Bret McGuire created CASSCPP-23:
-----------------------------------
Summary: Consider constraining TLS options to only TLS 1.2 or TLS
1.3
Key: CASSCPP-23
URL: https://issues.apache.org/jira/browse/CASSCPP-23
Project: Apache Cassandra C/C++ driver
Issue Type: Improvement
Reporter: Bret McGuire
The work done for CASSCPP-16 added support for TLS 1.3. While working on that
ticket it was observed that the driver [leverages the modern
TLS_client_method|https://github.com/apache/cassandra-cpp-driver/blob/2.17.1/src/ssl/ssl_openssl_impl.cpp#L40-L56]
as long as you're dealing with a not-ancient OpenSSL install (1.1.0 or up).
In other cases we might wind up with something much older, including in SSL
v2.3. At this point pretty much anything below TLS 1.2 is suspect... so there
seems to be a decent argument for making those the _only_ default options
regardless of which OpenSSL version is in play.
It's also worth noting that the driver can constrain the supported protocols
via
[set_min_protocol_version()|https://github.com/apache/cassandra-cpp-driver/blob/2.17.1/src/ssl/ssl_openssl_impl.cpp#L43-L56].
Problem is that this method _also_ supports versions back to TLS 1.0.
Depending on the choices made above we should consider constraining the min
options here to TLS 1.2 and up.
Side note: we should also consider bumping the version of OpenSSL (and
presumably LibreSSL by extension) we support. Our docs currently claim that we
support OpenSSL 1.0.x and up but that includes some versions that are truly
ancient. OpenSSL 1.1.1 was an LTS release and it was released 8 years ago
(with support dropped 3 years ago). I can make a decent argument that we
should require OpenSSL 3.x or newer (at a minimum).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
