DevFW-CICD/ingress-nginx-helm
12
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add setting to configure ecdh curve

Browse source
This commit is contained in:
Manuel de Brito Fontes 2017-03-30 23:23:14 -03:00
parent 5d17c7cc17
commit 8e41bdd3d4
2 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
controllers/nginx/pkg/config/config.go
View file

@ -200,6 +200,10 @@ type Configuration struct {
// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers // http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
SSLCiphers string `json:"ssl-ciphers,omitempty"` SSLCiphers string `json:"ssl-ciphers,omitempty"`
// Specifies a curve for ECDHE ciphers.
// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ecdh_curve
SSLECDHCurve string `json:"ssl-ecdh-curve,omitempty"`
// The secret that contains Diffie-Hellman key to help with "Perfect Forward Secrecy" // The secret that contains Diffie-Hellman key to help with "Perfect Forward Secrecy"
// https://www.openssl.org/docs/manmaster/apps/dhparam.html // https://www.openssl.org/docs/manmaster/apps/dhparam.html
// https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handshake_and_dhparam // https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handshake_and_dhparam
@ -280,6 +284,7 @@ func NewDefault() Configuration {
ShowServerTokens: true, ShowServerTokens: true,
SSLBufferSize: sslBufferSize, SSLBufferSize: sslBufferSize,
SSLCiphers: sslCiphers, SSLCiphers: sslCiphers,
SSLECDHCurve: "secp384r1",
SSLProtocols: sslProtocols, SSLProtocols: sslProtocols,
SSLSessionCache: true, SSLSessionCache: true,
SSLSessionCacheSize: sslSessionCacheSize, SSLSessionCacheSize: sslSessionCacheSize,

2
controllers/nginx/rootfs/etc/nginx/template/nginx.tmpl
View file

@ -183,6 +183,8 @@ http {
ssl_dyn_rec_size_lo 0; ssl_dyn_rec_size_lo 0;
{{ end }} {{ end }}
ssl_ecdh_curve {{ $cfg.SSLECDHCurve }};
{{ if .CustomErrors }} {{ if .CustomErrors }}
# Custom error pages # Custom error pages
proxy_intercept_errors on; proxy_intercept_errors on;