adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-31 01:32:02 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

Configuration Options for SSL Protocols and SSL Compression [$20 awarded] #407

New Issue
Closed
opened 2026-10-05 04:19:00 +02:00 by adam · 3 comments
adam commented 2026-10-05 04:19:00 +02:00
Owner
Copy link
Copy source

(RELATED: https://github.com/znc/znc/issues/621, https://github.com/znc/znc/issues/719)

Related to the issues stated in #621 for configuration of SSL Ciphers, I'd also like to see a configurable set of SSL Protocols. This way, we can choose to enable or disable supported SSL Protocols for legacy users (stuck on WinXP and such), if necessary for our environment.

As well, an option to enable or disable SSL Compression would also be wonderful to have. This way, we can mitigate the CRIME attack if an individual finds it necessary to do so in their environment (#719).

Ultimately I would like to see options in the config files for this.

CODERS:
In order to get my bounty, please include somewhat more detailed documentation for how to actually configure these in the config file. The SSLCiphers configuration option in #621 is not documented but DOES work - there's just not any detailed documentation on where to put it.

--- The **[$20 bounty](https://www.bountysource.com/issues/5548738-configuration-options-for-ssl-protocols-and-ssl-compression?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** on this issue has been claimed at [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github).
(RELATED: https://github.com/znc/znc/issues/621, https://github.com/znc/znc/issues/719) Related to the issues stated in #621 for configuration of SSL Ciphers, I'd also like to see a configurable set of SSL Protocols. This way, we can choose to enable or disable supported SSL Protocols for legacy users (stuck on WinXP and such), if necessary for our environment. As well, an option to enable or disable SSL Compression would also be wonderful to have. This way, we can mitigate the CRIME attack if an individual finds it necessary to do so in their environment (#719). Ultimately I would like to see options in the config files for this. CODERS: In order to get my bounty, please include somewhat more detailed documentation for how to actually configure these in the config file. The SSLCiphers configuration option in #621 is not documented but DOES work - there's just not any detailed documentation on where to put it. ## <bountysource-plugin> --- The **[$20 bounty](https://www.bountysource.com/issues/5548738-configuration-options-for-ssl-protocols-and-ssl-compression?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** on this issue has been claimed at [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin> <!-- github-sync-id:46898971 -->
adam closed this issue 2026-10-05 04:19:00 +02:00
adam commented 2026-10-05 04:19:01 +02:00
Author
Owner
Copy link
Copy source

please include somewhat more detailed documentation for how to actually configure these in the config file. The SSLCiphers configuration option in #621 is not documented but DOES work - there's just not any detailed documentation on where to put it.

I have plans to sync http://wiki.znc.in/Configuration with the current implementation. It would be best to have full history of configuration changes for any 1.x release, but I'm not yet sure how to organize that.

> please include somewhat more detailed documentation for how to actually configure these in the config file. The SSLCiphers configuration option in #621 is not documented but DOES work - there's just not any detailed documentation on where to put it. I have plans to sync http://wiki.znc.in/Configuration with the current implementation. It would be best to have full history of configuration changes for any 1.x release, but I'm not yet sure how to organize that. <!-- github-comment-id:60744519 -->
adam commented 2026-10-05 04:19:02 +02:00
Author
Owner
Copy link
Copy source

I've opened a PR for a global SSLDisabledProtocol config option: https://github.com/znc/znc/pull/728. I didn't go the extra mile and make it possible to override the config for each listener as you requested on IRC, though. It gets a bit more involved and is probably better done by someone who knows the listeners code better.

What comes to disabling SSL compression, I've opened a ticket for Csocket to make it possible. Anyway, let's handle that via https://github.com/znc/znc/issues/719.

I've opened a PR for a global SSLDisabledProtocol config option: https://github.com/znc/znc/pull/728. I didn't go the extra mile and make it possible to override the config for each listener as you requested on IRC, though. It gets a bit more involved and is probably better done by someone who knows the listeners code better. What comes to disabling SSL compression, I've opened a ticket for Csocket to make it possible. Anyway, let's handle that via https://github.com/znc/znc/issues/719. <!-- github-comment-id:60984353 -->
adam commented 2026-10-05 04:19:03 +02:00
Author
Owner
Copy link
Copy source

Is there any compelling reason to make SSL compression configurable?

Is there any compelling reason to make SSL compression configurable? <!-- github-comment-id:62257067 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#407