Fix for FREAK SSL vulnerability

This fix pushes selected set of secure ciphers into haproxy config file Change-Id: I7aff0fab44484fb235ee0432dbee8dc13efc3a63 Closes-Bug: #1477400
Juniper · Jul 23, 2015 · 722886b · 722886b
1 parent 4dcc708
commit 722886b
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/src/vnsw/agent/oper/loadbalancer_haproxy.cc b/src/vnsw/agent/oper/loadbalancer_haproxy.cc
@@ -64,6 +64,12 @@ void LoadbalancerHaproxy::GenerateGlobal(
     *out << string(4, ' ') << "group nogroup" << endl;
     *out << string(4, ' ') << "stats socket " << filename
                            << ".sock mode 0666 level user" << endl;
+    *out << string(4, ' ') << "tune.ssl.default-dh-param 2048" << endl;
+    *out << string(4, ' ') << "ssl-default-bind-ciphers " <<
+                              "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:" <<
+                              "DH+AES256:ECDH+AES128:DH+AES:" <<
+                              "ECDH+3DES:DH+3DES:RSA+AESGCM:" <<
+                              "RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS" << endl;
     *out << endl;
 }