thrift-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Vladimir Nevzorov (Jira)" <j...@apache.org>
Subject [jira] [Commented] (THRIFT-4986) cipher "TLSv1.2" returns SSL_CTX_set_ciper_list: bad value
Date Mon, 11 Nov 2019 14:02:00 GMT

    [ https://issues.apache.org/jira/browse/THRIFT-4986?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16971560#comment-16971560
] 

Vladimir Nevzorov commented on THRIFT-4986:
-------------------------------------------

Put _{{this->ciphers("TLSv1.2"}}__{{)}}_ after loadCerts... solved the problem.
    this->authenticate(true);    this->server(false);    this->loadCertificate(crt_path.c_str());
   this->loadPrivateKey(key_path.c_str());    this->loadTrustedCertificates(server_ca_path.c_str());
   this->ciphers("TLSv1.2");

> cipher "TLSv1.2" returns SSL_CTX_set_ciper_list: bad value
> ----------------------------------------------------------
>
>                 Key: THRIFT-4986
>                 URL: https://issues.apache.org/jira/browse/THRIFT-4986
>             Project: Thrift
>          Issue Type: Question
>          Components: C++ - Library
>    Affects Versions: 0.10.0
>         Environment: Debian GNU/Linux 10
> OpenSSL 1.1.1d 10 Sep 2019
>  
> Maybe it might help:
>  
> {code:java}
> $openssl ciphers TLSv1.3
> Error in cipher list
> 140585714578560:error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match:../ssl/ssl_lib.c:2558:
> {code}
> {code:java}
> $openssl ciphers TLSv1.2
> TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-CCM8:ECDHE-ECDSA-AES256-CCM:DHE-RSA-AES256-CCM8:DHE-RSA-AES256-CCM:ECDHE-ECDSA-ARIA256-GCM-SHA384:ECDHE-ARIA256-GCM-SHA384:DHE-DSS-ARIA256-GCM-SHA384:DHE-RSA-ARIA256-GCM-SHA384:ADH-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-CCM8:ECDHE-ECDSA-AES128-CCM:DHE-RSA-AES128-CCM8:DHE-RSA-AES128-CCM:ECDHE-ECDSA-ARIA128-GCM-SHA256:ECDHE-ARIA128-GCM-SHA256:DHE-DSS-ARIA128-GCM-SHA256:DHE-RSA-ARIA128-GCM-SHA256:ADH-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:ECDHE-ECDSA-CAMELLIA256-SHA384:ECDHE-RSA-CAMELLIA256-SHA384:DHE-RSA-CAMELLIA256-SHA256:DHE-DSS-CAMELLIA256-SHA256:ADH-AES256-SHA256:ADH-CAMELLIA256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDHE-ECDSA-CAMELLIA128-SHA256:ECDHE-RSA-CAMELLIA128-SHA256:DHE-RSA-CAMELLIA128-SHA256:DHE-DSS-CAMELLIA128-SHA256:ADH-AES128-SHA256:ADH-CAMELLIA128-SHA256:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:DHE-PSK-AES256-CCM8:DHE-PSK-AES256-CCM:RSA-PSK-ARIA256-GCM-SHA384:DHE-PSK-ARIA256-GCM-SHA384:AES256-GCM-SHA384:AES256-CCM8:AES256-CCM:ARIA256-GCM-SHA384:PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:PSK-AES256-CCM8:PSK-AES256-CCM:PSK-ARIA256-GCM-SHA384:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-CCM8:DHE-PSK-AES128-CCM:RSA-PSK-ARIA128-GCM-SHA256:DHE-PSK-ARIA128-GCM-SHA256:AES128-GCM-SHA256:AES128-CCM8:AES128-CCM:ARIA128-GCM-SHA256:PSK-AES128-GCM-SHA256:PSK-AES128-CCM8:PSK-AES128-CCM:PSK-ARIA128-GCM-SHA256:AES256-SHA256:CAMELLIA256-SHA256:AES128-SHA256:CAMELLIA128-SHA256:NULL-SHA256
> {code}
> {code:java}
> Makes some output:
> $openssl ciphers ALL
> $openssl ciphers ADH
> $openssl ciphers MD5
> Makes error output:
> $openssl ciphers LOW
> $$openssl ciphers EXP
> {code}
>  
>  
>            Reporter: Vladimir Nevzorov
>            Priority: Major
>
> Error occured after Debian upgrade.
> There is a class: 
> {code:java}
> .hpp
> class SSLSocketTransportFactory
>         : public apache::thrift::transport::TSSLSocketFactory
> {
> public:
>     SSLSocketTransportFactory(
>         bool is_server,
>         const std::string& crt_path,
>         const std::string& key_path,
>         const std::string& server_ca_path,
>         boost::shared_ptr<apache::thrift::transport::AccessManager>);
>     ~SSLSocketTransportFactory() = default;
> };
> {code}
>  
> {code:java}
> .cpp
> SSLSocketTransportFactory::SSLSocketTransportFactory(
>     bool is_server,
>     const std::string& crt_path,
>     const std::string& key_path,
>     const std::string& server_ca_path,
>     boost::shared_ptr<apache::thrift::transport::AccessManager> acc_mgr)
>         : TSSLSocketFactory(apache::thrift::transport::TLSv1_2)
> {
>     this->ciphers("TLSv1.2"); <<----- Error occured
>     this->authenticate(true);
>     this->server(is_server);
>     this->loadCertificate(crt_path.c_str());
>     this->loadPrivateKey(key_path.c_str());
>     this->loadTrustedCertificates(server_ca_path.c_str());
>     this->access(acc_mgr);
> }
> {code}
>  
> On Debian 9.6 worked fine!
> Now I have Debian 10. It compiled fine. But in run-time setting ciphers: 
> {code:java}
> this->ciphers("TLSv1.2");
> {code}
> returns:
> {code:java}
> SSL_CTX_set_ciper_list: bad value
> {code}
>  
> Additional info.
> I have another server - POCO server. There I'm using ciphers from an example:
> {code:java}
> ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH
> {code}
> It worked on both Debian.
> I don't know much what ciphers are, but I decided to use these ciphers in Apache Thrift.
I expected that it gonna work at Apache Thrift too as it worked in POCO.
> I got the same error!



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

Mime
View raw message