X-Git-Url: http://git.code-monkey.de/?a=blobdiff_plain;f=src%2Fssli_gnutls.c;h=1f72857fde756ee19b608000bab87538b0c3839b;hb=c72ebd29f239793218f2248c3f8b48a7b3e0a541;hp=3cbb17b3cbbfcd4215bba230106946a81f7fc3df;hpb=98f2360efc379f1bc7d3a012dc702049e4f2a13d;p=umurmur.git

diff --git a/src/ssli_gnutls.c b/src/ssli_gnutls.c
index 3cbb17b..1f72857 100644
--- a/src/ssli_gnutls.c
+++ b/src/ssli_gnutls.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2015, Felix Morgner <felix.morgner@gmail.com>
+/* Copyright (C) 2015-2016, Felix Morgner <felix.morgner@gmail.com>
 
    All rights reserved.
 
@@ -31,13 +31,23 @@
 #include "ssl.h"
 #include "conf.h"
 #include "log.h"
+#include "memory.h"
 
 #include <stdlib.h>
 
 static gnutls_dh_params_t dhParameters;
 static gnutls_certificate_credentials_t certificate;
 
-static const char * ciphers = "NORMAL";
+static const char * ciphers = "NONE:"
+							  "+ECDHE-ECDSA:+ECDHE-RSA:+RSA:"
+							  "+AES-256-GCM:+AES-128-GCM:"
+							  "+AEAD:+SHA384:+SHA256:+SHA1:"
+							  "+CURVE-ALL:"
+							  "+COMP-NULL:"
+							  "+SIGN-ALL:"
+							  "+VERS-TLS1.2:+VERS-TLS1.0:"
+							  "+CTYPE-X509";
+
 static gnutls_priority_t cipherCache;
 
 void initializeCertificate()
@@ -61,26 +71,18 @@ void initializeCertificate()
 	if( error != GNUTLS_E_SUCCESS ) {
 		Log_fatal("Could not open key (%s) or certificate (%s).", keyPath, certificatePath);
 	}
-
 }
 
 void SSLi_init()
 {
-	unsigned const bitCount = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_MEDIUM);
-
-	gnutls_dh_params_init(&dhParameters);
-	gnutls_dh_params_generate2(dhParameters, bitCount);
-
-#if GNUTLS_VERSION_NUMBER < 0x030300
-	gnutls_global_init();
-#endif
-
-	gnutls_priority_init(&cipherCache, ciphers, NULL);
+	if(gnutls_priority_init(&cipherCache, ciphers, NULL) != GNUTLS_E_SUCCESS)
+	{
+		Log_fatal("Failed to set priorities");
+	}
 
 	initializeCertificate();
 
 	Log_info("Sucessfully initialized GNUTLS version %s", gnutls_check_version(NULL));
-
 }
 
 void SSLi_deinit()
@@ -92,7 +94,8 @@ void SSLi_deinit()
 
 SSL_handle_t * SSLi_newconnection( int * fileDescriptor, bool_t * isSSLReady )
 {
-	gnutls_session_t * session = calloc(1, sizeof(gnutls_session_t));
+	gnutls_session_t * session
+		= Memory_safeCalloc(1, sizeof(gnutls_session_t));
 
 	gnutls_init(session, GNUTLS_SERVER);
 	gnutls_priority_set(*session, cipherCache);