This helper class manages the list of TLS ciphersuites supported by DCMTK, translates DcmTLSSecurityProfile enums into the corresponding sets of ciphersuites, and permits translation between the official TLS ciphersuite names (as used in DCMTK) and the corresponding internal OpenSSL name.
More...
|
| DcmTLSCiphersuiteHandler () |
| constructor.
|
|
virtual | ~DcmTLSCiphersuiteHandler () |
| destructor
|
|
OFCondition | setTLSProfile (DcmTLSSecurityProfile profile) |
| replace the current list of ciphersuites by the list of ciphersuites for the given profile.
|
|
DcmTLSSecurityProfile | getTLSProfile () const |
| return the currently selected TLS profile
|
|
void | clearTLSProfile () |
| clear the current list of ciphersuites.
|
|
OFCondition | addCipherSuite (const char *suite) |
| adds a ciphersuite to the list of ciphersuites for TLS negotiation.
|
|
void | getListOfCipherSuitesForOpenSSL (OFString &cslist, OFBool isServer) const |
| returns a string in OpenSSL syntax that contains the currently defined list of TLS ciphersuites.
|
|
long | getTLSOptions () const |
| returns the set of flags that need to be activated in OpenSSL depending on the selected TLS profile.
|
|
OFBool | cipher3DESsupported () const |
| checks if the 3DES ciphersuite TLS_RSA_WITH_3DES_EDE_CBC_SHA is supported by the underlying OpenSSL library (which newer versions only do if compiled with "weak ciphers" enabled).
|
|
OFBool | cipherNULLsupported () const |
| checks if the unencrypted ciphersuite TLS_RSA_WITH_NULL_SHA is supported by the underlying OpenSSL library (which newer versions only do if compiled with "weak ciphers" enabled).
|
|
OFBool | isTLS13Enabled () const |
| checks if TLS 1.3 is enabled (permitted) for the currently selected TLS security profile.
|
|
void | printSupportedCiphersuites (STD_NAMESPACE ostream &os) const |
| print a list of supported ciphersuites to the given output stream
|
|
|
static const size_t | unknownCipherSuiteIndex |
| constant returned by findOpenSSLCipherSuiteName() if ciphersuite name is unknown
|
|
|
| DcmTLSCiphersuiteHandler (const DcmTLSCiphersuiteHandler &) |
| private undefined copy constructor
|
|
DcmTLSCiphersuiteHandler & | operator= (const DcmTLSCiphersuiteHandler &) |
| private undefined assignment operator
|
|
void | determineSupportedCiphers () |
| determine the set of ciphersuites that are supported both by DCMTK and the OpenSSL library we are currently using
|
|
OFCondition | addRequiredCipherSuite (const char *name) |
| add ciphersuite by name, print error if unsupported
|
|
void | addOptional3DESCipherSuite () |
| add 3DES ciphersuite, print warning if unsupported
|
|
|
OFVector< size_t > | ciphersuiteList |
| current list of ciphersuites
|
|
DcmTLSSecurityProfile | currentProfile |
| currently selected DICOM TLS security profile
|
|
OFBool | tls13_enabled |
| indicator whether TLS 1.3 is enabled or disabled for the current profile
|
|
OFBool * | ciphersuiteSupported |
| an array of booleans indicating which ciphersuites known to DCMTK are actually supported by the OpenSSL library we are using.
|
|
This helper class manages the list of TLS ciphersuites supported by DCMTK, translates DcmTLSSecurityProfile enums into the corresponding sets of ciphersuites, and permits translation between the official TLS ciphersuite names (as used in DCMTK) and the corresponding internal OpenSSL name.
◆ DcmTLSCiphersuiteHandler()
DcmTLSCiphersuiteHandler::DcmTLSCiphersuiteHandler |
( |
| ) |
|
◆ addCipherSuite()
OFCondition DcmTLSCiphersuiteHandler::addCipherSuite |
( |
const char * |
suite | ) |
|
adds a ciphersuite to the list of ciphersuites for TLS negotiation.
It is the responsibility of the user to ensure that the added ciphersuite does not break the rules of the selected profile. Use with care!
- Parameters
-
suite | TLS ciphersuite name, in the official TLS name form. |
- Returns
- EC_Normal if successful, an error code otherwise
◆ addRequiredCipherSuite()
OFCondition DcmTLSCiphersuiteHandler::addRequiredCipherSuite |
( |
const char * |
name | ) |
|
|
private |
add ciphersuite by name, print error if unsupported
- Parameters
-
name | ciphersuite name in RFC 2246 form |
- Returns
- EC_Normal if successful, an error code otherwise
◆ cipher3DESsupported()
OFBool DcmTLSCiphersuiteHandler::cipher3DESsupported |
( |
| ) |
const |
checks if the 3DES ciphersuite TLS_RSA_WITH_3DES_EDE_CBC_SHA is supported by the underlying OpenSSL library (which newer versions only do if compiled with "weak ciphers" enabled).
- Returns
- true if we support 3DES, false otherwise
◆ cipherNULLsupported()
OFBool DcmTLSCiphersuiteHandler::cipherNULLsupported |
( |
| ) |
const |
checks if the unencrypted ciphersuite TLS_RSA_WITH_NULL_SHA is supported by the underlying OpenSSL library (which newer versions only do if compiled with "weak ciphers" enabled).
- Returns
- true if we support unencrypted TLS, false otherwise
◆ clearTLSProfile()
void DcmTLSCiphersuiteHandler::clearTLSProfile |
( |
| ) |
|
clear the current list of ciphersuites.
Equivalent to calling setTLSProfile(TSP_Profile_None).
◆ getCipherSuiteAuthentication()
returns the authentication algorithm used by the ciphersuite with the given index
- Parameters
-
- Returns
- authentication algorithm
◆ getCipherSuiteEffectiveKeySize()
static size_t DcmTLSCiphersuiteHandler::getCipherSuiteEffectiveKeySize |
( |
size_t |
idx | ) |
|
|
static |
returns the effective symmetric key size (i.e.
security level) of the ciphersuite with the given index. BCP 195 (2015) recommends that no ciphersuites with an effective key size of less than 112 bits should be used anymore with TLS.
- Parameters
-
- Returns
- effective symmetric key size, in bits
◆ getCipherSuiteEncryption()
returns the encryption algorithm used by the ciphersuite with the given index
- Parameters
-
- Returns
- minimum SSL/TLS version required
◆ getCipherSuiteKeyExchange()
returns the key exchange protocol used by the ciphersuite with the given index
- Parameters
-
- Returns
- key exchange protocol
◆ getCipherSuiteKeySize()
static size_t DcmTLSCiphersuiteHandler::getCipherSuiteKeySize |
( |
size_t |
idx | ) |
|
|
static |
returns the symmetric key size used by the ciphersuite with the given index
- Parameters
-
- Returns
- symmetric key size, in bits
◆ getCipherSuiteMAC()
static DcmTLSCipherMAC DcmTLSCiphersuiteHandler::getCipherSuiteMAC |
( |
size_t |
idx | ) |
|
|
static |
returns the message authentication code (MAC) algorithm used by the ciphersuite with the given index
- Parameters
-
- Returns
- message authentication code (MAC) algorithm
◆ getCipherSuiteProtocolVersion()
returns the minimum SSL/TLS version required for the ciphersuite with the given index
- Parameters
-
- Returns
- minimum SSL/TLS version required
◆ getListOfCipherSuitesForOpenSSL()
void DcmTLSCiphersuiteHandler::getListOfCipherSuitesForOpenSSL |
( |
OFString & |
cslist, |
|
|
OFBool |
isServer |
|
) |
| const |
returns a string in OpenSSL syntax that contains the currently defined list of TLS ciphersuites.
- Parameters
-
cslist | The list of ciphersuites in OpenSSL syntax is written to this string. |
isServer | true if the list of cipher suites is intended for a TLS server. In this case, the list of ciphersuites will be reordered from strongest to weakest, as recommended by BCP 195. |
◆ getNumberOfCipherSuites()
static size_t DcmTLSCiphersuiteHandler::getNumberOfCipherSuites |
( |
| ) |
|
|
static |
returns the number of known ciphersuites.
- Returns
- number of known ciphersuites
◆ getOpenSSLCipherSuiteName()
static const char * DcmTLSCiphersuiteHandler::getOpenSSLCipherSuiteName |
( |
size_t |
idx | ) |
|
|
static |
returns a ciphersuite name in OpenSSL form
- Parameters
-
- Returns
- ciphersuite name
◆ getTLSCipherSuiteName()
static const char * DcmTLSCiphersuiteHandler::getTLSCipherSuiteName |
( |
size_t |
idx | ) |
|
|
static |
returns a ciphersuite name in RFC 2246 (TLS) form
- Parameters
-
- Returns
- ciphersuite name
◆ getTLSOptions()
long DcmTLSCiphersuiteHandler::getTLSOptions |
( |
| ) |
const |
returns the set of flags that need to be activated in OpenSSL depending on the selected TLS profile.
- Returns
- flags for openssl
◆ getTLSProfile()
return the currently selected TLS profile
- Returns
- currently selected TLS profile
◆ isTLS13Enabled()
OFBool DcmTLSCiphersuiteHandler::isTLS13Enabled |
( |
| ) |
const |
checks if TLS 1.3 is enabled (permitted) for the currently selected TLS security profile.
Note that this does not imply that the underlying OpenSSL library version actually supports TLS 1.3. That is checked elsewhere.
- Returns
- true if we support TLS 1.3, false otherwise
◆ lookupCiphersuite()
static size_t DcmTLSCiphersuiteHandler::lookupCiphersuite |
( |
const char * |
tlsCipherSuiteName | ) |
|
|
static |
◆ lookupCiphersuiteByOpenSSLName()
static size_t DcmTLSCiphersuiteHandler::lookupCiphersuiteByOpenSSLName |
( |
const char * |
opensslCipherSuiteName | ) |
|
|
static |
looks up the index of the given ciphersuite by OpenSSL name
- Parameters
-
opensslCipherSuiteName | ciphersuite name in the form used by OpenSSL |
- Returns
- index into list of ciphersuites, DcmTLSCiphersuiteHandler::unknownCipherSuiteIndex if ciphersuite unknown
◆ lookupProfileName()
look up the name of the given security profile
- Parameters
-
profile | the given security profile |
- Returns
- name of security profile, never NULL.
◆ printSupportedCiphersuites()
void DcmTLSCiphersuiteHandler::printSupportedCiphersuites |
( |
STD_NAMESPACE ostream & |
os | ) |
const |
print a list of supported ciphersuites to the given output stream
- Parameters
-
◆ setTLSProfile()
replace the current list of ciphersuites by the list of ciphersuites for the given profile.
- Parameters
-
profile | TLS Security Profile |
- Returns
- EC_Normal if successful, an error code otherwise
The documentation for this class was generated from the following file: