Permalink
Browse files

New default for libssl ciphers: HIGH:!ADH:!MD5

git-svn-id: svn://cherokee-project.com/cherokee/trunk@6861 5dc97367-97f1-0310-9951-d761b3857238
  • Loading branch information...
1 parent 85d0d88 commit 28c2f3c6cf4ffbf9927aa675dbf111f3a9c0d1da @alobbs alobbs committed Sep 18, 2011
Showing with 7 additions and 2 deletions.
  1. +1 −1 admin/PageVServer.py
  2. +2 −0 cherokee/cryptor.h
  3. +4 −1 cherokee/virtual_server.c
View
@@ -45,7 +45,7 @@
NOTE_CERT = N_('This directive points to the PEM-encoded Certificate file for the server (Full path to the file)')
NOTE_CERT_KEY = N_('PEM-encoded Private Key file for the server (Full path to the file)')
NOTE_CA_LIST = N_('File containing the trusted CA certificates, utilized for checking the client certificates (Full path to the file)')
-NOTE_CIPHERS = N_('Ciphers that TLS/SSL is allowed to use. <a target="_blank" href="http://www.openssl.org/docs/apps/ciphers.html">Reference</a>. (Default: all ciphers supported by the OpenSSL version used).')
+NOTE_CIPHERS = N_('Ciphers that TLS/SSL is allowed to use. <a target="_blank" href="http://www.openssl.org/docs/apps/ciphers.html">Reference</a>. (Default: HIGH:!ADH:!MD5).')
NOTE_CLIENT_CERTS = N_('Skip, Accept or Require client certificates.')
NOTE_VERIFY_DEPTH = N_('Limit up to which depth certificates in a chain are used during the verification procedure (Default: 1)')
NOTE_ERROR_HANDLER = N_('Allows the selection of how to generate the error responses.')
View
@@ -35,6 +35,8 @@
CHEROKEE_BEGIN_DECLS
+#define CHEROKEE_CIPHERS_DEFAULT "HIGH:!ADH:!MD5"
+
/* Callback function prototipes
*/
typedef ret_t (* cryptor_func_new_t) (void **cryp);
@@ -82,7 +82,9 @@ cherokee_virtual_server_new (cherokee_virtual_server_t **vserver, void *server)
cherokee_buffer_init (&n->server_key);
cherokee_buffer_init (&n->certs_ca);
cherokee_buffer_init (&n->req_client_certs);
- cherokee_buffer_init (&n->ciphers);
+
+ cherokee_buffer_init (&n->ciphers);
+ cherokee_buffer_add_str (&n->ciphers, CHEROKEE_CIPHERS_DEFAULT);
ret = cherokee_buffer_init (&n->root);
if (unlikely(ret < ret_ok))
@@ -1119,6 +1121,7 @@ configure_virtual_server_property (cherokee_config_node_t *conf, void *data)
cherokee_buffer_add_buffer (&vserver->req_client_certs, &conf->val);
} else if (equal_buf_str (&conf->key, "ssl_ciphers")) {
+ cherokee_buffer_clean (&vserver->ciphers);
cherokee_buffer_add_buffer (&vserver->ciphers, &conf->val);
} else if (equal_buf_str (&conf->key, "flcache") ||

0 comments on commit 28c2f3c

Please sign in to comment.