Merge lp:~pedronis/ubuntu-push/no-rc4-cipher-suites-no-ssl-v3 into lp:ubuntu-push/automatic

[Samuele Pedroni]

servers shouldn't allow sslv3 and shouldn't advertize rc4 cipher suites

servers shouldn't allow sslv3 and shouldn't advertize rc4 cipher suites

[lp:~pedronis/ubuntu-push/no-rc4-cipher-suites-no-ssl-v3]

376. By Samuele Pedroni on 2015-03-18

remove debug print

[Bret Barker (noise)]

looks good.

review: Approve

[Guillermo Gonzalez (verterok)]

+1

review: Approve

=== modified file 'server/tlsconfig.go'
--- server/tlsconfig.go	2014-09-04 12:51:08 +0000
+++ server/tlsconfig.go	2015-03-18 14:44:53 +0000
@@ -48,6 +48,18 @@
 	tlsCfg := &tls.Config{
 		Certificates:           []tls.Certificate{cfg.cert},
 		SessionTicketsDisabled: true,
+		// order from crypto/tls/cipher_suites.go, no RC4
+		CipherSuites: []uint16{
+			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+			tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+			tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+			tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+		},
+		MinVersion: tls.VersionTLS12,
 	}
 	return tlsCfg
 }