ssl: gnutls: bump dh bitsize to 2048

[ngircd-alex.git] / src / ngircd / conn-ssl.c

diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c
index ae1646c5571fb13da78362837330d48b245cdae5..7630420dad36bfa46e2dbb0590e382055f3d7979 100644 (file)
--- a/src/ngircd/conn-ssl.c
+++ b/src/ngircd/conn-ssl.c
@@ -1,11 +1,15 @@
 /*
  * ngIRCd -- The Next Generation IRC Daemon
- *
- * SSL wrapper functions.
  * Copyright (c) 2005-2008 Florian Westphal <fw@strlen.de>
  */
 
 #include "portab.h"
+
+/**
+ * @file
+ * SSL wrapper functions
+ */
+
 #include "imp.h"
 #include "conf-ssl.h"
 
@@ -47,7 +51,7 @@ static bool ConnSSL_LoadServerKey_openssl PARAMS(( SSL_CTX *c ));
 #include <unistd.h>
 #include <gnutls/x509.h>
 
-#define DH_BITS 1024
+#define DH_BITS 2048
 static gnutls_certificate_credentials_t x509_cred;
 static gnutls_dh_params_t dh_params;
 
@@ -383,9 +387,10 @@ ConnSSL_Init_SSL(CONNECTION *c)
        int ret;
        assert(c != NULL);
 #ifdef HAVE_LIBSSL
-       if (!ssl_ctx)   /* NULL when library initialization failed */
+       if (!ssl_ctx) {
+               Log(LOG_ERR, "Cannot init ssl_ctx: OpenSSL initialization failed at startup");
                return false;
-
+       }
        assert(c->ssl_state.ssl == NULL);
 
        c->ssl_state.ssl = SSL_new(ssl_ctx);