Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement the needs of @AnonSphere and the stuff he did not request yet #1117

Merged
merged 1 commit into from Feb 6, 2014
Merged

Implement the needs of @AnonSphere and the stuff he did not request yet #1117

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
15 changes: 13 additions & 2 deletions admin/PageAdvanced.py
View file
Open in desktop
Expand Up @@ -54,6 +54,10 @@
("server!iocache!lasting_stat", validations.is_positive_int),
("server!iocache!lasting_mmap", validations.is_positive_int),
("server!tls!protocol!SSLv2", validations.is_boolean),
("server!tls!protocol!SSLv3", validations.is_boolean),
("server!tls!protocol!TLSv1", validations.is_boolean),
("server!tls!protocol!TLSv1_1", validations.is_boolean),
("server!tls!protocol!TLSv1_2", validations.is_boolean),
("server!tls!timeout_handshake", validations.is_positive_int),
("server!tls!dh_param512", validations.is_local_file_exists),
("server!tls!dh_param1024", validations.is_local_file_exists),
Expand Down Expand Up @@ -92,7 +96,10 @@
NOTE_DH4096 = N_('Path to a Diffie Hellman (DH) parameters PEM file: 4096 bits.')
NOTE_TLS_TIMEOUT = N_('Timeout for the TLS/SSL handshake. Default: 15 seconds.')
NOTE_TLS_SSLv2 = N_('Allow clients to use SSL version 2 - Beware: it is vulnerable. (Default: No)')

NOTE_TLS_SSLv3 = N_('Allow clients to use SSL version 3 (Default: Yes)')
NOTE_TLS_TLSv1 = N_('Allow clients to use TLS version 1 (Default: Yes)')
NOTE_TLS_TLSv1_1 = N_('Allow clients to use TLS version 1.1 (Default: Yes)')
NOTE_TLS_TLSv1_2 = N_('Allow clients to use TLS version 1.2 (Default: Yes)')

HELPS = [('config_advanced', N_('Advanced'))]

Expand Down Expand Up @@ -173,7 +180,11 @@ def __init__ (self):
CTK.Container.__init__ (self)

table = CTK.PropsAuto(URL_APPLY)
table.Add (_('Allow SSL v2'), CTK.CheckCfgText('server!tls!protocol!SSLv2', False, _("Allow")), _(NOTE_TLS_SSLv2))
table.Add (_('SSL version 2'), CTK.CheckCfgText('server!tls!protocol!SSLv2', False, _("Allow")), _(NOTE_TLS_SSLv2))
table.Add (_('SSL version 3'), CTK.CheckCfgText('server!tls!protocol!SSLv3', True, _("Allow")), _(NOTE_TLS_SSLv3))
table.Add (_('TLS version 1'), CTK.CheckCfgText('server!tls!protocol!TLSv1', True, _("Allow")), _(NOTE_TLS_TLSv1))
table.Add (_('TLS version 1.1'), CTK.CheckCfgText('server!tls!protocol!TLSv1_1', True, _("Allow")), _(NOTE_TLS_TLSv1_1))
table.Add (_('TLS version 1.2'), CTK.CheckCfgText('server!tls!protocol!TLSv1_2', True, _("Allow")), _(NOTE_TLS_TLSv1_2))
table.Add (_('Handshake Timeout'), CTK.TextCfg('server!tls!timeout_handshake', True), _(NOTE_TLS_TIMEOUT))
table.Add (_('DH parameters: 512 bits'), CTK.TextCfg('server!tls!dh_param512', True), _(NOTE_DH512))
table.Add (_('DH parameters: 1024 bits'), CTK.TextCfg('server!tls!dh_param1024', True), _(NOTE_DH1024))
Expand Down
8 changes: 8 additions & 0 deletions cherokee/cryptor.c
View file
Open in desktop
Expand Up @@ -49,6 +49,10 @@ cherokee_cryptor_init_base (cherokee_cryptor_t *cryp,
*/
cryp->timeout_handshake = TIMEOUT_DEFAULT;
cryp->allow_SSLv2 = false;
cryp->allow_SSLv3 = true;
cryp->allow_TLSv1 = true;
cryp->allow_TLSv1_1 = true;
cryp->allow_TLSv1_2 = true;

return ret_ok;
}
Expand Down Expand Up @@ -83,6 +87,10 @@ cherokee_cryptor_configure (cherokee_cryptor_t *cryp,
*/
cherokee_config_node_read_int (conf, "timeout_handshake", &cryp->timeout_handshake);
cherokee_config_node_read_bool (conf, "protocol!SSLv2", &cryp->allow_SSLv2);
cherokee_config_node_read_bool (conf, "protocol!SSLv3", &cryp->allow_SSLv3);
cherokee_config_node_read_bool (conf, "protocol!TLSv1", &cryp->allow_TLSv1);
cherokee_config_node_read_bool (conf, "protocol!TLSv1_1", &cryp->allow_TLSv1_1);
cherokee_config_node_read_bool (conf, "protocol!TLSv1_2", &cryp->allow_TLSv1_2);

/* Call the its virtual method
*/
Expand Down
4 changes: 4 additions & 0 deletions cherokee/cryptor.h
View file
Open in desktop
Expand Up @@ -67,6 +67,10 @@ typedef struct {
cherokee_module_t module;
cint_t timeout_handshake;
cherokee_boolean_t allow_SSLv2;
cherokee_boolean_t allow_SSLv3;
cherokee_boolean_t allow_TLSv1;
cherokee_boolean_t allow_TLSv1_1;
cherokee_boolean_t allow_TLSv1_2;

/* Methods */
cryptor_func_configure_t configure;
Expand Down
16 changes: 16 additions & 0 deletions cherokee/cryptor_libssl.c
View file
Open in desktop
Expand Up @@ -460,6 +460,22 @@ _vserver_new (cherokee_cryptor_t *cryp,
options |= SSL_OP_NO_SSLv2;
}

if (! cryp->allow_SSLv3) {
options |= SSL_OP_NO_SSLv3;
}

if (! cryp->allow_TLSv1) {
options |= SSL_OP_NO_TLSv1;
}

if (! cryp->allow_TLSv1_1) {
options |= SSL_OP_NO_TLSv1_1;
}

if (! cryp->allow_TLSv1_2) {
options |= SSL_OP_NO_TLSv1_2;
}

#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
if (vsrv->cipher_server_preference) {
options |= SSL_OP_CIPHER_SERVER_PREFERENCE;
Expand Down