Skip to content

Commit

Permalink
THRIFT-5706: lib/cpp Fix the Security tests on openssl 1.1 and 3.0
Browse files Browse the repository at this point in the history 
This PR fixes the Security tests to build on a clean install of ubuntu
20.04 and ubuntu 22.04 without modifications to the systems openssl
configuration.

 * Enable TLS 1.0 and TLS 1.1 on OpenSSL 1.1 with the seclevel=0 flag
 * Disable TLS 1.0 and TLS 1.1 on OpenSSL 3.0

While its technically possible to enable it on OpenSSL 3 I think because
of all the issues with these old TLS versions dropping support for it is
better.

This PR builds forth on the work done here: #2811

Tested with the ubuntu 20.04 (OpenSSL 1.1) and 22.04 (OpenSSL 3.0) docker containers.
All lib/cpp tests succeed in both.
  • Loading branch information
@thomasbruggink
thomasbruggink committed Feb 26, 2024
1 parent da2ef34 commit 8148f2f
Show file tree
Hide file tree
Showing 2 changed files with 32 additions and 10 deletions.
21 changes: 16 additions & 5 deletions lib/cpp/test/SecurityFromBufferTest.cpp
View file
Expand Up @@ -109,7 +109,13 @@ struct SecurityFromBufferFixture {
shared_ptr<TSSLServerSocket> pServerSocket;

pServerSocketFactory.reset(new TSSLSocketFactory(static_cast<apache::thrift::transport::SSLProtocol>(protocol)));
pServerSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");
#if OPENSSL_VERSION_NUMBER >= 0x10100000L && OPENSSL_VERSION_NUMBER < 0x30000000L
// OpenSSL 1.1.0 introduced @SECLEVEL. Modern distributions limit TLS 1.0/1.1
// to @SECLEVEL=0 or 1, so specify it to test all combinations.
pServerSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@SECLEVEL=0");
#else
pServerSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");
#endif
pServerSocketFactory->loadCertificateFromBuffer(certString("server.crt").c_str());
pServerSocketFactory->loadPrivateKeyFromBuffer(certString("server.key").c_str());
pServerSocketFactory->server(true);
Expand Down Expand Up @@ -155,6 +161,11 @@ struct SecurityFromBufferFixture {
try {
pClientSocketFactory.reset(new TSSLSocketFactory(static_cast<apache::thrift::transport::SSLProtocol>(protocol)));
pClientSocketFactory->authenticate(true);
#if OPENSSL_VERSION_NUMBER >= 0x10100000L && OPENSSL_VERSION_NUMBER < 0x30000000L
// OpenSSL 1.1.0 introduced @SECLEVEL. Modern distributions limit TLS 1.0/1.1
// to @SECLEVEL=0 or 1, so specify it to test all combinations.
pClientSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@SECLEVEL=0");
#endif
pClientSocketFactory->loadCertificateFromBuffer(certString("client.crt").c_str());
pClientSocketFactory->loadPrivateKeyFromBuffer(certString("client.key").c_str());
pClientSocketFactory->loadTrustedCertificatesFromBuffer(certString("CA.pem").c_str());
Expand Down Expand Up @@ -199,16 +210,16 @@ BOOST_AUTO_TEST_CASE(ssl_security_matrix) {
try {
// matrix of connection success between client and server with different SSLProtocol selections
static_assert(apache::thrift::transport::LATEST == 5, "Mismatch in assumed number of ssl protocols");
bool ossl1 = (OPENSSL_VERSION_NUMBER < 0x30000000L);
bool ossl1x = (OPENSSL_VERSION_NUMBER < 0x30000000L);
bool matrix[apache::thrift::transport::LATEST + 1][apache::thrift::transport::LATEST + 1] =
{
// server = SSLTLS SSLv2 SSLv3 TLSv1_0 TLSv1_1 TLSv1_2
// client
/* SSLTLS */ { true, false, false, ossl1, ossl1, true },
/* SSLTLS */ { true, false, false, ossl1x, ossl1x, true },
/* SSLv2 */ { false, false, false, false, false, false },
/* SSLv3 */ { false, false, true, false, false, false },
/* TLSv1_0 */ { ossl1, false, false, ossl1, false, false },
/* TLSv1_1 */ { ossl1, false, false, false, ossl1, false },
/* TLSv1_0 */ { ossl1x, false, false, ossl1x, false, false },
/* TLSv1_1 */ { ossl1x, false, false, false, ossl1x, false },
/* TLSv1_2 */ { true, false, false, false, false, true }
};

Expand Down
21 changes: 16 additions & 5 deletions lib/cpp/test/SecurityTest.cpp
View file
Expand Up @@ -108,7 +108,13 @@ struct SecurityFixture
shared_ptr<TSSLServerSocket> pServerSocket;

pServerSocketFactory.reset(new TSSLSocketFactory(static_cast<apache::thrift::transport::SSLProtocol>(protocol)));
pServerSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");
#if OPENSSL_VERSION_NUMBER >= 0x10100000L && OPENSSL_VERSION_NUMBER < 0x30000000L
// OpenSSL 1.1.0 introduced @SECLEVEL. Modern distributions limit TLS 1.0/1.1
// to @SECLEVEL=0 or 1, so specify it to test all combinations.
pServerSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@SECLEVEL=0:@STRENGTH");
#else
pServerSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");
#endif
pServerSocketFactory->loadCertificate(certFile("server.crt").string().c_str());
pServerSocketFactory->loadPrivateKey(certFile("server.key").string().c_str());
pServerSocketFactory->server(true);
Expand Down Expand Up @@ -162,6 +168,11 @@ struct SecurityFixture
{
pClientSocketFactory.reset(new TSSLSocketFactory(static_cast<apache::thrift::transport::SSLProtocol>(protocol)));
pClientSocketFactory->authenticate(true);
#if OPENSSL_VERSION_NUMBER >= 0x10100000L && OPENSSL_VERSION_NUMBER < 0x30000000L
// OpenSSL 1.1.0 introduced @SECLEVEL. Modern distributions limit TLS 1.0/1.1
// to @SECLEVEL=0 or 1, so specify it to test all combinations.
pClientSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@SECLEVEL=0");
#endif
pClientSocketFactory->loadCertificate(certFile("client.crt").string().c_str());
pClientSocketFactory->loadPrivateKey(certFile("client.key").string().c_str());
pClientSocketFactory->loadTrustedCertificates(certFile("CA.pem").string().c_str());
Expand Down Expand Up @@ -221,16 +232,16 @@ BOOST_AUTO_TEST_CASE(ssl_security_matrix)
{
// matrix of connection success between client and server with different SSLProtocol selections
static_assert(apache::thrift::transport::LATEST == 5, "Mismatch in assumed number of ssl protocols");
bool ossl1 = (OPENSSL_VERSION_NUMBER < 0x30000000L);
bool ossl1x = (OPENSSL_VERSION_NUMBER < 0x30000000L);
bool matrix[apache::thrift::transport::LATEST + 1][apache::thrift::transport::LATEST + 1] =
{
// server = SSLTLS SSLv2 SSLv3 TLSv1_0 TLSv1_1 TLSv1_2
// client
/* SSLTLS */ { true, false, false, ossl1, ossl1, true },
/* SSLTLS */ { true, false, false, ossl1x, ossl1x, true },
/* SSLv2 */ { false, false, false, false, false, false },
/* SSLv3 */ { false, false, true, false, false, false },
/* TLSv1_0 */ { ossl1, false, false, ossl1, false, false },
/* TLSv1_1 */ { ossl1, false, false, false, ossl1, false },
/* TLSv1_0 */ { ossl1x, false, false, ossl1x, false, false },
/* TLSv1_1 */ { ossl1x, false, false, false, ossl1x, false },
/* TLSv1_2 */ { true, false, false, false, false, true }
};

Expand Down

0 comments on commit 8148f2f

Please sign in to comment.