From 6364c42a86f9b14d8f4331f022c5ec78f4b9b548 Mon Sep 17 00:00:00 2001
From: jmoore <josh@glencoesoftware.com>
Date: Wed, 5 Nov 2014 09:05:01 +0100
Subject: [PATCH] Disable SSLv3 Ice protocol for all languages

To mitigate the POODLE/SSLv3 vulnerability, all Ice
languages are being restricted to TLS protocols. Here, we've
chosen `tls1` as the protocol setting in order to support
Ice 3.4 and Ice 3.5 at the same time. In practice, a newer
version of the TLS protocol will used if available.

See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566
---
 etc/grid/templates.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/etc/grid/templates.xml b/etc/grid/templates.xml
index 707c38d..1d9f25a 100644
--- a/etc/grid/templates.xml
+++ b/etc/grid/templates.xml
@@ -470,6 +470,7 @@
           <property name="Ice.Plugin.IceSSL" value="IceSSL:createIceSSL"/>
           <property name="IceSSL.Ciphers" value="ADH"/>
           <property name="IceSSL.VerifyPeer" value="0"/>
+          <property name="IceSSL.Protocols" value="tls1"/>
           <property name="Glacier2.Client.Endpoints" value="${client-endpoints}"/>
           <property name="Glacier2.Server.Endpoints" value="${server-endpoints}"/>
           <property name="Glacier2.InstanceName" value="${instance-name}"/>
-- 
1.9.1