the patch is doing and *why* it would be helpful? casual reader not into TLS (like me) may miss the benefit of this changes.
And why making it a compile time option?
Another question: may this option lead the client to an incompatible configuration?
Cheers,
Signature · 1 line
Antonio Quartulli
A message that is not in the archive (sent off-list or not yet received): [email protected]...
(re-adding the ml: please keep it in the CC list)
Quoted 15 lines · Szilárd Pfeiffer
Quoted 11 lines · Antonio Quartulli
Hi Szilárd,
Quoted 7 lines · Szilárd Pfeiffer
--- doc/openvpn.8 | 4 ++++ src/openvpn/options.c | 17 +++++++++++++++++ src/openvpn/ssl_common.h | 7 ++++--- src/openvpn/ssl_openssl.c | 6 ++++++ 4 files changed, 31 insertions(+), 3 deletions(-)Quoted 3 lines
how about adding some text in the commit message explaining what the patch is doing and *why* it would be helpful? casual reader not into TLS (like me) may miss the benefit of this changes.
Quoted 9 lines
The option does what
ssl_prefer_server_ciphersoptions does in NGINX, the SSLHonorCipherOrder option does in Apache, ...http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers
https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhonorcipherorderThe reason explained for example in the following blog post.
Quoted 1 line
why not putting some of this information in the commit message as well?
Quoted 3 lines
Quoted 1 line
And why making it a compile time option?
What do you mean? It can be set from command line.
all your code is surrounded by "#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE", hence I imagined you wanted your code to be included based on a compile time option. However, I don't see where SSL_OP_CIPHER_SERVER_PREFERENCE should be defined? Am I missing something or it was forgotten?
Quoted 4 lines
Quoted 2 lines
Another question: may this option lead the client to an incompatible configuration?
No, it is not. Only the cipher choosen by the server may change if the option is on.
Cheers,
Signature · 1 line
Antonio Quartulli
Quoted 30 lines · Antonio Quartulli
(re-adding the ml: please keep it in the CC list)
Quoted 15 lines · Szilárd Pfeiffer
Quoted 11 lines · Antonio Quartulli
Hi Szilárd,
Quoted 7 lines · Szilárd Pfeiffer
--- doc/openvpn.8 | 4 ++++ src/openvpn/options.c | 17 +++++++++++++++++ src/openvpn/ssl_common.h | 7 ++++--- src/openvpn/ssl_openssl.c | 6 ++++++ 4 files changed, 31 insertions(+), 3 deletions(-)Quoted 3 lines
how about adding some text in the commit message explaining what the patch is doing and *why* it would be helpful? casual reader not into TLS (like me) may miss the benefit of this changes.
Quoted 9 lines
The option does what
ssl_prefer_server_ciphersoptions does in NGINX, the SSLHonorCipherOrder option does in Apache, ...http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers
https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhonorcipherorderThe reason explained for example in the following blog post.
Quoted 1 line
why not putting some of this information in the commit message as well?
Quoted 9 lines
Quoted 3 lines
Quoted 1 line
And why making it a compile time option?
What do you mean? It can be set from command line.
all your code is surrounded by "#ifdef
SSL_OP_CIPHER_SERVER_PREFERENCE", hence I imagined you wanted your code to be included based on a compile time option. However, I don't see whereSSL_OP_CIPHER_SERVER_PREFERENCEshould be defined? Am I missing something or it was forgotten?
Sorry, but I realized just now that this is an OpenSSL specific mechanism and that the define is coming from OpenSSL itself.
This is not my field, so I'll leave the review to somebody else, but still, this should be explained in the commit message,
Cheers,
Signature · 1 line
Antonio Quartulli
Quoted 33 lines · Antonio Quartulli
Quoted 31 lines · Antonio Quartulli
(re-adding the ml: please keep it in the CC list)
Quoted 15 lines · Szilárd Pfeiffer
Quoted 11 lines · Antonio Quartulli
Hi Szilárd,
Quoted 7 lines · Szilárd Pfeiffer
--- doc/openvpn.8 | 4 ++++ src/openvpn/options.c | 17 +++++++++++++++++ src/openvpn/ssl_common.h | 7 ++++--- src/openvpn/ssl_openssl.c | 6 ++++++ 4 files changed, 31 insertions(+), 3 deletions(-)Quoted 3 lines
how about adding some text in the commit message explaining what the patch is doing and *why* it would be helpful? casual reader not into TLS (like me) may miss the benefit of this changes.
Quoted 8 lines
The option does what
ssl_prefer_server_ciphersoptions does in NGINX, the SSLHonorCipherOrder option does in Apache, ...http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers
https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhonorcipherorderThe reason explained for example in the following blog post.
why not putting some of this information in the commit message as well?
Quoted 3 lines
Quoted 1 line
And why making it a compile time option?
What do you mean? It can be set from command line.
Quoted 7 lines
Quoted 5 lines
all your code is surrounded by "#ifdef
SSL_OP_CIPHER_SERVER_PREFERENCE", hence I imagined you wanted your code to be included based on a compile time option. However, I don't see whereSSL_OP_CIPHER_SERVER_PREFERENCEshould be defined? Am I missing something or it was forgotten?Sorry, but I realized just now that this is an OpenSSL specific mechanism and that the define is coming from OpenSSL itself.
You are right. No problem.
Quoted 4 lines
This is not my field, so I'll leave the review to somebody else, but still, this should be explained in the commit message,
OK. I will write it to the commit message.
PATCH v2 1/1 Implement tls-prefer-server-ciphers option to prefer server cipher order
In reply to Antonio QuartulliPrefer server ciphers over client ciphers during the TLS handshake. Part of the ClientHello message client sends supported cipher suites in order of its preference. If tls-prefer-server-ciphers is when server choosing a cipher, use the server's preferences instead of the client preferences.
The functionality is the same as the folowings:
* ssl_prefer_server_ciphers in NGINX
* SSLHonorCipherOrder in Apache
* ...
--- doc/openvpn.8 | 4 ++++ src/openvpn/options.c | 17 +++++++++++++++++ src/openvpn/ssl_common.h | 7 ++++--- src/openvpn/ssl_openssl.c | 6 ++++++ 4 files changed, 31 insertions(+), 3 deletions(-)
doc/openvpn.8 +4 -0
@@ -4889,6 +4889,10 @@ when using PolarSSL or OpenSSL. .\"********************************************************* .TP +.B \-\-tls\-prefer\-server\-cipher +Prefer server ciphers over client ciphers during the TLS handshake. +.\"********************************************************* +.TP .B \-\-tls\-timeout n Packet retransmit timeout on TLS control channel if no acknowledgment from remote within
src/openvpn/options.c +17 -0
@@ -598,6 +598,10 @@ static const char usage_message[] =#endif "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n" " : Use --show-tls to see a list of supported TLS ciphers.\n" +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE + "--tls-prefer-server-ciphers: Prefer server ciphers over client ciphers during\n" + " the TLS handshake.\n" +#endif"--tls-timeout n : Packet retransmit timeout on TLS control channel\n" " if no ACK from remote within n seconds (default=%d).\n" "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
@@ -2445,6 +2449,12 @@ options_postprocess_verify_ce(const struct options *options, const struct connec {msg (M_USAGE ,"--opt-verify requires --mode server" ); } +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE +if (options->ssl_flags &SSLF_PREFER_SERVER_CIPHERS ) + { +msg (M_USAGE ,"--tls-prefer-server-ciphers requires --mode server" ); + } +#endif if (options->server_flags &SF_TCP_NODELAY_HELPER ) { msg(M_WARN, "WARNING: setting tcp-nodelay on the client side will not "
@@ -7814,6 +7824,13 @@ add_option(struct options *options,VERIFY_PERMISSION (OPT_P_GENERAL ); options->cipher_list = p[1 ]; } +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE + else if (streq(p[0], "tls-prefer-server-ciphers") && !p[1]) + { +VERIFY_PERMISSION (OPT_P_GENERAL ); + options->ssl_flags |=SSLF_PREFER_SERVER_CIPHERS ; + } +#endif else if (streq(p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir")) || (p[2] && streq(p[1], INLINE_FILE_TAG) ) || !p[2]) && !p[3]) {
src/openvpn/ssl_common.h +4 -3
@@ -322,10 +322,11 @@ struct tls_options#define SSLF_AUTH_USER_PASS_OPTIONAL (1<<3)#define SSLF_OPT_VERIFY (1<<4)#define SSLF_CRL_VERIFY_DIR (1<<5) -#define SSLF_TLS_VERSION_MIN_SHIFT 6 -#define SSLF_TLS_VERSION_MIN_MASK 0xF/* (uses bit positions 6 to 9) */ +#define SSLF_PREFER_SERVER_CIPHERS (1<<6) +#define SSLF_TLS_VERSION_MIN_SHIFT 8 +#define SSLF_TLS_VERSION_MIN_MASK 0xF/* (uses bit positions 7 to 10) */ #define SSLF_TLS_VERSION_MAX_SHIFT 10 -#define SSLF_TLS_VERSION_MAX_MASK 0xF/* (uses bit positions 10 to 13) */ +#define SSLF_TLS_VERSION_MAX_MASK 0xF/* (uses bit positions 11 to 14) */ unsigned int ssl_flags;#ifdef MANAGEMENT_DEF_AUTH
src/openvpn/ssl_openssl.c +6 -0
@@ -253,6 +253,12 @@ tls_ctx_set_options(struct tls_root_ctx *ctx, unsigned int ssl_flags) sslopt |= SSL_OP_NO_TLSv1_2; }#endif +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE +if (ssl_flags &SSLF_PREFER_SERVER_CIPHERS ) + { + sslopt |=SSL_OP_CIPHER_SERVER_PREFERENCE ; + } +#endif sslopt |=SSL_OP_NO_COMPRESSION ;SSL_CTX_set_options (ctx->ctx, sslopt); }
Signature · 1 line
2.13.3
Re: [Openvpn-devel] [PATCH v2] Implement tls-prefer-server-ciphers option to prefer server cipher order
Hi,
Quoted 10 lines · Szilárd Pfeiffer
Prefer server ciphers over client ciphers during the TLS handshake. Part of the ClientHello message client sends supported cipher suites in order of its preference. If tls-prefer-server-ciphers is when server choosing a cipher, use the server's preferences instead of the client preferences.
The functionality is the same as the folowings:
*
ssl_prefer_server_ciphersin NGINX
* SSLHonorCipherOrder in Apache
* ...
Took me a while to ponder about this one, sorry about that.
You probably know this, but as context for other readers: OpenVPN uses TLS differently than HTTP (nginx/apache) do, because we barely use the TLS record protocol. The reason to prefer client ciphers, is that a client can e.g. prefer a cipher that performs better on the client platform. Think chacha20-poly1305 on ARM chips without AES hardware acceleration. For OpenVPN, this is not really relevant, because the actual performance-relevant crypto is the data channel, which is negotiated (or statically configured) separately from the TLS ciphers.
All in all, I don't think we need an option for this, but can simply always use the server cipher preference. I think it's a safe bet to say that server admins are better at updating their configs than client users are. And if client do want to restrict their ciphers, they should simply evict the ciphers they don't want from their cipher suite.
Since mbed TLS by default already prefers the server-side cipher list, all we would need to do is or in the SSL_OP_CIPHER_SERVER_PREFERENCE flag in the OpenSSL-specific code. That makes the patch a lot simpler *and* we have less option combinations to test and maintain. We can even safely do that without #ifdef guards, because this define is available since OpenSSL 0.9.8, which is the oldest version we support.
-Steffan
Re: [Openvpn-devel] [PATCH v2] Implement tls-prefer-server-ciphers option to prefer server cipher order
Quoted 31 lines · Steffan Karger
Hi,
Quoted 10 lines · Szilárd Pfeiffer
Prefer server ciphers over client ciphers during the TLS handshake. Part of the ClientHello message client sends supported cipher suites in order of its preference. If tls-prefer-server-ciphers is when server choosing a cipher, use the server's preferences instead of the client preferences.
The functionality is the same as the folowings:
*
ssl_prefer_server_ciphersin NGINX
* SSLHonorCipherOrder in Apache
* ...Took me a while to ponder about this one, sorry about that.
You probably know this, but as context for other readers: OpenVPN uses TLS differently than HTTP (nginx/apache) do, because we barely use the TLS record protocol. The reason to prefer client ciphers, is that a client can e.g. prefer a cipher that performs better on the client platform. Think chacha20-poly1305 on ARM chips without AES hardware acceleration. For OpenVPN, this is not really relevant, because the actual performance-relevant crypto is the data channel, which is negotiated (or statically configured) separately from the TLS ciphers.
All in all, I don't think we need an option for this, but can simply always use the server cipher preference. I think it's a safe bet to say that server admins are better at updating their configs than client users are. And if client do want to restrict their ciphers, they should simply evict the ciphers they don't want from their cipher suite.
Quoted 6 lines
Since mbed TLS by default already prefers the server-side cipher list, all we would need to do is or in the
SSL_OP_CIPHER_SERVER_PREFERENCEflag in the OpenSSL-specific code. That makes the patch a lot simpler *and* we have less option combinations to test and maintain. We can even safely do that without #ifdef guards, because this define is available since OpenSSL 0.9.8, which is the oldest version we support.
This corresponds very well with my own conclusion as well; but as I'm not the crypto guru I hoped Steffan would respond in a reasonable time :)
I do like that we make mbed TLS and OpenSSL behave more similar with the SSL_OP_CIPHER_SERVER_PREFERENCE flag.
Regarding OpenSSL 0.9.8 support, that is nice to have - but if we need to move to 1.0.1 in release/2.4, I won't be hard to convince. We've already made that move for git master (future release/2.5). There are some SUSE Linux releases still shipping OpenSSL 0.9.8 (but also provides a 1.0.x package too, iirc).
Signature · 4 lines
kind regards, David Sommerseth OpenVPN Technologies, Inc
PATCH 1/1 OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag
* safe bet to say that server admins are better at updating their configs than client users are and if client do want to restrict their ciphers, they should simply evict the ciphers they don't want from their cipher suite
* mbed TLS and OpenSSL behave more similar with the SSL_OP_CIPHER_SERVER_PREFERENCE flag
--- src/openvpn/ssl_openssl.c | 3 +++ 1 file changed, 3 insertions(+)
src/openvpn/ssl_openssl.c +3 -0
@@ -252,6 +252,9 @@ tls_ctx_set_options(struct tls_root_ctx *ctx, unsigned int ssl_flags) { sslopt |= SSL_OP_NO_TLSv1_2; } +#endif +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE + sslopt |=SSL_OP_CIPHER_SERVER_PREFERENCE ;#endif sslopt |=SSL_OP_NO_COMPRESSION ;SSL_CTX_set_options (ctx->ctx, sslopt);
Signature · 1 line
2.14.1
Re: [Openvpn-devel] [PATCH] OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag
Hi,
Quoted 16 lines · Szilárd Pfeiffer
* safe bet to say that server admins are better at updating their configs than client users are and if client do want to restrict their ciphers, they should simply evict the ciphers they don't want from their cipher suite
* mbed TLS and OpenSSL behave more similar with theSSL_OP_CIPHER_SERVER_PREFERENCEflag--- src/openvpn/ssl_openssl.c | 3 +++ 1 file changed, 3 insertions(+)src/openvpn/ssl_openssl.c +0
-0
src/openvpn/ssl_openssl.c tls_ctx_set_options(struct tls_root_ctx *ctx, unsigned int ssl_flags) · line 260
Quoted 9 lines
src/openvpn/ssl_openssl.c +3
-0@@ -252,6 +252,9 @@ tls_ctx_set_options(struct tls_root_ctx *ctx, unsigned int ssl_flags) { sslopt |= SSL_OP_NO_TLSv1_2; } +#endif +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE + sslopt |=SSL_OP_CIPHER_SERVER_PREFERENCE ;#endif sslopt |=SSL_OP_NO_COMPRESSION ;SSL_CTX_set_options (ctx->ctx, sslopt);
The indent is one space short, but that can be fixed when applying the patch.
Other that that, this looks good. ACK.
-Steffan
PATCH 1/1 OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag
From: Szilárd Pfeiffer <[email protected]...>
* safe bet to say that server admins are better at updating their configs than client users are and if client do want to restrict their ciphers, they should simply evict the ciphers they don't want from their cipher suite
* mbed TLS and OpenSSL behave more similar with the SSL_OP_CIPHER_SERVER_PREFERENCE flag
--- src/openvpn/ssl_openssl.c | 3 +++ 1 file changed, 3 insertions(+)
src/openvpn/ssl_openssl.c +3 -0
@@ -252,6 +252,9 @@ tls_ctx_set_options(struct tls_root_ctx *ctx, unsigned int ssl_flags) { sslopt |= SSL_OP_NO_TLSv1_2; } +#endif +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE + sslopt |=SSL_OP_CIPHER_SERVER_PREFERENCE ;#endif sslopt |=SSL_OP_NO_COMPRESSION ;SSL_CTX_set_options (ctx->ctx, sslopt);
Signature · 1 line
2.14.1
Re: [Openvpn-devel] [PATCH] OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag
Quoted 18 lines · On 04-09-17 10:10, [email protected]... wrote:
From: Szilárd Pfeiffer <[email protected]...>
* safe bet to say that server admins are better at updating their configs than client users are and if client do want to restrict their ciphers, they should simply evict the ciphers they don't want from their cipher suite
* mbed TLS and OpenSSL behave more similar with theSSL_OP_CIPHER_SERVER_PREFERENCEflag--- src/openvpn/ssl_openssl.c | 3 +++ 1 file changed, 3 insertions(+)src/openvpn/ssl_openssl.c +0
-0
src/openvpn/ssl_openssl.c tls_ctx_set_options(struct tls_root_ctx *ctx, unsigned int ssl_flags) · line 260
Quoted 9 lines
src/openvpn/ssl_openssl.c +3
-0@@ -252,6 +252,9 @@ tls_ctx_set_options(struct tls_root_ctx *ctx, unsigned int ssl_flags) { sslopt |= SSL_OP_NO_TLSv1_2; } +#endif +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE + sslopt |=SSL_OP_CIPHER_SERVER_PREFERENCE ;#endif sslopt |=SSL_OP_NO_COMPRESSION ;SSL_CTX_set_options (ctx->ctx, sslopt);
ACK
-Steffan
Re: [Openvpn-devel] [PATCH applied] OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag
In reply to [email protected]...-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Your patch has been applied to the following branches
commit 5fd8e94d311825571931414064e4d13ed808f9b5 (master) commit a4c5c4bba4963ad107d6bf6eb5937a4cde6c1a0c (release/2.4)
Author: Szilárd Pfeiffer Date: Mon Sep 4 10:10:12 2017 +0200
OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag
Signed-off-by: Szilárd Pfeiffer <[email protected]...>
Acked-by: Steffan Karger <[email protected]...>
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg15356.html
Signed-off-by: David Sommerseth <[email protected]...>- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBCgAGBQJZsIGwAAoJEIbPlEyWcf3yszEP/0fmB/zeaW8PYUGFtibr7pWv To4m59Levm/xbMngDHEIfD4vUzWffaw77yNSDjCKow3+eevjox1jtxcRfj8cFV0W rQ+VcuEPerIpkgKewBK36wdjZguEmR74IoLFYQMOyOEK66gxl4+KQoXMeUsSZCmJ 8g5tt43pfQfGdt5xJz4wDwMWSlXmVnEs4E9yhs4OP7HQEGQpnFZVz5oQyEJQAh0L 1URRZitqm4A5ny2mKfbc2k29r56D5gCzHONIhMVYNlLh7tjqCEs6FJEsV6OCI6Bz s8eTdC9/hZwxFzPU+VKQ4hPkWxqSSRI1GDwna4kCtYAUtUbU1YTplN1IohBqoBAA McNVEvRRAXwB9o9dBNhT30E/hepsFhpfbE2slrJwXK1U81gQjxuriJKcjfg1p9I5 NGYbQSgsmp6aUyyS1rjy+hx7MxByvEphJydhWCKRkQkV4Z0gNr6Ah3mzyDnxnTcr VbnSH34nDlT8FBHl3vt7G7GVpcsFWL7Zt75tpBSwxCgZ8bO6LsTsD+cmktwkdpCb gTrSeiA27sDr02I40RHoBgO9wl89U0UUfZc/d+AdQmFE/Pkgj2XfwVAT8ZsqaHZR T4sQQEPw7aa3BZZJlqy1WdYJd3z7+ZToosi151/hYM/HbDo82/sk6QeIhFFAU74C Ye11BnY4kZG1J04RD58s
=bH+Z
-----END PGP SIGNATURE-----