diff options
| author | mrg <mrg@NetBSD.org> | 2021-08-24 09:53:26 +0000 |
|---|---|---|
| committer | mrg <mrg@NetBSD.org> | 2021-08-24 09:53:26 +0000 |
| commit | f202fc4774a9d24dfe0b5b83fba19f6603922b8a (patch) | |
| tree | 291d4d5d4d214e633375e3731b3d7140a11dbaa3 /libexec/httpd | |
| parent | a2859e53e9e24c309c46f2c5ca1bc41dfc97faff (diff) | |
extend the list of available ciphers to include most of the
openssl "HIGH" with some additional disables. retain the current
list of bad options. should deal with PR#51278.
Diffstat (limited to 'libexec/httpd')
| -rw-r--r-- | libexec/httpd/CHANGES | 5 | ||||
| -rw-r--r-- | libexec/httpd/ssl-bozo.c | 15 |
2 files changed, 14 insertions, 6 deletions
diff --git a/libexec/httpd/CHANGES b/libexec/httpd/CHANGES index 5f0c80c5a8d..1443274e4f8 100644 --- a/libexec/httpd/CHANGES +++ b/libexec/httpd/CHANGES @@ -1,8 +1,11 @@ -$NetBSD: CHANGES,v 1.50 2021/08/24 09:47:36 mrg Exp $ +$NetBSD: CHANGES,v 1.51 2021/08/24 09:53:26 mrg Exp $ changes in bozohttpd 20210824: o new "-m tlsversion" option to set the minimum TLS version available. partially from <sunil@nimmagadda.net>. + o extend the list of available ciphers to include most of the + openssl "HIGH" with some additional disables. retain the current + list of bad options. should deal with PR#51278. changes in bozohttpd 20210504: o don't assume host BUFSIZ is sufficent. small BUFSIZ leads to diff --git a/libexec/httpd/ssl-bozo.c b/libexec/httpd/ssl-bozo.c index 03bb8be2ef8..d3867fdbd7b 100644 --- a/libexec/httpd/ssl-bozo.c +++ b/libexec/httpd/ssl-bozo.c @@ -1,4 +1,4 @@ -/* $NetBSD: ssl-bozo.c,v 1.30 2021/08/24 09:47:36 mrg Exp $ */ +/* $NetBSD: ssl-bozo.c,v 1.31 2021/08/24 09:53:26 mrg Exp $ */ /* $eterna: ssl-bozo.c,v 1.15 2011/11/18 09:21:15 mrg Exp $ */ @@ -51,10 +51,15 @@ #ifndef BOZO_SSL_CIPHERS #define BOZO_SSL_CIPHERS \ - "AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:" \ - "AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:" \ - "AES:" \ - "-SHA:" \ + "HIGH:" \ + "-SHA:-ADH:" \ + "-PSK-AES128-CCM:-PSK-AES256-CCM:" \ + "-DHE-PSK-AES128-CCM8:-DHE-PSK-AES256-CCM8:" \ + "-AES128-CCM8:-AES256-CCM8:" \ + "-DHE-RSA-AES128-CCM8:-DHE-RSA-AES256-CCM8:" \ + "-PSK-AES128-CCM8:-PSK-AES256-CCM8:" \ + "-CAMELLIA128:-CAMELLIA256:" \ + "-RSA-PSK-CHACHA20-POLY1305:" \ "!aNULL:!eNULL:" \ "!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:" \ "!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:" \ |
