mirror of
https://github.com/servo/servo.git
synced 2025-08-06 14:10:11 +01:00
Fixed #8594 -- use a more modern default cipher suite list by default
This commit is contained in:
parent
8b39b9afed
commit
008d99663f
1 changed files with 17 additions and 0 deletions
|
@ -44,10 +44,27 @@ use uuid;
|
|||
|
||||
pub type Connector = HttpsConnector<Openssl>;
|
||||
|
||||
// The basic logic here is to prefer ciphers with ECDSA certificates, Forward
|
||||
// Secrecy, AES GCM ciphers, AES ciphers, and finally 3DES ciphers.
|
||||
// A complete discussion of the issues involved in TLS configuration can be found here:
|
||||
// https://wiki.mozilla.org/Security/Server_Side_TLS
|
||||
const DEFAULT_CIPHERS: &'static str = concat!(
|
||||
"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:",
|
||||
"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:",
|
||||
"DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:",
|
||||
"ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:",
|
||||
"ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:",
|
||||
"ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:",
|
||||
"DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:",
|
||||
"ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:",
|
||||
"AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA"
|
||||
);
|
||||
|
||||
pub fn create_http_connector() -> Arc<Pool<Connector>> {
|
||||
let mut context = SslContext::new(SslMethod::Sslv23).unwrap();
|
||||
context.set_verify(SSL_VERIFY_PEER, None);
|
||||
context.set_CA_file(&resources_dir_path().join("certs")).unwrap();
|
||||
context.set_cipher_list(DEFAULT_CIPHERS).unwrap();
|
||||
let connector = HttpsConnector::new(Openssl {
|
||||
context: Arc::new(context)
|
||||
});
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue