12:14 p.m.
Changes in V3:
* fixed tests
Lucio Correia (2):
Remove support for TLS v1.0 and add SSL timeout
Update tests
src/nginx/wok.conf.in | 3 ++-
src/wok/proxy.py | 1 +
tests/utils.py | 3 ++-
3 files changed, 5 insertions(+), 2 deletions(-)
--
1.9.1
12:14 p.m.
New subject: [PATCH] [Wok 1/2] Remove support for TLS v1.0 and add SSL timeout
Signed-off-by: Lucio Correia <luciojhc(a)linux.vnet.ibm.com>
---
src/nginx/wok.conf.in | 3 ++-
src/wok/proxy.py | 1 +
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/nginx/wok.conf.in b/src/nginx/wok.conf.in
index 8dd5d7c..cb05e4d 100644
--- a/src/nginx/wok.conf.in
+++ b/src/nginx/wok.conf.in
@@ -62,10 +62,11 @@ http {
ssl_certificate ${cert_pem};
ssl_certificate_key ${cert_key};
- ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers
'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:@STRENGTH';
ssl_prefer_server_ciphers on;
ssl_dhparam ${dhparams_pem};
+ ssl_session_timeout ${session_timeout}m;
add_header Strict-Transport-Security "max-age=31536000;
includeSubdomains;";
add_header X-Frame-Options DENY;
diff --git a/src/wok/proxy.py b/src/wok/proxy.py
index 9d39dbd..a74e88a 100644
--- a/src/wok/proxy.py
+++ b/src/wok/proxy.py
@@ -102,6 +102,7 @@ def _create_proxy_config(options):
websockets_port=options.websockets_port,
cert_pem=cert, cert_key=key,
max_body_size=eval(options.max_body_size),
+ session_timeout=options.session_timeout,
dhparams_pem=dhparams_pem)
# Write file to be used for nginx.
--
1.9.1
12:14 p.m.
New subject: [PATCH] [Wok 2/2] Update tests
Signed-off-by: Lucio Correia <luciojhc(a)linux.vnet.ibm.com>
---
tests/utils.py | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tests/utils.py b/tests/utils.py
index d158ba1..0fa8a53 100644
--- a/tests/utils.py
+++ b/tests/utils.py
@@ -119,7 +119,8 @@ def run_server(host, port, ssl_port, test_mode, cherrypy_port=None,
'websockets_port': 64667, 'ssl_cert': '',
'ssl_key': '',
'max_body_size': '4*1024', 'test': test_mode,
'access_log': '/dev/null', 'error_log':
'/dev/null',
- 'environment': environment, 'log_level':
'debug'})()
+ 'environment': environment, 'log_level':
'debug',
+ 'session_timeout': 10})()
if model is not None:
setattr(args, 'model', model)
--
1.9.1
3081
days inactive
3082
days old
3 comments
2 participants
participants (2)
-
Aline Manera -
Lucio Correia