* Set a list of preferred strong ciphers on load

src/libssl.c

@@ -55,6 +55,7 @@ static int load_symbols(void *handle) {
   DLSYM_GLOBAL(handle, SSLv23_client_method);
   DLSYM_GLOBAL(handle, SSL_write);
   DLSYM_GLOBAL(handle, SSL_CTX_ctrl);
+  DLSYM_GLOBAL(handle, SSL_CTX_set_cipher_list);
   DLSYM_GLOBAL(handle, SSL_CTX_set_tmp_dh_callback);
 
   return 0;

src/libssl.h

@@ -37,6 +37,7 @@ typedef int (*SSL_library_init_t)(void);
 typedef void (*SSL_CTX_free_t)(SSL_CTX*);
 typedef SSL_CTX* (*SSL_CTX_new_t)(const SSL_METHOD*);
 typedef long (*SSL_CTX_ctrl_t)(SSL_CTX*, int, long, void*);
+typedef int (*SSL_CTX_set_cipher_list_t)(SSL_CTX*, const char*);
 typedef void (*SSL_CTX_set_tmp_dh_callback_t)(SSL_CTX*, dh_callback_t);
 
 int load_libssl();

src/openssl.c

@@ -84,6 +84,12 @@ int init_openssl() {
   SSL_CTX_set_mode(ssl_ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER|SSL_MODE_ENABLE_PARTIAL_WRITE);
   SSL_CTX_set_tmp_dh_callback(ssl_ctx, tmp_dh_callback);
 
+  const char* ciphers = "HIGH:!MEDIUM:!LOW:!EXP:!SSLv2:!ADH:!aNULL:!eNULL:!NULL:@STRENGTH";
+  if (!SSL_CTX_set_cipher_list(ssl_ctx, ciphers)) {
+    sdprintf("Unable to load ciphers");
+    return 1;
+  }
+
   if (seed_PRNG()) {
     sdprintf("Wasn't able to properly seed the PRNG!");
     SSL_CTX_free(ssl_ctx);