diff options
| author | Andrew Thompson <[email protected]> | 2013-10-21 23:19:34 -0400 |
|---|---|---|
| committer | Andrew Thompson <[email protected]> | 2014-01-21 12:44:36 -0500 |
| commit | cb16d84c66b6040ca668b2e23ad4e740a3f3d0af (patch) | |
| tree | c27337f1930174a8746c11ad9ea2704415fda17e /lib/ssl/src/ssl_handshake.erl | |
| parent | d4046b68c706ce5c4485185738256e5d7bc88138 (diff) | |
| download | otp-cb16d84c66b6040ca668b2e23ad4e740a3f3d0af.tar.gz otp-cb16d84c66b6040ca668b2e23ad4e740a3f3d0af.tar.bz2 otp-cb16d84c66b6040ca668b2e23ad4e740a3f3d0af.zip | |
Implement 'honor_cipher_order' SSL server-side option
HonorCipherOrder as implemented in Apache, nginx, lighttpd, etc. This
instructs the server to prefer its own cipher ordering rather than the
client's and can help protect against things like BEAST while
maintaining compatability with clients which only support older ciphers.
This code is mostly written by Andrew Thompson, only the test case was
added by Andreas Schultz.
Diffstat (limited to 'lib/ssl/src/ssl_handshake.erl')
| -rw-r--r-- | lib/ssl/src/ssl_handshake.erl | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl index f5c0034f1b..62de49a349 100644 --- a/lib/ssl/src/ssl_handshake.erl +++ b/lib/ssl/src/ssl_handshake.erl @@ -1029,14 +1029,15 @@ cipher_suites(Suites, true) -> select_session(SuggestedSessionId, CipherSuites, Compressions, Port, #session{ecc = ECCCurve} = Session, Version, - #ssl_options{ciphers = UserSuites} = SslOpts, Cache, CacheCb, Cert) -> + #ssl_options{ciphers = UserSuites, honor_cipher_order = HCO} = SslOpts, + Cache, CacheCb, Cert) -> {SessionId, Resumed} = ssl_session:server_id(Port, SuggestedSessionId, SslOpts, Cert, Cache, CacheCb), case Resumed of undefined -> Suites = available_suites(Cert, UserSuites, Version, ECCCurve), - CipherSuite = select_cipher_suite(CipherSuites, Suites), + CipherSuite = select_cipher_suite(CipherSuites, Suites, HCO), Compression = select_compression(Compressions), {new, Session#session{session_id = SessionId, cipher_suite = CipherSuite, @@ -1792,6 +1793,11 @@ handle_srp_extension(#srp{username = Username}, Session) -> %%-------------Misc -------------------------------- +select_cipher_suite(CipherSuites, Suites, false) -> + select_cipher_suite(CipherSuites, Suites); +select_cipher_suite(CipherSuites, Suites, true) -> + select_cipher_suite(Suites, CipherSuites). + select_cipher_suite([], _) -> no_suite; select_cipher_suite([Suite | ClientSuites], SupportedSuites) -> |