Lukas Tribus 53ae85c38e MINOR: ssl: add prefer-client-ciphers ... Currently we unconditionally set SSL_OP_CIPHER_SERVER_PREFERENCE [1], which may not always be a good thing. The benefit of server side cipher prioritization may not apply to all cases out there, and it appears that the various SSL libs are going away from this recommendation ([2], [3]), as insecure ciphers suites are properly blacklisted/removed and honoring the client's preference is more likely to improve user experience (for example using SW-friendly ciphers on devices without HW AES support). This is especially true for TLSv1.3, which will restrict the cipher suites to just AES-GCM and Chacha20/Poly1305. Apache [4], nginx [5] and others give admins full flexibility, we should as well. The initial proposal to change the current default and add a "prefer-server-ciphers" option (as implemented in e566ecb) has been declined due to the possible security impact. This patch implements prefer-client-ciphers without changing the defaults. [1] https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_options.html [2] https://github.com/openssl/openssl/issues/541 [3] https://github.com/libressl-portable/portable/issues/66 [4] https://httpd.apache.org/docs/2.0/en/mod/mod_ssl.html#sslhonorcipherorder [5] https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers		2017-05-12 15:49:04 +02:00
..
acl.h	REORG/MAJOR: session: rename the "session" entity to "stream"	2015-04-06 11:23:56 +02:00
action.h	MINOR: http: custom status reason.	2017-01-06 11:57:44 +01:00
applet.h	MINOR: spoe: Remove SPOE details from the appctx structure	2017-03-09 15:32:55 +01:00
arg.h	MINOR: http/conf: store the use_backend configuration file and line for logs	2016-11-25 07:15:09 +01:00
auth.h	MAJOR: auth: Change the internal authentication system.	2014-03-17 18:06:06 +01:00
backend.h	MEDIUM: backend: add the crc32 hash algorithm for load balancing	2015-01-20 19:48:14 +01:00
capture.h	MINOR: capture: extend the captures to support non-header keys	2014-06-13 16:32:48 +02:00
channel.h	BUG/MEDIUM: filters: Fix channels synchronization in flt_end_analyze	2017-03-15 19:09:06 +01:00
checks.h	MAJOR: check: find out which port to use for health check at run time	2016-09-11 08:12:13 +02:00
cli.h	CLEANUP: cli: rename STAT_CLI_* to CLI_ST_*	2016-11-24 16:59:28 +01:00
compression.h	MAJOR: filters/http: Rewrite the HTTP compression as a filter	2016-02-09 14:53:15 +01:00
connection.h	MINOR: cli: Add a command to send listening sockets.	2017-04-13 19:15:17 +02:00
counters.h	CLEANUP: counters: move from 3 types to 2 types	2016-11-25 15:03:12 +01:00
dns.h	MINOR: dns: implement extra 'hold' timers.	2016-11-09 15:30:47 +01:00
fd.h	MINOR: fd: add a new flag HAP_POLL_F_RDHUP to struct poller	2017-03-21 16:30:35 +01:00
filters.h	MINOR: filters: Add check_timeouts callback to handle timers expiration on streams	2016-11-21 15:29:58 +01:00
freq_ctr.h	[MINOR] freq_ctr: add new types and functions for periods different from 1s	2010-08-10 14:01:09 +02:00
global.h	MINOR: proxy: Don't close FDs if not our proxy.	2017-04-13 19:15:17 +02:00
hdr_idx.h	[BUG] files were missing for hdr_idx in previous commit	2006-12-04 02:20:02 +01:00
hlua.h	BUG/MEDIUM: lua: In some case, the return of sample-fetches is ignored (2)	2016-12-14 12:52:47 +01:00
lb_chash.h	MINOR: backend: add hash-balance-factor option for hash-type consistent	2016-10-25 20:21:32 +02:00
lb_fas.h	MEDIUM: backend: add the 'first' balancing algorithm	2012-02-21 22:27:27 +01:00
lb_fwlc.h	[MEDIUM] build: switch ebtree users to use new ebtree version	2009-10-26 21:10:04 +01:00
lb_fwrr.h	[MEDIUM] build: switch ebtree users to use new ebtree version	2009-10-26 21:10:04 +01:00
lb_map.h	[CLEANUP] proxy: move last lb-specific bits to their respective files	2009-10-03 18:41:18 +02:00
listener.h	MINOR: ssl: add prefer-client-ciphers	2017-05-12 15:49:04 +02:00
log.h	CLEANUP: logs: remove unused log format field definitions	2016-08-23 15:25:28 +02:00
mailers.h	MINOR: mailers: make it possible to configure the connection timeout	2016-02-20 15:33:06 +01:00
map.h	CLEANUP: map: it seems that the map were planed to be chained	2016-03-30 15:41:15 +02:00
obj_type.h	CLEANUP: applet: rename struct si_applet to applet	2015-04-23 17:56:16 +02:00
pattern.h	MINOR: map: Add regex matching replacement	2016-02-10 23:38:34 +01:00
peers.h	MINOR: peers: remove the pointer to the stream	2016-10-31 20:07:01 +01:00
pipe.h	[MEDIUM] introduce pipe pools	2009-01-25 13:49:53 +01:00
port_range.h	[MEDIUM] add support for binding to source port ranges during connect	2009-06-10 12:23:32 +02:00
proto_http.h	DOC: update RFC references	2017-04-28 18:58:11 +02:00
proto_udp.h	MEDIUM: protocol: add minimalist UDP protocol client	2015-06-13 22:07:35 +02:00
protocol.h	CLEANUP: fix inconsistency between fd->iocb, proto->accept and accept()	2016-04-14 11:18:22 +02:00
proxy.h	MINOR: server: Add dynamic session cookies.	2017-03-15 11:37:30 +01:00
queue.h	REORG/MAJOR: session: rename the "session" entity to "stream"	2015-04-06 11:23:56 +02:00
sample.h	BUG/MEDIUM: samples: make smp_dup() always duplicate the sample	2016-08-09 14:03:23 +02:00
server.h	MINOR: server: cli: Add server FQDNs to server-state file and stats socket.	2017-05-03 06:58:53 +02:00
session.h	MEDIUM: vars: move the session variables to the session, not the stream	2015-06-19 11:59:02 +02:00
signal.h	[MEDIUM] signals: add support for registering functions and tasks	2010-08-27 18:00:40 +02:00
spoe.h	MINOR: spoe: Add "send-frag-payload" option in spoe-agent section	2017-03-09 15:32:55 +01:00
ssl_sock.h	MEDIUM: boringssl: support native multi-cert selection without bundling	2017-03-02 18:31:05 +01:00
stats.h	MEDIUM: stats: Add show json schema	2017-03-14 11:14:03 +01:00
stick_table.h	MEDIUM: http: implement http-response track-sc* directive	2016-07-26 14:31:14 +02:00
stream_interface.h	BUG/MEDIUM: stream: fix client-fin/server-fin handling	2017-03-21 15:04:43 +01:00
stream.h	MEDIUM: lua: remove Lua struct from session, and allocate it with memory pools	2016-12-21 15:24:56 +01:00
task.h	DIET/MINOR: task: reduce struct task size by 8 bytes	2013-12-09 16:06:22 +01:00
template.h	[CLEANUP] included common/version.h everywhere	2006-06-29 18:54:54 +02:00
vars.h	MEDIUM: vars: Add a per-process scope for variables	2016-11-09 22:57:00 +01:00