diff options
| author | Stuart McLaren <stuart.mclaren@hp.com> | 2014-09-19 14:25:10 +0000 |
|---|---|---|
| committer | Stuart McLaren <stuart.mclaren@hp.com> | 2014-09-19 14:25:10 +0000 |
| commit | 9dcf3f16ce1cb7e828ee3d1811bc0ebd44abb106 (patch) | |
| tree | 4a0ca2a023b3b31636de38a3a6bf3371c47bfff9 /glanceclient/common/https.py | |
| parent | 8a877b2752162d6a2db43d7d61d6311c4f42285b (diff) | |
| download | python-glanceclient-9dcf3f16ce1cb7e828ee3d1811bc0ebd44abb106.tar.gz | |
Reduce the set of supported client SSL ciphers
python-glanceclient (like, for example, curl) can advertise the default
set of supported OpenSSL ciphers in its ClientHello packet.
This patches reduces that to a stronger subset.
Change-Id: I7c30465e79d8a32f43458cd6253a98fcf067dc38
Closes-bug: #1370283
Diffstat (limited to 'glanceclient/common/https.py')
| -rw-r--r-- | glanceclient/common/https.py | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/glanceclient/common/https.py b/glanceclient/common/https.py index 4f0e6f5..15b41b0 100644 --- a/glanceclient/common/https.py +++ b/glanceclient/common/https.py @@ -133,6 +133,11 @@ class VerifiedHTTPSConnection(HTTPSConnection): Note: Much of this functionality can eventually be replaced with native Python 3.3 code. """ + # Restrict the set of client supported cipher suites + CIPHERS = 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:'\ + 'eCDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:'\ + 'RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS' + def __init__(self, host, port=None, key_file=None, cert_file=None, cacert=None, timeout=None, insecure=False, ssl_compression=True): @@ -219,6 +224,7 @@ class VerifiedHTTPSConnection(HTTPSConnection): Set up the OpenSSL context. """ self.context = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD) + self.context.set_cipher_list(self.CIPHERS) if self.ssl_compression is False: self.context.set_options(0x20000) # SSL_OP_NO_COMPRESSION |