Index: pure-ftpd-1.0.22/AUTHORS
===================================================================
--- pure-ftpd-1.0.22.orig/AUTHORS
+++ pure-ftpd-1.0.22/AUTHORS
@@ -315,6 +315,10 @@ enabled.
 
     Support for TLS encryption on the data channel.
 
+* Todd E Rinaldino / Cpanel
+
+    -J option (set allowed ciphers for SSL/TLS).
+
 * Frank DENIS aka Jedi/Sector One <j <at> pureftpd.org> :
 
     Pure-FTPd project initiator and maintainer.
Index: pure-ftpd-1.0.22/configuration-file/pure-config.pl.in
===================================================================
--- pure-ftpd-1.0.22.orig/configuration-file/pure-config.pl.in
+++ pure-ftpd-1.0.22/configuration-file/pure-config.pl.in
@@ -59,6 +59,7 @@ my %string_switch_for = (
 	TrustedIP		=> "-V",
 	AltLog			=> "-O",
 	PIDFile			=> "-g",
+	TLSCipherSuite          => "-J",
 );
 
 my %numeric_switch_for = (
Index: pure-ftpd-1.0.22/configuration-file/pure-config.py.in
===================================================================
--- pure-ftpd-1.0.22.orig/configuration-file/pure-config.py.in
+++ pure-ftpd-1.0.22/configuration-file/pure-config.py.in
@@ -112,6 +112,7 @@ option_tuple = (
     ["CustomerProof\s+yes",                "-Z"                  ],
     ["NoTruncate\s+yes",                   "-0"                  ],    
     ["PIDFile\s+(\S+)",                    "-g", None            ],
+    ["TLSCipherSuite\s+(\S+)",             "-J", None            ],
     ["PerUserLimits\s+([:0-9]+)",          "-y", None            ],
     ["TLSAuth\s+yes",                      "-Y", None            ])
 
Index: pure-ftpd-1.0.22/configuration-file/pure-ftpd.conf.in
===================================================================
--- pure-ftpd-1.0.22.orig/configuration-file/pure-ftpd.conf.in
+++ pure-ftpd-1.0.22/configuration-file/pure-ftpd.conf.in
@@ -436,6 +436,11 @@ CustomerProof              yes
 # TLS                      1
 
 
+# List of ciphers that will be accepted for SSL/TLS connections
+
+# TLSCipherSuite           -S:HIGH:MEDIUM:+TLSv1:!SSLv2:+SSLv3
+
+
 
 # Listen only to IPv4 addresses in standalone mode (ie. disable IPv6)
 # By default, both IPv4 and IPv6 are enabled.
Index: pure-ftpd-1.0.22/man/pure-ftpd.8
===================================================================
--- pure-ftpd-1.0.22.orig/man/pure-ftpd.8
+++ pure-ftpd-1.0.22/man/pure-ftpd.8
@@ -9,7 +9,7 @@
 pure\-ftpd \- simple File Transfer Protocol server
 
 .SH "SYNOPSIS"
-.B pure\-ftpd [\-0] [\-1] [\-4] [\-6] [\-a gid] [\-A] [\-b] [\-B] [\-c clients] [\-C cnx/ip] [\-d [\-d]] [\-D] [\-e] [\-E] [\-f facility] [\-F fortunes file] [\-g pidfile] [\-G] [\-H] [\-i] [\-I] [\-j] [\-k percentage] [\-K] [\-l authentication[:config file]] [\-L max files:max depth] [\-m maxload] [\-M] [\-n maxfiles:maxsize] [\-N] [\-o] [\-O format:log file] [\-p first:last] [\-P ip address or host name] [\-q upload:download ratio] [\-Q upload:download ratio] [\-r] [\-R] [\-s] [\-S [address,][port]] [\-t upload bandwidth:download bandwidth] [\-T upload bandwidth:download bandwidth] [\-u uid] [\-U umask files:umask dirs] [\-v bonjour name] [\-V ip address] [\-w] [\-W] [\-x] [\-X] [\-y max user sessions:max anon sessions] [\-Y tls behavior] [\-z] [\-Z]
+.B pure\-ftpd [\-0] [\-1] [\-4] [\-6] [\-a gid] [\-A] [\-b] [\-B] [\-c clients] [\-C cnx/ip] [\-d [\-d]] [\-D] [\-e] [\-E] [\-f facility] [\-F fortunes file] [\-g pidfile] [\-G] [\-H] [\-i] [\-I] [\-j] [\-J ciphers] [\-k percentage] [\-K] [\-l authentication[:config file]] [\-L max files:max depth] [\-m maxload] [\-M] [\-n maxfiles:maxsize] [\-N] [\-o] [\-O format:log file] [\-p first:last] [\-P ip address or host name] [\-q upload:download ratio] [\-Q upload:download ratio] [\-r] [\-R] [\-s] [\-S [address,][port]] [\-t upload bandwidth:download bandwidth] [\-T upload bandwidth:download bandwidth] [\-u uid] [\-U umask files:umask dirs] [\-v bonjour name] [\-V ip address] [\-w] [\-W] [\-x] [\-X] [\-y max user sessions:max anon sessions] [\-Y tls behavior] [\-z] [\-Z]
 
 .br
 Alternative style :
@@ -60,6 +60,8 @@ Alternative style :
 .br
 \-j \-\-createhomedir
 .br
+\-J \-\-tlsciphersuite
+.br
 \-k \-\-maxdiskusagepct
 .br
 \-K \-\-keepallfiles
@@ -276,6 +278,9 @@ create it. The newly created home direct
 permissions are set according to the current directory mask. To avoid local
 attacks, the parent directory should never belong to an untrusted user.
 .TP
+.B \-J ciphers
+Set the list of ciphers that will be accepted for SSL/TLS connections.
+.TP
 .B \-k percentage
 Disallow upload if the partition is more than
 .B percentage
Index: pure-ftpd-1.0.22/README
===================================================================
--- pure-ftpd-1.0.22.orig/README
+++ pure-ftpd-1.0.22/README
@@ -739,6 +739,10 @@ user. Also note that you must trust whoe
 because with that feature, he'll be able to create/chown directories anywhere
 on the server's filesystem.
 
+- '-J <ciphers>': Sets the list of ciphers that will be accepted for
+SSL/TLS connections.
+For example: -J HIGH:MEDIUM:+TLSv1:!SSLv2:+SSLv3
+
 - '-k <percentage>': Don't allow uploads if the partition is more than
 <percentage>% full. For instance, "-k 95" will ensure your disks will never
 get filled more than 95% by FTP. No need for the "percent" sign after the
@@ -996,6 +1000,7 @@ aliases are available. You can get this
 -i  --anonymouscantupload
 -I  --maxidletime           <time (min)>
 -j  --createhomedir
+-J  --tlsciphersuite        <ciphers>
 -k  --maxdiskusagepct       <percentage>
 -K  --keepallfiles
 -l  --login                 <auth> or <auth>:<config file>
@@ -1098,6 +1103,7 @@ aliases are available. You can get this
 
 -f  --syslogfacility        <facility>
 
+-J  --tlsciphersuite        <ciphers>
 -a  --trustedgid            <gid>
 -V  --trustedip             <ip address>
 
Index: pure-ftpd-1.0.22/src/ftpd.c
===================================================================
--- pure-ftpd-1.0.22.orig/src/ftpd.c
+++ pure-ftpd-1.0.22/src/ftpd.c
@@ -5479,6 +5479,16 @@ int main(int argc, char *argv[])
             }
             break;
         }            
+        case 'J': {
+            if (strncmp(optarg, "-S:", sizeof "-S:" - (size_t) 1U) == 0) {
+                optarg += sizeof "-S:" - (size_t) 1U;
+                ssl_disabled = 1;
+            }
+            if ((tlsciphersuite = strdup(optarg)) == NULL) {
+                die_mem();
+            }
+            break;
+        }
 #endif
         case 'e': {
             anon_only = 1;
Index: pure-ftpd-1.0.22/src/ftpd_p.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/ftpd_p.h
+++ pure-ftpd-1.0.22/src/ftpd_p.h
@@ -104,7 +104,7 @@ static const char *GETOPT_OPTIONS =
     "y:"
 #endif
 #ifdef WITH_TLS
-    "Y:"
+    "Y:J:"
 #endif    
     "zZ";
 
@@ -188,6 +188,7 @@ static struct option long_options[] = {
 # endif
 # ifdef WITH_TLS
     { "tls", 1, NULL, 'Y' },
+    { "tlsciphersuite", 1, NULL, 'J' },
 # endif
     { "allowdotfiles", 0, NULL, 'z' },
     { "customerproof", 0, NULL, 'Z' },
Index: pure-ftpd-1.0.22/src/globals.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/globals.h
+++ pure-ftpd-1.0.22/src/globals.h
@@ -166,6 +166,8 @@ GLOBAL0(signed char be_customer_proof);
 #ifdef WITH_TLS
 GLOBAL0(signed char enforce_tls_auth);
 GLOBAL0(int data_protection_level); 
+GLOBAL(const char *tlsciphersuite, NULL);
+GLOBAL0(signed char ssl_disabled);
 #endif
 
 GLOBAL0(char *atomic_prefix);
Index: pure-ftpd-1.0.22/src/messages_cs_cz.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_cs_cz.h
+++ pure-ftpd-1.0.22/src/messages_cs_cz.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "èas vypr¹el"
 #define MSG_CAPABILITIES "Nemohu zmìnit privilegia"
 #define MSG_CLIENT_CLOSED_CNX "Klient uzavøel spojení"
Index: pure-ftpd-1.0.22/src/messages_da.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_da.h
+++ pure-ftpd-1.0.22/src/messages_da.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Timeout"
 #define MSG_CAPABILITIES "Kan ikke ændre muligheder"
 #define MSG_CLIENT_CLOSED_CNX "Klient afbrød forbindelsen"
Index: pure-ftpd-1.0.22/src/messages_de.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_de.h
+++ pure-ftpd-1.0.22/src/messages_de.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Zeitüberschreitung"
 #define MSG_CAPABILITIES "Konnte Berechtigungen (CAPABILITES) nicht wechseln."
 #define MSG_CLIENT_CLOSED_CNX "Die Gegenstelle hat die Verbindung geschlossen."
Index: pure-ftpd-1.0.22/src/messages_en.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_en.h
+++ pure-ftpd-1.0.22/src/messages_en.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Timeout"
 #define MSG_CAPABILITIES "Unable to switch capabilities"
 #define MSG_CLIENT_CLOSED_CNX "Client closed the connection"
Index: pure-ftpd-1.0.22/src/messages_es.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_es.h
+++ pure-ftpd-1.0.22/src/messages_es.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Timeout"
 #define MSG_CAPABILITIES "No se han podido alternar capacidades"
 #define MSG_CLIENT_CLOSED_CNX "El cliente cerró la conexión"
Index: pure-ftpd-1.0.22/src/messages_fr_funny.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_fr_funny.h
+++ pure-ftpd-1.0.22/src/messages_fr_funny.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Putain mais achete-toi des doigts"
 #define MSG_CAPABILITIES "Ton kernel m'a envoye chier"
 #define MSG_CLIENT_CLOSED_CNX "Le mec s'est casse"
Index: pure-ftpd-1.0.22/src/messages_fr.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_fr.h
+++ pure-ftpd-1.0.22/src/messages_fr.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Temps de reponse depasse"
 #define MSG_CAPABILITIES "Impossible d'acceder a cette fonctionnalite"
 #define MSG_CLIENT_CLOSED_CNX "Le client a ferme la connexion"
Index: pure-ftpd-1.0.22/src/messages_hu.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_hu.h
+++ pure-ftpd-1.0.22/src/messages_hu.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Id?túllépés"
 #define MSG_CAPABILITIES "Képesség váltás sikertelen"
 #define MSG_CLIENT_CLOSED_CNX "A Kliens bontotta a kapcsolatot"
Index: pure-ftpd-1.0.22/src/messages_it.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_it.h
+++ pure-ftpd-1.0.22/src/messages_it.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Timeout"
 #define MSG_CAPABILITIES "Impossibile modificare i permessi"
 #define MSG_CLIENT_CLOSED_CNX "Il client ha chiuso la connessione"
Index: pure-ftpd-1.0.22/src/messages_kr.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_kr.h
+++ pure-ftpd-1.0.22/src/messages_kr.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "½Ã°£ ÃÊ°ú"
 #define MSG_CAPABILITIES "±â´É ÀüÈ¯ ºÒ°¡"
 #define MSG_CLIENT_CLOSED_CNX "Å¬¶óÀÌ¾ðÆ®°¡ Á¢¼ÓÀ» ´ÝÀ½"
Index: pure-ftpd-1.0.22/src/messages_nl.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_nl.h
+++ pure-ftpd-1.0.22/src/messages_nl.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Onderbreking"
 #define MSG_CAPABILITIES "Onmogelijk om de instelling te wisselen"
 #define MSG_CLIENT_CLOSED_CNX "Client sloot de verbinding"
Index: pure-ftpd-1.0.22/src/messages_no.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_no.h
+++ pure-ftpd-1.0.22/src/messages_no.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Timeout"
 #define MSG_CAPABILITIES "Kan ikke endre egenskaper"
 #define MSG_CLIENT_CLOSED_CNX "Klienten lukket tilkoblingen"
Index: pure-ftpd-1.0.22/src/messages_pl.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_pl.h
+++ pure-ftpd-1.0.22/src/messages_pl.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Przekroczony czas oczekiwania"
 #define MSG_CAPABILITIES "Nie mo¿na prze³±czaæ capabilities"
 #define MSG_CLIENT_CLOSED_CNX "Klient zamkn±³ po³±czenie"
Index: pure-ftpd-1.0.22/src/messages_pt_br.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_pt_br.h
+++ pure-ftpd-1.0.22/src/messages_pt_br.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Tempo expirado"
 #define MSG_CAPABILITIES "Não foi possível trocar capacidades"
 #define MSG_CLIENT_CLOSED_CNX "Cliente encerrou a conexão"
Index: pure-ftpd-1.0.22/src/messages_ro.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_ro.h
+++ pure-ftpd-1.0.22/src/messages_ro.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Temporizare expirata"
 #define MSG_CAPABILITIES "Nu pot comuta capabilitatile"
 #define MSG_CLIENT_CLOSED_CNX "Clientul a inchis conexiunea"
Index: pure-ftpd-1.0.22/src/messages_ru.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_ru.h
+++ pure-ftpd-1.0.22/src/messages_ru.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "éÓÔÅËÌÏ ×ÒÅÍÑ ÏÖÉÄÁÎÉÑ"
 #define MSG_CAPABILITIES "îÅ×ÏÚÍÏÖÎÏ ÐÅÒÅËÌÀÞÉÔØ ÒÁÚÒÅÛÅÎÉÑ (capabilities)"
 #define MSG_CLIENT_CLOSED_CNX "ëÌÉÅÎÔ ÚÁËÒÙÌ ÓÏÅÄÉÎÅÎÉÅ"
Index: pure-ftpd-1.0.22/src/messages_sk.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_sk.h
+++ pure-ftpd-1.0.22/src/messages_sk.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Cas vyprsal"
 #define MSG_CAPABILITIES "Nemozem zmenit privilegia"
 #define MSG_CLIENT_CLOSED_CNX "Klient zavrel spojenie"
Index: pure-ftpd-1.0.22/src/messages_sv.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_sv.h
+++ pure-ftpd-1.0.22/src/messages_sv.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Timeout"
 #define MSG_CAPABILITIES "Oförmögen att ändra möjligheter"
 #define MSG_CLIENT_CLOSED_CNX "Klienten avbröt anslutningen"
Index: pure-ftpd-1.0.22/src/messages_tr.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_tr.h
+++ pure-ftpd-1.0.22/src/messages_tr.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "Zaman Aþýmý"
 #define MSG_CAPABILITIES "Anahtar destekleri yapýlamýyor"
 #define MSG_CLIENT_CLOSED_CNX "Kullanýcý baðlantýyý kapattý"
Index: pure-ftpd-1.0.22/src/messages_zh_cn.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_zh_cn.h
+++ pure-ftpd-1.0.22/src/messages_zh_cn.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "³¬Ê±"
 #define MSG_CAPABILITIES "ÎÞ·¨ÇÐ»»ÐÔÄÜ"
 #define MSG_CLIENT_CLOSED_CNX "ÓÃ»§¶Ë¹Ø±ÕÁ¬½Ó"
Index: pure-ftpd-1.0.22/src/messages_zh_tw.h
===================================================================
--- pure-ftpd-1.0.22.orig/src/messages_zh_tw.h
+++ pure-ftpd-1.0.22/src/messages_zh_tw.h
@@ -1,3 +1,4 @@
+#define MSG_TLS_CIPHER_FAILED "SSL/TLS: Invalid TLSCipherSuite specified '%s'"
 #define MSG_TIMEOUT "¹O®É"
 #define MSG_CAPABILITIES "µLªk¤Á´«©Ê¯à"
 #define MSG_CLIENT_CLOSED_CNX "¥Î¤áºÝÃö³¬³s½u"
Index: pure-ftpd-1.0.22/src/tls.c
===================================================================
--- pure-ftpd-1.0.22.orig/src/tls.c
+++ pure-ftpd-1.0.22/src/tls.c
@@ -9,6 +9,7 @@
 # include "tls.h"
 # include "ftpwho-update.h"
 # include "messages.h"
+# include "globals.h"
 
 /*
  * Unfortunately disabled by default, because it looks like a lot of clients
@@ -65,6 +66,7 @@ int tls_init_library(void)
 {
     const char *tls_ctx_id = "pure-ftpd";    
     unsigned int rnd;
+    long options;
     
     SSL_library_init();
     SSL_load_error_strings();
@@ -76,7 +78,11 @@ int tls_init_library(void)
         tls_error();
     }
     tls_init_cache();
-    SSL_CTX_set_options(tls_ctx, SSL_OP_ALL);    
+    options = SSL_OP_NO_SSLv2 | SSL_OP_ALL;
+    if (ssl_disabled != 0) {
+         options |= SSL_OP_NO_SSLv3;
+    }
+    SSL_CTX_set_options(tls_ctx, options);
     if (SSL_CTX_use_certificate_chain_file
         (tls_ctx, TLS_CERTIFICATE_FILE) != 1) {
         die(421, LOG_ERR,
@@ -106,6 +112,12 @@ int tls_init_library(void)
     if (tls_init_diffie() < 0) {
         tls_error();
     }
+    if (tlsciphersuite != NULL) {
+        if (SSL_CTX_set_cipher_list(tls_ctx, tlsciphersuite) != 1) {
+            logfile(LOG_ERR, MSG_TLS_CIPHER_FAILED, tlsciphersuite);
+            _EXIT(EXIT_FAILURE);
+        }
+    }
 #ifdef REQUIRE_VALID_CLIENT_CERTIFICATE
     SSL_CTX_set_verify(tls_ctx, SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
                        SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, NULL);
