[ https://issues.apache.org/jira/browse/THRIFT-4986?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Vladimir Nevzorov updated THRIFT-4986: -------------------------------------- Affects Version/s: (was: 0.11.0) 0.10.0 > cipher "TLSv1.2" returns SSL_CTX_set_ciper_list: bad value > ---------------------------------------------------------- > > Key: THRIFT-4986 > URL: https://issues.apache.org/jira/browse/THRIFT-4986 > Project: Thrift > Issue Type: Question > Affects Versions: 0.10.0 > Environment: Debian GNU/Linux 10 > OpenSSL 1.1.1d 10 Sep 2019 > > Maybe it might help: > > {code:java} > $openssl ciphers TLSv1.3 > Error in cipher list > 140585714578560:error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher > match:../ssl/ssl_lib.c:2558: > {code} > {code:java} > $openssl ciphers TLSv1.2 > TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-CCM8:ECDHE-ECDSA-AES256-CCM:DHE-RSA-AES256-CCM8:DHE-RSA-AES256-CCM:ECDHE-ECDSA-ARIA256-GCM-SHA384:ECDHE-ARIA256-GCM-SHA384:DHE-DSS-ARIA256-GCM-SHA384:DHE-RSA-ARIA256-GCM-SHA384:ADH-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-CCM8:ECDHE-ECDSA-AES128-CCM:DHE-RSA-AES128-CCM8:DHE-RSA-AES128-CCM:ECDHE-ECDSA-ARIA128-GCM-SHA256:ECDHE-ARIA128-GCM-SHA256:DHE-DSS-ARIA128-GCM-SHA256:DHE-RSA-ARIA128-GCM-SHA256:ADH-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:ECDHE-ECDSA-CAMELLIA256-SHA384:ECDHE-RSA-CAMELLIA256-SHA384:DHE-RSA-CAMELLIA256-SHA256:DHE-DSS-CAMELLIA256-SHA256:ADH-AES256-SHA256:ADH-CAMELLIA256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDHE-ECDSA-CAMELLIA128-SHA256:ECDHE-RSA-CAMELLIA128-SHA256:DHE-RSA-CAMELLIA128-SHA256:DHE-DSS-CAMELLIA128-SHA256:ADH-AES128-SHA256:ADH-CAMELLIA128-SHA256:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:DHE-PSK-AES256-CCM8:DHE-PSK-AES256-CCM:RSA-PSK-ARIA256-GCM-SHA384:DHE-PSK-ARIA256-GCM-SHA384:AES256-GCM-SHA384:AES256-CCM8:AES256-CCM:ARIA256-GCM-SHA384:PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:PSK-AES256-CCM8:PSK-AES256-CCM:PSK-ARIA256-GCM-SHA384:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-CCM8:DHE-PSK-AES128-CCM:RSA-PSK-ARIA128-GCM-SHA256:DHE-PSK-ARIA128-GCM-SHA256:AES128-GCM-SHA256:AES128-CCM8:AES128-CCM:ARIA128-GCM-SHA256:PSK-AES128-GCM-SHA256:PSK-AES128-CCM8:PSK-AES128-CCM:PSK-ARIA128-GCM-SHA256:AES256-SHA256:CAMELLIA256-SHA256:AES128-SHA256:CAMELLIA128-SHA256:NULL-SHA256 > {code} > {code:java} > Makes some output: > $openssl ciphers ALL > $openssl ciphers ADH > $openssl ciphers MD5 > Makes error output: > $openssl ciphers LOW > $$openssl ciphers EXP > {code} > > > Reporter: Vladimir Nevzorov > Priority: Major > > Error occured after Debian upgrade. > There is a class: > {code:java} > .hpp > class SSLSocketTransportFactory > : public apache::thrift::transport::TSSLSocketFactory > { > public: > SSLSocketTransportFactory( > bool is_server, > const std::string& crt_path, > const std::string& key_path, > const std::string& server_ca_path, > boost::shared_ptr<apache::thrift::transport::AccessManager>); > ~SSLSocketTransportFactory() = default; > }; > {code} > > {code:java} > .cpp > SSLSocketTransportFactory::SSLSocketTransportFactory( > bool is_server, > const std::string& crt_path, > const std::string& key_path, > const std::string& server_ca_path, > boost::shared_ptr<apache::thrift::transport::AccessManager> acc_mgr) > : TSSLSocketFactory(apache::thrift::transport::TLSv1_2) > { > this->ciphers("TLSv1.2"); <<----- Error occured > this->authenticate(true); > this->server(is_server); > this->loadCertificate(crt_path.c_str()); > this->loadPrivateKey(key_path.c_str()); > this->loadTrustedCertificates(server_ca_path.c_str()); > this->access(acc_mgr); > } > {code} > > On Debian 9.6 worked fine! > Now I have Debian 10. It compiled fine. But in run-time setting ciphers: > {code:java} > this->ciphers("TLSv1.2"); > {code} > returns: > {code:java} > SSL_CTX_set_ciper_list: bad value > {code} > > Additional info. > I have another server - POCO server. There I'm using ciphers from an example: > {code:java} > ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH > {code} > It worked on both Debian. > I don't know much what ciphers are, but I decided to use these ciphers in > Apache Thrift. I expected that it gonna work at Apache Thrift too as it > worked in POCO. > I got the same error! -- This message was sent by Atlassian Jira (v8.3.4#803005)