Mercurial > hg > orthanc
changeset 5631:76e6df2ac08c tls-ignore-unexpected-tls
disable SSL_OP_IGNORE_UNEXPECTED_EOF
author | Alain Mazy <am@orthanc.team> |
---|---|
date | Tue, 21 May 2024 12:15:02 +0200 |
parents | d9824edad40a |
children | 3e96897934cc |
files | OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.cpp OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.h |
diffstat | 2 files changed, 6 insertions(+), 4 deletions(-) [+] |
line wrap: on
line diff
--- a/OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.cpp Thu May 16 15:24:03 2024 +0200 +++ b/OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.cpp Tue May 21 12:15:02 2024 +0200 @@ -166,9 +166,10 @@ throw OrthancException(ErrorCode_InternalError, "Cannot activate the cipher suites for DICOM TLS"); } - // TODO: add parameters to enable/disable IGNORE_UNEXPECTED_EOF ? - DcmTLSTransportLayer::native_handle_type sslNativeHandle = tls->getNativeHandle(); - SSL_CTX_set_options(sslNativeHandle, SSL_OP_IGNORE_UNEXPECTED_EOF); + // Note: It is possible to fine tune the SSL context configuration by calling these 2 methods. + // However, it has not been required so far. Keeping this code as "documentation" + // DcmTLSTransportLayer::native_handle_type sslNativeHandle = tls->getNativeHandle(); + // SSL_CTX_set_options(sslNativeHandle, SSL_OP_IGNORE_UNEXPECTED_EOF); #else CLOG(INFO, DICOM) << "Using the following cipher suites for DICOM TLS: " << opt_ciphersuites;
--- a/OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.h Thu May 16 15:24:03 2024 +0200 +++ b/OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.h Tue May 21 12:15:02 2024 +0200 @@ -50,6 +50,7 @@ const std::string& ownPrivateKeyPath, // This is the first argument of "+tls" option from DCMTK command-line tools const std::string& ownCertificatePath, // This is the second argument of "+tls" option const std::string& trustedCertificatesPath, // This is the "--add-cert-file" ("+cf") option - bool requireRemoteCertificate); // "true" means "--require-peer-cert", "false" means "--verify-peer-cert" + bool requireRemoteCertificate); // "true" means "--require-peer-cert", "false" means "--ignore-peer-cert": don't request remote certificate + } }