diff options
| author | Andreas Schneider <asn@samba.org> | 2020-06-15 11:50:16 +0200 |
|---|---|---|
| committer | Andreas Schneider <asn@cryptomilk.org> | 2020-06-17 17:42:02 +0000 |
| commit | 53e3a959b958a3b099df6ecc5f6e294e96bd948e (patch) | |
| tree | 63e0cbc0729147a8a868c714f6ea9782628c6f6c /lib | |
| parent | 3d1b6ddcd0a1cee2eaeed5cc8bb38a8e8cdc1891 (diff) | |
| download | samba-53e3a959b958a3b099df6ecc5f6e294e96bd948e.tar.gz | |
s3:lib:tls: Use better priority lists for modern GnuTLS
We should use the default priority list. That is a good practice,
because TLS protocol hardening and phasing out of legacy algorithms,
is easier to co-ordinate when happens at a single place. See crypto
policies of Fedora.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14408
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jun 17 17:42:02 UTC 2020 on sn-devel-184
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/param/loadparm.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c index d00ed9dca43..53eedeb0cb2 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -2818,7 +2818,15 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) lpcfg_do_global_parameter(lp_ctx, "tls keyfile", "tls/key.pem"); lpcfg_do_global_parameter(lp_ctx, "tls certfile", "tls/cert.pem"); lpcfg_do_global_parameter(lp_ctx, "tls cafile", "tls/ca.pem"); - lpcfg_do_global_parameter(lp_ctx, "tls priority", "NORMAL:-VERS-SSL3.0"); +#ifdef HAVE_GNUTLS_SET_DEFAULT_PRIORITY_APPEND + lpcfg_do_global_parameter(lp_ctx, + "tls priority", + "@SAMBA,SYSTEM,NORMAL:!-VERS-SSL3.0"); +#else + lpcfg_do_global_parameter(lp_ctx, + "tls priority", + "NORMAL:-VERS-SSL3.0"); +#endif lpcfg_do_global_parameter(lp_ctx, "nsupdate command", "/usr/bin/nsupdate -g"); |