Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
A
Actor Framework
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Operations
Operations
Metrics
Environments
Analytics
Analytics
CI / CD
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
cpp-libs
Actor Framework
Commits
ab4beecb
Commit
ab4beecb
authored
May 15, 2023
by
Dominik Charousset
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Remove hard-coded default cipher lists for OpenSSL
parent
7b308e89
Changes
3
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
18 additions
and
11 deletions
+18
-11
CHANGELOG.md
CHANGELOG.md
+8
-0
libcaf_openssl/src/openssl/manager.cpp
libcaf_openssl/src/openssl/manager.cpp
+3
-1
libcaf_openssl/src/openssl/session.cpp
libcaf_openssl/src/openssl/session.cpp
+7
-10
No files found.
CHANGELOG.md
View file @
ab4beecb
...
...
@@ -8,6 +8,14 @@ is based on [Keep a Changelog](https://keepachangelog.com).
### Changed
-
Install CAF tools to
`${CMAKE_INSTALL_BINDIR}`
to make packaging easier.
-
The OpenSSL module no longer hard-codes calls to
`SSL_CTX_set_cipher_list`
in
order to use the system settings by default. Users can provide a custom cipher
list by providing a value for the configuration option
`caf.openssl.cipher-list`
. To restore the previous behavior, set this
parameter to
`HIGH:!aNULL:!MD5`
when running with a certificate and
`AECDH-AES256-SHA@SECLEVEL=0`
otherwise (or without
`@SECLEVEL=0`
for older
versions of OpenSSL). Please note that these lists are
*not*
recommended as
safe defaults, which is why we are no longer setting these values.
## [0.19.1] - 2023-05-01
...
...
libcaf_openssl/src/openssl/manager.cpp
View file @
ab4beecb
...
...
@@ -148,7 +148,9 @@ void manager::add_module_options(actor_system_config& cfg) {
"path to an OpenSSL-style directory of trusted certificates"
)
.
add
<
std
::
string
>
(
cfg
.
openssl_cafile
,
"cafile"
,
"path to a file of concatenated PEM-formatted certificates"
);
"path to a file of concatenated PEM-formatted certificates"
)
.
add
<
std
::
string
>
(
"cipher-list"
,
"colon-separated list of OpenSSL cipher strings to use"
);
}
actor_system
::
module
*
manager
::
make
(
actor_system
&
sys
,
detail
::
type_list
<>
)
{
...
...
libcaf_openssl/src/openssl/session.cpp
View file @
ab4beecb
...
...
@@ -195,9 +195,9 @@ SSL_CTX* session::create_ssl_context() {
#endif
if
(
!
ctx
)
CAF_RAISE_ERROR
(
"cannot create OpenSSL context"
);
auto
&
cfg
=
sys_
.
config
();
if
(
sys_
.
openssl_manager
().
authentication_enabled
())
{
// Require valid certificates on both sides.
auto
&
cfg
=
sys_
.
config
();
if
(
!
cfg
.
openssl_certificate
.
empty
()
&&
SSL_CTX_use_certificate_chain_file
(
ctx
,
cfg
.
openssl_certificate
.
c_str
())
...
...
@@ -223,8 +223,6 @@ SSL_CTX* session::create_ssl_context() {
}
SSL_CTX_set_verify
(
ctx
,
SSL_VERIFY_PEER
|
SSL_VERIFY_FAIL_IF_NO_PEER_CERT
,
nullptr
);
if
(
SSL_CTX_set_cipher_list
(
ctx
,
"HIGH:!aNULL:!MD5"
)
!=
1
)
CAF_RAISE_ERROR
(
"cannot set cipher list"
);
}
else
{
// No authentication.
SSL_CTX_set_verify
(
ctx
,
SSL_VERIFY_NONE
,
nullptr
);
...
...
@@ -243,13 +241,12 @@ SSL_CTX* session::create_ssl_context() {
SSL_CTX_set1_groups_list
(
ctx
,
"P-384"
);
# endif
/* OPENSSL_VERSION_NUMBER < 0x10101000L */
#endif
#ifdef CAF_SSL_HAS_SECURITY_LEVEL
const
char
*
cipher
=
"AECDH-AES256-SHA@SECLEVEL=0"
;
#else
const
char
*
cipher
=
"AECDH-AES256-SHA"
;
#endif
if
(
SSL_CTX_set_cipher_list
(
ctx
,
cipher
)
!=
1
)
CAF_RAISE_ERROR
(
"cannot set anonymous cipher"
);
}
// Set custom cipher list if specified.
if
(
auto
str
=
get_if
<
std
::
string
>
(
&
cfg
,
"caf.openssl.cipher-list"
);
str
&&
!
str
->
empty
())
{
if
(
SSL_CTX_set_cipher_list
(
ctx
,
str
->
c_str
())
!=
1
)
CAF_RAISE_ERROR
(
"failed to set cipher list"
);
}
return
ctx
;
}
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment