mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Disable the BEAST protection by default because the GUI *will* break if you use this and have a Hifn card installed. Others may break similarly. Change it into a checkbox option, off by default, and automatically disable it if a conflicting card has been detected.

Browse Source
This commit is contained in:
jim-p 2013-07-18 09:30:20 -04:00
parent 436a9a88b8
commit 30adceda1f
2 changed files with 58 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
etc/inc/system.inc
View File

@ -1125,8 +1125,27 @@ EOD;
// Harden SSL a bit for PCI conformance testing
$lighty_config .= "ssl.use-sslv2 = \"disable\"\n";
$lighty_config .= "ssl.honor-cipher-order = \"enable\"\n";
$lighty_config .= "ssl.cipher-list = \"ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM\"\n";
/* Hifn accelerators do NOT work with the BEAST mitigation code. Do not allow it to be enabled if a Hifn card has been detected. */
$fd = @fopen("{$g['varlog_path']}/dmesg.boot", "r");
if ($fd) {
while (!feof($fd)) {
$dmesgl = fgets($fd);
if (preg_match("/^hifn.: (.*?),/", $dmesgl, $matches) && isset($config['system']['webgui']['beast_protection'])) {
unset($config['system']['webgui']['beast_protection']);
log_error("BEAST Protection disabled because a conflicting cryptographic accelerator card has been detected (" . $matches[1] . ")");
break;
}
}
fclose($fd);
}
if (isset($config['system']['webgui']['beast_protection'])) {
$lighty_config .= "ssl.honor-cipher-order = \"enable\"\n";
$lighty_config .= "ssl.cipher-list = \"ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM\"\n";
} else {
$lighty_config .= "ssl.cipher-list = \"DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:CAMELLIA256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:CAMELLIA128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:!aNULL:!eNULL:!3DES:@STRENGTH\"\n";
}
if(!(empty($ca) || (strlen(trim($ca)) == 0)))
$lighty_config .= "ssl.ca-file = \"{$g['varetc_path']}/{$ca_location}\"\n\n";

37
usr/local/www/system_advanced_admin.php
View File

@ -58,6 +58,7 @@ $pconfig['disableconsolemenu'] = isset($config['system']['disableconsolemenu']);
$pconfig['noantilockout'] = isset($config['system']['webgui']['noantilockout']);
$pconfig['nodnsrebindcheck'] = isset($config['system']['webgui']['nodnsrebindcheck']);
$pconfig['nohttpreferercheck'] = isset($config['system']['webgui']['nohttpreferercheck']);
$pconfig['beast_protection'] = isset($config['system']['webgui']['beast_protection']);
$pconfig['noautocomplete'] = isset($config['system']['webgui']['noautocomplete']);
$pconfig['althostnames'] = $config['system']['webgui']['althostnames'];
$pconfig['enableserial'] = $config['system']['enableserial'];
@ -166,6 +167,11 @@ if ($_POST) {
else
unset($config['system']['webgui']['nohttpreferercheck']);
if ($_POST['beast_protection'] == "yes")
$config['system']['webgui']['beast_protection'] = true;
else
unset($config['system']['webgui']['beast_protection']);
if ($_POST['noautocomplete'] == "yes")
$config['system']['webgui']['noautocomplete'] = true;
else
@ -239,6 +245,21 @@ if ($_POST) {
}
}
unset($hwcrypto);
$fd = @fopen("{$g['varlog_path']}/dmesg.boot", "r");
if ($fd) {
while (!feof($fd)) {
$dmesgl = fgets($fd);
if (preg_match("/^hifn.: (.*?),/", $dmesgl, $matches)) {
unset($pconfig['beast_protection']);
$disable_beast_option = "disabled";
$hwcrypto = $matches[1];
break;
}
}
fclose($fd);
}
$pgtitle = array(gettext("System"),gettext("Advanced: Admin Access"));
include("head.inc");
@ -450,6 +471,22 @@ function prot_change() {
"webConfigurator access in certain corner cases such as using external scripts to interact with this system. More information on HTTP_REFERER is available from <a target='_blank' href='http://en.wikipedia.org/wiki/HTTP_referrer'>Wikipedia</a>."); ?>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("BEAST Attack Protection"); ?></td>
<td width="78%" class="vtable">
<input name="beast_protection" type="checkbox" id="beast_protection" value="yes" <?php if ($pconfig['beast_protection']) echo "checked=\"checked\""; ?> <?= $disable_beast_option ?>/>
<strong><?=gettext("Mitigate the BEAST SSL Attack"); ?></strong>
<br/>
<?php echo gettext("When this is checked, the webConfigurator can mitigate BEAST SSL attacks. ") ?>
<br/>
<?php if ($disable_beast_option) {
echo "<br/>" . sprintf(gettext("This option has been automatically disabled because a conflicting cryptographic accelerator card has been detected (%s)."), $hwcrypto) . "<br/><br/>";
} ?>
<?php echo gettext("This option is off by default because Hifn accelerators do NOT work with this option, and the GUI will not function. " .
"It is possible that other accelerators have a similar problem that is not yet known/documented. " .
"More information on BEAST is available from <a target='_blank' href='https://en.wikipedia.org/wiki/Transport_Layer_Security#BEAST_attack'>Wikipedia</a>."); ?>
</td>
</tr>
<tr>
<td colspan="2" class="list" height="12">&nbsp;</td>
</tr>