Vladimir Nevzorov created THRIFT-4986:
-----------------------------------------
Summary: cipher "TLSv1.2" returns SSL_CTX_set_ciper_list: bad value
Key: THRIFT-4986
URL: https://issues.apache.org/jira/browse/THRIFT-4986
Project: Thrift
Issue Type: Question
Affects Versions: 0.11.0
Environment: Debian GNU/Linux 10
OpenSSL 1.1.1d 10 Sep 2019
Maybe it might help:
{code:java}
$openssl ciphers TLSv1.3
Error in cipher list
140585714578560:error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher
match:../ssl/ssl_lib.c:2558:
{code}
{code:java}
$openssl ciphers TLSv1.2
TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-CCM8:ECDHE-ECDSA-AES256-CCM:DHE-RSA-AES256-CCM8:DHE-RSA-AES256-CCM:ECDHE-ECDSA-ARIA256-GCM-SHA384:ECDHE-ARIA256-GCM-SHA384:DHE-DSS-ARIA256-GCM-SHA384:DHE-RSA-ARIA256-GCM-SHA384:ADH-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-CCM8:ECDHE-ECDSA-AES128-CCM:DHE-RSA-AES128-CCM8:DHE-RSA-AES128-CCM:ECDHE-ECDSA-ARIA128-GCM-SHA256:ECDHE-ARIA128-GCM-SHA256:DHE-DSS-ARIA128-GCM-SHA256:DHE-RSA-ARIA128-GCM-SHA256:ADH-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:ECDHE-ECDSA-CAMELLIA256-SHA384:ECDHE-RSA-CAMELLIA256-SHA384:DHE-RSA-CAMELLIA256-SHA256:DHE-DSS-CAMELLIA256-SHA256:ADH-AES256-SHA256:ADH-CAMELLIA256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDHE-ECDSA-CAMELLIA128-SHA256:ECDHE-RSA-CAMELLIA128-SHA256:DHE-RSA-CAMELLIA128-SHA256:DHE-DSS-CAMELLIA128-SHA256:ADH-AES128-SHA256:ADH-CAMELLIA128-SHA256:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:DHE-PSK-AES256-CCM8:DHE-PSK-AES256-CCM:RSA-PSK-ARIA256-GCM-SHA384:DHE-PSK-ARIA256-GCM-SHA384:AES256-GCM-SHA384:AES256-CCM8:AES256-CCM:ARIA256-GCM-SHA384:PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:PSK-AES256-CCM8:PSK-AES256-CCM:PSK-ARIA256-GCM-SHA384:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-CCM8:DHE-PSK-AES128-CCM:RSA-PSK-ARIA128-GCM-SHA256:DHE-PSK-ARIA128-GCM-SHA256:AES128-GCM-SHA256:AES128-CCM8:AES128-CCM:ARIA128-GCM-SHA256:PSK-AES128-GCM-SHA256:PSK-AES128-CCM8:PSK-AES128-CCM:PSK-ARIA128-GCM-SHA256:AES256-SHA256:CAMELLIA256-SHA256:AES128-SHA256:CAMELLIA128-SHA256:NULL-SHA256
{code}
{code:java}
Makes some output:
$openssl ciphers ALL
$openssl ciphers ADH
$openssl ciphers MD5
Makes error output:
$openssl ciphers LOW
$$openssl ciphers EXP
{code}
Reporter: Vladimir Nevzorov
Error occured after Debian upgrade.
There is a class:
{code:java}
.hpp
class SSLSocketTransportFactory
: public apache::thrift::transport::TSSLSocketFactory
{
public:
SSLSocketTransportFactory(
bool is_server,
const std::string& crt_path,
const std::string& key_path,
const std::string& server_ca_path,
boost::shared_ptr<apache::thrift::transport::AccessManager>);
~SSLSocketTransportFactory() = default;
};
{code}
{code:java}
.cpp
SSLSocketTransportFactory::SSLSocketTransportFactory(
bool is_server,
const std::string& crt_path,
const std::string& key_path,
const std::string& server_ca_path,
boost::shared_ptr<apache::thrift::transport::AccessManager> acc_mgr)
: TSSLSocketFactory(apache::thrift::transport::TLSv1_2)
{
this->ciphers("TLSv1.2"); <<----- Error occured
this->authenticate(true);
this->server(is_server);
this->loadCertificate(crt_path.c_str());
this->loadPrivateKey(key_path.c_str());
this->loadTrustedCertificates(server_ca_path.c_str());
this->access(acc_mgr);
}
{code}
On Debian 9.6 worked fine!
Now I have Debian 10. It compiled fine. But in run-time setting ciphers:
{code:java}
this->ciphers("TLSv1.2");
{code}
returns:
{code:java}
SSL_CTX_set_ciper_list: bad value
{code}
Additional info.
I have another server - POCO server. There I'm using ciphers from an example:
{code:java}
ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH
{code}
It worked on both Debian.
I don't know much what ciphers are, but I decided to use these ciphers in
Apache Thrift. I expected that it gonna work at Apache Thrift too as it worked
in POCO.
I got the same error!
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
