From 85fdfdd81fc48dbced04f7e4c57f8d47e2d3f650 Mon Sep 17 00:00:00 2001
From: "roberto@backup" <roberto@backup>
Date: Sun, 20 May 2012 08:44:59 +0200
Subject: [PATCH] protect from SSL beast attack

---
 plugins/http/http.c |  8 +++++---
 utils.c             | 14 ++++++++++++++
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/plugins/http/http.c b/plugins/http/http.c
index f78e9c96..a9f49b5c 100644
--- a/plugins/http/http.c
+++ b/plugins/http/http.c
@@ -812,8 +812,9 @@ ssize_t uwsgi_http_ssl_recv(struct http_session *hs, char *buf, size_t len) {
                 errno = EINPROGRESS;
 		return -1;
         }
-
-        uwsgi_error("SSL_read()");
+	
+	if (err == SSL_ERROR_SYSCALL)
+        	uwsgi_error("SSL_read()");
         return -1;
 
 }
@@ -846,7 +847,8 @@ ssize_t uwsgi_http_ssl_send(struct http_session *hs, char *buf, size_t len) {
 		return -1;
 	}
 
-	uwsgi_error("SSL_write()");
+	if (err == SSL_ERROR_SYSCALL)
+		uwsgi_error("SSL_write()");
 	return -1;
 }
 
diff --git a/utils.c b/utils.c
index fd2bd755..4ce80570 100644
--- a/utils.c
+++ b/utils.c
@@ -4311,6 +4311,14 @@ void uwsgi_ssl_init(void) {
 	uwsgi.ssl_initialized = 1;
 }
 
+void uwsgi_ssl_info_cb(SSL const *ssl, int where, int ret) {
+	if (where & SSL_CB_HANDSHAKE_DONE) {
+		if (ssl->s3) {
+            		ssl->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
+		}
+	}
+}
+
 SSL_CTX *uwsgi_ssl_new_server_context(char *crt, char *key, char *ciphers) {
 	
 	SSL_CTX *ctx = SSL_CTX_new(SSLv23_server_method());
@@ -4360,13 +4368,19 @@ SSL_CTX *uwsgi_ssl_new_server_context(char *crt, char *key, char *ciphers) {
 		exit(1);
 	}
 
+	// if ciphers are specified, prefer server ciphers
 	if (ciphers) {
 		if (SSL_CTX_set_cipher_list(ctx, ciphers) == 0) {
 			uwsgi_log("unable to set ssl requested ciphers: %s\n", ciphers);
 			exit(1);
 		}
+
+		SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
 	}
 
+
+	SSL_CTX_set_info_callback(ctx, uwsgi_ssl_info_cb);
+
 	return ctx;
 }