generic-library/poco
1
0
Fork 0
mirror of https://github.com/pocoproject/poco.git synced 2025-01-06 00:31:10 +01:00
Code Issues Projects Releases Wiki Activity

fix(NetSSL): Incorrect setting of ciphersuites for TLSv1.3 #4610

Browse Source
This commit is contained in:
Günter Obiltschnig 2024-12-01 10:10:06 +01:00
parent 2a1f6c246d
commit 24fba7b77c
2 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
NetSSL_OpenSSL/include/Poco/Net/Context.h
View File

@ -191,6 +191,15 @@ public:
std::string cipherList; std::string cipherList;
/// Specifies the supported ciphers in OpenSSL notation. /// Specifies the supported ciphers in OpenSSL notation.
/// Defaults to "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH". /// Defaults to "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH".
/// Note: The cipher list only applies for TLS 1.2 and
/// earlier versions. To configure TLS 1.3 cipher suites,
/// please use the cipherSuites member variable.
std::string cipherSuites;
/// Specifies the supported TLS 1.3 cipher suites.
/// If left empty, the OpenSSL default cipher suites
/// are used. Please refer to the OpenSSL documentation
/// for available cipher suite names.
std::string dhParamsFile; std::string dhParamsFile;
/// Specifies a file containing Diffie-Hellman parameters. /// Specifies a file containing Diffie-Hellman parameters.

11
NetSSL_OpenSSL/src/Context.cpp
View File

@ -189,11 +189,14 @@ void Context::init(const Params& params)
else else
SSL_CTX_set_verify(_pSSLContext, params.verificationMode, &SSLManager::verifyClientCallback); SSL_CTX_set_verify(_pSSLContext, params.verificationMode, &SSLManager::verifyClientCallback);
#if OPENSSL_VERSION_NUMBER >= 0x30000000L #if OPENSSL_VERSION_NUMBER >= 0x10101000L
SSL_CTX_set_ciphersuites(_pSSLContext, params.cipherList.c_str()); if (!params.cipherSuites.empty())
#else {
SSL_CTX_set_ciphersuites(_pSSLContext, params.cipherSuites.c_str());
}
#endif
SSL_CTX_set_cipher_list(_pSSLContext, params.cipherList.c_str()); SSL_CTX_set_cipher_list(_pSSLContext, params.cipherList.c_str());
#endif // OPENSSL_VERSION_NUMBER >= 0x30000000L
SSL_CTX_set_verify_depth(_pSSLContext, params.verificationDepth); SSL_CTX_set_verify_depth(_pSSLContext, params.verificationDepth);
SSL_CTX_set_mode(_pSSLContext, SSL_MODE_AUTO_RETRY); SSL_CTX_set_mode(_pSSLContext, SSL_MODE_AUTO_RETRY);
SSL_CTX_set_session_cache_mode(_pSSLContext, SSL_SESS_CACHE_OFF); SSL_CTX_set_session_cache_mode(_pSSLContext, SSL_SESS_CACHE_OFF);