Fix to remediate FREAK SSL vulnerability

This fix pushes selected set of secure ciphers into haproxy config file Change-Id: Ic7154a961879e1bb56e4567159b8f5614116cc14 Closes-Bug: #1477400
Juniper · Jul 23, 2015 · 5175519 · 5175519
1 parent c6ea9ac
commit 5175519
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/src/vnsw/agent/oper/loadbalancer_haproxy.cc b/src/vnsw/agent/oper/loadbalancer_haproxy.cc
@@ -61,6 +61,12 @@ void LoadbalancerHaproxy::GenerateGlobal(
     *out << string(4, ' ') << "daemon" << endl;
     *out << string(4, ' ') << "user nobody" << endl;
     *out << string(4, ' ') << "group nogroup" << endl;
+    *out << string(4, ' ') << "tune.ssl.default-dh-param 2048" << endl;
+    *out << string(4, ' ') << "ssl-default-bind-ciphers " <<
+                              "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:" <<
+                              "DH+AES256:ECDH+AES128:DH+AES:" <<
+                              "ECDH+3DES:DH+3DES:RSA+AESGCM:" <<
+                              "RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS" << endl;
     *out << endl;
 }