mirrors/Nim
1
0
Fork 0
mirror of https://github.com/nim-lang/Nim.git synced 2026-05-02 20:14:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

net: use a secure cipher list by default

Browse Source 
Previously, the `net` module use the blanket "ALL" as the default cipher
list. This list may contain security ciphers that are weak and/or outdated
according to the current standard.

This commit introduces a new module `ssl_config` that contains the
latest OpenSSL configurations as recommended by Mozilla OpSec, and
make the `net` module use the cipher list targeting `intermediate`
compatibility level as the default.
This commit is contained in:
Leorize
2020-06-03 17:02:18 -05:00
committed by Andreas Rumpf
parent 6cb94b5da6
commit 1fb2a58674
5 changed files with 125 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
lib/pure/net.nim
View File

@@ -68,6 +68,7 @@ import std/private/since
import nativesockets, os, strutils, times, sets, options, std/monotimes
from ssl_certs import scanSSLCertificates
import ssl_config
export nativesockets.Port, nativesockets.`$`, nativesockets.`==`
export Domain, SockType, Protocol
@@ -533,7 +534,7 @@ when defineSsl:
raiseSSLError("Verification of private key file failed.")
proc newContext*(protVersion = protSSLv23, verifyMode = CVerifyPeer,
certFile = "", keyFile = "", cipherList = "ALL",
certFile = "", keyFile = "", cipherList = CiphersIntermediate,
caDir = "", caFile = ""): SSLContext =
## Creates an SSL context.
##

51
lib/pure/ssl_config.nim Normal file
View File

@@ -0,0 +1,51 @@
# This file was automatically generated by tools/ssl_config_parser on 2020-06-03T22:02:05Z. DO NOT EDIT.
## This module contains SSL configuration parameters obtained from
## `Mozilla OpSec <https://wiki.mozilla.org/Security/Server_Side_TLS>`_.
##
## The configuration file used to generate this module: https://ssl-config.mozilla.org/guidelines/5.4.json
const CiphersModern* = "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
## An OpenSSL-compatible list of secure ciphers for ``modern`` compatibility
## per Mozilla's recommendations.
##
## Oldest clients supported by this list:
## * Firefox 63
## * Android 10.0
## * Chrome 70
## * Edge 75
## * Java 11
## * OpenSSL 1.1.1
## * Opera 57
## * Safari 12.1
const CiphersIntermediate* = "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
## An OpenSSL-compatible list of secure ciphers for ``intermediate`` compatibility
## per Mozilla's recommendations.
##
## Oldest clients supported by this list:
## * Firefox 27
## * Android 4.4.2
## * Chrome 31
## * Edge
## * IE 11 on Windows 7
## * Java 8u31
## * OpenSSL 1.0.1
## * Opera 20
## * Safari 9
const CiphersOld* = "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
## An OpenSSL-compatible list of secure ciphers for ``old`` compatibility
## per Mozilla's recommendations.
##
## Oldest clients supported by this list:
## * Firefox 1
## * Android 2.3
## * Chrome 1
## * Edge 12
## * IE8 on Windows XP
## * Java 6
## * OpenSSL 0.9.8
## * Opera 5
## * Safari 1