Commit ab4beecb authored by Dominik Charousset's avatar Dominik Charousset

Remove hard-coded default cipher lists for OpenSSL

parent 7b308e89
......@@ -8,6 +8,14 @@ is based on [Keep a Changelog](https://keepachangelog.com).
### Changed
- Install CAF tools to `${CMAKE_INSTALL_BINDIR}` to make packaging easier.
- The OpenSSL module no longer hard-codes calls to `SSL_CTX_set_cipher_list` in
order to use the system settings by default. Users can provide a custom cipher
list by providing a value for the configuration option
`caf.openssl.cipher-list`. To restore the previous behavior, set this
parameter to `HIGH:!aNULL:!MD5` when running with a certificate and
`AECDH-AES256-SHA@SECLEVEL=0` otherwise (or without `@SECLEVEL=0` for older
versions of OpenSSL). Please note that these lists are *not* recommended as
safe defaults, which is why we are no longer setting these values.
## [0.19.1] - 2023-05-01
......
......@@ -148,7 +148,9 @@ void manager::add_module_options(actor_system_config& cfg) {
"path to an OpenSSL-style directory of trusted certificates")
.add<std::string>(
cfg.openssl_cafile, "cafile",
"path to a file of concatenated PEM-formatted certificates");
"path to a file of concatenated PEM-formatted certificates")
.add<std::string>("cipher-list",
"colon-separated list of OpenSSL cipher strings to use");
}
actor_system::module* manager::make(actor_system& sys, detail::type_list<>) {
......
......@@ -195,9 +195,9 @@ SSL_CTX* session::create_ssl_context() {
#endif
if (!ctx)
CAF_RAISE_ERROR("cannot create OpenSSL context");
auto& cfg = sys_.config();
if (sys_.openssl_manager().authentication_enabled()) {
// Require valid certificates on both sides.
auto& cfg = sys_.config();
if (!cfg.openssl_certificate.empty()
&& SSL_CTX_use_certificate_chain_file(ctx,
cfg.openssl_certificate.c_str())
......@@ -223,8 +223,6 @@ SSL_CTX* session::create_ssl_context() {
}
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
nullptr);
if (SSL_CTX_set_cipher_list(ctx, "HIGH:!aNULL:!MD5") != 1)
CAF_RAISE_ERROR("cannot set cipher list");
} else {
// No authentication.
SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, nullptr);
......@@ -243,13 +241,12 @@ SSL_CTX* session::create_ssl_context() {
SSL_CTX_set1_groups_list(ctx, "P-384");
# endif /* OPENSSL_VERSION_NUMBER < 0x10101000L */
#endif
#ifdef CAF_SSL_HAS_SECURITY_LEVEL
const char* cipher = "AECDH-AES256-SHA@SECLEVEL=0";
#else
const char* cipher = "AECDH-AES256-SHA";
#endif
if (SSL_CTX_set_cipher_list(ctx, cipher) != 1)
CAF_RAISE_ERROR("cannot set anonymous cipher");
}
// Set custom cipher list if specified.
if (auto str = get_if<std::string>(&cfg, "caf.openssl.cipher-list");
str && !str->empty()) {
if (SSL_CTX_set_cipher_list(ctx, str->c_str()) != 1)
CAF_RAISE_ERROR("failed to set cipher list");
}
return ctx;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment