Commit 96803c60 authored by Marian Triebe's avatar Marian Triebe

Fix unit tests with OpenSSL 1.1.0

With OpenSSL 1.1.0 a security level specifier was introduced.
By default its set to 1. Our default settings does not fulfill level 1.

With this patch we don't use a specific curve anymore. OpenSSL will
select a curve automatically. In OpenSSL 1.1.0 and higher this is
already the default.

closes #625
parent 6c0f3d70
......@@ -45,6 +45,8 @@ if(CAF_BUILD_STATIC_RUNTIME)
endif()
endif()
endforeach()
else()
set(CAF_BUILD_STATIC_RUNTIME no)
endif()
# add helper target that simplifies re-running configure
......@@ -537,7 +539,7 @@ if(NOT CAF_NO_OPENSSL)
# Check OpenSSL version >= 1.0.1
if (OPENSSL_VERSION VERSION_LESS 1.0.1)
message(STATUS
"Disable OpenSSL. Required >= 1.0.1 due to TLSv2 support.")
"Disable OpenSSL. Required >= 1.0.1 due to TLSv1.2 support.")
set(CAF_NO_OPENSSL yes)
else()
# Check if openssl headers and library versions match
......@@ -552,7 +554,7 @@ if(NOT CAF_NO_OPENSSL)
}
return -1;
}
" OPENSSL_CORRECT_VERSION_NUMBER )
" OPENSSL_CORRECT_VERSION_NUMBER)
if (NOT OPENSSL_CORRECT_VERSION_NUMBER)
message(FATAL_ERROR
"OpenSSL library version does not match headers")
......
......@@ -236,5 +236,4 @@
throw std::runtime_error(msg)
#endif // CAF_NO_EXCEPTIONS
#endif // CAF_CONFIG_HPP
......@@ -33,6 +33,11 @@ CAF_POP_WARNINGS
#include "caf/io/network/native_socket.hpp"
#include "caf/io/network/default_multiplexer.hpp"
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
# define CAF_SSL_HAS_SECURITY_LEVEL
# define CAF_SSL_HAS_NON_VERSIONED_TLS_FUN
#endif
namespace caf {
namespace openssl {
......
......@@ -204,7 +204,11 @@ const char* session::openssl_passphrase() {
SSL_CTX* session::create_ssl_context() {
CAF_BLOCK_SIGPIPE();
#ifdef CAF_SSL_HAS_NON_VERSIONED_TLS_FUN
auto ctx = SSL_CTX_new(TLS_method());
#else
auto ctx = SSL_CTX_new(TLSv1_2_method());
#endif
if (!ctx)
raise_ssl_error("cannot create OpenSSL context");
if (sys_.openssl_manager().authentication_enabled()) {
......@@ -240,13 +244,13 @@ SSL_CTX* session::create_ssl_context() {
} else {
// No authentication.
SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, nullptr);
auto ecdh = EC_KEY_new_by_curve_name(NID_secp384r1);
if (!ecdh)
raise_ssl_error("cannot get ECDH curve");
CAF_PUSH_WARNINGS
SSL_CTX_set_tmp_ecdh(ctx, ecdh);
CAF_POP_WARNINGS
if (SSL_CTX_set_cipher_list(ctx, "AECDH-AES256-SHA") != 1)
SSL_CTX_set_ecdh_auto(ctx, 1);
#ifdef CAF_SSL_HAS_SECURITY_LEVEL
const char* cipher = "AECDH-AES256-SHA@SECLEVEL=0";
#else
const char* cipher = "AECDH-AES256-SHA";
#endif
if (SSL_CTX_set_cipher_list(ctx, cipher) != 1)
raise_ssl_error("cannot set anonymous cipher");
}
return ctx;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment