bammv/sguil — pull request #8 by inliniac (2014-01-05 11:29:20+00:00)
Title: Force TLSv1 for all communication

This patch explicitly disables SSLv2 and SSLv3, and enables TLSv1 in
sensor-server and client-server communications.

SSLv2 clearly shouldn't be used anymore. While changing this code it
makes sense to skip SSLv3 as well.

Other than the improvement of security, this solves a problem with
sguild running on Debian Wheezy. It appears that tcl-tls on that OS
no longer supports SSLv2. Clients/agents connecting to this sguild
instance are rejected with an error:
ERROR: handshake failed: wrong version number

Forcing both sides to SSLv3 or TLSv1 solves this issue. This patch
chooses to force to TLSv1.

All clients, agents and the server will need to be in sync for this
to work properly, so it may be a good time to also bump the protocol
version number.