Skip to content

Commit 249c0f8

Browse files
author
Yorhel
committed
Disable RC4 ciphers by default from tls_priority
I can't say I'm a huge fan of referencing specific ciphers and features in the default tls_priority setting for two reasons: 1. If the particular feature isn't supported by the GnuTLS version being used, it will cause GnuTLS to return with an error during connect and all TLS activity will fail. 2. I am not an authority in figuring out which ciphers are "secure enough", nor do I have any clue as to which settings may cause issues with compatibility. GnuTLS has a "NORMAL" setting for a reason. As for (1), I think it's safe to assume every GnuTLS library has support for RC4, considering its wide-spread use. Though if RC4 is ever removed, ncdc will break. For (2), it's unfortunate that the "NORMAL" setting doesn't exclude RC4 already. Likely for compatibility reasons in the context of HTTPS. All DC clients and hubs ought to support better ciphers so it shouldn't be an issue for us to exclude it. Fixes bug #73: http://dev.yorhel.nl/ncdc/bug/73
1 parent 55616ac commit 249c0f8

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

src/vars.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -990,7 +990,7 @@ struct var_t {
990990
V(slots, 1,0, f_int, p_int_ge1, NULL, NULL, s_hubinfo, "10")\
991991
V(sudp_policy, 1,0, f_sudp_policy, p_sudp_policy, su_sudp_policy,g_sudp_policy,s_sudp_policy, G_STRINGIFY(VAR_SUDPP_PREFER))\
992992
V(tls_policy, 1,1, f_tls_policy, p_tls_policy, su_tls_policy, g_tls_policy, s_tls_policy, G_STRINGIFY(VAR_TLSP_PREFER))\
993-
V(tls_priority, 1,0, f_id, p_tls_priority, su_old, NULL, NULL, "NORMAL")\
993+
V(tls_priority, 1,0, f_id, p_tls_priority, su_old, NULL, NULL, "NORMAL:-ARCFOUR-40:-ARCFOUR-128")\
994994
V(ui_time_format, 1,0, f_id, p_id, su_old, NULL, NULL, "[%H:%M:%S]")\
995995
V(upload_rate, 1,0, f_speed, p_speed, NULL, NULL, NULL, NULL)
996996

0 commit comments

Comments
 (0)