clearlinux/uwsgi
2
0
Fork 0
mirror of https://github.com/clearlinux/uwsgi.git synced 2026-08-24 23:16:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

protect from SSL beast attack

Browse Source
This commit is contained in:
roberto@backup
2012-05-20 08:44:59 +02:00
parent 3d194cd8cc
commit 85fdfdd81f
2 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/http/http.c
+5 -3
View File
@@ -812,8 +812,9 @@ ssize_t uwsgi_http_ssl_recv(struct http_session *hs, char *buf, size_t len) {
errno = EINPROGRESS;
return -1;
}
uwsgi_error("SSL_read()");
if (err == SSL_ERROR_SYSCALL)
uwsgi_error("SSL_read()");
return -1;
}
@@ -846,7 +847,8 @@ ssize_t uwsgi_http_ssl_send(struct http_session *hs, char *buf, size_t len) {
return -1;
}
uwsgi_error("SSL_write()");
if (err == SSL_ERROR_SYSCALL)
uwsgi_error("SSL_write()");
return -1;
}
utils.c
+14
View File
@@ -4311,6 +4311,14 @@ void uwsgi_ssl_init(void) {
uwsgi.ssl_initialized = 1;
}
void uwsgi_ssl_info_cb(SSL const *ssl, int where, int ret) {
if (where & SSL_CB_HANDSHAKE_DONE) {
if (ssl->s3) {
ssl->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
}
}
}
SSL_CTX *uwsgi_ssl_new_server_context(char *crt, char *key, char *ciphers) {
SSL_CTX *ctx = SSL_CTX_new(SSLv23_server_method());
@@ -4360,13 +4368,19 @@ SSL_CTX *uwsgi_ssl_new_server_context(char *crt, char *key, char *ciphers) {
exit(1);
}
// if ciphers are specified, prefer server ciphers
if (ciphers) {
if (SSL_CTX_set_cipher_list(ctx, ciphers) == 0) {
uwsgi_log("unable to set ssl requested ciphers: %s\n", ciphers);
exit(1);
}
SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
}
SSL_CTX_set_info_callback(ctx, uwsgi_ssl_info_cb);
return ctx;
}