Commit 9f87fdb8 authored by Abdulbaki Aydin's avatar Abdulbaki Aydin Committed by Facebook GitHub Bot

Add an API to set signature algorithms in string form

Summary:
Add an API to enable setting signature algorithms in string form.
An example string form: `"ECDSA+SHA256:RSA+SHA256"`.
OpenSSL supports TLS1.3 Signature Scheme format,
e.g.; `"ecdsa_secp256r1_sha256:rsa_pss_rsae_sha256"`.

Reviewed By: mingtaoy

Differential Revision: D24745481

fbshipit-source-id: 018be0a242d922f36a81d051791679a20fe08893
parent cc1be4ce
...@@ -216,6 +216,15 @@ void SSLContext::setCiphersOrThrow(const std::string& ciphers) { ...@@ -216,6 +216,15 @@ void SSLContext::setCiphersOrThrow(const std::string& ciphers) {
providedCiphersString_ = ciphers; providedCiphersString_ = ciphers;
} }
void SSLContext::setSigAlgsOrThrow(const std::string& sigalgs) {
#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
int rc = SSL_CTX_set1_sigalgs_list(ctx_, sigalgs.c_str());
if (rc == 0) {
throw std::runtime_error("SSL_CTX_set1_sigalgs_list " + getErrors());
}
#endif
}
void SSLContext::setVerificationOption( void SSLContext::setVerificationOption(
const SSLContext::SSLVerifyPeerEnum& verifyPeer) { const SSLContext::SSLVerifyPeerEnum& verifyPeer) {
CHECK(verifyPeer != SSLVerifyPeerEnum::USE_CTX); // dont recurse CHECK(verifyPeer != SSLVerifyPeerEnum::USE_CTX); // dont recurse
......
...@@ -166,7 +166,6 @@ class SSLContext { ...@@ -166,7 +166,6 @@ class SSLContext {
/** /**
* Set default ciphers to be used in SSL handshake process. * Set default ciphers to be used in SSL handshake process.
*/ */
template <typename Iterator> template <typename Iterator>
void setCipherList(Iterator ibegin, Iterator iend) { void setCipherList(Iterator ibegin, Iterator iend) {
if (ibegin != iend) { if (ibegin != iend) {
...@@ -188,20 +187,18 @@ class SSLContext { ...@@ -188,20 +187,18 @@ class SSLContext {
} }
/** /**
* Sets the signature algorithms to be used during SSL negotiation * Low-level method that attempts to set the provided signature
* for TLS1.2+. * algorithms on the SSL_CTX object for TLS1.2+,
* and throws if something goes wrong.
*/ */
virtual void setSigAlgsOrThrow(const std::string& sigAlgs);
template <typename Iterator> template <typename Iterator>
void setSignatureAlgorithms(Iterator ibegin, Iterator iend) { void setSignatureAlgorithms(Iterator ibegin, Iterator iend) {
if (ibegin != iend) { if (ibegin != iend) {
#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
std::string opensslSigAlgsList; std::string opensslSigAlgsList;
join(":", ibegin, iend, opensslSigAlgsList); join(":", ibegin, iend, opensslSigAlgsList);
if (!SSL_CTX_set1_sigalgs_list(ctx_, opensslSigAlgsList.c_str())) { setSigAlgsOrThrow(opensslSigAlgsList);
throw std::runtime_error("SSL_CTX_set1_sigalgs_list " + getErrors());
}
#endif
} }
} }
......
...@@ -190,4 +190,19 @@ TEST_F(SSLContextTest, TestGetFromSSLCtx) { ...@@ -190,4 +190,19 @@ TEST_F(SSLContextTest, TestGetFromSSLCtx) {
SSL_CTX_free(randomCtx); SSL_CTX_free(randomCtx);
} }
#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
TEST_F(SSLContextTest, TestInvalidSigAlgThrows) {
{
SSLContext tmpCtx;
EXPECT_THROW(tmpCtx.setSigAlgsOrThrow(""), std::runtime_error);
}
{
SSLContext tmpCtx;
EXPECT_THROW(
tmpCtx.setSigAlgsOrThrow("rsa_pss_rsae_sha512:ECDSA+SHA256:RSA+HA256"),
std::runtime_error);
}
}
#endif
} // namespace folly } // namespace folly
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment