diff --git a/fhem/FHEM/01_FHEMWEB.pm b/fhem/FHEM/01_FHEMWEB.pm index 1ef9b4d30..06829cdd1 100755 --- a/fhem/FHEM/01_FHEMWEB.pm +++ b/fhem/FHEM/01_FHEMWEB.pm @@ -164,6 +164,7 @@ FHEMWEB_Initialize($) reverseLogs:0,1 roomIcons sortRooms + sslVersion smallscreen:unused smallscreenCommands:0,1 stylesheetPrefix @@ -3395,6 +3396,9 @@ FW_widgetOverride($$) smallscreen landscape mode.
+
  • sslVersion
    + See the global attribute sslVersion. +

  • @@ -4105,6 +4109,10 @@ FW_widgetOverride($$) Smallscreen Landscape Modus angezeigt.
    +
  • sslVersion
    + Siehe das global Attribut sslVersion. +

  • + diff --git a/fhem/FHEM/98_telnet.pm b/fhem/FHEM/98_telnet.pm index 32e46b476..21f52c0fd 100644 --- a/fhem/FHEM/98_telnet.pm +++ b/fhem/FHEM/98_telnet.pm @@ -22,7 +22,7 @@ telnet_Initialize($) $hash->{NotifyFn}= "telnet_SecurityCheck"; $hash->{AttrList} = "globalpassword password prompt ". "allowfrom SSL connectTimeout connectInterval ". - "encoding:utf8,latin1"; + "encoding:utf8,latin1 sslVersion"; $hash->{ActivateInformFn} = "telnet_ActivateInform"; my %lhash = ( Fn=>"CommandTelnetEncoding", @@ -471,9 +471,13 @@ telnet_ActivateInform($;$)
  • encoding
    - Sets the encoding for the data send to the client. Possible values are latin1 and utf8. Default is utf8. + Sets the encoding for the data send to the client. Possible values are + latin1 and utf8. Default is utf8.

  • +
  • sslVersion
    + See the global attribute sslVersion. +

  • @@ -634,6 +638,9 @@ telnet_ActivateInform($;$) Mögliche Werte sind utf8 und latin1. Standardwert ist utf8.
    +
  • sslVersion
    + Siehe das global Attribut sslVersion. +

  • diff --git a/fhem/FHEM/HttpUtils.pm b/fhem/FHEM/HttpUtils.pm index f2fe5b378..8a7760793 100644 --- a/fhem/FHEM/HttpUtils.pm +++ b/fhem/FHEM/HttpUtils.pm @@ -185,9 +185,11 @@ HttpUtils_Connect2($) Log3 $hash, $hash->{loglevel}, $@; } else { $hash->{conn}->blocking(1); + my $sslVersion = AttrVal($hash->{NAME}, "sslVersion", + AttrVal("global", "sslVersion", "SSLv23:!SSLv3:!SSLv2")); IO::Socket::SSL->start_SSL($hash->{conn}, { Timeout => $hash->{timeout}, - SSL_version => 'SSLv23:!SSLv3:!SSLv2', #Forum #27565 + SSL_version => $sslVersion }) || undef $hash->{conn}; } } diff --git a/fhem/FHEM/TcpServerUtils.pm b/fhem/FHEM/TcpServerUtils.pm index cd8731362..aeb542ff4 100644 --- a/fhem/FHEM/TcpServerUtils.pm +++ b/fhem/FHEM/TcpServerUtils.pm @@ -83,6 +83,10 @@ TcpServer_Accept($$) #$clientinfo[0]->blocking(0); # Forum #24799 if($hash->{SSL}) { + # Forum #27565: SSLv23:!SSLv3:!SSLv2', #35004: TLSv12:!SSLv3 + my $sslVersion = AttrVal($hash->{NAME}, "sslVersion", + AttrVal("global", "sslVersion", "TLSv12:!SSLv3")); + # Certs directory must be in the modpath, i.e. at the same level as the # FHEM directory my $mp = AttrVal("global", "modpath", "."); @@ -90,8 +94,7 @@ TcpServer_Accept($$) SSL_server => 1, SSL_key_file => "$mp/certs/server-key.pem", SSL_cert_file => "$mp/certs/server-cert.pem", - #SSL_version => 'SSLv23:!SSLv3:!SSLv2', #Forum #27565 - SSL_version => 'TLSv12:!SSLv3', # Forum #35004 + SSL_version => $sslVersion, SSL_cipher_list => 'HIGH:!RC4:!eNULL:!aNULL', Timeout => 4, }); diff --git a/fhem/docs/commandref_frame.html b/fhem/docs/commandref_frame.html index ec0acc96b..98860d2f4 100644 --- a/fhem/docs/commandref_frame.html +++ b/fhem/docs/commandref_frame.html @@ -1456,6 +1456,14 @@ The following local attributes are used by a wider range of devices: overview and by xmllist.
    + +
  • sslVersion
    + Specifies the accepted cryptography algorithms by all modules using the + TcpServices helper module. The current default TLSv12:!SSLv3 is thought + to be more secure than the previously used SSLv23:!SSLv3:!SSLv2, but it + causes problems with some not updated web services. +

  • +
  • stacktrace
    if set (to 1), dump a stacktrace to the log for each "PERL WARNING". diff --git a/fhem/docs/commandref_frame_DE.html b/fhem/docs/commandref_frame_DE.html index 26514dfab..706672594 100644 --- a/fhem/docs/commandref_frame_DE.html +++ b/fhem/docs/commandref_frame_DE.html @@ -1552,6 +1552,14 @@ Die folgenden lokalen Attribute werden von mehreren Geräten verwendet: xmllist Befehl, und bei der FHEMWEB Raumansicht geprüft.

  • + +
  • sslVersion
    + Setzt die akzeptierten Crypto-Algorithmen im TcpServices Hilfsmodul. + Die Voreinstellung TLSv12:!SSLv3 wird als sicherer erachtet als die + vorherige SSLv23:!SSLv3:!SSLv2, aber sie kann Probleme mit nicht + ausreichend aktualisierten Netzwerk-Diensten verursachen. +

  • +
  • stacktrace
    Falls gesetzt (auf 1), schreibt ins FHEM-Log zusätzlich zu jedem diff --git a/fhem/fhem.pl b/fhem/fhem.pl index 3b88d0e8a..281504ac6 100755 --- a/fhem/fhem.pl +++ b/fhem/fhem.pl @@ -281,6 +281,7 @@ my @globalAttrList = qw( restoreDirs sendStatistics:onUpdate,manually,never showInternalValues:1,0 + sslVersion stacktrace:1,0 statefile title