From 7befee11a8f114c43614ad20c3d470e202deb8dc Mon Sep 17 00:00:00 2001 From: Lars Magne Ingebrigtsen Date: Mon, 8 Dec 2014 22:23:41 +0100 Subject: * lisp/net/nsm.el (nsm-check-protocol): Test for RC4 on `high'. --- lisp/net/nsm.el | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) (limited to 'lisp/net/nsm.el') diff --git a/lisp/net/nsm.el b/lisp/net/nsm.el index 659f96922c5..16e07ff088c 100644 --- a/lisp/net/nsm.el +++ b/lisp/net/nsm.el @@ -177,7 +177,11 @@ unencrypted." process)))))) (defun nsm-check-protocol (process host port status settings) - (let ((prime-bits (plist-get status :diffie-hellman-prime-bits))) + (let ((prime-bits (plist-get status :diffie-hellman-prime-bits)) + (encryption (format "%s-%s-%s" + (plist-get status :key-exchange) + (plist-get status :cipher) + (plist-get status :mac)))) (cond ((and prime-bits (< prime-bits 1024) @@ -186,10 +190,17 @@ unencrypted." (not (nsm-query host port status :diffie-hellman-prime-bits - "The Diffie-Hellman prime bits (%s) used for this connection to\n%s:%s\nis less than what is considerer safe (%s)." + "The Diffie-Hellman prime bits (%s) used for this connection to\n%s:%s\nis less than what is considered safe (%s)." prime-bits host port 1024))) (delete-process process) nil) + ((and (string-match "\\bRC4\\b" encryption) + (not (memq :rc4 (plist-get settings :conditions))) + (not + (nsm-query + host port status :rc4 + "The connection to %s:%s uses the RC4 algorithm (%s), which is believed to be unsafe." + host port encryption)))) (t process)))) -- cgit v1.2.1