瀏覽代碼

[core] Use cipher list to restrict ciphers used for Hue SSL

Abraham Elmahrek 12 年之前
父節點
當前提交
2b4169b

+ 5 - 0
desktop/core/src/desktop/conf.py

@@ -62,6 +62,11 @@ SSL_PRIVATE_KEY = Config(
   help=_("Filename of SSL RSA Private Key"),
   default=None)
 
+SSL_CIPHER_LIST = Config(
+  key="ssl_cipher_list",
+  help=_("List of allowed and disallowed ciphers"),
+  default="DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2")
+
 ENABLE_SERVER = Config(
   key="enable_server",
   help=_("If set to false, runcpserver will not actually start the web server.  Used if Apache is being used as a WSGI container."),

+ 2 - 0
desktop/core/src/desktop/lib/wsgiserver.py

@@ -1508,6 +1508,7 @@ class CherryPyWSGIServer(object):
     # Paths to certificate and private key files
     ssl_certificate = None
     ssl_private_key = None
+    ssl_cipher_list = "DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2"
     
     def __init__(self, bind_addr, wsgi_app, numthreads=10, server_name=None,
                  max=-1, request_queue_size=5, timeout=10, shutdown_timeout=5):
@@ -1663,6 +1664,7 @@ class CherryPyWSGIServer(object):
             
             # See http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/442473
             ctx = SSL.Context(SSL.SSLv23_METHOD)
+            ctx.set_cipher_list(self.ssl_cipher_list)
             ctx.use_privatekey_file(self.ssl_private_key)
             ctx.use_certificate_file(self.ssl_certificate)
             self.socket = SSLConnection(ctx, self.socket)

+ 4 - 2
desktop/core/src/desktop/management/commands/runcherrypyserver.py

@@ -39,7 +39,8 @@ CPSERVER_OPTIONS = {
   'server_user': conf.SERVER_USER.get(),
   'server_group': conf.SERVER_GROUP.get(),
   'ssl_certificate': conf.SSL_CERTIFICATE.get(),
-  'ssl_private_key': conf.SSL_PRIVATE_KEY.get()
+  'ssl_private_key': conf.SSL_PRIVATE_KEY.get(),
+  'ssl_cipher_list': conf.SSL_CIPHER_LIST.get()
 }
 
 
@@ -80,7 +81,8 @@ def start_server(options):
     )
     if options['ssl_certificate'] and options['ssl_private_key']:
         server.ssl_certificate = options['ssl_certificate']
-        server.ssl_private_key = options['ssl_private_key']  
+        server.ssl_private_key = options['ssl_private_key']
+        server.ssl_cipher_list = options['ssl_cipher_list']
     try:
         server.bind_server()
         drop_privileges_if_necessary(options)