Feature Proposal: Support selecting the TLS protocol version
"Weweler, Yves-Noel via omniORB-list" <[email protected]> Tue, 2 Jan 2024 13:18:30 +0000
| Newsgroups | gmane.comp.corba.omniorb.user |
|---|---|
| Message-ID | <[email protected]> |
--===============5884969157924828752==
Content-Type: multipart/alternative;
boundary="_000_1b25bffcebfd47fcac5ab49f3c0ab165insiderstechnologiesde_"
--_000_1b25bffcebfd47fcac5ab49f3c0ab165insiderstechnologiesde_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Hi,
We have certain requirements that force us to ensure that we can force spec=
ific TLS protocol versions.
First I tried doing this using an openssl configuration file. However, I no=
ticed that within src/lib/omniORB/orbcore/ssl/sslContext.cc the TLS version=
configuration is overwritten.
```
void
sslContext::set_supported_versions() {
SSL_CTX_set_options(pd_ctx,
SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);
}
```
Do you have any suggestions on how to force specific protocol versions?
Alternatively, I would like to propose that we add additional configuration=
to omniorb that behaves similar to `cipher_list`.
Essentially, I would like to be able to set the protocol version using the =
orb specific configurations as well as using the python interface.
According to the openssl wiki setting the version using options is deprecat=
ed. Hence, I suggest we adopt the min and max approach of configuration.
* https://wiki.openssl.org/index.php/List_of_SSL_OP_Flags
These options are deprecated as of 1.1.0, use SSL_CTX_set_min_proto_version=
() and SSL_CTX_set_max_proto_version() instead.
Sadly, my understanding of the omniorb codebase is rather limited at the mo=
ment, hence writing appropriate tests and getting all locations correct is =
currently out of reach for me.
Nevertheless, I prepared a small patch as a sketch for my proposal. (I neve=
r compiled it and it does not yet cover Python. Just to show my idea!)
Do you think that my approach is worth implementing?
Best regards,
Yves-Noel Weweler
Index: include/omniORB4/sslContext.h
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- include/omniORB4/sslContext.h (Revision 6674)
+++ include/omniORB4/sslContext.h (Arbeitskopie)
@@ -101,6 +101,19 @@
static _core_attr CORBA::Boolean full_peerdetails;
+ // Map of string to OpenSSL version enumerators
+ static std::map<std::string, int> ssl_version_string_to_enum_mapping =3D=
{
+ {"SSL3_VERSION", SSL3_VERSION},
+ {"TLS1_VERSION", TLS1_VERSION},
+ {"TLS1_1_VERSION", TLS1_1_VERSION},
+ {"TLS1_2_VERSION", TLS1_2_VERSION},
+ {"TLS1_3_VERSION", TLS1_3_VERSION},
+ {"DTLS1_VERSION", DTLS1_VERSION},
+ {"DTLS1_2_VERSION", DTLS1_2_VERSION}
+ };
+ static int convert_ssl_version_string_to_enum(CORBA::String_var versionS=
tring);
+ static CORBA::String_var convert_enum_to_ssl_version_string(int enum);
+
class PeerDetails {
public:
inline PeerDetails(SSL* s, X509* c, CORBA::Boolean v)
@@ -150,6 +163,8 @@
void update_CA(const char* cafile, const char* capath);
void update_key(const char* keyfile, const char* password);
void update_cipher_list(const char* cipher_list);
+ void update_min_protocol_version(int version);
+ void update_max_protocol_version(int version);
void update_verify_mode(int mode, int mode_incoming, omni_verify_cb call=
back);
void update_info_cb(omni_info_cb callback);
@@ -179,7 +194,7 @@
//
// Virtual functions that populate the SSL_CTX in pd_ctx. Subclasses
- // may override these if required. Thse are called while holding
+ // may override these if required. These are called while holding
// pd_ctx_lock.
SSL_CTX* get_SSL_CTX() const
@@ -193,12 +208,8 @@
virtual SSL_METHOD* set_method();
// Method to pass to SSL_CTX_new. Defaults to return TLS_method().
- virtual void set_supported_versions();
- // Default to
- // SSL_CTX_set_options(ssl_ctx,
- // SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
- // SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);
- // That is, only accept TLS 1.2 or later.
+ virtual void set_min_protocol_version(int version);
+ virtual void set_max_protocol_version(int version);
virtual void set_CA();
// Set CA details. Calls both SSL_CTX_load_verify_locations and
@@ -239,6 +250,8 @@
CORBA::String_var pd_password;
CORBA::String_var pd_password_in_ctx;
CORBA::String_var pd_cipher_list;
+ int pd_min_protocol_version;
+ int pd_max_protocol_version;
int pd_verify_mode;
int pd_verify_mode_incoming;
omni_verify_cb pd_verify_cb;
Index: sample.cfg
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- sample.cfg (Revision 6674)
+++ sample.cfg (Arbeitskopie)
@@ -326,6 +326,8 @@
# sslCAFile
# sslCAPath
# sslCipherList
+# sslMinProtocolVersion
+# sslMaxProtocolVersion
# sslKeyFile
# sslKeyPassword
# sslVerifyMode
@@ -349,6 +351,16 @@
# sslCipherList specifies the string form of acceptable ciphers. See
# the OpenSSL ciphers(1) manual page for details.
#
+# sslMinProtocolVersion specifies the minimum protocol version to use.
+# Currently supported versions are SSL3_VERSION, TLS1_VERSION,
+# TLS1_1_VERSION, TLS1_2_VERSION, TLS1_3_VERSION for TLS and
+# DTLS1_VERSION, DTLS1_2_VERSION for DTLS.
+#
+# sslMaxProtocolVersion specifies the maximum protocol version to use.
+# Currently supported versions are SSL3_VERSION, TLS1_VERSION,
+# TLS1_1_VERSION, TLS1_2_VERSION, TLS1_3_VERSION for TLS and
+# DTLS1_VERSION, DTLS1_2_VERSION for DTLS.
+#
# sslKeyFile specifies the file containing the SSL key.
#
# sslKeyPassword specifies the password to unlock the key.
Index: src/lib/omniORB/orbcore/ssl/sslContext.cc
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- src/lib/omniORB/orbcore/ssl/sslContext.cc (Revision 6674)
+++ src/lib/omniORB/orbcore/ssl/sslContext.cc (Arbeitskopie)
@@ -53,6 +53,8 @@
const char* sslContext::key_file =3D 0;
const char* sslContext::key_file_password =3D 0;
const char* sslContext::cipher_list =3D 0;
+int sslContext::min_protocol_version =3D TLS1_2_VERSION;
+int sslContext::max_protocol_version =3D TLS1_3_VERSION;
int sslContext::verify_mode =3D
(SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_=
CERT);
int sslContext::verify_mode_incoming =3D -1;
@@ -136,6 +138,21 @@
/////////////////////////////////////////////////////////////////////////
void
+sslContext::update_min_protocol_version(int version)
+{
+ omni_tracedmutex_lock sync(pd_ctx_lock);
+ pd_min_protocol_version =3D version;
+}
+
+/////////////////////////////////////////////////////////////////////////
+void
+sslContext::update_max_protocol_version(int version)
+{
+ omni_tracedmutex_lock sync(pd_ctx_lock);
+ pd_max_protocol_version =3D version;
+}
+/////////////////////////////////////////////////////////////////////////
+void
sslContext::update_verify_mode(int mode, int mode_incoming,
omni_verify_cb callback)
{
@@ -178,7 +195,8 @@
CORBA::COMPLETED_NO);
}
- set_supported_versions();
+ set_min_protocol_version();
+ set_max_protocol_version();
set_certificate();
set_privatekey();
set_CA();
@@ -208,7 +226,7 @@
SSL_CTX_set_default_passwd_cb_userdata(pd_ctx, 0);
SSL_CTX_free(pd_ctx);
pd_password_in_ctx =3D (const char*)0;
-
+
create_ctx();
}
@@ -222,7 +240,7 @@
// not free it yet.
if (!(const char*)pd_password_in_ctx)
pd_password_in_ctx =3D pd_password._retn();
-
+
pd_cafile =3D certificate_authority_file;
pd_capath =3D certificate_authority_path;
pd_keyfile =3D key_file;
@@ -229,6 +247,8 @@
pd_password =3D key_file_password;
}
pd_cipher_list =3D cipher_list;
+ pd_min_protocol_version =3D min_protocol_version;
+ pd_max_protocol_version =3D max_protocol_version;
pd_verify_mode =3D verify_mode;
pd_verify_mode_incoming =3D verify_mode_incoming;
pd_verify_cb =3D verify_callback;
@@ -276,14 +296,24 @@
/////////////////////////////////////////////////////////////////////////
void
-sslContext::set_supported_versions() {
- SSL_CTX_set_options(pd_ctx,
- SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
- SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);
+sslContext::set_min_protocol_version(int version) {
+ if (!int SSL_CTX_set_min_proto_version(pd_ctx, version)) {
+ report_error();
+ OMNIORB_THROW(INITIALIZE, INITIALIZE_TransportError, CORBA::COMPLETED_=
NO);
+ }
}
/////////////////////////////////////////////////////////////////////////
void
+sslContext::set_max_protocol_version(int version) {
+ if (!int SSL_CTX_set_max_proto_version(pd_ctx, version)) {
+ report_error();
+ OMNIORB_THROW(INITIALIZE, INITIALIZE_TransportError, CORBA::COMPLETED_=
NO);
+ }
+}
+
+/////////////////////////////////////////////////////////////////////////
+void
sslContext::set_CA() {
if (pd_cafile.in() || pd_capath.in()) {
@@ -492,3 +522,19 @@
log << "OpenSSL: " << (const char*) buf << "\n";
}
}
+
+static int convert_ssl_version_string_to_enum(CORBA::String_var versionStr=
ing) {
+ auto it =3D versionMap.find(versionStr);
+ int version =3D (it !=3D versionMap.end()) ? it->second : -1;
+ return version;
+}
+
+static CORBA::String_var convert_enum_to_ssl_version_string(int enumerator=
) {
+ std::map<int, std::string> reversedMap;
+ for (const auto& pair : originalMap) {
+ reversedMap[pair.second] =3D pair.first;
+ }
+ auto it =3D reversedMap.find(enumerator);
+ std::string versionString =3D (it !=3D reversedMap.end()) ? it->second :=
'UNKNOWN';
+ return CORBA::string_dup(versionString);
+}
Index: src/lib/omniORB/orbcore/ssl/sslTransportImpl.cc
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- src/lib/omniORB/orbcore/ssl/sslTransportImpl.cc (Revision 6674)
+++ src/lib/omniORB/orbcore/ssl/sslTransportImpl.cc (Arbeitskopie)
@@ -272,6 +272,57 @@
//////////////////////////////////////////////////////////////////////////=
///
+class sslMinTlsVersionHandler : public orbOptions::Handler {
+public:
+
+ sslMinTlsVersionHandler() :
+ orbOptions::Handler("sslMinTlsVersion",
+ "sslMinTlsVersion =3D <min. p=
rotocol version>",
+ 1,
+ "-ORBsslMinTlsVersion <min. p=
rotocol version>") {}
+
+ void visit(const char* value, orbOptions::Source)
+ {
+ sslContext::min_protocol_version =3D SSLContext::ssl_version_string_to=
_enum(value);
+ }
+
+ void dump(orbOptions::sequenceString& result)
+ {
+ orbOptions::addKVString(key(),
+ sslContext::convert_enum_=
to_ssl_version_string(sslContext::min_protocol_version),
+ result);
+ }
+};
+
+static sslMinTlsVersionHandler sslMinTlsVersionHandler_;
+
+
+//////////////////////////////////////////////////////////////////////////=
///
+class sslMaxTlsVersionHandler : public orbOptions::Handler {
+public:
+
+ sslMaxTlsVersionHandler() :
+ orbOptions::Handler("sslMaxTlsVersion",
+ "sslMaxTlsVersion =3D <max. p=
rotocol version>",
+ 1,
+ "-ORBsslMaxTlsVersion <max. p=
rotocol version>") {}
+
+ void visit(const char* value, orbOptions::Source)
+ {
+ sslContext::max_protocol_version =3D SSLContext::ssl_version_string_to=
_enum(value);
+ }
+
+ void dump(orbOptions::sequenceString& result)
+ {
+ orbOptions::addKVString(key(),
+ sslContext::convert_enum_=
to_ssl_version_string(sslContext::max_protocol_version),
+ result);
+ }
+};
+
+static sslMaxTlsVersionHandler sslMaxTlsVersionHandler_;
+
+//////////////////////////////////////////////////////////////////////////=
///
static int
verifyModeValue(const char* key, const char* value, CORBA::Boolean unset_ok=
)
{
@@ -455,6 +506,8 @@
orbOptions::singleton().registerHandler(sslKeyFileHandler_);
orbOptions::singleton().registerHandler(sslKeyPasswordHandler_);
orbOptions::singleton().registerHandler(sslCipherListHandler_);
+ orbOptions::singleton().registerHandler(sslMinTlsVersionHandler_);
+ orbOptions::singleton().registerHandler(sslMaxTlsVersionHandler_);
orbOptions::singleton().registerHandler(sslVerifyModeHandler_);
orbOptions::singleton().registerHandler(sslVerifyModeIncomingHandler_)=
;
orbOptions::singleton().registerHandler(sslAcceptTimeOutHandler_);
--_000_1b25bffcebfd47fcac5ab49f3c0ab165insiderstechnologiesde_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:911429611;
mso-list-type:hybrid;
mso-list-template-ids:-2039944276 1093049452 67567619 67567621 67567617 67=
567619 67567621 67567617 67567619 67567621;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:23.25pt;
text-indent:-18.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:Calibri;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:59.25pt;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:95.25pt;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:131.25pt;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:167.25pt;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:203.25pt;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:239.25pt;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:275.25pt;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:311.25pt;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"DE" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span lang=3D"EN-US">Hi,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">We have certain requirements th=
at force us to ensure that we can force specific TLS protocol versions.<br>
First I tried doing this using an openssl configuration file. However, I no=
ticed that within src/lib/omniORB/orbcore/ssl/sslContext.cc the TLS version=
configuration is overwritten.<br>
```<br>
void<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">sslContext::set_supported_versi=
ons() {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> SSL_CTX_set_options(pd_c=
tx,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> &=
nbsp; &nbs=
p; SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |<o:p></o:p></span><=
/p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> &=
nbsp; &nbs=
p; SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);<o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">}<br>
```<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Do you have any suggestions on =
how to force specific protocol versions?<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><br>
Alternatively, I would like to propose that we add additional configuration=
to omniorb that behaves similar to `cipher_list`.<br>
Essentially, I would like to be able to set the protocol version using the =
orb specific configurations as well as using the python interface.<br>
<br>
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">According to the openssl wiki s=
etting the version using options is deprecated. Hence, I suggest we adopt t=
he min and max approach of configuration.<o:p></o:p></span></p>
<ul style=3D"margin-top:0cm" type=3D"disc">
<li class=3D"MsoListParagraph" style=3D"margin-left:-12.75pt;mso-list:l0 le=
vel1 lfo1">
<span lang=3D"EN-US"><a href=3D"https://wiki.openssl.org/index.php/List_of_=
SSL_OP_Flags">https://wiki.openssl.org/index.php/List_of_SSL_OP_Flags</a><b=
r>
</span><span lang=3D"EN-US" style=3D"font-size:9.5pt;font-family:"Aria=
l",sans-serif;color:black;background:white">These options are deprecat=
ed as of 1.1.0, use <b>SSL_CTX_set_min_proto_version()</b> and&nb=
sp;<b>SSL_CTX_set_max_proto_version()</b> instead.</span><span lang=3D=
"EN-US"><o:p></o:p></span></li></ul>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Sadly, my understanding of the =
omniorb codebase is rather limited at the moment, hence writing appropriate=
tests and getting all locations correct is currently out of reach for me.<=
o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Nevertheless, I prepared a smal=
l patch as a sketch for my proposal. (I never compiled it and it does not y=
et cover Python. Just to show my idea!)<br>
<br>
Do you think that my approach is worth implementing?<br>
<br>
Best regards,<br>
Yves-Noel Weweler<br>
<br>
<br>
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Index: include/omniORB4/sslCont=
ext.h<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">--- include/omniORB4/sslContext=
.h (Revision 6674)<o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+++ include/omniORB=
4/sslContext.h (Arbeitskopie)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -101,6 +101,19 @@<o:p></=
o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> static _core_=
attr CORBA::Boolean full_peerdetails;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ // Map of string to=
OpenSSL version enumerators<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ static std::map<=
std::string, int> ssl_version_string_to_enum_mapping =3D {<o:p></o:p></s=
pan></p>
<p class=3D"MsoNormal">+ {"SSL3_VERS=
ION", SSL3_VERSION},<o:p></o:p></p>
<p class=3D"MsoNormal">+ {"TLS1_VERS=
ION", TLS1_VERSION},<o:p></o:p></p>
<p class=3D"MsoNormal">+ {"TLS1_1_VE=
RSION", TLS1_1_VERSION},<o:p></o:p></p>
<p class=3D"MsoNormal">+ {"TLS1_2_VE=
RSION", TLS1_2_VERSION},<o:p></o:p></p>
<p class=3D"MsoNormal">+ {"TLS1_3_VE=
RSION", TLS1_3_VERSION},<o:p></o:p></p>
<p class=3D"MsoNormal">+ {"DTLS1_VER=
SION", DTLS1_VERSION},<o:p></o:p></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ &n=
bsp; {"DTLS1_2_VERSION", DTLS1_2_VERSION}<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ };<o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ static int convert_=
ssl_version_string_to_enum(CORBA::String_var versionString);<o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ static CORBA::Strin=
g_var convert_enum_to_ssl_version_string(int enum);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> class PeerDetails =
{<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> public:<o:p></o:p>=
</span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> inline=
PeerDetails(SSL* s, X509* c, CORBA::Boolean v)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -150,6 +163,8 @@<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> void update_CA(con=
st char* cafile, const char* capath);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> void update_key(co=
nst char* keyfile, const char* password);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> void update_cipher=
_list(const char* cipher_list);<o:p></o:p></span></p>
<p class=3D"MsoNormal">+ void update_min_protocol_version(int ver=
sion);<o:p></o:p></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ void update_max_pro=
tocol_version(int version);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> void update_verify=
_mode(int mode, int mode_incoming, omni_verify_cb callback);<o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> void update_info_c=
b(omni_info_cb callback);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -179,7 +194,7 @@<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> <o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> //<o:p></o:p>=
</span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> // Virtual functio=
ns that populate the SSL_CTX in pd_ctx. Subclasses<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- // may override these i=
f required. Thse are called while holding<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ // may override the=
se if required. These are called while holding<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> // pd_ctx_lock.<o:=
p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> SSL_CTX* get_=
SSL_CTX() const<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -193,12 +208,8 @@<o:p></=
o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> virtual SSL_METHOD=
* set_method(); <o:p>
</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> // Method to =
pass to SSL_CTX_new. Defaults to return TLS_method().<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- virtual void set_suppor=
ted_versions();
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- // Default to<o:p></o:p=
></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- // SSL_CTX_=
set_options(ssl_ctx,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- // &nb=
sp; =
SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |<o:=
p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- // &nb=
sp; =
SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);<=
o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- // That is, only accept=
TLS 1.2 or later.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ virtual void set_mi=
n_protocol_version(int version);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ virtual void set_ma=
x_protocol_version(int version);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> virtual void =
set_CA();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> // Set CA details.=
Calls both SSL_CTX_load_verify_locations and<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -239,6 +250,8 @@<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> CORBA::String_var =
pd_password;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> CORBA::String_var =
pd_password_in_ctx;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> CORBA::String_var =
pd_cipher_list;<o:p></o:p></span></p>
<p class=3D"MsoNormal">+ int &=
nbsp; pd_min_protocol_version;<o:=
p></o:p></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ int &nbs=
p; pd_max=
_protocol_version;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> int &nb=
sp; pd_ve=
rify_mode;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> int &nb=
sp; pd_ve=
rify_mode_incoming;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> omni_verify_cb&nbs=
p; pd_verify_cb;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Index: sample.cfg<o:p></o:p></s=
pan></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">--- sample.cfg  =
; (Revision 6674)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+++ sample.cfg (Arb=
eitskopie)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -326,6 +326,8 @@<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"># sslCAFile<o:p></o:p></span></=
p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"># sslCAPath<o:p></o:p></span></=
p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"># sslCipherList<o:p></o:p></spa=
n></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+# sslMinProtocolVersion<o:=
p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+# sslMaxProtocolVersion<o:=
p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"># sslKeyFile<o:p></o:p></span><=
/p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"># sslKeyPassword<o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"># sslVerifyMode<o:p></o:p></spa=
n></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -349,6 +351,16 @@<o:p></=
o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"># sslCipherList spe=
cifies the string form of acceptable ciphers. See<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"># the OpenSSL ciphe=
rs(1) manual page for details.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">#<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+# sslMinProtoc=
olVersion specifies the minimum protocol version to use.<o:p></o:p></span><=
/p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+# Currently su=
pported versions are SSL3_VERSION, TLS1_VERSION,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+# TLS1_1_VERSI=
ON, TLS1_2_VERSION, TLS1_3_VERSION for TLS and<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+# DTLS1_VERSIO=
N, DTLS1_2_VERSION for DTLS.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+#<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+# sslMaxProtoc=
olVersion specifies the maximum protocol version to use.<o:p></o:p></span><=
/p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+# Currently su=
pported versions are SSL3_VERSION, TLS1_VERSION,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+# TLS1_1_VERSI=
ON, TLS1_2_VERSION, TLS1_3_VERSION for TLS and<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+# DTLS1_VERSIO=
N, DTLS1_2_VERSION for DTLS.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+#<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"># sslKeyFile specif=
ies the file containing the SSL key.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">#<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"># sslKeyPassword sp=
ecifies the password to unlock the key.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Index: src/lib/omniORB/orbcore/=
ssl/sslContext.cc<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">--- src/lib/omniORB/orbcore/ssl=
/sslContext.cc (Revision 6674)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+++ src/lib/omniORB=
/orbcore/ssl/sslContext.cc (Arbeitskopie)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -53,6 +53,8 @@<o:p></o:p=
></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">const char* s=
slContext::key_file &n=
bsp; =3D 0;<o:p></o:p=
></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">const char* s=
slContext::key_file_password  =
; =3D 0;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">const char* s=
slContext::cipher_list  =
; =3D 0;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+int  =
; sslContext::min_protocol_versio=
n =3D TLS1_2_VERSION;<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+int  =
; sslContext::max_protocol_versio=
n =3D TLS1_3_VERSION;<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">int &nbs=
p; sslContext::verify_mode &=
nbsp; &nbs=
p; =3D<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> &=
nbsp; &nbs=
p; (SSL_VERIFY_=
PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">int &nbs=
p; sslContext::verify_mode_incoming&nbs=
p; =3D -1;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -136,6 +138,21 @@<o:p></=
o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> /////////////////////////=
////////////////////////////////////////////////<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">void<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+sslContext::update_min_pro=
tocol_version(int version)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+{<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ omni_tracedmutex_lo=
ck sync(pd_ctx_lock);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ pd_min_protocol_ver=
sion =3D version;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+}<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+//////////////////////////=
///////////////////////////////////////////////<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+void<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+sslContext::update_max_pro=
tocol_version(int version)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+{<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ omni_tracedmutex_lo=
ck sync(pd_ctx_lock);<o:p></o:p></span></p>
<p class=3D"MsoNormal">+ pd_max_protocol_version =3D version;<o:p=
></o:p></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+}<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+//////////////////////////=
///////////////////////////////////////////////<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+void<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">sslContext::update_verify_mode(=
int mode, int mode_incoming,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> &=
nbsp; &nbs=
p; &=
nbsp; omni_verify_cb callback)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">{<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -178,7 +195,8 @@<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> &=
nbsp; &nbs=
p; CORBA::COMPLETED_NO);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> }<o:p>=
</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- set_support=
ed_versions();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ set_min=
_protocol_version();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ set_max=
_protocol_version();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> set_ce=
rtificate();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> set_pr=
ivatekey();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> set_CA=
();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -208,7 +226,7 @@<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> SSL_CTX_set_defaul=
t_passwd_cb_userdata(pd_ctx, 0);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> SSL_CTX_free(pd_ct=
x);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> pd_password_in_ctx=
=3D (const char*)0;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- <o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> create_ctx();<o:p>=
</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">}<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -222,7 +240,7 @@<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> // not=
free it yet.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> if (!(=
const char*)pd_password_in_ctx)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> &=
nbsp; pd_password_in_ctx =3D pd_password._retn();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- <o:p></o:p>=
</span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> pd_caf=
ile =3D certificate_authority_file;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> pd_cap=
ath =3D certificate_authority_path;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> pd_key=
file =3D key_file;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -229,6 +247,8 @@<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> pd_pas=
sword =3D key_file_password;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> }<o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> pd_cipher_list&nbs=
p; =3D cipher_list;<o:p></o=
:p></span></p>
<p class=3D"MsoNormal">+ pd_min_protocol_version =3D =
min_protocol_version;<o:p></o:p></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ pd_max_protocol_ver=
sion =3D max_protocol_version;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> pd_verify_mode&nbs=
p; =3D verify_mode;<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> pd_verify_mode_inc=
oming =3D verify_mode_incoming;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> pd_verify_cb =
=3D verify_cal=
lback;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -276,14 +296,24 @@<o:p><=
/o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> /////////////////////////=
////////////////////////////////////////////////<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">void<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">-sslContext::set_supported_vers=
ions() {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- SSL_CTX_set_options(pd_=
ctx,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- =
&nb=
sp; SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- =
&nb=
sp; SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);<o:p></o:p></spa=
n></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+sslContext::set_min_protoc=
ol_version(int version) {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ if (!int SSL_CTX_se=
t_min_proto_version(pd_ctx, version)) {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ report_=
error();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ OMNIORB=
_THROW(INITIALIZE, INITIALIZE_TransportError, CORBA::COMPLETED_NO);<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ }<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">}<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> /////////////////////////=
////////////////////////////////////////////////<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">void<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+sslContext::set_max_protoc=
ol_version(int version) {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ if (!int SSL_CTX_se=
t_max_proto_version(pd_ctx, version)) {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ report_=
error();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ OMNIORB=
_THROW(INITIALIZE, INITIALIZE_TransportError, CORBA::COMPLETED_NO);<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ }<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+}<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+//////////////////////////=
///////////////////////////////////////////////<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+void<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">sslContext::set_CA() {<o:p></o:=
p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> if (pd_cafile=
.in() || pd_capath.in()) {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -492,3 +522,19 @@<o:p></=
o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> log &l=
t;< "OpenSSL: " << (const char*) buf << "\n&q=
uot;;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> }<o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">}<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+static int convert_ssl_ver=
sion_string_to_enum(CORBA::String_var versionString) {<o:p></o:p></span></p=
>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ auto it =3D version=
Map.find(versionStr);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ int version =3D (it=
!=3D versionMap.end()) ? it->second : -1;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ return version;<o:p=
></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+}<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+static CORBA::String_var c=
onvert_enum_to_ssl_version_string(int enumerator) {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ std::map<int, st=
d::string> reversedMap;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ for (const auto&=
; pair : originalMap) {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ &n=
bsp; reversedMap[pair.second] =3D pair.first;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ }<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ auto it =3D reverse=
dMap.find(enumerator);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ std::string version=
String =3D (it !=3D reversedMap.end()) ? it->second : 'UNKNOWN';<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ return CORBA::strin=
g_dup(versionString);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+}<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Index: src/lib/omniORB/orbcore/=
ssl/sslTransportImpl.cc<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">--- src/lib/omniORB/orbcore/ssl=
/sslTransportImpl.cc (Revision 6674)<o:p></o:=
p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+++ src/lib/omniORB=
/orbcore/ssl/sslTransportImpl.cc (Arbeitskopie)<o:p></o:p></spa=
n></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">@@ -272,6 +272,57 @@<o:p></=
o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> <o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> /////////////////////////=
////////////////////////////////////////////////////<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+class sslMinTlsVersionHand=
ler : public orbOptions::Handler {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+public:<o:p></o:p></span><=
/p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ sslMinTlsVersionHan=
dler() :<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ orbOpti=
ons::Handler("sslMinTlsVersion",<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ &n=
bsp;  =
; &n=
bsp;  =
; "sslMinTlsVersion =3D <min. protocol version>"=
;,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ &n=
bsp;  =
; &n=
bsp;  =
; 1,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ &n=
bsp;  =
; &n=
bsp;  =
; "-ORBsslMinTlsVersion <min. protocol version>"=
;) {}<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ void visit(const ch=
ar* value, orbOptions::Source)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ {<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ sslCont=
ext::min_protocol_version =3D SSLContext::ssl_version_string_to_enum(value)=
;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ }<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ void dump(orbOption=
s::sequenceString& result)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ {<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ orbOpti=
ons::addKVString(key(),<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ &n=
bsp;  =
; &n=
bsp;  =
; sslContext::convert_enum_to_ssl_version_st=
ring(sslContext::min_protocol_version),<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ &n=
bsp;  =
; &n=
bsp;  =
; result);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ }<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+};<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+static sslMinTlsVersionHan=
dler sslMinTlsVersionHandler_;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+//////////////////////////=
///////////////////////////////////////////////////<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+class sslMaxTlsVersionHand=
ler : public orbOptions::Handler {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+public:<o:p></o:p></span><=
/p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ sslMaxTlsVersionHan=
dler() :<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ orbOpti=
ons::Handler("sslMaxTlsVersion",<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ &n=
bsp;  =
; &n=
bsp;  =
; "sslMaxTlsVersion =3D <max. protocol version>"=
;,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ &n=
bsp;  =
; &n=
bsp;  =
; 1,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ &n=
bsp;  =
; &n=
bsp;  =
; "-ORBsslMaxTlsVersion <max. protocol version>"=
;) {}<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ void visit(const ch=
ar* value, orbOptions::Source)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ {<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ sslCont=
ext::max_protocol_version =3D SSLContext::ssl_version_string_to_enum(value)=
;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ }<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ void dump(orbOption=
s::sequenceString& result)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ {<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ orbOpti=
ons::addKVString(key(),<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ &n=
bsp;  =
; &n=
bsp;  =
; sslContext::convert_enum_to_ssl_version_st=
ring(sslContext::max_protocol_version),<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ &n=
bsp;  =
; &n=
bsp;  =
; result);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+ }<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+};<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+static sslMaxTlsVersionHan=
dler sslMaxTlsVersionHandler_;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">+//////////////////////////=
///////////////////////////////////////////////////<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">static int<o:p></o:p></span></p=
>
<p class=3D"MsoNormal"><span lang=3D"EN-US">verifyModeValue(const char* key=
, const char* value, CORBA::Boolean unset_ok)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"></span>{<o:p></o:p></p>
<p class=3D"MsoNormal">@@ -455,6 +506,8 @@<o:p></o:p></p>
<p class=3D"MsoNormal"> orbOptions::singleton().reg=
isterHandler(sslKeyFileHandler_);<o:p></o:p></p>
<p class=3D"MsoNormal"> orbOptions::singleton().reg=
isterHandler(sslKeyPasswordHandler_);<o:p></o:p></p>
<p class=3D"MsoNormal"> orbOptions::singleton().reg=
isterHandler(sslCipherListHandler_);<o:p></o:p></p>
<p class=3D"MsoNormal">+ orbOptions::singleton().regi=
sterHandler(sslMinTlsVersionHandler_);<o:p></o:p></p>
<p class=3D"MsoNormal">+ orbOptions::singleton().regi=
sterHandler(sslMaxTlsVersionHandler_);<o:p></o:p></p>
<p class=3D"MsoNormal"> orbOptions::singleton().reg=
isterHandler(sslVerifyModeHandler_);<o:p></o:p></p>
<p class=3D"MsoNormal"> <span lang=3D"EN-US">orbOpt=
ions::singleton().registerHandler(sslVerifyModeIncomingHandler_);<o:p></o:p=
></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"> orbOpt=
ions::singleton().registerHandler(sslAcceptTimeOutHandler_);<o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><br>
<br>
<o:p></o:p></span></p>
</div>
</body>
</html>
--_000_1b25bffcebfd47fcac5ab49f3c0ab165insiderstechnologiesde_--
--===============5884969157924828752==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
omniORB-list mailing list
[email protected]
https://www.omniorb-support.com/mailman/listinfo/omniorb-list
--===============5884969157924828752==--