MirrorHub/construct
0
0
Fork 0
mirror of https://github.com/matrix-construct/construct synced 2024-11-29 10:12:39 +01:00
Code Issues Releases Wiki Activity

ircd::net::acceptor: Add conf::item to blacklist ciphers out of the supported cipher list.

Browse source
This commit is contained in:
Jason Volk 2019-03-12 17:47:57 -07:00
parent e4fd5111fa
commit 721039f359
2 changed files with 27 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
include/ircd/net/acceptor.h
View file

@ -26,6 +26,7 @@ struct ircd::net::acceptor
static log::log log;
static conf::item<milliseconds> timeout;
static conf::item<std::string> ssl_cipher_list;
static conf::item<std::string> ssl_cipher_blacklist;
net::listener *listener_;
std::string name;

26
ircd/net.cc
View file

@ -1109,6 +1109,13 @@ ircd::net::acceptor::ssl_cipher_list
{ "default", string_view{} },
};
decltype(ircd::net::acceptor::ssl_cipher_blacklist)
ircd::net::acceptor::ssl_cipher_blacklist
{
{ "name", "ircd.net.acceptor.ssl.cipher.blacklist" },
{ "default", string_view{} },
};
std::ostream &
ircd::net::operator<<(std::ostream &s, const acceptor &a)
{
@ -1572,6 +1579,25 @@ ircd::net::acceptor::configure(const json::object &opts)
const string_view &list(ssl_cipher_list);
openssl::set_cipher_list(*ssl.native_handle(), list);
}
else if(!empty(string_view(ssl_cipher_blacklist)))
{
assert(ssl.native_handle());
std::stringstream res;
const string_view &blacklist(ssl_cipher_blacklist);
const auto ciphers(openssl::cipher_list(*ssl.native_handle(), 0));
ircd::tokens(ciphers, ':', [&res, &blacklist]
(const string_view &cipher)
{
if(!has(blacklist, cipher))
res << cipher << ':';
});
std::string list(res.str());
assert(list.empty() || list.back() == ':');
list.pop_back();
openssl::set_cipher_list(*ssl.native_handle(), list);
}
if(!empty(unquote(opts["ssl_curve_list"])))
{