net.http: Disable SSLv2 support for HTTPS connections
authorMatthew Wild <mwild1@gmail.com>
Wed, 20 Mar 2013 20:31:52 +0000
changeset 5354 18ebc3874364
parent 5353 8c3f28f5c1c1
child 5355 11eff33f60d3
child 5357 ac530c44772e
net.http: Disable SSLv2 support for HTTPS connections
net/http.lua
--- a/net/http.lua	Wed Mar 20 20:31:02 2013 +0000
+++ b/net/http.lua	Wed Mar 20 20:31:52 2013 +0000
@@ -190,7 +190,7 @@
 	
 	local sslctx = false;
 	if using_https then
-		sslctx = ex and ex.sslctx or { mode = "client", protocol = "sslv23" };
+		sslctx = ex and ex.sslctx or { mode = "client", protocol = "sslv23", options = { "no_sslv2" } };
 	end
 
 	req.handler, req.conn = server.wrapclient(conn, req.host, port, listener, "*a", sslctx);