Author: gshapiro
Date: Wed Jun 17 02:39:10 2015
New Revision: 284485
URL: https://svnweb.freebsd.org/changeset/base/284485
Log:
MFC: The import of openssl to address the FreeBSD-SA-15:10.openssl security
advisory includes a change which rejects handshakes with DH parameters
below 768 bits. sendmail releases prior to 8.15.2 (not yet released),
defaulted to a 512 bit DH parameter setting for client connections.
This commit chages that default to 1024 bits. sendmail 8.15.2, when
released well use a default of 2048 bits.
Modified:
stable/10/contrib/sendmail/src/tls.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/contrib/sendmail/src/tls.c
==============================================================================
--- stable/10/contrib/sendmail/src/tls.c Wed Jun 17 02:30:12 2015
(r284484)
+++ stable/10/contrib/sendmail/src/tls.c Wed Jun 17 02:39:10 2015
(r284485)
@@ -650,7 +650,7 @@ inittls(ctx, req, options, srv, certfile
** 1024 generate 1024 bit parameters
** 2048 generate 2048 bit parameters
** /file/name read parameters from /file/name
- ** default is: 1024 for server, 512 for client (OK? XXX)
+ ** default is: 1024
*/
if (bitset(TLS_I_TRY_DH, req))
@@ -676,8 +676,8 @@ inittls(ctx, req, options, srv, certfile
}
if (dhparam == NULL)
{
- dhparam = srv ? "1" : "5";
- req |= (srv ? TLS_I_DH1024 : TLS_I_DH512);
+ dhparam = "1";
+ req |= TLS_I_DH1024;
}
else if (*dhparam == '/')
{
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
