Details
-
Suggestion
-
Resolution: Done
-
Not Evaluated
-
5.2.1, 5.3.2
-
None
-
bf3246fdff321b4f07f88c697102c8ef5a7969d0
Description
Because of the POODLE attack it is recommended to disable SSLv3 (eg see https://disablessl3.com/ ). Disabling it in the client and server means that a MiTM cannot force to downgrade the connection to a vulnerable protocol.
However, QSsl::SslProtocol currently only has the option to force a specific TlsV1_x. This is too specific. It would be useful to have a protocol QSsl::AnyTls, or even better, a bit field to disable or enable specific protocols. Something to inject SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2 at the OpenSSL level.
Attachments
Issue Links
- duplicates
-
QTBUG-28469 QSsl::SslProtocol should be of type QFlags<QSsl::SslProtocolFlag>
- Closed