boost::asio::ssl 漏洞扫描应对

boost::asio::ssl 漏洞扫描应对

• SSL 3.0 POODLE攻击信息泄露漏洞(CVE-2014-3566)
• 服务器支持 TLS Client-initiated 重协商攻击(CVE-2011-1473)
• SSL/TLS 受诫礼(BAR-MITZVAH)攻击漏洞(CVE-2015-2808)
• SSL/TLS RC4 信息泄露漏洞(CVE-2013-2566)
• Secure Renegotiation (CVE-2009-3555)

const  char ssl_ciphers[] = "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:!3DES";
context_.set_options(
	boost::asio::ssl::context::default_workarounds
	| boost::asio::ssl::context::no_sslv2 
	| boost::asio::ssl::context::no_sslv3 // SSL 3.0 POODLE攻击信息泄露漏洞(CVE-2014-3566)
	);
SSL_CTX_set_info_callback(context_.native_handle(),dv_handshake_callback); // 服务器支持 TLS Client-initiated 重协商攻击(CVE-2011-1473)
SSL_CTX_set_cipher_list(context_.native_handle(), ssl_ciphers); // SSL/TLS 受诫礼(BAR-MITZVAH)攻击漏洞(CVE-2015-2808)  & SSL/TLS RC4 信息泄露漏洞(CVE-2013-2566)
SSL_CTX_clear_options(context_.native_handle(), SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION); // Secure Renegotiation (CVE-2009-3555)  上面已经禁止了重协商，这里应该不加可以

static void
dv_handshake_callback(const SSL *ssl, int type, int val)
{
	if (0 != (type & SSL_CB_HANDSHAKE_DONE))
	{
		ssl->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
	}
}

ssl漏洞测试工具：https://github.com/drwetter/testssl.sh

参考资料：openssl相关漏洞处理