polarssl: enable DHE in default client ciphersuite

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

diff --git a/ustream-polarssl.c b/ustream-polarssl.c
index 7135d3c3952773cf12af3fb22cbf2db946c58fbe..57b37142a739cf9ab4cd2a7d5884f1ce7dbd9e6c 100644 (file)
--- a/ustream-polarssl.c
+++ b/ustream-polarssl.c
@@ -249,42 +249,36 @@ __hidden int __ustream_ssl_read(struct ustream_ssl *us, char *buf, int len)
        return ret;
 }
 
+#define TLS_DEFAULT_CIPHERS                    \
+    TLS_CIPHER(AES_256_CBC_SHA256)             \
+    TLS_CIPHER(AES_256_GCM_SHA384)             \
+    TLS_CIPHER(AES_256_CBC_SHA)                        \
+    TLS_CIPHER(CAMELLIA_256_CBC_SHA256)                \
+    TLS_CIPHER(CAMELLIA_256_CBC_SHA)           \
+    TLS_CIPHER(AES_128_CBC_SHA256)             \
+    TLS_CIPHER(AES_128_GCM_SHA256)             \
+    TLS_CIPHER(AES_128_CBC_SHA)                        \
+    TLS_CIPHER(CAMELLIA_128_CBC_SHA256)                \
+    TLS_CIPHER(CAMELLIA_128_CBC_SHA)           \
+    TLS_CIPHER(3DES_EDE_CBC_SHA)
+
+static const int default_ciphersuites_nodhe[] =
+{
+#define TLS_CIPHER(v)                          \
+       TLS_RSA_WITH_##v,
+       TLS_DEFAULT_CIPHERS
+#undef TLS_CIPHER
+       0
+};
+
 static const int default_ciphersuites[] =
 {
-#if defined(POLARSSL_AES_C)
-#if defined(POLARSSL_SHA2_C)
-    TLS_RSA_WITH_AES_256_CBC_SHA256,
-#endif /* POLARSSL_SHA2_C */
-#if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA4_C)
-    TLS_RSA_WITH_AES_256_GCM_SHA384,
-#endif /* POLARSSL_SHA2_C */
-    TLS_RSA_WITH_AES_256_CBC_SHA,
-#endif
-#if defined(POLARSSL_CAMELLIA_C)
-#if defined(POLARSSL_SHA2_C)
-    TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256,
-#endif /* POLARSSL_SHA2_C */
-    TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
-#endif
-#if defined(POLARSSL_AES_C)
-#if defined(POLARSSL_SHA2_C)
-    TLS_RSA_WITH_AES_128_CBC_SHA256,
-#endif /* POLARSSL_SHA2_C */
-#if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA2_C)
-    TLS_RSA_WITH_AES_128_GCM_SHA256,
-#endif /* POLARSSL_SHA2_C */
-    TLS_RSA_WITH_AES_128_CBC_SHA,
-#endif
-#if defined(POLARSSL_CAMELLIA_C)
-#if defined(POLARSSL_SHA2_C)
-    TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256,
-#endif /* POLARSSL_SHA2_C */
-    TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,
-#endif
-#if defined(POLARSSL_DES_C)
-    TLS_RSA_WITH_3DES_EDE_CBC_SHA,
-#endif
-    0
+#define TLS_CIPHER(v)                          \
+       TLS_DHE_RSA_WITH_##v,                   \
+       TLS_RSA_WITH_##v,
+       TLS_DEFAULT_CIPHERS
+#undef TLS_CIPHER
+       0
 };
 
 __hidden void *__ustream_ssl_session_new(struct ustream_ssl_ctx *ctx)
@@ -310,16 +304,17 @@ __hidden void *__ustream_ssl_session_new(struct ustream_ssl_ctx *ctx)
                auth = SSL_VERIFY_OPTIONAL;
        }
 
-       ssl_set_ciphersuites(ssl, default_ciphersuites);
        ssl_set_endpoint(ssl, ep);
        ssl_set_authmode(ssl, auth);
        ssl_set_rng(ssl, _urandom, NULL);
 
        if (ctx->server) {
+               ssl_set_ciphersuites(ssl, default_ciphersuites_nodhe);
                if (ctx->cert.next)
                        ssl_set_ca_chain(ssl, ctx->cert.next, NULL, NULL);
                ssl_set_own_cert(ssl, &ctx->cert, &ctx->key);
        } else {
+               ssl_set_ciphersuites(ssl, default_ciphersuites);
                ssl_set_ca_chain(ssl, &ctx->ca_cert, NULL, NULL);
        }