|
 |
b902700 |
diff -ruNp curl.orig/lib/nss.c curl/lib/nss.c
|
|
|
b902700 |
--- curl.orig/lib/nss.c 2009-03-04 17:54:28.459240000 +0100
|
|
|
b902700 |
+++ curl/lib/nss.c 2009-03-18 11:38:34.245797020 +0100
|
|
|
b902700 |
@@ -162,6 +162,18 @@ static const cipher_s cipherlist[] = {
|
|
|
b902700 |
#endif
|
|
|
b902700 |
};
|
|
|
b902700 |
|
|
|
b902700 |
+/* following ciphers are new in NSS 3.4 and not enabled by default, therefor
|
|
|
b902700 |
+ they are enabled explicitly */
|
|
|
b902700 |
+static const int enable_ciphers_by_default[] = {
|
|
|
b902700 |
+ TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
|
|
|
b902700 |
+ TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
|
|
|
b902700 |
+ TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
|
|
|
b902700 |
+ TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
|
|
|
b902700 |
+ TLS_RSA_WITH_AES_128_CBC_SHA,
|
|
|
b902700 |
+ TLS_RSA_WITH_AES_256_CBC_SHA,
|
|
|
b902700 |
+ SSL_NULL_WITH_NULL_NULL
|
|
|
b902700 |
+};
|
|
|
b902700 |
+
|
|
|
b902700 |
#ifdef HAVE_PK11_CREATEGENERICOBJECT
|
|
|
b902700 |
static const char* pem_library = "libnsspem.so";
|
|
|
b902700 |
#endif
|
|
|
b902700 |
@@ -954,6 +966,7 @@ CURLcode Curl_nss_connect(struct connect
|
|
|
b902700 |
#endif
|
|
|
b902700 |
char *certDir = NULL;
|
|
|
b902700 |
int curlerr;
|
|
|
b902700 |
+ const int *cipher_to_enable;
|
|
|
b902700 |
|
|
|
b902700 |
curlerr = CURLE_SSL_CONNECT_ERROR;
|
|
|
b902700 |
|
|
|
b902700 |
@@ -1057,6 +1070,16 @@ CURLcode Curl_nss_connect(struct connect
|
|
|
b902700 |
if(SSL_OptionSet(model, SSL_V2_COMPATIBLE_HELLO, ssl2) != SECSuccess)
|
|
|
b902700 |
goto error;
|
|
|
b902700 |
|
|
|
b902700 |
+ /* enable all ciphers from enable_ciphers_by_default */
|
|
|
b902700 |
+ cipher_to_enable = enable_ciphers_by_default;
|
|
|
b902700 |
+ while (SSL_NULL_WITH_NULL_NULL != *cipher_to_enable) {
|
|
|
b902700 |
+ if (SSL_CipherPrefSet(model, *cipher_to_enable, PR_TRUE) != SECSuccess) {
|
|
|
b902700 |
+ curlerr = CURLE_SSL_CIPHER;
|
|
|
b902700 |
+ goto error;
|
|
|
b902700 |
+ }
|
|
|
b902700 |
+ cipher_to_enable++;
|
|
|
b902700 |
+ }
|
|
|
b902700 |
+
|
|
|
b902700 |
if(data->set.ssl.cipher_list) {
|
|
|
b902700 |
if(set_ciphers(data, model, data->set.ssl.cipher_list) != SECSuccess) {
|
|
|
b902700 |
curlerr = CURLE_SSL_CIPHER;
|