diff options
| author | Jenkins <jenkins@review.openstack.org> | 2015-02-23 16:06:48 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2015-02-23 16:06:48 +0000 |
| commit | 93ca39ba18a2e11e7332527d1af909e046623854 (patch) | |
| tree | affa16f59434011300d9c7d550f3b15149e06bd4 /glanceclient/common/https.py | |
| parent | 654ba87a89d5ceb13e8704ee6366578a60705405 (diff) | |
| parent | 9dcf3f16ce1cb7e828ee3d1811bc0ebd44abb106 (diff) | |
| download | python-glanceclient-93ca39ba18a2e11e7332527d1af909e046623854.tar.gz | |
Merge "Reduce the set of supported client SSL ciphers"
Diffstat (limited to 'glanceclient/common/https.py')
| -rw-r--r-- | glanceclient/common/https.py | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/glanceclient/common/https.py b/glanceclient/common/https.py index b81f7ac..ac140e4 100644 --- a/glanceclient/common/https.py +++ b/glanceclient/common/https.py @@ -141,6 +141,11 @@ class VerifiedHTTPSConnection(HTTPSConnection): Note: Much of this functionality can eventually be replaced with native Python 3.3 code. """ + # Restrict the set of client supported cipher suites + CIPHERS = 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:'\ + 'eCDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:'\ + 'RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS' + def __init__(self, host, port=None, key_file=None, cert_file=None, cacert=None, timeout=None, insecure=False, ssl_compression=True): @@ -235,6 +240,7 @@ class VerifiedHTTPSConnection(HTTPSConnection): Set up the OpenSSL context. """ self.context = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD) + self.context.set_cipher_list(self.CIPHERS) if self.ssl_compression is False: self.context.set_options(0x20000) # SSL_OP_NO_COMPRESSION |