changeset 5631:76e6df2ac08c tls-ignore-unexpected-tls

disable SSL_OP_IGNORE_UNEXPECTED_EOF
author Alain Mazy <am@orthanc.team>
date Tue, 21 May 2024 12:15:02 +0200
parents d9824edad40a
children 3e96897934cc
files OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.cpp OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.h
diffstat 2 files changed, 6 insertions(+), 4 deletions(-) [+]
line wrap: on
line diff
--- a/OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.cpp	Thu May 16 15:24:03 2024 +0200
+++ b/OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.cpp	Tue May 21 12:15:02 2024 +0200
@@ -166,9 +166,10 @@
         throw OrthancException(ErrorCode_InternalError, "Cannot activate the cipher suites for DICOM TLS");
       }
 
-      // TODO: add parameters to enable/disable IGNORE_UNEXPECTED_EOF ?
-      DcmTLSTransportLayer::native_handle_type sslNativeHandle = tls->getNativeHandle();
-      SSL_CTX_set_options(sslNativeHandle, SSL_OP_IGNORE_UNEXPECTED_EOF);
+      // Note: It is possible to fine tune the SSL context configuration by calling these 2 methods.
+      //       However, it has not been required so far.  Keeping this code as "documentation"
+      // DcmTLSTransportLayer::native_handle_type sslNativeHandle = tls->getNativeHandle();
+      // SSL_CTX_set_options(sslNativeHandle, SSL_OP_IGNORE_UNEXPECTED_EOF);
 
 #else
       CLOG(INFO, DICOM) << "Using the following cipher suites for DICOM TLS: " << opt_ciphersuites;
--- a/OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.h	Thu May 16 15:24:03 2024 +0200
+++ b/OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.h	Tue May 21 12:15:02 2024 +0200
@@ -50,6 +50,7 @@
       const std::string& ownPrivateKeyPath,        // This is the first argument of "+tls" option from DCMTK command-line tools
       const std::string& ownCertificatePath,       // This is the second argument of "+tls" option
       const std::string& trustedCertificatesPath,  // This is the "--add-cert-file" ("+cf") option
-      bool requireRemoteCertificate);              // "true" means "--require-peer-cert", "false" means "--verify-peer-cert"
+      bool requireRemoteCertificate);              // "true" means "--require-peer-cert", "false" means "--ignore-peer-cert": don't request remote certificate
+      
   }
 }