Skip to content

25.3.8-fips: add TLSv1.3 support to disableProtocols configuration #1569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mkmkme wants to merge 2 commits into
base: releases/25.3.8-fips
Choose a base branch
from
+18 −3
Open

25.3.8-fips: add TLSv1.3 support to disableProtocols configuration #1569

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
756bc3c
add TLSv1.3 support to disableProtocols configuration
mkmkme Mar 23, 2026
73c8ae4
minor comment fix
mkmkme Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion base/poco/NetSSL_OpenSSL/include/Poco/Net/Context.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,8 @@ namespace Net
PROTO_SSLV3 = 0x02,
PROTO_TLSV1 = 0x04,
PROTO_TLSV1_1 = 0x08,
PROTO_TLSV1_2 = 0x10
PROTO_TLSV1_2 = 0x10,
PROTO_TLSV1_3 = 0x20
};

struct NetSSL_API CAPaths
Expand Down
4 changes: 2 additions & 2 deletions base/poco/NetSSL_OpenSSL/include/Poco/Net/SSLManager.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ namespace Net
/// <requireTLSv1>true|false</requireTLSv1>
/// <requireTLSv1_1>true|false</requireTLSv1_1>
/// <requireTLSv1_2>true|false</requireTLSv1_2>
/// <disableProtocols>sslv2,sslv3,tlsv1,tlsv1_1,tlsv1_2</disableProtocols>
/// <disableProtocols>sslv2,sslv3,tlsv1,tlsv1_1,tlsv1_2,tlsv1_3</disableProtocols>
/// <dhParamsFile>dh.pem</dhParamsFile>
/// <ecdhCurve>prime256v1</ecdhCurve>
/// </server|client>
Expand Down Expand Up @@ -147,7 +147,7 @@ namespace Net
/// - requireTLSv1_1 (boolean): Require a TLSv1.1 connection.
/// - requireTLSv1_2 (boolean): Require a TLSv1.2 connection.
/// - disableProtocols (string): A comma-separated list of protocols that should be
/// disabled. Valid protocol names are sslv2, sslv3, tlsv1, tlsv1_1, tlsv1_2.
/// disabled. Valid protocol names are sslv2, sslv3, tlsv1, tlsv1_1, tlsv1_2, tlsv1_3.
/// - dhParamsFile (string): Specifies a file containing Diffie-Hellman parameters.
/// If not specified or empty, the default parameters are used.
/// - ecdhCurve (string): Specifies the name of the curve to use for ECDH, based
Expand Down
6 changes: 6 additions & 0 deletions base/poco/NetSSL_OpenSSL/src/Context.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -515,6 +515,12 @@ void Context::disableProtocols(int protocols)
{
#if defined(SSL_OP_NO_TLSv1_2)
SSL_CTX_set_options(_pSSLContext, SSL_OP_NO_TLSv1_2);
#endif
}
if (protocols & PROTO_TLSV1_3)
{
#if defined(SSL_OP_NO_TLSv1_3)
SSL_CTX_set_options(_pSSLContext, SSL_OP_NO_TLSv1_3);
#endif
}
}
Expand Down
2 changes: 2 additions & 0 deletions base/poco/NetSSL_OpenSSL/src/SSLManager.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -324,6 +324,8 @@ void SSLManager::initDefaultContext(bool server)
disabledProtocols |= Context::PROTO_TLSV1_1;
else if (*it == "tlsv1_2")
disabledProtocols |= Context::PROTO_TLSV1_2;
else if (*it == "tlsv1_3")
disabledProtocols |= Context::PROTO_TLSV1_3;
}
if (server)
_ptrDefaultServerContext->disableProtocols(disabledProtocols);
Expand Down
2 changes: 2 additions & 0 deletions src/Coordination/KeeperServer.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,8 @@ auto getSslContextProvider(const Poco::Util::AbstractConfiguration & config, std
disabled_protocols |= Poco::Net::Context::PROTO_TLSV1_1;
else if (token == "tlsv1_2")
disabled_protocols |= Poco::Net::Context::PROTO_TLSV1_2;
else if (token == "tlsv1_3")
disabled_protocols |= Poco::Net::Context::PROTO_TLSV1_3;
}

auto prefer_server_cypher = config.getBool(fmt::format("openSSL.{}.preferServerCiphers", key), false);
Expand Down
2 changes: 2 additions & 0 deletions src/Server/PostgreSQLHandler.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,6 +122,8 @@ PostgreSQLHandler::PostgreSQLHandler(
disabled_protocols |= Poco::Net::Context::PROTO_TLSV1_1;
else if (token == "tlsv1_2")
disabled_protocols |= Poco::Net::Context::PROTO_TLSV1_2;
else if (token == "tlsv1_3")
disabled_protocols |= Poco::Net::Context::PROTO_TLSV1_3;
}

extended_verification = config.getBool(prefix + Poco::Net::SSLManager::CFG_EXTENDED_VERIFICATION, false);
Expand Down
2 changes: 2 additions & 0 deletions src/Server/TLSHandler.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,8 @@ DB::TLSHandler::TLSHandler(
disabled_protocols |= Context::PROTO_TLSV1_1;
else if (token == "tlsv1_2")
disabled_protocols |= Context::PROTO_TLSV1_2;
else if (token == "tlsv1_3")
disabled_protocols |= Context::PROTO_TLSV1_3;
}

extended_verification = config.getBool(prefix + SSLManager::CFG_EXTENDED_VERIFICATION, false);
Expand Down
Loading