From 9797b3639bc7f810d5aa61137c1118988cb88de0 Mon Sep 17 00:00:00 2001
From: Court Ewing <court@epixa.com>
Date: Tue, 1 Dec 2015 12:43:07 -0500
Subject: [PATCH] Use a modern cipher list for tsl

The default cipher list in node 0.12.7 includes obsolete and insecure
cipher suites. Recent versions of node include more secure defaults, so
we hardcode those defaults instead. We also enforce the cipher order as
we list it on the server rather than rely on the preferences of the
client so we can help avoid BEAST attacks.

Fixes #5542
---
 src/server/http/index.js | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/src/server/http/index.js b/src/server/http/index.js
index 0f0942a716191..22f66ce0a5a3a 100644
--- a/src/server/http/index.js
+++ b/src/server/http/index.js
@@ -26,7 +26,36 @@ module.exports = function (kbnServer, server, config) {
   if (config.get('server.ssl.key') && config.get('server.ssl.cert')) {
     connectionOptions.tls = {
       key: fs.readFileSync(config.get('server.ssl.key')),
-      cert: fs.readFileSync(config.get('server.ssl.cert'))
+      cert: fs.readFileSync(config.get('server.ssl.cert')),
+      // The default ciphers in node 0.12.x include insecure ciphers, so until
+      // we enforce a more recent version of node, we craft our own list
+      // @see https://github.com/nodejs/node/blob/master/src/node_constants.h#L8-L28
+      ciphers: [
+        'ECDHE-RSA-AES128-GCM-SHA256',
+        'ECDHE-ECDSA-AES128-GCM-SHA256',
+        'ECDHE-RSA-AES256-GCM-SHA384',
+        'ECDHE-ECDSA-AES256-GCM-SHA384',
+        'DHE-RSA-AES128-GCM-SHA256',
+        'ECDHE-RSA-AES128-SHA256',
+        'DHE-RSA-AES128-SHA256',
+        'ECDHE-RSA-AES256-SHA384',
+        'DHE-RSA-AES256-SHA384',
+        'ECDHE-RSA-AES256-SHA256',
+        'DHE-RSA-AES256-SHA256',
+        'HIGH',
+        '!aNULL',
+        '!eNULL',
+        '!EXPORT',
+        '!DES',
+        '!RC4',
+        '!MD5',
+        '!PSK',
+        '!SRP',
+        '!CAMELLIA'
+      ].join(':'),
+      // We use the server's cipher order rather than the client's to prevent
+      // the BEAST attack
+      honorCipherOrder: true
     };
   }