Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added XrdHttp cipherlist filter string config option #678

Merged
merged 1 commit into from
Apr 27, 2018
Merged

Added XrdHttp cipherlist filter string config option #678

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
49 changes: 46 additions & 3 deletions src/XrdHttp/XrdHttpProtocol.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,7 @@ int XrdHttpProtocol::Window = 0;
char *XrdHttpProtocol::sslcert = 0;
char *XrdHttpProtocol::sslkey = 0;
char *XrdHttpProtocol::sslcadir = 0;
char *XrdHttpProtocol::sslcipherfilter = 0;
char *XrdHttpProtocol::listredir = 0;
bool XrdHttpProtocol::listdeny = false;
bool XrdHttpProtocol::embeddedstatic = true;
Expand Down Expand Up @@ -860,6 +861,7 @@ int XrdHttpProtocol::Config(const char *ConfigFN, XrdOucEnv *myEnv) {
else if TS_Xeq("cert", xsslcert);
else if TS_Xeq("key", xsslkey);
else if TS_Xeq("cadir", xsslcadir);
else if TS_Xeq("cipherfilter", xsslcipherfilter);
else if TS_Xeq("gridmap", xgmap);
else if TS_Xeq("cafile", xsslcafile);
else if TS_Xeq("secretkey", xsecretkey);
Expand Down Expand Up @@ -1495,8 +1497,15 @@ int XrdHttpProtocol::InitSecurity() {
}
}

// Use default cipherlist filter if none is provided
if (!sslcipherfilter) sslcipherfilter = (char *) "ALL:!LOW:!EXP:!MD5:!MD2";
/* Apply the cipherlist filtering. */
if (!SSL_CTX_set_cipher_list(sslctx, sslcipherfilter)) {
TRACE(EMSG, " Error setting the cipherlist filter.");
ERR_print_errors(sslbio_err);
exit(1);
}

SSL_CTX_set_cipher_list(sslctx, "ALL:!LOW:!EXP:!MD5:!MD2");
//SSL_CTX_set_purpose(sslctx, X509_PURPOSE_ANY);
SSL_CTX_set_mode(sslctx, SSL_MODE_AUTO_RETRY);

Expand Down Expand Up @@ -2129,7 +2138,7 @@ int XrdHttpProtocol::xstaticpreload(XrdOucStream & Config) {


/******************************************************************************/
/* x s e l f h t t p s 2 h t t p */
/* x s e l f h t t p s 2 h t t p */
/******************************************************************************/

/* Function: selfhttps2http
Expand Down Expand Up @@ -2365,6 +2374,40 @@ int XrdHttpProtocol::xsslcadir(XrdOucStream & Config) {
return 0;
}


/******************************************************************************/
/* x s s l c i p h e r f i l t e r */
/******************************************************************************/

/* Function: xsslcipherfilter

Purpose: To parse the directive: sslcipherfilter <filter>

<filter> the filter string to be used when generating
the SSL cipher list

Output: 0 upon success or !0 upon failure.
*/

int XrdHttpProtocol::xsslcipherfilter(XrdOucStream & Config) {
char *val;

// Get the filter string
//
val = Config.GetWord();
if (!val || !val[0]) {
eDest.Emsg("Config", "SSL cipherlist filter string not specified");
return 1;
}

// Record the filter string
//
if (sslcipherfilter) free(sslcipherfilter);
sslcipherfilter = strdup(val);

return 0;
}

/******************************************************************************/
/* x t r a c e */
/******************************************************************************/
Expand All @@ -2374,7 +2417,7 @@ int XrdHttpProtocol::xsslcadir(XrdOucStream & Config) {
Purpose: To parse the directive: trace <events>

<events> the blank separated list of events to trace. Trace
directives are cummalative.
directives are cumulative.

Output: 0 upon success or 1 upon failure.
*/
Expand Down
3 changes: 2 additions & 1 deletion src/XrdHttp/XrdHttpProtocol.hh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,7 @@ private:
static int xsecxtractor(XrdOucStream &Config);
static int xexthandler(XrdOucStream & Config, const char *ConfigFN, XrdOucEnv *myEnv);
static int xsslcadir(XrdOucStream &Config);
static int xsslcipherfilter(XrdOucStream &Config);
static int xdesthttps(XrdOucStream &Config);
static int xlistdeny(XrdOucStream &Config);
static int xlistredir(XrdOucStream &Config);
Expand Down Expand Up @@ -332,7 +333,7 @@ protected:
static int Window;

/// OpenSSL stuff
static char *sslcert, *sslkey, *sslcadir, *sslcafile;
static char *sslcert, *sslkey, *sslcadir, *sslcafile, *sslcipherfilter;

/// Gridmap file location. The same used by XrdSecGsi
static char *gridmap;// [s] gridmap file [/etc/grid-security/gridmap]
Expand Down