Unverified Commit 612e34fa authored by Raphael's avatar Raphael Committed by GitHub

Merge pull request #1411

Remove hard-coded default cipher lists for OpenSSL
parents 7b308e89 f0eca040
...@@ -8,6 +8,14 @@ is based on [Keep a Changelog](https://keepachangelog.com). ...@@ -8,6 +8,14 @@ is based on [Keep a Changelog](https://keepachangelog.com).
### Changed ### Changed
- Install CAF tools to `${CMAKE_INSTALL_BINDIR}` to make packaging easier. - Install CAF tools to `${CMAKE_INSTALL_BINDIR}` to make packaging easier.
- The OpenSSL module no longer hard-codes calls to `SSL_CTX_set_cipher_list` in
order to use the system settings by default. Users can provide a custom cipher
list by providing a value for the configuration option
`caf.openssl.cipher-list`. To restore the previous behavior, set this
parameter to `HIGH:!aNULL:!MD5` when running with a certificate and
`AECDH-AES256-SHA@SECLEVEL=0` otherwise (or without `@SECLEVEL=0` for older
versions of OpenSSL). Please note that these lists are *not* recommended as
safe defaults, which is why we are no longer setting these values.
## [0.19.1] - 2023-05-01 ## [0.19.1] - 2023-05-01
......
...@@ -18,7 +18,6 @@ CAF_POP_WARNINGS ...@@ -18,7 +18,6 @@ CAF_POP_WARNINGS
#include "caf/io/network/native_socket.hpp" #include "caf/io/network/native_socket.hpp"
#if OPENSSL_VERSION_NUMBER >= 0x10100000L #if OPENSSL_VERSION_NUMBER >= 0x10100000L
# define CAF_SSL_HAS_SECURITY_LEVEL
# define CAF_SSL_HAS_NON_VERSIONED_TLS_FUN # define CAF_SSL_HAS_NON_VERSIONED_TLS_FUN
#endif #endif
......
...@@ -148,7 +148,9 @@ void manager::add_module_options(actor_system_config& cfg) { ...@@ -148,7 +148,9 @@ void manager::add_module_options(actor_system_config& cfg) {
"path to an OpenSSL-style directory of trusted certificates") "path to an OpenSSL-style directory of trusted certificates")
.add<std::string>( .add<std::string>(
cfg.openssl_cafile, "cafile", cfg.openssl_cafile, "cafile",
"path to a file of concatenated PEM-formatted certificates"); "path to a file of concatenated PEM-formatted certificates")
.add<std::string>("cipher-list",
"colon-separated list of OpenSSL cipher strings to use");
} }
actor_system::module* manager::make(actor_system& sys, detail::type_list<>) { actor_system::module* manager::make(actor_system& sys, detail::type_list<>) {
......
...@@ -195,9 +195,9 @@ SSL_CTX* session::create_ssl_context() { ...@@ -195,9 +195,9 @@ SSL_CTX* session::create_ssl_context() {
#endif #endif
if (!ctx) if (!ctx)
CAF_RAISE_ERROR("cannot create OpenSSL context"); CAF_RAISE_ERROR("cannot create OpenSSL context");
auto& cfg = sys_.config();
if (sys_.openssl_manager().authentication_enabled()) { if (sys_.openssl_manager().authentication_enabled()) {
// Require valid certificates on both sides. // Require valid certificates on both sides.
auto& cfg = sys_.config();
if (!cfg.openssl_certificate.empty() if (!cfg.openssl_certificate.empty()
&& SSL_CTX_use_certificate_chain_file(ctx, && SSL_CTX_use_certificate_chain_file(ctx,
cfg.openssl_certificate.c_str()) cfg.openssl_certificate.c_str())
...@@ -223,8 +223,6 @@ SSL_CTX* session::create_ssl_context() { ...@@ -223,8 +223,6 @@ SSL_CTX* session::create_ssl_context() {
} }
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
nullptr); nullptr);
if (SSL_CTX_set_cipher_list(ctx, "HIGH:!aNULL:!MD5") != 1)
CAF_RAISE_ERROR("cannot set cipher list");
} else { } else {
// No authentication. // No authentication.
SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, nullptr); SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, nullptr);
...@@ -243,13 +241,12 @@ SSL_CTX* session::create_ssl_context() { ...@@ -243,13 +241,12 @@ SSL_CTX* session::create_ssl_context() {
SSL_CTX_set1_groups_list(ctx, "P-384"); SSL_CTX_set1_groups_list(ctx, "P-384");
# endif /* OPENSSL_VERSION_NUMBER < 0x10101000L */ # endif /* OPENSSL_VERSION_NUMBER < 0x10101000L */
#endif #endif
#ifdef CAF_SSL_HAS_SECURITY_LEVEL }
const char* cipher = "AECDH-AES256-SHA@SECLEVEL=0"; // Set custom cipher list if specified.
#else if (auto str = get_if<std::string>(&cfg, "caf.openssl.cipher-list");
const char* cipher = "AECDH-AES256-SHA"; str && !str->empty()) {
#endif if (SSL_CTX_set_cipher_list(ctx, str->c_str()) != 1)
if (SSL_CTX_set_cipher_list(ctx, cipher) != 1) CAF_RAISE_ERROR("failed to set cipher list");
CAF_RAISE_ERROR("cannot set anonymous cipher");
} }
return ctx; return ctx;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment