Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update SSL backends and unit test #4254

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Update SSL backends and unit test #4254

wants to merge 2 commits into from

Conversation

sauwming
Copy link
Member

Update SSL backends to use TLS 1.2 and 1.3 by default as older TLS versions have been deprecated. Unit tests have been updated with newer versions of TLS and ciphers.

Tested and pass with OpenSSL and GnuTLS backend.

Also in this PR:

  • Fixed bug in https_client_test() that causes PJ_EINVAL error during connection. Also, activate the test since CI machine should have Internet access to install the required dependencies.
  • Also fixed OpenSSL backend failure to set cipher for TLS 1.3, which uses a different API to set the ciphers (https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_cipher_list/#synopsis).

Apple SSL will be updated in a separate PR since it needs more comprehensive changes.

@sauwming sauwming self-assigned this Jan 17, 2025
@sauwming sauwming linked an issue Jan 17, 2025 that may be closed by this pull request
@sauwming sauwming added this to the release-2.16 milestone Jan 17, 2025
@sauwming
Copy link
Member Author

@nanangizz , please help check the Windows SChannel backend.

@nanangizz
Copy link
Member

nanangizz commented Jan 17, 2025

From here, Windows Schannel seems to already disable TLS 1.1 or older, so when PJ_SSL_SOCK_PROTO_DEFAULT is set, it should use TLS 1.2 & 1.3.

Btw, the PJ_SSL_SOCK_PROTO_DEFAULT docs only says:

Default protocol of backend.

which does not seem to be accurate, instead of backend's default, this PR implements it as TLS 1.2 & 1.3.
Perhaps also add something about TLS 1.1/older deprecation in the docs?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Outdated SSL sock unit test
2 participants