mirrors/Nim
1
0
Fork 0
mirror of https://github.com/nim-lang/Nim.git synced 2026-01-23 04:50:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

net: also set TLSv1.3 cipher suites

Browse Source
This commit is contained in:
Leorize
2020-06-04 18:13:06 -05:00
committed by Andreas Rumpf
parent 3cd74c6408
commit 6b2d8bfc8b
2 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
lib/pure/net.nim
View File

@@ -580,6 +580,13 @@ when defineSsl:
if newCTX.SSL_CTX_set_cipher_list(cipherList) != 1:
raiseSSLError()
when not defined(openssl10) and not defined(libressl):
let sslVersion = getOpenSSLVersion()
if sslVersion >= 0x010101000 and not sslVersion == 0x020000000:
# In OpenSSL >= 1.1.1, TLSv1.3 cipher suites can only be configured via
# this API.
if newCTX.SSL_CTX_set_ciphersuites(cipherList) != 1:
raiseSSLError()
# Automatically the best ECDH curve for client exchange. Without this, ECDH
# ciphers will be ignored by the server.
#

5
lib/wrappers/openssl.nim
View File

@@ -296,6 +296,7 @@ when compileOption("dynlibOverride", "ssl") or defined(noOpenSSLHacks):
SSl_state(ssl) and SSL_ST_INIT
else:
proc SSL_in_init*(ssl: SslPtr): cint {.cdecl, dynlib: DLLSSLName, importc.}
proc SSL_CTX_set_ciphersuites*(ctx: SslCtx, str: cstring): cint {.cdecl, dynlib: DLLSSLName, importc.}
template OpenSSL_add_all_algorithms*() = discard
@@ -423,6 +424,10 @@ else:
else:
raiseInvalidLibrary MainProc
proc SSL_CTX_set_ciphersuites*(ctx: SslCtx, str: cstring): cint =
let theProc {.global.} = cast[proc(ctx: SslCtx, str: cstring) {.cdecl, gcsafe.}](sslSymThrows("SSL_CTX_set_ciphersuites"))
theProc(ctx, str)
proc ERR_load_BIO_strings*(){.cdecl, dynlib: DLLUtilName, importc.}
proc SSL_new*(context: SslCtx): SslPtr{.cdecl, dynlib: DLLSSLName, importc.}