jyapayne/Nim
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

net: also set TLSv1.3 cipher suites

Browse source
This commit is contained in:
Leorize 2020-06-04 18:13:06 -05:00 • committed by Andreas Rumpf
commit 6b2d8bfc8b
2 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/pure/net.nim
View file

@ -580,6 +580,13 @@ when defineSsl:
if newCTX.SSL_CTX_set_cipher_list(cipherList) != 1: if newCTX.SSL_CTX_set_cipher_list(cipherList) != 1:
raiseSSLError() raiseSSLError()
when not defined(openssl10) and not defined(libressl):
let sslVersion = getOpenSSLVersion()
if sslVersion >= 0x010101000 and not sslVersion == 0x020000000:
# In OpenSSL >= 1.1.1, TLSv1.3 cipher suites can only be configured via
# this API.
if newCTX.SSL_CTX_set_ciphersuites(cipherList) != 1:
raiseSSLError()
# Automatically the best ECDH curve for client exchange. Without this, ECDH # Automatically the best ECDH curve for client exchange. Without this, ECDH
# ciphers will be ignored by the server. # ciphers will be ignored by the server.
# #

5
lib/wrappers/openssl.nim
View file

@ -296,6 +296,7 @@ when compileOption("dynlibOverride", "ssl") or defined(noOpenSSLHacks):
SSl_state(ssl) and SSL_ST_INIT SSl_state(ssl) and SSL_ST_INIT
else: else:
proc SSL_in_init*(ssl: SslPtr): cint {.cdecl, dynlib: DLLSSLName, importc.} proc SSL_in_init*(ssl: SslPtr): cint {.cdecl, dynlib: DLLSSLName, importc.}
proc SSL_CTX_set_ciphersuites*(ctx: SslCtx, str: cstring): cint {.cdecl, dynlib: DLLSSLName, importc.}
template OpenSSL_add_all_algorithms*() = discard template OpenSSL_add_all_algorithms*() = discard
@ -423,6 +424,10 @@ else:
else: else:
raiseInvalidLibrary MainProc raiseInvalidLibrary MainProc
proc SSL_CTX_set_ciphersuites*(ctx: SslCtx, str: cstring): cint =
let theProc {.global.} = cast[proc(ctx: SslCtx, str: cstring) {.cdecl, gcsafe.}](sslSymThrows("SSL_CTX_set_ciphersuites"))
theProc(ctx, str)
proc ERR_load_BIO_strings*(){.cdecl, dynlib: DLLUtilName, importc.} proc ERR_load_BIO_strings*(){.cdecl, dynlib: DLLUtilName, importc.}
proc SSL_new*(context: SslCtx): SslPtr{.cdecl, dynlib: DLLSSLName, importc.} proc SSL_new*(context: SslCtx): SslPtr{.cdecl, dynlib: DLLSSLName, importc.}