Commit 9f87fdb8 authored by Abdulbaki Aydin's avatar Abdulbaki Aydin Committed by Facebook GitHub Bot

Add an API to set signature algorithms in string form

Summary:
Add an API to enable setting signature algorithms in string form.
An example string form: `"ECDSA+SHA256:RSA+SHA256"`.
OpenSSL supports TLS1.3 Signature Scheme format,
e.g.; `"ecdsa_secp256r1_sha256:rsa_pss_rsae_sha256"`.

Reviewed By: mingtaoy

Differential Revision: D24745481

fbshipit-source-id: 018be0a242d922f36a81d051791679a20fe08893
parent cc1be4ce
......@@ -216,6 +216,15 @@ void SSLContext::setCiphersOrThrow(const std::string& ciphers) {
providedCiphersString_ = ciphers;
}
void SSLContext::setSigAlgsOrThrow(const std::string& sigalgs) {
#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
int rc = SSL_CTX_set1_sigalgs_list(ctx_, sigalgs.c_str());
if (rc == 0) {
throw std::runtime_error("SSL_CTX_set1_sigalgs_list " + getErrors());
}
#endif
}
void SSLContext::setVerificationOption(
const SSLContext::SSLVerifyPeerEnum& verifyPeer) {
CHECK(verifyPeer != SSLVerifyPeerEnum::USE_CTX); // dont recurse
......
......@@ -166,7 +166,6 @@ class SSLContext {
/**
* Set default ciphers to be used in SSL handshake process.
*/
template <typename Iterator>
void setCipherList(Iterator ibegin, Iterator iend) {
if (ibegin != iend) {
......@@ -188,20 +187,18 @@ class SSLContext {
}
/**
* Sets the signature algorithms to be used during SSL negotiation
* for TLS1.2+.
* Low-level method that attempts to set the provided signature
* algorithms on the SSL_CTX object for TLS1.2+,
* and throws if something goes wrong.
*/
virtual void setSigAlgsOrThrow(const std::string& sigAlgs);
template <typename Iterator>
void setSignatureAlgorithms(Iterator ibegin, Iterator iend) {
if (ibegin != iend) {
#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
std::string opensslSigAlgsList;
join(":", ibegin, iend, opensslSigAlgsList);
if (!SSL_CTX_set1_sigalgs_list(ctx_, opensslSigAlgsList.c_str())) {
throw std::runtime_error("SSL_CTX_set1_sigalgs_list " + getErrors());
}
#endif
setSigAlgsOrThrow(opensslSigAlgsList);
}
}
......
......@@ -190,4 +190,19 @@ TEST_F(SSLContextTest, TestGetFromSSLCtx) {
SSL_CTX_free(randomCtx);
}
#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
TEST_F(SSLContextTest, TestInvalidSigAlgThrows) {
{
SSLContext tmpCtx;
EXPECT_THROW(tmpCtx.setSigAlgsOrThrow(""), std::runtime_error);
}
{
SSLContext tmpCtx;
EXPECT_THROW(
tmpCtx.setSigAlgsOrThrow("rsa_pss_rsae_sha512:ECDSA+SHA256:RSA+HA256"),
std::runtime_error);
}
}
#endif
} // namespace folly
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment