From 517551968f583143a66e900d9a9184efb1606f40 Mon Sep 17 00:00:00 2001 From: Varun Lodaya Date: Wed, 22 Jul 2015 22:57:57 -0700 Subject: [PATCH] Fix to remediate FREAK SSL vulnerability This fix pushes selected set of secure ciphers into haproxy config file Change-Id: Ic7154a961879e1bb56e4567159b8f5614116cc14 Closes-Bug: #1477400 --- src/vnsw/agent/oper/loadbalancer_haproxy.cc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/vnsw/agent/oper/loadbalancer_haproxy.cc b/src/vnsw/agent/oper/loadbalancer_haproxy.cc index d67859ff881..513fc80f702 100644 --- a/src/vnsw/agent/oper/loadbalancer_haproxy.cc +++ b/src/vnsw/agent/oper/loadbalancer_haproxy.cc @@ -61,6 +61,12 @@ void LoadbalancerHaproxy::GenerateGlobal( *out << string(4, ' ') << "daemon" << endl; *out << string(4, ' ') << "user nobody" << endl; *out << string(4, ' ') << "group nogroup" << endl; + *out << string(4, ' ') << "tune.ssl.default-dh-param 2048" << endl; + *out << string(4, ' ') << "ssl-default-bind-ciphers " << + "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:" << + "DH+AES256:ECDH+AES128:DH+AES:" << + "ECDH+3DES:DH+3DES:RSA+AESGCM:" << + "RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS" << endl; *out << endl; }