generic-library/poco
1
0
Fork 0
mirror of https://github.com/pocoproject/poco.git synced 2025-07-03 17:17:12 +02:00
Code Issues Projects Releases Wiki Activity

NetSSL_OpenSSL: better way to specify TLS version for Context

Browse Source
This commit is contained in:
Günter Obiltschnig 2020-01-09 21:25:30 +01:00
parent d4077125cf
commit a2f8f8fbe1
2 changed files with 136 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
NetSSL_OpenSSL/include/Poco/Net/Context.h
View File

@ -46,9 +46,7 @@ class NetSSL_API Context: public Poco::RefCountedObject
/// A Note Regarding TLSv1.3 Support: /// A Note Regarding TLSv1.3 Support:
/// ///
/// TLSv1.3 support requires at least OpenSSL version 1.1.1. /// TLSv1.3 support requires at least OpenSSL version 1.1.1.
/// In order to enable TLSv1.3 support, specify TLSV1_3_CLIENT_USE /// Make sure that the TLSv1.3 cipher suites are enabled:
/// or TLSV1_3_SERVER_USE and make sure that the TLSv1.3
/// cipher suites are enabled:
/// ///
/// - TLS_AES_256_GCM_SHA384 /// - TLS_AES_256_GCM_SHA384
/// - TLS_CHACHA20_POLY1305_SHA256 /// - TLS_CHACHA20_POLY1305_SHA256
@ -65,16 +63,18 @@ public:
enum Usage enum Usage
{ {
CLIENT_USE, /// Context is used by a client. TLS_CLIENT_USE, /// Context is used by a client for TLSv1 or higher. Use requireMinimumProtocol() or disableProtocols() to disable undesired older versions.
SERVER_USE, /// Context is used by a server. TLS_SERVER_USE, /// Context is used by a client for TLSv1 or higher. Use requireMinimumProtocol() or disableProtocols() to disable undesired older versions.
TLSV1_CLIENT_USE, /// Context is used by a client requiring TLSv1. CLIENT_USE, /// DEPRECATED. Context is used by a client.
TLSV1_SERVER_USE, /// Context is used by a server requiring TLSv1. SERVER_USE, /// DEPRECATED. Context is used by a server.
TLSV1_1_CLIENT_USE, /// Context is used by a client requiring TLSv1.1 (OpenSSL 1.0.0 or newer). TLSV1_CLIENT_USE, /// DEPRECATED. Context is used by a client requiring TLSv1.
TLSV1_1_SERVER_USE, /// Context is used by a server requiring TLSv1.1 (OpenSSL 1.0.0 or newer). TLSV1_SERVER_USE, /// DEPRECATED. Context is used by a server requiring TLSv1.
TLSV1_2_CLIENT_USE, /// Context is used by a client requiring TLSv1.2 (OpenSSL 1.0.1 or newer). TLSV1_1_CLIENT_USE, /// DEPRECATED. Context is used by a client requiring TLSv1.1 (OpenSSL 1.0.0 or newer).
TLSV1_2_SERVER_USE, /// Context is used by a server requiring TLSv1.2 (OpenSSL 1.0.1 or newer). TLSV1_1_SERVER_USE, /// DEPRECATED. Context is used by a server requiring TLSv1.1 (OpenSSL 1.0.0 or newer).
TLSV1_3_CLIENT_USE, /// Context is used by a client requiring TLSv1.3 (OpenSSL 1.1.1 or newer). TLSV1_2_CLIENT_USE, /// DEPRECATED. Context is used by a client requiring TLSv1.2 (OpenSSL 1.0.1 or newer).
TLSV1_3_SERVER_USE /// Context is used by a server requiring TLSv1.3 (OpenSSL 1.1.1 or newer). TLSV1_2_SERVER_USE, /// DEPRECATED. Context is used by a server requiring TLSv1.2 (OpenSSL 1.0.1 or newer).
TLSV1_3_CLIENT_USE, /// DEPRECATED. Context is used by a client requiring TLSv1.3 (OpenSSL 1.1.1 or newer).
TLSV1_3_SERVER_USE /// DEPRECATED. Context is used by a server requiring TLSv1.3 (OpenSSL 1.1.1 or newer).
}; };
enum VerificationMode enum VerificationMode
@ -367,6 +367,12 @@ public:
/// ///
/// context.disableProtocols(PROTO_SSLV2 | PROTO_SSLV3); /// context.disableProtocols(PROTO_SSLV2 | PROTO_SSLV3);
void requireMinimumProtocol(Protocols protocol);
/// Disables all protocol version lower than the given one.
/// To require at least TLS 1.2 or later:
///
/// context.requireMinimumProtocol(PROTO_TLSV1_2);
void preferServerCiphers(); void preferServerCiphers();
/// When choosing a cipher, use the server's preferences instead of the client /// When choosing a cipher, use the server's preferences instead of the client
/// preferences. When not called, the SSL server will always follow the clients /// preferences. When not called, the SSL server will always follow the clients

127
NetSSL_OpenSSL/src/Context.cpp
View File

@ -385,6 +385,62 @@ void Context::disableProtocols(int protocols)
} }
void Context::requireMinimumProtocol(Protocols protocol)
{
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
int version = 0;
switch (protocol)
{
case PROTO_SSLV2:
throw Poco::InvalidArgumentException("SSLv2 is no longer supported");
case PROTO_SSLV3:
version = SSL3_VERSION;
break;
case PROTO_TLSV1:
version = TLS1_VERSION;
break;
case PROTO_TLSV1_1:
version = TLS1_1_VERSION;
break;
case PROTO_TLSV1_2:
version = TLS1_2_VERSION;
break;
case PROTO_TLSV1_3:
version = TLS1_3_VERSION;
break;
}
if (!SSL_CTX_set_min_proto_version(_pSSLContext, version))
{
unsigned long err = ERR_get_error();
throw SSLException("Cannot set minimum supported version on SSL_CTX object", ERR_error_string(err, 0));
}
#else
switch (protocol)
{
case PROTO_SSLV2:
throw Poco::InvalidArgumentException("SSLv2 is no longer supported");
case PROTO_SSLV3:
disableProtocols(PROTO_SSLV2);
break;
case PROTO_TLSV1:
disableProtocols(PROTO_SSLV2 | PROTO_SSLV3);
break;
case PROTO_TLSV1_1:
disableProtocols(PROTO_SSLV2 | PROTO_SSLV3 | PROTO_TLSV1);
break;
case PROTO_TLSV1_2:
disableProtocols(PROTO_SSLV2 | PROTO_SSLV3 | PROTO_TLSV1 | PROTO_TLSV1_1);
break;
case PROTO_TLSV1_3:
disableProtocols(PROTO_SSLV2 | PROTO_SSLV3 | PROTO_TLSV1 | PROTO_TLSV1_1 | PROTO_TLSV1_2);
break;
}
#endif
}
void Context::preferServerCiphers() void Context::preferServerCiphers()
{ {
#if defined(SSL_OP_CIPHER_SERVER_PREFERENCE) #if defined(SSL_OP_CIPHER_SERVER_PREFERENCE)
@ -395,64 +451,102 @@ void Context::preferServerCiphers()
void Context::createSSLContext() void Context::createSSLContext()
{ {
int minTLSVersion = 0;
if (SSLManager::isFIPSEnabled()) if (SSLManager::isFIPSEnabled())
{ {
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
_pSSLContext = SSL_CTX_new(TLS_method());
#else
_pSSLContext = SSL_CTX_new(TLSv1_method()); _pSSLContext = SSL_CTX_new(TLSv1_method());
#endif
} }
else else
{ {
switch (_usage) switch (_usage)
{ {
case CLIENT_USE: case CLIENT_USE:
case TLS_CLIENT_USE:
case TLSV1_CLIENT_USE:
#if OPENSSL_VERSION_NUMBER >= 0x10100000L #if OPENSSL_VERSION_NUMBER >= 0x10100000L
_pSSLContext = SSL_CTX_new(TLS_client_method()); _pSSLContext = SSL_CTX_new(TLS_client_method());
minTLSVersion = TLS1_VERSION;
#else #else
_pSSLContext = SSL_CTX_new(SSLv23_client_method()); _pSSLContext = SSL_CTX_new(TLSv1_client_method());
#endif #endif
break; break;
case SERVER_USE: case SERVER_USE:
case TLS_SERVER_USE:
case TLSV1_SERVER_USE:
#if OPENSSL_VERSION_NUMBER >= 0x10100000L #if OPENSSL_VERSION_NUMBER >= 0x10100000L
_pSSLContext = SSL_CTX_new(TLS_server_method()); _pSSLContext = SSL_CTX_new(TLS_server_method());
minTLSVersion = TLS1_VERSION;
#else #else
_pSSLContext = SSL_CTX_new(SSLv23_server_method());
#endif
break;
#if defined(SSL_OP_NO_TLSv1) && !defined(OPENSSL_NO_TLS1)
case TLSV1_CLIENT_USE:
_pSSLContext = SSL_CTX_new(TLSv1_client_method());
break;
case TLSV1_SERVER_USE:
_pSSLContext = SSL_CTX_new(TLSv1_server_method()); _pSSLContext = SSL_CTX_new(TLSv1_server_method());
break;
#endif #endif
break;
#if defined(SSL_OP_NO_TLSv1_1) && !defined(OPENSSL_NO_TLS1) #if defined(SSL_OP_NO_TLSv1_1) && !defined(OPENSSL_NO_TLS1)
/* SSL_OP_NO_TLSv1_1 is defined in ssl.h if the library version supports TLSv1.1. /* SSL_OP_NO_TLSv1_1 is defined in ssl.h if the library version supports TLSv1.1.
* OPENSSL_NO_TLS1 is defined in opensslconf.h or on the compiler command line * OPENSSL_NO_TLS1 is defined in opensslconf.h or on the compiler command line
* if TLS1.x was removed at OpenSSL library build time via Configure options. * if TLS1.x was removed at OpenSSL library build time via Configure options.
*/ */
case TLSV1_1_CLIENT_USE: case TLSV1_1_CLIENT_USE:
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
_pSSLContext = SSL_CTX_new(TLS_client_method());
minTLSVersion = TLS1_1_VERSION;
#else
_pSSLContext = SSL_CTX_new(TLSv1_1_client_method()); _pSSLContext = SSL_CTX_new(TLSv1_1_client_method());
#endif
break; break;
case TLSV1_1_SERVER_USE: case TLSV1_1_SERVER_USE:
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
_pSSLContext = SSL_CTX_new(TLS_server_method());
minTLSVersion = TLS1_1_VERSION;
#else
_pSSLContext = SSL_CTX_new(TLSv1_1_server_method()); _pSSLContext = SSL_CTX_new(TLSv1_1_server_method());
#endif
break; break;
#endif #endif
#if defined(SSL_OP_NO_TLSv1_2) && !defined(OPENSSL_NO_TLS1) #if defined(SSL_OP_NO_TLSv1_2) && !defined(OPENSSL_NO_TLS1)
case TLSV1_2_CLIENT_USE: case TLSV1_2_CLIENT_USE:
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
_pSSLContext = SSL_CTX_new(TLS_client_method());
minTLSVersion = TLS1_2_VERSION;
#else
_pSSLContext = SSL_CTX_new(TLSv1_2_client_method()); _pSSLContext = SSL_CTX_new(TLSv1_2_client_method());
#endif
break; break;
case TLSV1_2_SERVER_USE: case TLSV1_2_SERVER_USE:
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
_pSSLContext = SSL_CTX_new(TLS_server_method());
minTLSVersion = TLS1_2_VERSION;
#else
_pSSLContext = SSL_CTX_new(TLSv1_2_server_method()); _pSSLContext = SSL_CTX_new(TLSv1_2_server_method());
#endif
break; break;
#endif #endif
#if defined(SSL_OP_NO_TLSv1_3) && !defined(OPENSSL_NO_TLS1) #if defined(SSL_OP_NO_TLSv1_3) && !defined(OPENSSL_NO_TLS1)
case TLSV1_3_CLIENT_USE: case TLSV1_3_CLIENT_USE:
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
_pSSLContext = SSL_CTX_new(TLS_client_method()); _pSSLContext = SSL_CTX_new(TLS_client_method());
minTLSVersion = TLS1_3_VERSION;
#endif
break; break;
case TLSV1_3_SERVER_USE: case TLSV1_3_SERVER_USE:
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
_pSSLContext = SSL_CTX_new(TLS_server_method()); _pSSLContext = SSL_CTX_new(TLS_server_method());
minTLSVersion = TLS1_3_VERSION;
#endif
break; break;
#endif #endif
default: default:
throw Poco::InvalidArgumentException("Invalid or unsupported usage"); throw Poco::InvalidArgumentException("Invalid or unsupported usage");
} }
@ -463,6 +557,19 @@ void Context::createSSLContext()
throw SSLException("Cannot create SSL_CTX object", ERR_error_string(err, 0)); throw SSLException("Cannot create SSL_CTX object", ERR_error_string(err, 0));
} }
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
if (minTLSVersion)
{
if (!SSL_CTX_set_min_proto_version(_pSSLContext, minTLSVersion))
{
SSL_CTX_free(_pSSLContext);
_pSSLContext = 0;
unsigned long err = ERR_get_error();
throw SSLException("Cannot set minimum supported version on SSL_CTX object", ERR_error_string(err, 0));
}
}
#endif
SSL_CTX_set_default_passwd_cb(_pSSLContext, &SSLManager::privateKeyPassphraseCallback); SSL_CTX_set_default_passwd_cb(_pSSLContext, &SSLManager::privateKeyPassphraseCallback);
Utility::clearErrorStack(); Utility::clearErrorStack();
SSL_CTX_set_options(_pSSLContext, SSL_OP_ALL); SSL_CTX_set_options(_pSSLContext, SSL_OP_ALL);