Hello!

On Tue, Jun 14, 2011 at 09:58:21AM +0100, Rob Stradling wrote:

> Hi. NGX_DEFAULT_CIPHERS specifies !ADH to exclude the Anonymous DH
> ciphersuites. With OpenSSL-0.x, this has the effect of disabling all
> ciphersuites that offer no authentication. However, OpenSSL-1.x adds support
> for Anonymous ECDH ciphersuites, and these are not disabled by !ADH.
>
> !aNULL is the appropriate cipher string for disabling all anonymous
> ciphersuites. [1] observes that anonymous ciphersuites 'are vulnerable to a
> "man in the middle'' attack and so their use is normally discouraged.'
>
> Trivial patch attached.

Yes, thank you for the patch. While not strictly necessary right
now as nginx doesn't set ephemeral ECDH key and hence ECDH doesn't
work anyway, I agree that using !aNULL is better.

> Apache httpd just committed a patch for the same issue [2].
>
> [1] http://www.openssl.org/docs/apps/ciphers.html
> [2] https://issues.apache.org/bugzilla/show_bug.cgi?id=51363
>
> Rob Stradling
> Senior Research & Development Scientist
> COMODO - Creating Trust Online

> diff -ur nginx-1.0.4/conf/nginx.conf nginx-1.0.4-defaultcipher/conf/nginx.conf
> --- nginx-1.0.4/conf/nginx.conf 2009-04-06 14:43:46.000000000 +0100
> +++ nginx-1.0.4-defaultcipher/conf/nginx.conf 2011-06-14 09:36:25.250146709 +0100
> @@ -106,7 +106,7 @@
> # ssl_session_timeout 5m;
>
> # ssl_protocols SSLv2 SSLv3 TLSv1;
> - # ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
> + # ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
> # ssl_prefer_server_ciphers on;
>
> # location / {
> diff -ur nginx-1.0.4/src/http/modules/ngx_http_ssl_module.c nginx-1.0.4-defaultcipher/src/http/modules/ngx_http_ssl_module.c
> --- nginx-1.0.4/src/http/modules/ngx_http_ssl_module.c 2010-05-14 10:56:37.000000000 +0100
> +++ nginx-1.0.4-defaultcipher/src/http/modules/ngx_http_ssl_module.c 2011-06-14 09:33:42.085994902 +0100
> @@ -13,7 +13,7 @@
> ngx_pool_t *pool, ngx_str_t *s);
>
>
> -#define NGX_DEFAULT_CIPHERS "HIGH:!ADH:!MD5"
> +#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
>
>
> static ngx_int_t ngx_http_ssl_static_variable(ngx_http_request_t *r,

This should be changed in src/mail/ngx_mail_ssl_module.c as well.
Otherwise looks good. Tested just to be sure - works well here
with OpenSSL 0.9.7 (oldest OpenSSL supported by nginx).

To Igor: could you please commit this (and the same change to
mail)?

Maxim Dounin

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://nginx.org/mailman/listinfo/nginx-devel