Unverified Commit 38470bd3 authored by Steven Fackler's avatar Steven Fackler Committed by GitHub
Browse files

Merge pull request #846 from sfackler/client-cipher-update 

Update SslConnector cipher list
parents 69a91815 15048f4c

openssl/src/ssl/connector.rs

+13 −17
Original line number Diff line number Diff line
@@ -7,18 +7,6 @@ use ssl::{HandshakeError, Ssl, SslContext, SslContextBuilder, SslMethod, SslMode 
          SslRef, SslStream, SslVerifyMode};

use version;



// ffdhe2048 from https://wiki.mozilla.org/Security/Server_Side_TLS#ffdhe2048

const DHPARAM_PEM: &'static str = "

-----BEGIN DH PARAMETERS-----

MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz

+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a

87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7

YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi

7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD

ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==

-----END DH PARAMETERS-----

";



fn ctx(method: SslMethod) -> Result<SslContextBuilder, ErrorStack> {

    let mut ctx = SslContextBuilder::new(method)?;
@@ -61,11 +49,8 @@ impl SslConnector { 
    pub fn builder(method: SslMethod) -> Result<SslConnectorBuilder, ErrorStack> {

        let mut ctx = ctx(method)?;

        ctx.set_default_verify_paths()?;

        // From https://github.com/python/cpython/blob/a170fa162dc03f0a014373349e548954fff2e567/Lib/ssl.py#L193

        ctx.set_cipher_list(

            "TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:\

             ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:DH+CHACHA20:ECDH+AES256:DH+AES256:ECDH+AES128:\

             DH+AES:ECDH+HIGH:DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:!aNULL:!eNULL:!MD5:!3DES",

            "DEFAULT:!aNULL:!eNULL:!MD5:!3DES:!DES:!RC4:!IDEA:!SEED:!aDSS:!SRP:!PSK",

        )?;

        setup_verify(&mut ctx);
@@ -212,7 +197,18 @@ impl SslAcceptor { 
                bits: ::ffi::SSL_OP_NO_TLSv1_3,

            });

        }

        let dh = Dh::params_from_pem(DHPARAM_PEM.as_bytes())?;

        let dh = Dh::params_from_pem(

            b"

-----BEGIN DH PARAMETERS-----

MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz

+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a

87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7

YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi

7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD

ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==

-----END DH PARAMETERS-----

",

        )?;

        ctx.set_tmp_dh(&dh)?;

        setup_curves(&mut ctx)?;

        ctx.set_cipher_list(