Add TLS 1.3 ciphersuites to SSLCommonOptions and SSLServerOptions

Reviewed By: AjanthanAsogamoorthy

Differential Revision: D31399112

fbshipit-source-id: ea98963536de42136642809d2bd07b9567464f68

folly/io/async/SSLOptions.h

@@ -46,6 +46,17 @@ struct SSLCommonOptions {
         "AES128-SHA");
   }
 
+  /**
+   * The TLS 1.3 ciphersuites recommended for this options configuration.
+   */
+  static constexpr auto ciphersuites() {
+    return folly::make_array(
+        "TLS_AES_128_GCM_SHA256",
+        "TLS_AES_256_GCM_SHA384",
+        "TLS_CHACHA20_POLY1305_SHA256",
+        "TLS_AES_128_CCM_SHA256");
+  }
+
   /**
    * The list of signature algorithms recommended for this options
    * configuration.
@@ -104,6 +115,17 @@ struct SSLServerOptions {
         "AES128-SHA",
         "AES256-SHA");
   }
+
+  /**
+   * The TLS 1.3 ciphersuites recommended for this options configuration.
+   */
+  static constexpr auto ciphersuites() {
+    return folly::make_array(
+        "TLS_AES_128_GCM_SHA256",
+        "TLS_AES_256_GCM_SHA384",
+        "TLS_CHACHA20_POLY1305_SHA256",
+        "TLS_AES_128_CCM_SHA256");
+  }
 };
 
 /**
@@ -114,6 +136,11 @@ struct SSLServerOptions {
 template <typename TSSLOptions>
 void setCipherSuites(SSLContext& ctx) {
   try {
+#if FOLLY_OPENSSL_PREREQ(1, 1, 1)
+    std::string ciphersuites;
+    folly::join(':', TSSLOptions::ciphersuites(), ciphersuites);
+    ctx.setCiphersuitesOrThrow(std::move(ciphersuites));
+#endif
     ctx.setCipherList(TSSLOptions::ciphers());
   } catch (std::runtime_error const& e) {
     ssl_options_detail::logDfatal(e);

folly/io/async/test/SSLOptionsTest.cpp

@@ -35,8 +35,29 @@ TEST_F(SSLOptionsTest, TestSetCommonCipherList) {
   std::vector<std::string> commonOptionCiphersVec(
       begin(commonOptionCiphers), end(commonOptionCiphers));
 
+  const auto& commonOptionCiphersuites = ssl::SSLCommonOptions::ciphersuites();
+  std::vector<std::string> commonOptionCiphersuitesVec(
+      begin(commonOptionCiphersuites), end(commonOptionCiphersuites));
+
   ssl::SSLUniquePtr ssl(ctx.createSSL());
   EXPECT_EQ(commonOptionCiphersVec, test::getNonTLS13CipherList(ssl.get()));
+  EXPECT_EQ(commonOptionCiphersuitesVec, test::getTLS13Ciphersuites(ssl.get()));
+}
+
+TEST_F(SSLOptionsTest, TestSetServerCipherList) {
+  SSLContext ctx;
+  ssl::setCipherSuites<ssl::SSLServerOptions>(ctx);
+
+  const auto& ciphers = ssl::SSLServerOptions::ciphers();
+  std::vector<std::string> ciphersVec(begin(ciphers), end(ciphers));
+
+  const auto& ciphersuites = ssl::SSLServerOptions::ciphersuites();
+  std::vector<std::string> ciphersuitesVec(
+      begin(ciphersuites), end(ciphersuites));
+
+  ssl::SSLUniquePtr ssl(ctx.createSSL());
+  EXPECT_EQ(ciphersVec, test::getNonTLS13CipherList(ssl.get()));
+  EXPECT_EQ(ciphersuitesVec, test::getTLS13Ciphersuites(ssl.get()));
 }
 
 TEST_F(SSLOptionsTest, TestSetCipherListWithVector) {