[pve-devel] [PATCH manager v2 3/3] pveproxy: honor_cipher_order by default

[Thomas Lamprecht]

On 2/19/19 7:18 PM, Stoiko Ivanov wrote:
> change the default from client preference to server preference, but leave it
> configurable.
> 
> Signed-off-by: Stoiko Ivanov <s.ivanov at proxmox.com>
> ---
>  PVE/Service/pveproxy.pm | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/PVE/Service/pveproxy.pm b/PVE/Service/pveproxy.pm
> index 7a4a804f..ee74db4c 100755
> --- a/PVE/Service/pveproxy.pm
> +++ b/PVE/Service/pveproxy.pm
> @@ -109,7 +109,7 @@ sub init {
>  	    cipher_list => $proxyconf->{CIPHERS} || 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256',
>  	    key_file => '/etc/pve/local/pve-ssl.key',
>  	    cert_file => '/etc/pve/local/pve-ssl.pem',
> -	    honor_cipher_order => $proxyconf->{HONOR_CIPHER_ORDER},
> +	    honor_cipher_order => $proxyconf->{HONOR_CIPHER_ORDER} // 1,
>  	},
>  	compression => $proxyconf->{COMPRESSION},
>  	# Note: there is no authentication for those pages and dirs!
> 

on another node, we probably want this for PMG too? may even make sense
to switch it default on in http-server (additionally to allow configuring
(disabling) it then in PMG)?