From: cantor <cantor@de75baf8-a10c-0410-a50a-987c0e22f00f>
Date: Fri, 3 Aug 2007 19:15:14 +0000 (+0000)
Subject: Fix default cipher list, go back to SSLv3 only.
X-Git-Tag: 1.4.1~456
X-Git-Url: http://www.project-moonshot.org/gitweb/?p=shibboleth%2Fxmltooling.git;a=commitdiff_plain;h=17e635225985aa0f7fa7bb51e57b0cbb6e01db4d

Fix default cipher list, go back to SSLv3 only.

git-svn-id: https://svn.middleware.georgetown.edu/cpp-xmltooling/trunk@369 de75baf8-a10c-0410-a50a-987c0e22f00f
---

diff --git a/xmltooling/soap/impl/CURLSOAPTransport.cpp b/xmltooling/soap/impl/CURLSOAPTransport.cpp
index a1acf81..116d196 100644
--- a/xmltooling/soap/impl/CURLSOAPTransport.cpp
+++ b/xmltooling/soap/impl/CURLSOAPTransport.cpp
@@ -293,10 +293,8 @@ CURL* CURLPool::get(const char* to, const char* endpoint)
     curl_easy_setopt(handle,CURLOPT_NOPROGRESS,1);
     curl_easy_setopt(handle,CURLOPT_NOSIGNAL,1);
     curl_easy_setopt(handle,CURLOPT_FAILONERROR,1);
-    // I can't disable v2 without disallowing SSLv3 or TLS,
-    // so I'll rely on the cipher list to disable v2.
-    //curl_easy_setopt(handle,CURLOPT_SSLVERSION,3);
-    curl_easy_setopt(handle,CURLOPT_SSL_CIPHER_LIST,"HIGH:MEDIUM:!SSLv2");
+    curl_easy_setopt(handle,CURLOPT_SSLVERSION,CURL_SSLVERSION_SSLv3);
+    curl_easy_setopt(handle,CURLOPT_SSL_CIPHER_LIST,"ALL:!aNULL:!LOW:!EXPORT:!SSLv2");
     // Verification of the peer is via TrustEngine only.
     curl_easy_setopt(handle,CURLOPT_SSL_VERIFYPEER,0);
     curl_easy_setopt(handle,CURLOPT_HEADERFUNCTION,&curl_header_hook);