Lukas Tribus 53ae85c38e MINOR: ssl: add prefer-client-ciphers ... Currently we unconditionally set SSL_OP_CIPHER_SERVER_PREFERENCE [1], which may not always be a good thing. The benefit of server side cipher prioritization may not apply to all cases out there, and it appears that the various SSL libs are going away from this recommendation ([2], [3]), as insecure ciphers suites are properly blacklisted/removed and honoring the client's preference is more likely to improve user experience (for example using SW-friendly ciphers on devices without HW AES support). This is especially true for TLSv1.3, which will restrict the cipher suites to just AES-GCM and Chacha20/Poly1305. Apache [4], nginx [5] and others give admins full flexibility, we should as well. The initial proposal to change the current default and add a "prefer-server-ciphers" option (as implemented in e566ecb) has been declined due to the possible security impact. This patch implements prefer-client-ciphers without changing the defaults. [1] https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_options.html [2] https://github.com/openssl/openssl/issues/541 [3] https://github.com/libressl-portable/portable/issues/66 [4] https://httpd.apache.org/docs/2.0/en/mod/mod_ssl.html#sslhonorcipherorder [5] https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers		2017-05-12 15:49:04 +02:00
..
51d.c	CLEANUP: 51d: move global settings out of the global section	2016-12-21 21:30:54 +01:00
acl.c	BUG/MEDIUM: acl: proprely release unused args in prune_acl_expr()	2017-04-19 11:31:44 +02:00
applet.c	BUG/MAJOR: Fix how the list of entities waiting for a buffer is handled	2016-12-12 19:11:04 +01:00
arg.c	BUG/MEDIUM: arg: ensure that we properly unlink unresolved arguments on error	2017-04-13 12:20:52 +02:00
auth.c	CLEANUP: auth: use the build options list to report its support	2016-12-21 21:30:54 +01:00
backend.c	CLEANUP: Replace repeated code to count usable servers with be_usable_srv()	2017-03-13 18:26:05 +01:00
base64.c	[MINOR] add encode/decode function for 30-bit integers from/to base64	2010-10-30 19:04:33 +02:00
buffer.c	CLEANUP: buffers: Remove buffer_bounce_realign function	2017-03-31 14:38:22 +02:00
cfgparse.c	MINOR: server: cli: Add server FQDNs to server-state file and stats socket.	2017-05-03 06:58:53 +02:00
channel.c	BUG/MEDIUM: buffers: Fix how input/output data are injected into buffers	2017-03-31 14:36:04 +02:00
checks.c	BUG/MINOR: checks: don't send proxy protocol with agent checks	2017-05-06 08:45:28 +02:00
chunk.c	MINOR: chunks: implement a simple dynamic allocator for trash buffers	2017-02-08 11:16:29 +01:00
cli.c	MINOR: socket transfer: Set a timeout on the socket.	2017-04-13 19:15:17 +02:00
compression.c	MINOR: compression: fix -vv output without zlib/slz	2017-01-11 16:11:11 +01:00
connection.c	MEDIUM: connection: don't test for CO_FL_WAKE_DATA	2017-03-19 12:17:35 +01:00
da.c	CLEANUP: da: move global settings out of the global section	2016-12-21 21:30:54 +01:00
dns.c	BUG/MINOR: dns: Wrong address family used when creating IPv6 sockets.	2017-04-11 20:02:21 +02:00
ev_epoll.c	MINOR: fd: add a new flag HAP_POLL_F_RDHUP to struct poller	2017-03-21 16:30:35 +01:00
ev_kqueue.c	MEDIUM: kqueue: only set FD_POLL_IN when there are pending data	2017-03-21 16:35:17 +01:00
ev_poll.c	OPTIM: poll: enable support for POLLRDHUP	2017-03-21 16:30:44 +01:00
ev_select.c	MINOR: fd: add a new flag HAP_POLL_F_RDHUP to struct poller	2017-03-21 16:30:35 +01:00
fd.c	MINOR: proxy: Don't close FDs if not our proxy.	2017-04-13 19:15:17 +02:00
filters.c	BUG/MINOR: filters: Don't force the stream's wakeup when we wait in flt_end_analyze	2017-03-31 14:40:45 +02:00
flt_http_comp.c	OPTIM: http: move all http character classs tables into a single one	2016-11-05 15:58:08 +01:00
flt_spoe.c	REORG: spoe: move spoe_encode_varint / spoe_decode_varint from spoe to common	2017-04-27 11:50:41 +02:00
flt_trace.c	MINOR: filters: Add check_timeouts callback to handle timers expiration on streams	2016-11-21 15:29:58 +01:00
freq_ctr.c	BUG/MINOR: time: frequency counters are not totally accurate	2012-12-29 21:50:07 +01:00
frontend.c	MINOR: proxy: Add fe_name/be_name fetchers next to existing fe_id/be_id	2016-12-12 15:10:43 +01:00
haproxy-systemd-wrapper.c	MINOR: systemd wrapper: add support for passing the -x option.	2017-04-13 19:15:17 +02:00
haproxy.c	DOC: update RFC references	2017-04-28 18:58:11 +02:00
hash.c	MINOR: hash: add new function hash_crc32	2015-01-20 19:48:05 +01:00
hdr_idx.c	OPTIM/MINOR: move the hdr_idx pools out of the proxy struct	2011-10-24 18:15:04 +02:00
hlua_fcn.c	BUILD: lua: build failed on FreeBSD.	2016-12-23 18:03:43 +01:00
hlua.c	CLEANUP: lua: remove test	2017-04-26 15:13:18 +02:00
i386-linux-vsys.c	MEDIUM: listener: add support for linux's accept4() syscall	2012-10-08 20:11:03 +02:00
lb_chash.c	BUG/MINOR: hash-balance-factor isn't effective in certain circumstances	2017-04-26 15:45:27 +02:00
lb_fas.c	REORG/MEDIUM: server: split server state and flags in two different variables	2014-05-22 11:27:00 +02:00
lb_fwlc.c	REORG/MEDIUM: server: split server state and flags in two different variables	2014-05-22 11:27:00 +02:00
lb_fwrr.c	REORG/MEDIUM: server: split server state and flags in two different variables	2014-05-22 11:27:00 +02:00
lb_map.c	CLEANUP: remove unneeded casts	2016-04-03 14:17:42 +02:00
listener.c	MINOR: proxy: Don't close FDs if not our proxy.	2017-04-13 19:15:17 +02:00
log.c	CLEANUP: logs: typo: simgle => single	2017-04-18 14:52:07 +02:00
lru.c	MINOR: lru: new function to delete <nb> least recently used keys	2016-01-11 07:31:35 +01:00
mailers.c	MEDIUM: Add parsing of mailers section	2015-02-03 00:24:16 +01:00
map.c	BUG/MINOR: Fix "get map <map> <value>" CLI command	2017-03-13 18:25:53 +01:00
memory.c	CLEANUP: memory: remove the now unused cli_parse_show_pools() function	2016-12-16 19:40:13 +01:00
namespace.c	CLEANUP: namespaces: use the build options list to report it	2016-12-21 21:30:54 +01:00
pattern.c	BUG/MINOR: pattern: Avoid memory leak on out-of-memory condition	2016-03-13 07:47:25 +01:00
payload.c	BUG: payload: fix payload not retrieving arbitrary lengths	2017-03-20 07:25:37 +01:00
peers.c	BUG/MEDIUM: peers: fix buffer overflow control in intdecode.	2017-03-30 12:12:46 +02:00
pipe.c	BUILD/MINOR: silent a build warning in src/pipe.c (fcntl)	2011-10-24 17:09:22 +02:00
proto_http.c	DOC: update RFC references	2017-04-28 18:58:11 +02:00
proto_tcp.c	MINOR: tcp: When binding socket, attempt to reuse one from the old proc.	2017-04-13 19:15:17 +02:00
proto_udp.c	CLEANUP: fix inconsistency between fd->iocb, proto->accept and accept()	2016-04-14 11:18:22 +02:00
proto_uxst.c	MINOR: cli: Add a command to send listening sockets.	2017-04-13 19:15:17 +02:00
protocol.c	BUILD: protocol: fix some build errors on OpenBSD	2016-08-10 19:31:58 +02:00
proxy.c	MINOR: server: cli: Add server FQDNs to server-state file and stats socket.	2017-05-03 06:58:53 +02:00
queue.c	MINOR: proxy: add 'served' field to proxy, equal to total of all servers'	2016-10-25 20:21:32 +02:00
raw_sock.c	BUG/MINOR: raw_sock: always perfom the last recv if RDHUP is not available	2017-03-21 16:30:44 +01:00
rbtree.c
regex.c	MEDIUM: regex: pcre2 support	2016-12-28 12:51:51 +01:00
sample.c	CLEANUP: Remove comment that's no longer valid	2017-03-13 18:26:05 +01:00
server.c	MINOR: server: cli: Add server FQDNs to server-state file and stats socket.	2017-05-03 06:58:53 +02:00
session.c	CLEANUP: connection: completely remove CO_FL_WAKE_DATA	2017-03-19 12:18:27 +01:00
shctx.c	MEDIUM: ssl: Add support for OpenSSL 1.1.0	2016-11-08 20:54:41 +01:00
signal.c	MEDIUM: unblock signals on startup.	2016-04-20 10:53:12 +02:00
ssl_sock.c	MINOR: ssl: add prefer-client-ciphers	2017-05-12 15:49:04 +02:00
standard.c	MINOR: server: Add 'server-template' new keyword supported in backend sections.	2017-04-21 15:42:10 +02:00
stats.c	BUILD/MINOR: stats: remove unexpected argument to stats_dump_json_header()	2017-04-11 07:54:45 +02:00
stick_table.c	BUG/MINOR: sample-fetches/stick-tables: bad type for the sample fetches sc*_get_gpt0	2017-01-05 16:04:05 +01:00
stream_interface.c	BUG/MEDIUM: stream: fix client-fin/server-fin handling	2017-03-21 15:04:43 +01:00
stream.c	BUG/MINOR: http: Fix conditions to clean up a txn and to handle the next request	2017-03-31 14:36:20 +02:00
task.c	MINOR: task: Rename run_queue and run_queue_cur counters	2016-12-12 19:10:54 +01:00
tcp_rules.c	MINOR: tcp-rules: check that the listener exists before updating its counters	2016-12-22 23:26:37 +01:00
time.c	CLEANUP: time: curr_sec_ms doesn't need to be exported	2017-03-29 15:24:33 +02:00
trace.c	BUG/MEDIUM: trace.c: rdtsc() is defined in two files	2016-04-09 22:27:01 +02:00
uri_auth.c	CLEANUP: uniformize last argument of malloc/calloc	2016-04-03 14:17:42 +02:00
vars.c	BUG/MEDIUM: variables: some variable name can hide another ones	2016-12-12 14:34:56 +01:00
wurfl.c	CLEANUP: wurfl: move global settings out of the global section	2016-12-21 21:30:54 +01:00
xxhash.c	CLEANUP: remove unneeded casts	2016-04-03 14:17:42 +02:00