MINOR: ssl: add prefer-client-ciphers

Currently we unconditionally set SSL_OP_CIPHER_SERVER_PREFERENCE [1],
which may not always be a good thing.

The benefit of server side cipher prioritization may not apply to all
cases out there, and it appears that the various SSL libs are going away
from this recommendation ([2], [3]), as insecure ciphers suites are
properly blacklisted/removed and honoring the client's preference is
more likely to improve user experience  (for example using SW-friendly
ciphers on devices without HW AES support).

This is especially true for TLSv1.3, which will restrict the cipher
suites to just AES-GCM and Chacha20/Poly1305.

Apache [4], nginx [5] and others give admins full flexibility, we should
as well.

The initial proposal to change the current default and add a
"prefer-server-ciphers" option (as implemented in e566ecb) has been
declined due to the possible security impact.

This patch implements prefer-client-ciphers without changing the defaults.

[1] https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_options.html
[2] https://github.com/openssl/openssl/issues/541
[3] https://github.com/libressl-portable/portable/issues/66
[4] https://httpd.apache.org/docs/2.0/en/mod/mod_ssl.html#sslhonorcipherorder
[5] https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers

diff --git a/doc/configuration.txt b/doc/configuration.txt
index 06a1a2af3ebd8f5024816da6ee1a898331b10dd0..fea06cb5c91c1c25f9ae1f77b8e54fd21296a75d 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -10592,6 +10592,11 @@ npn <protocols>
   enabled (check with haproxy -vv). Note that the NPN extension has been
   replaced with the ALPN extension (see the "alpn" keyword).
 
+prefer-client-ciphers
+  Use the client's preference when selecting the cipher suite, by default
+  the server's preference is enforced. This option is also available on
+  global statement "ssl-default-bind-options".
+
 process [ all | odd | even | <number 1-64>[-<number 1-64>] ]
   This restricts the list of processes on which this listener is allowed to
   run. It does not enforce any process but eliminates those which do not match.

diff --git a/include/types/listener.h b/include/types/listener.h
index 2b8f5feb64fe173984224542bed3aad36f299691..8aae395e0d6b1d3733ae549e4b7ea70750d15baa 100644 (file)
--- a/include/types/listener.h
+++ b/include/types/listener.h
@@ -114,6 +114,7 @@ enum li_state {
 #define BC_SSL_O_USE_TLSV12     0x0080 /* force TLSv12 */
 /* 0x00F0 reserved for 'force' protocol version options */
 #define BC_SSL_O_NO_TLS_TICKETS 0x0100 /* disable session resumption tickets */
+#define BC_SSL_O_PREF_CLIE_CIPH 0x0200  /* prefer client ciphers */
 #endif
 
 /* ssl "bind" settings */

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 48ad1b26e294c66ef1f90103aa88be542888aaa7..acb7d283f5a3b5b6ae8478ddbf89b5d9a054f423 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -3238,6 +3238,8 @@ ssl_sock_initial_ctx(struct bind_conf *bind_conf)
        }
        if (conf_ssl_options & BC_SSL_O_NO_TLS_TICKETS)
                ssloptions |= SSL_OP_NO_TICKET;
+       if (conf_ssl_options & BC_SSL_O_PREF_CLIE_CIPH)
+               ssloptions &= ~SSL_OP_CIPHER_SERVER_PREFERENCE;
        SSL_CTX_set_options(ctx, ssloptions);
        SSL_CTX_set_mode(ctx, sslmode);
        if (global_ssl.life_time)
@@ -6327,6 +6329,13 @@ static int bind_parse_ssl(char **args, int cur_arg, struct proxy *px, struct bin
        return 0;
 }
 
+/* parse the "prefer-client-ciphers" bind keyword */
+static int bind_parse_pcc(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
+{
+        conf->ssl_options |= BC_SSL_O_PREF_CLIE_CIPH;
+        return 0;
+}
+
 /* parse the "generate-certificates" bind keyword */
 static int bind_parse_generate_certs(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
 {
@@ -6870,6 +6879,8 @@ static int ssl_parse_default_bind_options(char **args, int section_type, struct
                }
                else if (!strcmp(args[i], "no-tls-tickets"))
                        global_ssl.listen_default_ssloptions |= BC_SSL_O_NO_TLS_TICKETS;
+               else if (!strcmp(args[i], "prefer-client-ciphers"))
+                       global_ssl.listen_default_ssloptions |= BC_SSL_O_PREF_CLIE_CIPH;
                else {
                        memprintf(err, "unknown option '%s' on global statement '%s'.", args[i], args[0]);
                        return -1;
@@ -7505,6 +7516,7 @@ static struct bind_kw_list bind_kws = { "SSL", { }, {
        { "tls-ticket-keys",       bind_parse_tls_ticket_keys, 1 }, /* set file to load TLS ticket keys from */
        { "verify",                bind_parse_verify,          1 }, /* set SSL verify method */
        { "npn",                   bind_parse_npn,             1 }, /* set NPN supported protocols */
+       { "prefer-client-ciphers", bind_parse_pcc,             0 }, /* prefer client ciphers */
        { NULL, NULL, 0 },
 }};