Disable TLS 1.0 and 1.1 use in cpprest (#20)

amitsara · web-flow · commit 28c3b39411f1 · 2019-12-19T16:24:53.000-08:00
* Disable TLS version 1.0 &amp; 1.1.
diff --git a/Release/src/http/client/http_client_asio.cpp b/Release/src/http/client/http_client_asio.cpp
@@ -140,9 +140,11 @@ class asio_connection
     {
         std::lock_guard<std::mutex> lock(m_socket_lock);
         assert(!is_ssl());
-        boost::asio::ssl::context ssl_context(boost::asio::ssl::context::sslv23);
+        boost::asio::ssl::context ssl_context(boost::asio::ssl::context::tlsv12);
         ssl_context.set_default_verify_paths();
-        ssl_context.set_options(boost::asio::ssl::context::default_workarounds);
+        ssl_context.set_options(boost::asio::ssl::context::default_workarounds |
+                             boost::asio::ssl::context::no_sslv2 |
+                             boost::asio::ssl::context::no_sslv3);
         if (ssl_context_callback)
         {
             ssl_context_callback(ssl_context);
diff --git a/Release/src/http/client/http_client_winhttp.cpp b/Release/src/http/client/http_client_winhttp.cpp
@@ -539,7 +539,7 @@ class winhttp_client : public _http_client_communicator
 #if !defined(CPPREST_TARGET_XP)
         BOOL win32_result(FALSE);
 
-        DWORD secure_protocols(WINHTTP_FLAG_SECURE_PROTOCOL_SSL3 | WINHTTP_FLAG_SECURE_PROTOCOL_TLS1 | WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1 | WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2);
+        DWORD secure_protocols(WINHTTP_FLAG_SECURE_PROTOCOL_SSL3 | WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2);
         win32_result = ::WinHttpSetOption(m_hSession, WINHTTP_OPTION_SECURE_PROTOCOLS, &secure_protocols, sizeof(secure_protocols));
         if(FALSE == win32_result)
         {
@@ -1561,4 +1561,4 @@ std::shared_ptr<_http_client_communicator> create_winhttp_client(uri&& base_uri,
 }
 
 }}}}
-
+

Original file line number	Diff line number	Diff line change
`@@ -140,9 +140,11 @@ class asio_connection`
`140`	`140`	`{`
`141`	`141`	`std::lock_guard<std::mutex> lock(m_socket_lock);`
`142`	`142`	`assert(!is_ssl());`
`143`		`- boost::asio::ssl::context ssl_context(boost::asio::ssl::context::sslv23);`
	`143`	`+ boost::asio::ssl::context ssl_context(boost::asio::ssl::context::tlsv12);`
`144`	`144`	`ssl_context.set_default_verify_paths();`
`145`		`- ssl_context.set_options(boost::asio::ssl::context::default_workarounds);`
	`145`	`+ ssl_context.set_options(boost::asio::ssl::context::default_workarounds \|`
	`146`	`+ boost::asio::ssl::context::no_sslv2 \|`
	`147`	`+ boost::asio::ssl::context::no_sslv3);`
`146`	`148`	`if (ssl_context_callback)`
`147`	`149`	`{`
`148`	`150`	`ssl_context_callback(ssl_context);`
Original file line number	Diff line number	Diff line change
`@@ -539,7 +539,7 @@ class winhttp_client : public _http_client_communicator`
`539`	`539`	`#if !defined(CPPREST_TARGET_XP)`
`540`	`540`	`BOOL win32_result(FALSE);`
`541`	`541`
`542`		`- DWORD secure_protocols(WINHTTP_FLAG_SECURE_PROTOCOL_SSL3 \| WINHTTP_FLAG_SECURE_PROTOCOL_TLS1 \| WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1 \| WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2);`
	`542`	`+ DWORD secure_protocols(WINHTTP_FLAG_SECURE_PROTOCOL_SSL3 \| WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2);`
`543`	`543`	`win32_result = ::WinHttpSetOption(m_hSession, WINHTTP_OPTION_SECURE_PROTOCOLS, &secure_protocols, sizeof(secure_protocols));`
`544`	`544`	`if(FALSE == win32_result)`
`545`	`545`	`{`
`@@ -1561,4 +1561,4 @@ std::shared_ptr<_http_client_communicator> create_winhttp_client(uri&& base_uri,`
`1561`	`1561`	`}`
`1562`	`1562`
`1563`	`1563`	`}}}}`
`1564`		`-`
	`1564`	`+`