Added limited list of supported ciphers

Summary: Added method to enable server support for a specific elliptic curve encryption algorithm.

Reviewed By: siyengar

Differential Revision: D3432860

fbshipit-source-id: 078531eead48ea156a68a109f8a62dc4907ac1ec

diff --git a/folly/io/async/SSLContext.cpp b/folly/io/async/SSLContext.cpp
index 8854b9be550f103019b7e9342296fb503978e801..a8cf72de2895e514c6a14888c494e2c15c9b8ff9 100644 (file)
--- a/folly/io/async/SSLContext.cpp
+++ b/folly/io/async/SSLContext.cpp
@@ -145,6 +145,42 @@ void SSLContext::setClientECCurvesList(
 #endif
 }
 
+void SSLContext::setServerECCurve(const std::string& curveName) {
+  bool validCall = false;
+#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
+#ifndef OPENSSL_NO_ECDH
+  validCall = true;
+#endif
+#endif
+  if (!validCall) {
+    throw std::runtime_error("Elliptic curve encryption not allowed");
+  }
+
+  EC_KEY* ecdh = nullptr;
+  int nid;
+
+  /*
+   * Elliptic-Curve Diffie-Hellman parameters are either "named curves"
+   * from RFC 4492 section 5.1.1, or explicitly described curves over
+   * binary fields. OpenSSL only supports the "named curves", which provide
+   * maximum interoperability.
+   */
+
+  nid = OBJ_sn2nid(curveName.c_str());
+  if (nid == 0) {
+    LOG(FATAL) << "Unknown curve name:" << curveName.c_str();
+    return;
+  }
+  ecdh = EC_KEY_new_by_curve_name(nid);
+  if (ecdh == nullptr) {
+    LOG(FATAL) << "Unable to create curve:" << curveName.c_str();
+    return;
+  }
+
+  SSL_CTX_set_tmp_ecdh(ctx_, ecdh);
+  EC_KEY_free(ecdh);
+}
+
 void SSLContext::setX509VerifyParam(
     const ssl::X509VerifyParam& x509VerifyParam) {
   if (!x509VerifyParam) {

diff --git a/folly/io/async/SSLContext.h b/folly/io/async/SSLContext.h
index 83f0ad22442ae21300c894b563f8730b1639a53d..4593f91804a5651f7993b7ee3505cea21763e635 100644 (file)
--- a/folly/io/async/SSLContext.h
+++ b/folly/io/async/SSLContext.h
@@ -161,6 +161,13 @@ class SSLContext {
    */
   void setClientECCurvesList(const std::vector<std::string>& ecCurves);
 
+  /**
+   * Method to add support for a specific elliptic curve encryption algorithm.
+   *
+   * @param curveName: The name of the ec curve to support, eg: prime256v1.
+   */
+  void setServerECCurve(const std::string& curveName);
+
   /**
    * Sets an x509 verification param on the context.
    */