From a0c69902c852b8316fdd0a115a310f97230a1a7e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= Date: Wed, 15 Dec 2021 15:18:36 +0100 Subject: [PATCH] fix #3763: disable renegotiation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit requires openssl crate with fix[0], like our packaged one. 0: https://github.com/sfackler/rust-openssl/pull/1584 Tested-by: Stoiko Ivanov s.ivanov@proxmox.com Reviewed-by: Stoiko Ivanov s.ivanov@proxmox.com Signed-off-by: Fabian Grünbichler --- Cargo.toml | 2 +- src/bin/proxmox-backup-proxy.rs | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/Cargo.toml b/Cargo.toml index 0debfa93..1b2488a3 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -64,7 +64,7 @@ log = "0.4" nix = "0.19.1" num-traits = "0.2" once_cell = "1.3.1" -openssl = "0.10" +openssl = "0.10.38" # currently patched! pam = "0.7" pam-sys = "0.5" percent-encoding = "2.1" diff --git a/src/bin/proxmox-backup-proxy.rs b/src/bin/proxmox-backup-proxy.rs index 07a53687..5e5babd1 100644 --- a/src/bin/proxmox-backup-proxy.rs +++ b/src/bin/proxmox-backup-proxy.rs @@ -348,6 +348,7 @@ fn make_tls_acceptor() -> Result { .map_err(|err| format_err!("unable to read proxy key {} - {}", key_path, err))?; acceptor.set_certificate_chain_file(cert_path) .map_err(|err| format_err!("unable to read proxy cert {} - {}", cert_path, err))?; + acceptor.set_options(openssl::ssl::SslOptions::NO_RENEGOTIATION); acceptor.check_private_key().unwrap(); Ok(acceptor.build())