get rid of toxic OP_ALL option, disable SSLv3 by default

SSL_OP_ALL, see: http://daniel.haxx.se/blog/2012/01/27/sloppily-using-ssl_op_all/ SSLv3: https://datatracker.ietf.org/doc/draft-ietf-tls-sslv3-diediedie/
varnish · Jun 11, 2015 · 936b761 · 936b761
1 parent c444d95
commit 936b761
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/hitch.c b/src/hitch.c
@@ -773,7 +773,7 @@ SSL_CTX *make_ctx(const char *pemfile) {
     SSL_CTX *ctx;
     RSA *rsa;
 
-    long ssloptions = SSL_OP_NO_SSLv2 | SSL_OP_ALL |
+    long ssloptions = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
             SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION;
 
 #ifdef SSL_OP_NO_COMPRESSION