mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Explicit disable ssl.use-compression on lighty config. It should fix #4230

Browse Source
This commit is contained in:
Renato Botelho 2015-03-11 14:09:22 -03:00
parent 8304fb462a
commit cd8ce13c29
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
etc/inc/system.inc
View File

@ -1344,6 +1344,9 @@ EOD;
// where ssl.cipher-list is set, this is automatically enabled, but set it explicitly anyway.
$lighty_config .= "ssl.honor-cipher-order = \"enable\"\n";
// Explicit disable compression to mitigate CRIME attack
$lighty_config .= "ssl.use-compression = \"disable\"\n";
$lighty_config .= "ssl.cipher-list = \"AES128+EECDH:AES256+EECDH:AES128+EDH:AES256+EDH:AES128-SHA:AES256-SHA:!aNULL:!eNULL:!DSS\"\n";
if(!(empty($ca) || (strlen(trim($ca)) == 0)))