enabled TLSv1.1 and TLSv1.2 for STARTTLS.

git-svn-id: svn://sylpheed.sraoss.jp/sylpheed/trunk@3502 ee746299-78ed-0310-b773-934348b2243d

3 files changed, 16 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index 848e5366..d7800bb6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2015-12-21
+
+	* libsylph/ssl.c: ssl_init(): enabled TLSv1.1 and TLSv1.2 for
+	  STARTTLS when OpenSSL 1.0.1 or later was used.
+
 2015-12-08
 
 	* src/subscribedialog.c
diff --git a/NEWS b/NEWS
index 9371cb88..f49d9f72 100644
--- a/NEWS
+++ b/NEWS
@@ -3,10 +3,14 @@ Changes of Sylpheed
 * 3.5.0 (stable)
 
     * A fix for ARM architecture was made.
+    * TLSv1.1 and TLSv1.2 will be enabled for STARTTLS when OpenSSL 1.0.1 or
+      above is used.
     * Some bugfixes and stability improvements were made.
     * Win32: more fix for the crash when linked with newer MSVCRT was made.
     * Win32: irresponsibe text entries on the first display of the filter
       edit dialog were fixed.
+    * Win32: libpng was updated to 1.4.18.
+    * Win32: OpenSSL was updated to v0.9.8zh.
 
 * 3.5.0beta3 (development)
 
diff --git a/libsylph/ssl.c b/libsylph/ssl.c
index 4763a741..6ab2fba2 100644
--- a/libsylph/ssl.c
+++ b/libsylph/ssl.c
@@ -137,11 +137,15 @@ void ssl_init(void)
 			g_warning("SSLv23 SSL_CTX_load_verify_locations failed.\n");
 	}
 
-	ssl_ctx_TLSv1 = SSL_CTX_new(TLSv1_client_method());
+	/* ssl_ctx_TLSv1 = SSL_CTX_new(TLSv1_client_method()); */
+	ssl_ctx_TLSv1 = SSL_CTX_new(SSLv23_client_method());
 	if (ssl_ctx_TLSv1 == NULL) {
 		debug_print(_("TLSv1 not available\n"));
 	} else {
 		debug_print(_("TLSv1 available\n"));
+		/* disable SSLv2/SSLv3 */
+		SSL_CTX_set_options(ssl_ctx_TLSv1,
+				    SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3);
 		if ((certs_file || certs_dir) &&
 		    !SSL_CTX_load_verify_locations(ssl_ctx_TLSv1, certs_file,
 						   certs_dir))
@@ -270,6 +274,8 @@ gboolean ssl_init_socket_with_method(SockInfo *sockinfo, SSLMethod method)
 
 	debug_print(_("SSL connection using %s\n"),
 		    SSL_get_cipher(sockinfo->ssl));
+	debug_print("SSL protocol version: %s\n",
+		    SSL_get_version(sockinfo->ssl));
 
 	/* Get server's certificate (note: beware of dynamic allocation) */