From 4c37e4927480fdf8f0ff024a98314387711d5203 Mon Sep 17 00:00:00 2001
From: Deomid Ryabkov <rojer@cesanta.com>
Date: Wed, 5 Jul 2017 17:53:29 +0100
Subject: [PATCH] Disable insecure and deprectaed SSL protocols

Also allow disabling conmpression and forcing server cipher list.

PUBLISHED_FROM=5539deec9c2382ba34597872dd7f3a5abc0cc311
---
 mongoose.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/mongoose.c b/mongoose.c
index 4a8aea4f..e6edab39 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -4198,6 +4198,21 @@ enum mg_ssl_if_result mg_ssl_if_conn_init(
     return MG_SSL_ERROR;
   }
 
+#ifndef KR_VERSION
+  /* Disable deprecated protocols. */
+  SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv2);
+  SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv3);
+  SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1);
+#ifdef MG_SSL_OPENSSL_NO_COMPRESSION
+  SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_COMPRESSION);
+#endif
+#ifdef MG_SSL_OPENSSL_CIPHER_SERVER_PREFERENCE
+  SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
+#endif
+#else
+/* Krypton only supports TLSv1.2 anyway. */
+#endif
+
   if (params->cert != NULL &&
       mg_use_cert(ctx->ssl_ctx, params->cert, params->key, err_msg) !=
           MG_SSL_OK) {