Commit Graph

123 Commits

Author SHA1 Message Date
Günter Obiltschnig
24fba7b77c fix(NetSSL): Incorrect setting of ciphersuites for TLSv1.3 #4610 2024-12-01 10:10:06 +01:00
Günter Obiltschnig
0eb2e1b3b3 fix(NetSSL): handle EWOULDBLOCK when calling SSL_shutdown() 2024-11-28 08:19:45 +01:00
Günter Obiltschnig
1811f2f35c fix(NetSSL): shutdown behavior 2024-11-28 08:19:45 +01:00
Günter Obiltschnig
bf09be3f33 fix(NetSSL): Non-blocking sockets support #4773 2024-11-16 16:50:38 +01:00
Aleksandar Fabijanic
c4f66d5188
fix(OpenSSL) Openssl DH key size (#4753)
* Fixed incorrect SSL_CTX_set0_tmp_dh_pkey() usage

* fix(OpenSSL): use DH group enum

* fix(IPAddress): windows scoped test, part II #4644

* fix(OpenSSL): fuzz errors #4663

* chore: remove misplaced comment

---------

Co-authored-by: Peter Klotz <peter.klotz99@gmail.com>
2024-11-11 19:01:00 +01:00
Aleksandar Fabijanic
c156f0b357
fix(HTTPSClientSession): There is no way to resolve host in advance and connect to HTTPS server with SNI. #4395 (#4751) 2024-11-05 20:46:42 +01:00
Aleksandar Fabijanic
59afdc2c04
fix(NetSSL): Incorrect setting of ciphersuites for TLSv1.3 #4610 (#4752) 2024-10-31 01:12:51 +01:00
Matej Kenda
c038b52f36 chore(Poco): Resolve a lot of warnings, reported by g++ 13. 2024-10-10 10:41:24 +02:00
Matej Kenda
f24547cdcf enh(Poco): Mark deprecated functionality with C++ attributes and resolve internal usage of deprecated functions (#4551)
* enh(poco): Replace deprecated comments with C++ deprecated attribute.

* enh(Poco): Replace some deprecated functionality in Poco sources. (#4426)

* enh(Poco): Replace more deprecated functionality in Poco sources. (#4426)

* fix(CMake): Variable BUILD_SHARED_LIBS must be defined properly to create valid binaries.

* enh: Code improvements done while resolving deprecated functionality (#4426)

* Un-deprecate LocalDateTme (#4426)

* enh(Poco): Replace usage of deprecated functionality with other functions/classes (#4426)

* chore(SSL): temporarily un-deprecate SSL-related functionality (#4426)

* chore(SSL): temporarily un-deprecate old MongoDB protocol functionality (#4426)

* enh(Poco): Minor Hash improvements (#4426)

* enh(Foundation): Compile deprecated hash tests only when POCO_TEST_DEPRECATED is enabled (#4426)

* enh(Net): Compile deprecated Socket::select functionality only when POCO_TEST_DEPRECATED is enabled (#4426)

* enh(Bonjour): Replace deprecated Socket::select with PollSet (#4426)

* enh(Poco): Introduce POCO_DEPRECATED macro to have the ability to disable deprecation warnings in applications (#4426)

* test(ODBC): add few asserts to testStoredProcedureDynamicVar

* fix(ODBC): rename DynamicAny -> DynamicVar in tests

* fix(ODBC): make Dignostics static members inline to prevent explicit instantiation warnings on windows

---------

Co-authored-by: Alex Fabijanic <alex@pocoproject.org>
2024-07-29 08:37:35 +02:00
Günter Obiltschnig
68d12fdd52 fix(NetSSL): SecureSocketImpl::peerCertificate() should just return certificate, not verify it 2024-04-03 07:51:55 +02:00
Aleksandar Fabijanic
ece360393f
4435 secure sock thread (#4512)
* fix(SecureSocket): Refactor detection of timeout when reading, writing or handshaking. (#3725)

* enh(SecureSocket): some trivial C++17 modernisation changes.

* chore: indentation and compiler warning

* fix(SecureSocketImpl): not thread-safe (1st attempt) #4435

* fix(SecureSocketImpl): silence CodeQL cpp/certificate-not-checked

---------

Co-authored-by: Matej Kenda <matejken@gmail.com>
2024-04-02 18:53:42 +02:00
Matej Kenda
8d3de8a5ed fix(SecureSocket): Reset does not close socket, it is closed in dtor. (#4415) 2024-03-29 19:09:28 +01:00
Matej Kenda
482c066307
fix(SecureSocket): Refactor detection of timeout when reading, writing and handshaking (#4510)
* fix(SecureSocket): Refactor detection of timeout when reading, writing or handshaking. (#3725)

* enh(SecureSocket): some trivial C++17 modernisation changes.

* chore: indentation and compiler warning

---------

Co-authored-by: Alex Fabijanic <alex@pocoproject.org>
2024-03-27 00:29:58 +01:00
Matej Kenda
db5a8a7112 fix(SSLManager): Fixed regression introduced in PR #4103, fixes #4421 2024-01-31 10:50:21 +01:00
Günter Obiltschnig
d5a5ebc2d7 enh: #3890: Get rid of SingletonHolder 2024-01-30 09:56:27 +01:00
chrisbednarski
388a3b4010
fix openssl session resumption, add quiet shutdown option, support FTPS with hostname (#4103) 2023-11-26 18:12:11 +01:00
Günter Obiltschnig
4999c2258b merge more changes from 1.12.5 2023-10-03 21:33:21 +02:00
Aleksandar Fabijanic
641d29f4ad fix(SecureSocketImpl.cpp): Shutdown TLS1.3 connection #2776 2023-07-11 14:54:44 +02:00
Günter Obiltschnig
8f764e3505 #3880: NetSSL_OpenSSL: Support session resumption with TLSv1.3 2023-06-06 13:06:02 +02:00
Conor Burgess
9a374ca2de
Fix error handling with OpenSSL 3.0 in SecureSocketImpl.cpp (#3971) 2023-03-17 10:07:37 -05:00
Rosen Penev
a93be3ed1c
fix compilation without deprecated OpenSSL APIs (#3690)
Missing headers and function.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2022-07-18 05:58:22 -05:00
John Vandenberg
0e6e16645c
Remove trailing whitespace (#3668) 2022-07-07 04:18:20 -05:00
Alex Fabijanic
5d7a1016c2 feat(SecureSocketImpl): how to set the socket of SecureSocketImpl to no-blocking? #2352 2022-06-29 11:41:39 +02:00
Aleksandar Fabijanic
7db9831f32
Netssl/openssl3 (#3575)
* feat(Context): DH init openssl3 port (1/2 hardcoded params)

* create poco-1.11.3 branch, bump version

* update copyright date

* #3567: check legacy provider existence for legacy exception #3567

* fix(Placeholder): comparison for zero value

* feat(Context): DH init openssl3 port (2/2 params from file)

* test(HTTPSClientSession): try/catch to understand CI failure

* chore(cmake): copy the DH parameters file

* fix(OpenSSLInitializer): unload provider on uninitialize

* chore(HTTPSClientSessionTest): remove try/catch

* fix(OpenSSLInitializer): fix provider unloading

* feat(CppUnit): make tests exceptions more descriptive

* chore(CppUnit): a more descriptive name for callback

Co-authored-by: Günter Obiltschnig <guenter.obiltschnig@appinf.com>
2022-04-28 22:24:43 -05:00
Alex Fabijanic
fa6e3f5e9d fix(SSLManager): Race condition in SSLManager #3558 2022-04-16 21:49:49 +02:00
Alex Fabijanic
7b051851b6 merge 1.11.2 2022-04-16 21:10:45 +02:00
Günter Obiltschnig
e99f4fd31a #3563: Remove support for OpenSSL < 1.0 2022-04-16 08:05:12 +02:00
Alex Fabijanic
1d4d444e08 chore: cleanup 2022-04-02 05:15:08 -07:00
Alex Fabijanic
3fb001f397 fix(Socket): shutdown fixes from pull #3448 2022-03-31 19:03:27 +00:00
Robin Lee
3bab3548f4
Basic support for OpenSSL 3.0.0 (#3448)
* updated README.md

* Create close-inactive-issues.yml

* check return codes of EVP_CIPHER_CTX_new and EVP_CipherInit

Especially with OpenSSL 3, it is possible that EVP_CipherInit may fail even when
passed a non-null cipher[1]. Without the checking, it will finally get to a
segfault.

[1] https://github.com/openssl/openssl/issues/16864

* Automatically load default and legacy providers with OpenSSL 3

Without the legacy provider [1], some ciphers are not available. For example,
the 'des-ecb' one used by test sutie is missed and the test will fail.

[1] OSSL_PROVIDER-LEGACY(7ossl)

* Make p12 ca order the same as pem

OpenSSL < 3 returns p12 ca order in reversed order. This is fixed
in OpenSSL 3. We work around it with old OpenSSL.

See:
https://github.com/openssl/openssl/issues/16421
https://github.com/openssl/openssl/pull/12641
f5eb85eb0f

* Implement SSL abort handling on OpenSSL 3

On an unexpected EOF, versions before OpenSSL 3.0 returned SSL_ERROR_SYSCALL,
nothing was added to the error stack, and errno was 0. Since OpenSSL 3.0 the
returned error is SSL_ERROR_SSL with a meaningful error on the error stack.[1]

[1] SSL_GET_ERROR(3ossl)

Co-authored-by: Günter Obiltschnig <guenter.obiltschnig@appinf.com>
Co-authored-by: Robin Lee <cheeselee@fedoraproject.org>
Co-authored-by: Aleksandar Fabijanic <aleks-f@users.noreply.github.com>
2022-03-29 13:23:44 -05:00
Günter Obiltschnig
dbfd27611b manually merge #3448, part 1 (NetSSL) 2022-02-07 17:56:05 +01:00
Günter Obiltschnig
3ca91a8fe1 #2895, #2935: support OCSP stapling 2021-06-23 08:36:38 +02:00
Günter Obiltschnig
22eb76d3ae #3302: MSVC: Poco hides warnings (C4996) for the C++14 attribute [[deprecated]] 2021-06-17 18:20:29 +02:00
Günter Obiltschnig
746a69dc09 testReuseSession: remove bad checks for session reuse 2021-06-16 18:30:30 +02:00
Günter Obiltschnig
907e240ff2 #3269: Poco::Net::Context initialization with empty certificateFile 2021-06-15 14:05:56 +02:00
Günter Obiltschnig
e01fede825 disallow SSLv3 2021-06-15 13:51:41 +02:00
Günter Obiltschnig
7917abf727 #2418: SecureServerSocket doesn't work with IpV6 2021-06-15 10:23:22 +02:00
Günter Obiltschnig
59ae91e5ba #3089: HTTPSessionFactory does not support HTTPClientSession::ProxyConfig 2021-06-15 09:45:01 +02:00
Günter Obiltschnig
ab010473b9 #3299: NetSSL: Allow per-Context InvalidCertificateHandler 2021-06-06 18:11:05 +02:00
Günter Obiltschnig
13d3a03529 remove curves unsupported by some OpenSSL builds 2020-02-04 15:31:48 +01:00
Günter Obiltschnig
fc8a95c44e make Context compile with OpenSSL >= 1.1 2020-02-04 13:41:23 +01:00
Günter Obiltschnig
81624a269f #2898: poco 1.10/ NetSSL / openssl < 1.1 : default server usage changed (compare to 1.9.4) 2020-02-04 10:23:55 +01:00
Günter Obiltschnig
d33a39a987 #2816: Modernise TLS configuration 2020-02-04 09:33:31 +01:00
Günter Obiltschnig
839009d9b5 fix header comments 2020-01-23 18:57:05 +01:00
Günter Obiltschnig
d65bf03a83 fixes and improvements to FTP(S)ClientSession 2020-01-23 17:55:30 +01:00
Günter Obiltschnig
878b8bbeca fixes for FTPSClientSession 2020-01-23 13:29:54 +01:00
Günter Obiltschnig
5d481ff493 merge FTPSClientSession from develop-experimental 2020-01-23 11:57:28 +01:00
Günter Obiltschnig
18adb1e43b code cleanup; fix move ctors and assignment 2020-01-21 17:52:43 +01:00
Günter Obiltschnig
e1f09a602b cleanup and modernization 2020-01-10 12:20:30 +01:00
Günter Obiltschnig
a2f8f8fbe1 NetSSL_OpenSSL: better way to specify TLS version for Context 2020-01-09 21:25:30 +01:00