boost::asio::ssl 漏洞扫描应对
- SSL 3.0 POODLE攻击信息泄露漏洞(CVE-2014-3566)
- 服务器支持 TLS Client-initiated 重协商攻击(CVE-2011-1473)
- SSL/TLS 受诫礼(BAR-MITZVAH)攻击漏洞(CVE-2015-2808)
- SSL/TLS RC4 信息泄露漏洞(CVE-2013-2566)
- Secure Renegotiation (CVE-2009-3555)
const char ssl_ciphers[] = "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:!3DES";
context_.set_options(
boost::asio::ssl::context::default_workarounds
| boost::asio::ssl::context::no_sslv2
| boost::asio::ssl::context::no_sslv3 // SSL 3.0 POODLE攻击信息泄露漏洞(CVE-2014-3566)
);
SSL_CTX_set_info_callback(context_.native_handle(),dv_handshake_callback); // 服务器支持 TLS Client-initiated 重协商攻击(CVE-2011-1473)
SSL_CTX_set_cipher_list(context_.native_handle(), ssl_ciphers); // SSL/TLS 受诫礼(BAR-MITZVAH)攻击漏洞(CVE-2015-2808) & SSL/TLS RC4 信息泄露漏洞(CVE-2013-2566)
SSL_CTX_clear_options(context_.native_handle(), SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION); // Secure Renegotiation (CVE-2009-3555) 上面已经禁止了重协商,这里应该不加可以
static void
dv_handshake_callback(const SSL *ssl, int type, int val)
{
if (0 != (type & SSL_CB_HANDSHAKE_DONE))
{
ssl->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
}
}
ssl漏洞测试工具:https://github.com/drwetter/testssl.sh
参考资料:openssl相关漏洞处理