[cpp-xmltooling COMMIT] /branches/REL_1/xmltooling/soap/impl/CURLSOAPTransport.cpp

[noreply at shibboleth.net]

Author: scantor
Date: Mon Jan 19 18:44:03 2015
New Revision: 1041

URL: http://svn.shibboleth.net/view/cpp-xmltooling?rev=1041&view=rev
Log:
https://issues.shibboleth.net/jira/browse/CPPXT-101

Modified:
    branches/REL_1/xmltooling/soap/impl/CURLSOAPTransport.cpp

Modified: branches/REL_1/xmltooling/soap/impl/CURLSOAPTransport.cpp
URL: http://svn.shibboleth.net/view/cpp-xmltooling/branches/REL_1/xmltooling/soap/impl/CURLSOAPTransport.cpp?rev=1041&r1=1040&r2=1041&view=diff
==============================================================================
--- branches/REL_1/xmltooling/soap/impl/CURLSOAPTransport.cpp (original)
+++ branches/REL_1/xmltooling/soap/impl/CURLSOAPTransport.cpp Mon Jan 19 18:44:03 2015
@@ -76,7 +76,7 @@
 #ifndef XMLTOOLING_NO_XMLSEC
                     m_cred(nullptr), m_trustEngine(nullptr), m_peerResolver(nullptr), m_mandatory(false),
 #endif
-                    m_openssl_ops(SSL_OP_ALL|SSL_OP_NO_SSLv2), m_ssl_callback(nullptr), m_ssl_userptr(nullptr),
+                    m_openssl_ops(SSL_OP_ALL|SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3), m_ssl_callback(nullptr), m_ssl_userptr(nullptr),
                     m_chunked(true), m_authenticated(false), m_cacheTag(nullptr) {
             m_handle = g_CURLPool->get(addr);
             curl_easy_setopt(m_handle,CURLOPT_URL,addr.m_endpoint);
@@ -315,7 +315,7 @@
     curl_easy_setopt(handle,CURLOPT_FAILONERROR,1);
     // This may (but probably won't) help with < 7.20 bug in DNS caching.
     curl_easy_setopt(handle,CURLOPT_DNS_CACHE_TIMEOUT,120);
-    curl_easy_setopt(handle,CURLOPT_SSL_CIPHER_LIST,"ALL:!aNULL:!LOW:!EXPORT:!SSLv2");
+    curl_easy_setopt(handle,CURLOPT_SSL_CIPHER_LIST,"ALL:!aNULL:!LOW:!EXPORT:!SSLv2:!SSLv3");
     // Verification of the peer is via TrustEngine only.
     curl_easy_setopt(handle,CURLOPT_SSL_VERIFYPEER,0);
     curl_easy_setopt(handle,CURLOPT_CAINFO,nullptr);
@@ -709,9 +709,9 @@
 {
     CURLSOAPTransport* conf = reinterpret_cast<CURLSOAPTransport*>(userptr);
 
-    // Default flags manually disable SSLv2 so we're not dependent on libcurl to do it.
-    // Also disable the ticket option where implemented, since this breaks a variety
-    // of servers. Newer libcurl also does this for us.
+    // Default flags manually disable SSLv2 and SSLv3 so we're not dependent on libcurl
+    // to do it. Also disable the ticket option where implemented, since this breaks a
+    // variety of servers. Newer libcurl also does this for us.
 #ifdef SSL_OP_NO_TICKET
     SSL_CTX_set_options(ssl_ctx, conf->m_openssl_ops|SSL_OP_NO_TICKET);
 #else