switched to TLS 1.2 and DHE-RSA-CAMELLIA256-SHA. DH parameters file is created on first start

git-svn-id: svn://localhost/project_picapica/trunk@273 fb96df88-216d-11de-830c-f3023f12d8ac

1 files changed, 30 insertions, 2 deletions

diff --git a/PICA_client.c b/PICA_client.c
index 40d708e..c11e244 100755
--- a/PICA_client.c
+++ b/PICA_client.c
@@ -2,7 +2,7 @@
 #include "PICA_proto.h"
 #include "PICA_msgproc.h"
 #include "PICA_common.h"
-
+#include <openssl/dh.h>
 //#ifdef NO_RAND_DEV
 //#include "PICA_rand_seed.h"
 //#endif
@@ -721,12 +721,16 @@ int PICA_new_connection(const char *nodeaddr,
                         const char *CA_file,
                         const char *cert_file,
                         const char *pkey_file,
+                        const char *dh_param_file,
                         int (*password_cb)(char *buf, int size, int rwflag, void *userdata),
                         struct PICA_conninfo **ci)
 {
 int ret,ret_err;
 struct PICA_conninfo *cid;
 struct sockaddr_in a;
+DH *dh = NULL;
+FILE *dh_file = NULL;
+
 
 if (!(nodeaddr && CA_file && cert_file && pkey_file && ci))
 	return PICA_ERRINVARG;
@@ -743,7 +747,7 @@ if (!cid->read_buf)
     goto error_ret_1;
     }
 
-cid->ctx=SSL_CTX_new(TLSv1_method());//(3)
+cid->ctx=SSL_CTX_new(TLSv1_2_method());//(3)
 
 if (!cid->ctx)
 	{
@@ -751,6 +755,22 @@ if (!cid->ctx)
     goto error_ret_2;
 	}
 
+dh_file = fopen(dh_param_file, "r");
+
+if (dh_file)
+    {
+    dh = PEM_read_DHparams(dh_file, NULL, NULL, NULL);
+    fclose(dh_file);
+    }
+
+if (1 != SSL_CTX_set_tmp_dh(cid->ctx, dh))
+{
+    ret_err = PICA_ERRSSL;
+    goto error_ret_2;
+}
+
+DH_free (dh);
+
 if (!PICA_get_id_from_cert_file(cert_file, cid->id))
     {
     ret_err=PICA_ERRINVCERT;
@@ -781,6 +801,14 @@ ret=SSL_CTX_load_verify_locations(cid->ctx,CA_file,0/*"trustedCA/"*/);
 //printf("loadverifylocations ret=%i\n",ret);//debug
 SSL_CTX_set_client_CA_list(cid->ctx,SSL_load_client_CA_file(CA_file));
 
+ret = SSL_CTX_set_cipher_list(cid->ctx,"DHE-RSA-CAMELLIA256-SHA"/*:DHE-RSA-AES256-SHA256"*/);
+
+if (ret != 1)
+{
+    ret_err = PICA_ERRSSL;
+    goto error_ret_2;
+}
+
 
 cid->ssl_comm=SSL_new(cid->ctx);//(4)