Freeze break request: adding cipher to dl*.fedoraproject.org for BFO

[Patrick Uiterwijk]

Hi all,

Since boot.fedoraproject.org does not support (EC)DHE_ ciphers, the attached patch will
add support for RSA_WITH_AES_256_CBC_SHA256 to dl*.fedoraproject.org.
Please +1 or -2?


> From c4e72c37cedb2fd14e948f7a82d5ac14c12dc292 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk(a)redhat.com&gt;
Date: Thu, 20 Nov 2014 21:12:21 +0000
Subject: [PATCH] Enable RSA_WITH_AES_256_CBC_SHA256 for bfo

---
 .../download/files/httpd/dl.fedoraproject.org.conf |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/roles/download/files/httpd/dl.fedoraproject.org.conf
b/roles/download/files/httpd/dl.fedoraproject.org.conf
index 7be586c..1129149 100644
--- a/roles/download/files/httpd/dl.fedoraproject.org.conf
+++ b/roles/download/files/httpd/dl.fedoraproject.org.conf
@@ -23,9 +23,10 @@
   # https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14
   # If you change the protocols or cipher suites, you should probably update
   # modules/squid/files/squid.conf-el6 too, to keep it in sync.
+  # RSA_WITH_AES_256_CBC_SHA256 is supported for boot.fedoraproject.org (iPXE doesn't
support DHE_ or ECDHE_)

    SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
-   SSLCipherSuite
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+   SSLCipherSuite
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:RSA_WITH_AES_256_CBC_SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

   Include "conf.d/dl.fedoraproject.org/*.conf"
 </VirtualHost>
-- 
1.7.2.1



With kind regards,
Patrick Uiterwijk
Associate Software Engineer, Red Hat

[Kevin Fenzi]

On Thu, 20 Nov 2014 16:17:50 -0500 (EST)
Patrick Uiterwijk <puiterwijk(a)redhat.com&gt; wrote:

>  Hi all,
>  
>  Since boot.fedoraproject.org does not support (EC)DHE_ ciphers, the
>  attached patch will add support for RSA_WITH_AES_256_CBC_SHA256 to
>  dl*.fedoraproject.org. Please +1 or -2? 
+2 ! :) 

ok, +1

kevin

[Toshio Kuratomi]

On Thu, Nov 20, 2014 at 04:17:50PM -0500, Patrick Uiterwijk wrote:
>  Hi all,
>  
>  Since boot.fedoraproject.org does not support (EC)DHE_ ciphers, the attached patch will
> add support for RSA_WITH_AES_256_CBC_SHA256 to dl*.fedoraproject.org.
>  Please +1 or -2?
>   
+1

-Toshio

FIX Freeze break request: adding cipher to dl*.fedoraproject.org for BFO

[Patrick Uiterwijk]

Hi,

Sorry for the mistake in the previous one: I had specified the name of the cipher, which
is not the same as the OpenSSL cipher spec.
Here another patch that does the same but now actually uses the correct cipher spec (and
so works).
The only change wrt the previous patch is that the cipher name
(TLS_RSA_WITH_AES_256_CBC_SHA) has been replaced with the cipher spec (AES256-SHA).


> From 1833afa7dd674059a1d1e250a9924315bece044f Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk(a)redhat.com&gt;
Date: Fri, 21 Nov 2014 04:05:54 +0000
Subject: [PATCH] Now really enable the correct cipher.

OpenSSL AES256-SHA = TLS_RSA_WITH_AES_256_CBC_SHA
---
 .../download/files/httpd/dl.fedoraproject.org.conf |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/roles/download/files/httpd/dl.fedoraproject.org.conf
b/roles/download/files/httpd/dl.fedoraproject.org.conf
index 7be586c..aaa3872 100644
--- a/roles/download/files/httpd/dl.fedoraproject.org.conf
+++ b/roles/download/files/httpd/dl.fedoraproject.org.conf
@@ -25,7 +25,7 @@
   # modules/squid/files/squid.conf-el6 too, to keep it in sync.

    SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
-   SSLCipherSuite
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+   SSLCipherSuite
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

   Include "conf.d/dl.fedoraproject.org/*.conf"
 </VirtualHost>
-- 
1.7.2.1




With kind regards,
Patrick Uiterwijk
Associate Software Engineer, Red Hat

----- Original Message -----
>  On Thu, Nov 20, 2014 at 04:17:50PM -0500, Patrick Uiterwijk wrote:
>  > Hi all,
>  > 
>  > Since boot.fedoraproject.org does not support (EC)DHE_ ciphers, the
>  > attached patch will add support for RSA_WITH_AES_256_CBC_SHA256 to
>  > dl*.fedoraproject.org.
>  > Please +1 or -2?
>  > 
>  +1
>  
>  -Toshio
>  
>  _______________________________________________
>  infrastructure mailing list
>  infrastructure(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/infrastructure

FIX Freeze break request: adding cipher to dl*.fedoraproject.org for BFO

[Kevin Fenzi]

+1

kevin

FIX Freeze break request: adding cipher to dl*.fedoraproject.org for BFO

[Pierre-Yves Chibon]

On Thu, Nov 20, 2014 at 11:10:07PM -0500, Patrick Uiterwijk wrote:
>  Hi,
>  
>  Sorry for the mistake in the previous one: I had specified the name of the cipher, which
> is not the same as the OpenSSL cipher spec.
>  Here another patch that does the same but now actually uses the correct cipher spec (and
> so works).
>  The only change wrt the previous patch is that the cipher name
> (TLS_RSA_WITH_AES_256_CBC_SHA) has been replaced with the cipher spec (AES256-SHA).
>  
>  
>  From 1833afa7dd674059a1d1e250a9924315bece044f Mon Sep 17 00:00:00 2001
>  From: Patrick Uiterwijk <puiterwijk(a)redhat.com&gt;
>  Date: Fri, 21 Nov 2014 04:05:54 +0000
>  Subject: [PATCH] Now really enable the correct cipher.
>  
>  OpenSSL AES256-SHA = TLS_RSA_WITH_AES_256_CBC_SHA
>  ---
>   .../download/files/httpd/dl.fedoraproject.org.conf |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>  
>  diff --git a/roles/download/files/httpd/dl.fedoraproject.org.conf
> b/roles/download/files/httpd/dl.fedoraproject.org.conf
>  index 7be586c..aaa3872 100644
>  --- a/roles/download/files/httpd/dl.fedoraproject.org.conf
>  +++ b/roles/download/files/httpd/dl.fedoraproject.org.conf
>  @@ -25,7 +25,7 @@
>     # modules/squid/files/squid.conf-el6 too, to keep it in sync.
>  
>      SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
>  -   SSLCipherSuite
> ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
>  +   SSLCipherSuite
> ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
>  
>     Include "conf.d/dl.fedoraproject.org/*.conf"
>   </VirtualHost>
>  --  
+1

Pierre