Dzahn has submitted this change and it was merged.
Change subject: ssl_ciphersuite - add new compat mode
......................................................................
ssl_ciphersuite - add new compat mode
add a new compatibility mode besides
the existing
"compat" (which doesn't disable SSLv3)
"strong" (requires Apache 2.4)
called "compatnossl" (yea, give me a better one)
that is like compat so it can work on 2.2
but still disables SSL3
then, use it on ytterbium, for gerrit
Change-Id: I0cff61a2d86060e8c3bd6197eeb5666fee3168dc
---
M modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
1 file changed, 6 insertions(+), 0 deletions(-)
Approvals:
Chmarkine: Looks good to me, but someone else must approve
CSteipp: Looks good to me, but someone else must approve
Filippo Giunchedi: Looks good to me, but someone else must approve
Giuseppe Lavagetto: Looks good to me, but someone else must approve
JanZerebecki: Looks good to me, but someone else must approve
John F. Lewis: Looks good to me, but someone else must approve
BBlack: Looks good to me, but someone else must approve
jenkins-bot: Verified
Dzahn: Looks good to me, approved
diff --git a/modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
b/modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
index bbd0d59..a3c0df7 100644
--- a/modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
+++ b/modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
@@ -48,6 +48,7 @@
module Puppet::Parser::Functions
ciphersuites = {
'compat' =>
'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!DH',
+ 'compatnossl' =>
'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!DH',
'strong' =>
'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!DH'
}
newfunction(
@@ -65,6 +66,7 @@
ssl_ciphersuite('apache-2.4', 'compat') # Compatible config for apache 2.4
ssl_ciphersuite('nginx', 'strong', '365') # PFS-only, use HSTS for 365 days
+ ssl_ciphersuite('apache-2.2', 'compatnossl') # Compatible config for apache
2.2 but don't allow SSL3
END
) do |args|
@@ -112,6 +114,8 @@
output.push('SSLProtocol all -SSLv2 -SSLv3 -TLSv1')
when 'compat' then
output.push('SSLProtocol all -SSLv2')
+ when 'compatnossl' then
+ output.push('SSLProtocol all -SSLv2 -SSLv3')
end
output.push("SSLCipherSuite #{cipherlist}")
output.push('SSLHonorCipherOrder On')
@@ -126,6 +130,8 @@
output.push('ssl_protocols TLSv1.1 TLSv1.2;')
when 'compat' then
output.push('ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;')
+ when 'compatnossl' then
+ output.push('ssl_protocols TLSv1 TLSv1.1 TLSv1.2;')
end
output.push("ssl_ciphers #{cipherlist};")
output.push('ssl_prefer_server_ciphers on;')
--
To view, visit https://gerrit.wikimedia.org/r/166710
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I0cff61a2d86060e8c3bd6197eeb5666fee3168dc
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Dzahn <[email protected]>
Gerrit-Reviewer: Alexandros Kosiaris <[email protected]>
Gerrit-Reviewer: BBlack <[email protected]>
Gerrit-Reviewer: CSteipp <[email protected]>
Gerrit-Reviewer: Chmarkine <[email protected]>
Gerrit-Reviewer: Dzahn <[email protected]>
Gerrit-Reviewer: Faidon Liambotis <[email protected]>
Gerrit-Reviewer: Filippo Giunchedi <[email protected]>
Gerrit-Reviewer: Giuseppe Lavagetto <[email protected]>
Gerrit-Reviewer: JanZerebecki <[email protected]>
Gerrit-Reviewer: John F. Lewis <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
