Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SSL Configuration needs to be moved per port and per connect block #45

Open
rubinlinux opened this issue Dec 29, 2015 · 0 comments
Open

Comments

@rubinlinux
Copy link
Member

The climate for SSL is very hostile right now.

Because of degredation attacks, even accepting SSLv3 is dangerous, a MITM attack can just fall you back to a protocol they can break. So servers (and most clients) do not want to have that as an option.

However, we have some users (such as Johndrinkwater) with old machines currently connecting to afternet with SSLv3 that will break if we disallow it.

We need the ability to specify the cipher details of openssl on a per-port basis. And the outbound connections for linking servers on a per-connect block basis.

The ircd already has seperate init functions for accepting and initiating connections, but they all share the same feature block settings such as SSL_NOSSLV3 so it is currently impossible to have servers link with the latest and greatest, but let clients connect with anything.

In the future, I can see us having the default port be restricted to 'super secure'. but having another port with SSLv3 turned on, for older clients.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant