Commit graph

26 commits

Author SHA1 Message Date
Ashod Nakashian
e9b26cdf53 wsd: use the default DH parameters in SSL
OpenSSL 3 deprecated the manual DH parameter
functions. Instead, it encourages the use
of the built-in parameters. Since this
API also works on the 1.1 version, we only
need the manual parameters for older versions.

Change-Id: I900cc11c3ca09f1d85b7d88cfbf537d802f69846
Signed-off-by: Ashod Nakashian <ashod.nakashian@collabora.co.uk>
2022-04-22 09:47:19 +02:00
Ashod Nakashian
c9082aea86 wsd: enforce TLSv1.2 as the minimum acceptable version
Signed-off-by: Ashod Nakashian <ashod.nakashian@collabora.co.uk>
(cherry picked from commit dad7ed85e97afe0e4f5229b1de125aada9a8c2e8)

Change-Id: I5683f835f37f67ee353a0b629a4662c7c78787a6
2022-01-10 21:26:38 +01:00
Ashod Nakashian
f63d077916 wsd: ssl certificate verification requirements
Change-Id: I72ffa586310296f1986276c3007672c41146c92b
Signed-off-by: Ashod Nakashian <ashod.nakashian@collabora.co.uk>
2021-07-18 21:14:48 -04:00
Ashod Nakashian
5a310a2232 wsd: separate client SSL context from the server
Change-Id: I4d86f733a16e6c76340b18ff836831ebe6acfd4d
Signed-off-by: Ashod Nakashian <ashod.nakashian@collabora.co.uk>
2021-06-23 23:39:34 -04:00
Ashod Nakashian
a9e650a8db wsd: separate the SSL locks from the context
Change-Id: I2b1742054d5cec16ae3cf90e2098de40eeade4a8
Signed-off-by: Ashod Nakashian <ashod.nakashian@collabora.co.uk>
2021-06-23 23:39:34 -04:00
Gleb Popov
55ed321a1c Implement SslContext::id() for FreeBSD systems by calling pthread_getthreadid_np().
Change-Id: I9d92837dd35c5386222c2644ece9693d7bbb1535
Signed-off-by: Gleb Popov <6yearold@gmail.com>
2020-11-16 14:02:23 +00:00
Andras Timar
0002fdfd6c fix license headers
Change-Id: I8623770b32d278a45357dc7f757fabfadd2b4af7
2020-10-01 11:56:43 +02:00
Ashod Nakashian
224ef08c7f wsd: single-char string literals -> char
More readable and typically more efficient.

Change-Id: I9bd5bfc91f4ac255bb8ae0987708fb8b56b398f8
Reviewed-on: https://gerrit.libreoffice.org/c/online/+/95285
Reviewed-by: Michael Meeks <michael.meeks@collabora.com>
Tested-by: Jenkins
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
2020-06-02 01:31:26 +02:00
Pranam Lashkari
8b349716eb killpoco: removed Poco::Process completely
Change-Id: Iba67abf9342c11517c69c1d94903bf4752aa87d6
Reviewed-on: https://gerrit.libreoffice.org/c/online/+/83770
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Jan Holesovsky <kendy@collabora.com>
2020-04-29 14:27:54 +02:00
Lionel Elie Mamane
1fbf148f09 modernise TLS setup
Some machines (e.g. Debian 10) by default will refuse DH groups
shorter than 2048 bits.

Change-Id: I3505bc392775d7c92069a8f705f574338666a8e7
Reviewed-on: https://gerrit.libreoffice.org/83300
Reviewed-by: Andras Timar <andras.timar@collabora.com>
Tested-by: Andras Timar <andras.timar@collabora.com>
2019-11-20 13:48:07 +01:00
Aron Budea
cfe43ef3f5 Improve SSL initialization
Always log cipher list, and disable any chance of fallback
to deprecated protocols.

Change-Id: Ifdfc7a3e44e98b078a36fdda6f3c813354a79e60
Reviewed-on: https://gerrit.libreoffice.org/76465
Reviewed-by: Michael Meeks <michael.meeks@collabora.com>
Tested-by: Michael Meeks <michael.meeks@collabora.com>
2019-08-21 15:25:43 +02:00
Miklos Vajna
85f24ccb55 CRYPTO_dynlock_value: make members private
Change-Id: I5328bd272d4aaef1a445b9ddc5dd4c878d803777
2018-12-03 09:11:22 +01:00
Michael Meeks
5a94614217 Enable SSL in outbound, client websockets ...
Switch SSL context creation to be generic rather than pure server.

Change-Id: I1b750b4ddc8c607381f5541a4f4412fa16e457d4
2018-05-18 15:16:39 +02:00
Pranav Kant
9cbef14160 loplugin:nullptr
Change-Id: I5f0dc970e8522b63570faa0ba05ab19dd0f45d5a
2017-12-20 22:36:41 +05:30
Pranav Kant
f63858433b loplugin:includeform
Change-Id: Ib62a7aa61062f00698aa3e8a144438de5c57e53d
2017-12-20 21:21:05 +05:30
Pranav Kant
483a5d68e5 tdf#114073: Potential fix for crash with openssl1.1
Using null ssl context to set options is surely not a good idea:

unsigned long SSL_CTX_set_options(SSL_CTX *ctx, unsigned long op)
{
    return ctx->options |= op;
}

Change-Id: I2700350e0c3928e372488c81b8111c9ab0b48e06
2017-11-27 16:31:21 +05:30
Michael Meeks
ec80d623b8 Edit the right configuration XML file.
Change-Id: If72006918550ee5c440ad6b2ff26a5bd0d1efef1
2017-11-22 16:47:05 +00:00
Michael Meeks
92379ffbf2 Make the WSD SSL cipher list configurable.
Change-Id: If79b9efc9438cf0a2345b8e81385adafef63ce22
2017-11-22 15:55:03 +00:00
Christian Glombek
702bbdd5d8 Add Support for OpenSSL 1.1.0
Change-Id: I0aa58b893e8577bba94fa45c0c4c81449b12e4e2
Reviewed-on: https://gerrit.libreoffice.org/42356
Reviewed-by: Ashod Nakashian <ashnakash@gmail.com>
Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
Tested-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
2017-09-20 03:48:08 +02:00
Ashod Nakashian
4f8ebca0cb wsd: free leaking memory
With help from Valgrind to find and verify
these leaks.

Change-Id: I3afeed89dc4bcd714a222f81822144477a346fb0
Reviewed-on: https://gerrit.libreoffice.org/39464
Reviewed-by: Ashod Nakashian <ashnakash@gmail.com>
Tested-by: Ashod Nakashian <ashnakash@gmail.com>
2017-07-03 05:42:38 +02:00
Ashod Nakashian
762ba09370 wsd: fix SSL initialization/uninitialization error
Valgrind found a number of erroneous data access
during the construction and destruction of SslContext.

Change-Id: Ie5072798a3660ed8acc707ba32ac196fa2d0f8af
Reviewed-on: https://gerrit.libreoffice.org/36055
Reviewed-by: Ashod Nakashian <ashnakash@gmail.com>
Tested-by: Ashod Nakashian <ashnakash@gmail.com>
2017-04-04 04:16:53 +00:00
Jan Holesovsky
a9389687a4 Don't try to clean up after a runtime error.
We don't know in what state we are...

Change-Id: I8d144000ba684ca23ff67977959c95b31de34367
2017-04-03 11:39:09 +02:00
Michael Meeks
e26079eecb tdf#106797 - avoid locking up / crashing on exceptions from main. 2017-03-27 20:15:30 +01:00
Michael Meeks
0eaef6c896 config.h - get includes right: must always be the first include. 2017-03-10 10:47:43 +01:00
Ashod Nakashian
d488efd3b7 nb: move openssl-specific struct to avoid conflicts
Change-Id: I4cf4ceb5b9ae1748f5087d4884dc40c280f5a00c
2017-03-10 10:47:40 +01:00
Ashod Nakashian
18b131f30d nb: more consistent filenames
Change-Id: I2f1ff0b18080d469dc68b75ea0d7b9ddf5ea7d57
2017-03-10 10:47:39 +01:00
Renamed from net/ssl.cpp (Browse further)