From bb9733a42af348a870e99fb916d8a628eb6ec7e7 Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Sun, 14 Mar 2010 11:36:21 -0700
Subject: [PATCH] Strong SSL ciphers option

---
 webmin/CHANGELOG      |  2 ++
 webmin/change_ssl.cgi |  5 ++++-
 webmin/edit_ssl.cgi   | 11 +++++++++--
 webmin/lang/en        |  2 ++
 webmin/webmin-lib.pl  |  2 ++
 5 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/webmin/CHANGELOG b/webmin/CHANGELOG
index a00fb668f..7f4366ef2 100644
--- a/webmin/CHANGELOG
+++ b/webmin/CHANGELOG
@@ -99,3 +99,5 @@ Added an option on the Logging page to record logins and logouts from Webmin, fo
 Added a field to the Debugging Log File page to select modules to debug for.
 ---- Changes since 1.500 ----
 Added an option to the User Interface page to always put the hostname before the page title.
+---- Changes since 1.510 ----
+Strong PCI-compliant ciphers can now be selected on the SSL Encryption page.
diff --git a/webmin/change_ssl.cgi b/webmin/change_ssl.cgi
index f48d0c53d..4ec065440 100755
--- a/webmin/change_ssl.cgi
+++ b/webmin/change_ssl.cgi
@@ -20,9 +20,12 @@ else {
 	$in{'version'} =~ /^\d+$/ || &error($text{'ssl_eversion'});
 	$miniserv{'ssl_version'} = $in{'version'};
 	}
-if ($in{'cipher_list_def'}) {
+if ($in{'cipher_list_def'} == 1) {
 	delete($miniserv{'ssl_cipher_list'});
 	}
+elsif ($in{'cipher_list_def'} == 2) {
+	$miniserv{'ssl_cipher_list'} = $strong_ssl_ciphers;
+	}
 else {
 	$in{'cipher_list'} =~ /^\S+$/ || &error($text{'ssl_ecipher_list'});
 	$miniserv{'ssl_cipher_list'} = $in{'cipher_list'};
diff --git a/webmin/edit_ssl.cgi b/webmin/edit_ssl.cgi
index a829442dd..6b1d1b083 100755
--- a/webmin/edit_ssl.cgi
+++ b/webmin/edit_ssl.cgi
@@ -54,9 +54,16 @@ print &ui_table_row($text{'ssl_version'},
 	&ui_opt_textbox("version", $miniserv{'ssl_version'}, 4,
 			$text{'ssl_auto'}));
 
+$clist = $miniserv{'ssl_cipher_list'};
+$cmode = !$clist ? 1 :
+	 $clist eq $strong_ssl_ciphers ? 2 : 0;
 print &ui_table_row($text{'ssl_cipher_list'},
-	&ui_opt_textbox("cipher_list", $miniserv{'ssl_cipher_list'}, 30,
-			$text{'ssl_auto'}));
+	&ui_radio("cipher_list_def", $cmode,
+		  [ [ 1, $text{'ssl_auto'}."<br>" ],
+		    [ 2, $text{'ssl_strong'}."<br>" ],
+		    [ 0, $text{'ssl_clist'}." ".
+			 &ui_textbox("cipher_list",
+				     $cmode == 0 ? $clist : "", 30) ] ]));
 
 print &ui_table_row($text{'ssl_extracas'},
 	&ui_textarea("extracas", join("\n",split(/\s+/, $miniserv{'extracas'})),
diff --git a/webmin/lang/en b/webmin/lang/en
index 08382f10c..c8133b509 100644
--- a/webmin/lang/en
+++ b/webmin/lang/en
@@ -337,6 +337,8 @@ ssl_return=SSL keys
 ssl_version=SSL protocol version
 ssl_no2=Allow SSL version 2 browsers?
 ssl_cipher_list=Allowed SSL ciphers
+ssl_strong=Only strong PCI-compliant ciphers
+ssl_clist=Listed ciphers
 ssl_ecipher_list=Missing or invalid cipher list - must be like <tt>HIGH:-SSLv2:-aNULL</tt>
 ssl_auto=Detect automatically
 ssl_eversion=Missing or invalid version number
diff --git a/webmin/webmin-lib.pl b/webmin/webmin-lib.pl
index c246669b9..bff21ca4e 100755
--- a/webmin/webmin-lib.pl
+++ b/webmin/webmin-lib.pl
@@ -52,6 +52,8 @@ $detect_operating_system_cache = "$module_config_directory/oscache";
 $record_login_cmd = "$config_directory/login.pl";
 $record_logout_cmd = "$config_directory/logout.pl";
 
+$strong_ssl_ciphers = "ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM";
+
 =head2 setup_ca
 
 Internal function to create all the configuration files needed for the Webmin