I use nghttp2 asio_http2_client with TLS 1.3 protocol, but when i try to add additional suites in cipher suites list via SSL_CTX_get_ciphers function, i don't see anything changes in my Client hello message. I.e. cipher suites list stay without changes.
My code example:
#include <nghttp2/asio_http2_client.h>
#include <iostream>
using boost::asio::ip::tcp;
using namespace nghttp2::asio_http2;
using namespace nghttp2::asio_http2::client;
int main(int argc, char* argv[])
{
boost::system::error_code ec;
boost::asio::io_service io_service;
boost::asio::ssl::context tls(boost::asio::ssl::context::tlsv13_client);
tls.set_verify_mode(boost::asio::ssl::verify_peer);
// https://testssl.sh/openssl-iana.mapping.html
auto rc = SSL_CTX_set_cipher_list(
tls.native_handle(),
R"(TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-CHACHA20-POLY1305-OLD:ECDHE-RSA-CHACHA20-POLY1305-OLD:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA)");
if (rc != 1) {
std::cout << "no cipher list found " << rc << std::endl;
}
auto ciph = SSL_CTX_get_ciphers(tls.native_handle());
printf("after SSL_CTX_set_ciphersuites()\n");
for (size_t i = 0; i < sk_SSL_CIPHER_num(ciph); i++)
printf("%s%s", i != 0 ? ":" : "", SSL_CIPHER_get_name(sk_SSL_CIPHER_value(ciph, i)));
// return 1;
configure_tls_context(ec, tls);
// connect to
session sess(io_service, tls, "www.google.com", "443");
sess.on_connect([&sess](tcp::resolver::iterator endpoint_it) {
boost::system::error_code ec;
std::cerr << "Connected!" << std::endl;
});
sess.on_error([](const boost::system::error_code& ec) {
std::cerr << "error: " << ec.message() << std::endl;
});
io_service.run();
}
In wireshark i see following output(4 cipher suites,but there are many more cipher suites in the SSL_CTX_set_cipher_list arguments):
I did an experiment with SSL_CTX_set_cipher_list and commented out the next lines:
auto rc = SSL_CTX_set_cipher_list(
tls.native_handle(),
R"(TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-CHACHA20-POLY1305-OLD:ECDHE-RSA-CHACHA20-POLY1305-OLD:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA)");
if (rc != 1) {
std::cout << "no cipher list found " << rc << std::endl;
}
auto ciph = SSL_CTX_get_ciphers(tls.native_handle());
printf("after SSL_CTX_set_ciphersuites()\n");
for (size_t i = 0; i < sk_SSL_CIPHER_num(ciph); i++)
printf("%s%s", i != 0 ? ":" : "", SSL_CIPHER_get_name(sk_SSL_CIPHER_value(ciph, i)));
But cipher suite list remained the same. Whats wrong?
If you go to the documentation for SSL_CTX_get_ciphers it states:
SSL_CTX_set_cipher_list() sets the list of available ciphers (TLSv1.2 and below)
and
This function does not impact TLSv1.3 ciphersuites. Use SSL_CTX_set_ciphersuites() to configure those.
So you need to go read the SSL_CTX_set_cipher_list API as the v1.3 cipher list is a lot different and much smaller than up to v1.2 cipher list.