Skip to content

Commit 327d5dd

Browse files
an-taoan-tao
authored
Disable TLS 1.0 and 1.1 by default (#102)
1 parent 3687058 commit 327d5dd

File tree

7 files changed

+76
-32
lines changed

7 files changed

+76
-32
lines changed

‎trantor/net/TcpClient.cc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -199,11 +199,11 @@ void TcpClient::removeConnection(const TcpConnectionPtr &conn)
199199
}
200200
}
201201

202-
void TcpClient::enableSSL()
202+
void TcpClient::enableSSL(bool useOldTLS)
203203
{
204204
#ifdef USE_OPENSSL
205205
/* Create a new OpenSSL context */
206-
sslCtxPtr_ = newSSLContext();
206+
sslCtxPtr_ = newSSLContext(useOldTLS);
207207
#else
208208
LOG_FATAL << "OpenSSL is not found in your system!";
209209
abort();

‎trantor/net/TcpClient.h

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -177,9 +177,12 @@ class TcpClient : NonCopyable
177177

178178
/**
179179
* @brief Enable SSL encryption.
180-
*
180+
* @param useOldTLS If true, the TLS 1.0 and 1.1 are supported by the
181+
* client.
182+
* @note It's well known that TLS 1.0 and 1.1 are not considered secure in
183+
* 2020. And it's a good practice to only use TLS 1.2 and above.
181184
*/
182-
void enableSSL();
185+
void enableSSL(bool useOldTLS = false);
183186

184187
private:
185188
/// Not thread safe, but in loop

‎trantor/net/TcpConnection.h

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ namespace trantor
2626
{
2727
class SSLContext;
2828
std::shared_ptr<SSLContext> newSSLServerContext(const std::string &certPath,
29-
const std::string &keyPath);
29+
const std::string &keyPath,
30+
bool useOldTLS = false);
3031
/**
3132
* @brief This class represents a TCP connection.
3233
*
@@ -225,13 +226,14 @@ class TcpConnection
225226
* @param callback The callback is called when the SSL connection is
226227
* established.
227228
*/
228-
virtual void startClientEncryption(std::function<void()> callback) = 0;
229+
virtual void startClientEncryption(std::function<void()> callback,
230+
bool useOldTLS = false) = 0;
229231

230232
/**
231233
* @brief Start the SSL encryption on the connection (as a server).
232234
*
233235
* @param ctx The SSL context.
234-
* @param callback The callback is called when the SSL connection is is
236+
* @param callback The callback is called when the SSL connection is
235237
* established.
236238
*/
237239
virtual void startServerEncryption(const std::shared_ptr<SSLContext> &ctx,

‎trantor/net/TcpServer.cc

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
*
3-
* TcpServer.cc
4-
* An Tao
3+
* @file TcpServer.cc
4+
* @author An Tao
55
*
66
* Copyright 2018, An Tao. All rights reserved.
77
* https://github.com/an-tao/trantor
@@ -185,11 +185,12 @@ const trantor::InetAddress &TcpServer::address() const
185185
}
186186

187187
void TcpServer::enableSSL(const std::string &certPath,
188-
const std::string &keyPath)
188+
const std::string &keyPath,
189+
bool useOldTLS)
189190
{
190191
#ifdef USE_OPENSSL
191192
/* Create a new OpenSSL context */
192-
sslCtxPtr_ = newSSLServerContext(certPath, keyPath);
193+
sslCtxPtr_ = newSSLServerContext(certPath, keyPath, useOldTLS);
193194
#else
194195
LOG_FATAL << "OpenSSL is not found in your system!";
195196
abort();

‎trantor/net/TcpServer.h

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,8 +199,14 @@ class TcpServer : NonCopyable
199199
*
200200
* @param certPath The path of the certificate file.
201201
* @param keyPath The path of the private key file.
202+
* @param useOldTLS If true, the TLS 1.0 and 1.1 are supported by the
203+
* server.
204+
* @note It's well known that TLS 1.0 and 1.1 are not considered secure in
205+
* 2020. And it's a good practice to only use TLS 1.2 and above.
202206
*/
203-
void enableSSL(const std::string &certPath, const std::string &keyPath);
207+
void enableSSL(const std::string &certPath,
208+
const std::string &keyPath,
209+
bool useOldTLS = false);
204210

205211
private:
206212
EventLoop *loop_;

‎trantor/net/inner/TcpConnectionImpl.cc

Lines changed: 43 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
*
3-
* TcpConnectionImpl.cc
4-
* An Tao
3+
* @file TcpConnectionImpl.cc
4+
* @author An Tao
55
*
66
* Public header file in trantor lib.
77
*
@@ -57,9 +57,32 @@ void initOpenSSL()
5757
class SSLContext
5858
{
5959
public:
60-
SSLContext()
60+
explicit SSLContext(bool useOldTLS)
6161
{
62+
#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
63+
ctxPtr_ = SSL_CTX_new(TLS_method());
64+
if (!useOldTLS)
65+
SSL_CTX_set_min_proto_version(ctxPtr_, TLS1_2_VERSION);
66+
else
67+
{
68+
LOG_WARN << "TLS 1.0/1.1 are enabled. They are considered "
69+
"obsolete, insecure standards and should only be "
70+
"used for legacy purpose.";
71+
}
72+
#else
6273
ctxPtr_ = SSL_CTX_new(SSLv23_method());
74+
if (!useOldTLS)
75+
{
76+
SSL_CTX_set_options(ctxPtr_, SSL_OP_NO_TLSv1);
77+
SSL_CTX_set_options(ctxPtr_, SSL_OP_NO_TLSv1_1);
78+
}
79+
else
80+
{
81+
LOG_WARN << "TLS 1.0/1.1 are enabled. They are considered "
82+
"obsolete, insecure standards and should only be "
83+
"used for legacy purpose.";
84+
}
85+
#endif
6386
}
6487
~SSLContext()
6588
{
@@ -100,15 +123,16 @@ class SSLConn
100123
SSL *SSL_;
101124
};
102125

103-
std::shared_ptr<SSLContext> newSSLContext()
126+
std::shared_ptr<SSLContext> newSSLContext(bool useOldTLS)
104127
{ // init OpenSSL
105128
initOpenSSL();
106-
return std::make_shared<SSLContext>();
129+
return std::make_shared<SSLContext>(useOldTLS);
107130
}
108131
std::shared_ptr<SSLContext> newSSLServerContext(const std::string &certPath,
109-
const std::string &keyPath)
132+
const std::string &keyPath,
133+
bool useOldTLS)
110134
{
111-
auto ctx = newSSLContext();
135+
auto ctx = newSSLContext(useOldTLS);
112136
auto r = SSL_CTX_use_certificate_chain_file(ctx->get(), certPath.c_str());
113137
if (!r)
114138
{
@@ -148,7 +172,8 @@ std::shared_ptr<SSLContext> newSSLServerContext(const std::string &certPath,
148172
namespace trantor
149173
{
150174
std::shared_ptr<SSLContext> newSSLServerContext(const std::string &certPath,
151-
const std::string &keyPath)
175+
const std::string &keyPath,
176+
bool useOldTLS)
152177
{
153178
LOG_FATAL << "OpenSSL is not found in your system!";
154179
abort();
@@ -184,7 +209,8 @@ TcpConnectionImpl::~TcpConnectionImpl()
184209
}
185210
#ifdef USE_OPENSSL
186211
void TcpConnectionImpl::startClientEncryptionInLoop(
187-
std::function<void()> &&callback)
212+
std::function<void()> &&callback,
213+
bool useOldTLS)
188214
{
189215
loop_->assertInLoopThread();
190216
if (isEncrypted_)
@@ -194,7 +220,7 @@ void TcpConnectionImpl::startClientEncryptionInLoop(
194220
}
195221
sslEncryptionPtr_ = std::make_unique<SSLEncryption>();
196222
sslEncryptionPtr_->upgradeCallback_ = std::move(callback);
197-
sslEncryptionPtr_->sslCtxPtr_ = newSSLContext();
223+
sslEncryptionPtr_->sslCtxPtr_ = newSSLContext(useOldTLS);
198224
sslEncryptionPtr_->sslPtr_ =
199225
std::make_unique<SSLConn>(sslEncryptionPtr_->sslCtxPtr_->get());
200226
isEncrypted_ = true;
@@ -258,21 +284,24 @@ void TcpConnectionImpl::startServerEncryption(
258284

259285
#endif
260286
}
261-
void TcpConnectionImpl::startClientEncryption(std::function<void()> callback)
287+
void TcpConnectionImpl::startClientEncryption(std::function<void()> callback,
288+
bool useOldTLS)
262289
{
263290
#ifndef USE_OPENSSL
264291
LOG_FATAL << "OpenSSL is not found in your system!";
265292
abort();
266293
#else
267294
if (loop_->isInLoopThread())
268295
{
269-
startClientEncryptionInLoop(std::move(callback));
296+
startClientEncryptionInLoop(std::move(callback), useOldTLS);
270297
}
271298
else
272299
{
273300
loop_->queueInLoop([thisPtr = shared_from_this(),
274-
callback = std::move(callback)]() mutable {
275-
thisPtr->startClientEncryptionInLoop(std::move(callback));
301+
callback = std::move(callback),
302+
useOldTLS]() mutable {
303+
thisPtr->startClientEncryptionInLoop(std::move(callback),
304+
useOldTLS);
276305
});
277306
}
278307
#endif

‎trantor/net/inner/TcpConnectionImpl.h

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
*
3-
* TcpConnectionImpl.h
4-
* An Tao
3+
* @file TcpConnectionImpl.h
4+
* @author An Tao
55
*
66
* Public header file in trantor lib.
77
*
@@ -37,9 +37,10 @@ enum class SSLStatus
3737
class SSLContext;
3838
class SSLConn;
3939

40-
std::shared_ptr<SSLContext> newSSLContext();
40+
std::shared_ptr<SSLContext> newSSLContext(bool useOldTLS);
4141
std::shared_ptr<SSLContext> newSSLServerContext(const std::string &certPath,
42-
const std::string &keyPath);
42+
const std::string &keyPath,
43+
bool useOldTLS);
4344
// void initServerSSLContext(const std::shared_ptr<SSLContext> &ctx,
4445
// const std::string &certPath,
4546
// const std::string &keyPath);
@@ -167,7 +168,8 @@ class TcpConnectionImpl : public TcpConnection,
167168
{
168169
return bytesReceived_;
169170
}
170-
virtual void startClientEncryption(std::function<void()> callback) override;
171+
virtual void startClientEncryption(std::function<void()> callback,
172+
bool useOldTLS = false) override;
171173
virtual void startServerEncryption(const std::shared_ptr<SSLContext> &ctx,
172174
std::function<void()> callback) override;
173175
virtual bool isSSLConnection() const override
@@ -305,7 +307,8 @@ class TcpConnectionImpl : public TcpConnection,
305307
std::function<void()> upgradeCallback_;
306308
};
307309
std::unique_ptr<SSLEncryption> sslEncryptionPtr_;
308-
void startClientEncryptionInLoop(std::function<void()> &&callback);
310+
void startClientEncryptionInLoop(std::function<void()> &&callback,
311+
bool useOldTLS);
309312
void startServerEncryptionInLoop(const std::shared_ptr<SSLContext> &ctx,
310313
std::function<void()> &&callback);
311314
#endif

0 commit comments

Comments
 (0)