denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'tls-fixes'

Browse Source
This commit is contained in:
Andreas Steffen
2021-02-18 20:28:33 +01:00
parent d08fa4bd0a 48f4f9f667
commit 283b352cee
17 changed files with 125 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/tls_test.c
+29 -21
View File
@@ -38,7 +38,7 @@ static void usage(FILE *out, char *cmd)
{
fprintf(out, "usage:\n");
fprintf(out, " %s --connect <address> --port <port> [--key <key] [--cert <file>] [--cacert <file>]+ [--times <n>]\n", cmd);
fprintf(out, " %s --listen <address> --port <port> --key <key> --cert <file> [--cacert <file>]+ [--times <n>]\n", cmd);
fprintf(out, " %s --listen <address> --port <port> --key <key> --cert <file> [--cacert <file>]+ [--auth-optional] [--times <n>]\n", cmd);
fprintf(out, "\n");
fprintf(out, "options:\n");
fprintf(out, " --help print help and exit\n");
@@ -48,6 +48,7 @@ static void usage(FILE *out, char *cmd)
fprintf(out, " --cert <file> certificate to authenticate itself\n");
fprintf(out, " --key <file> private key to authenticate itself\n");
fprintf(out, " --cacert <file> certificate to verify other peer\n");
fprintf(out, " --auth-optional don't enforce client authentication\n");
fprintf(out, " --times <n> specify the amount of repeated connection establishments\n");
fprintf(out, " --ipv4 use IPv4\n");
fprintf(out, " --ipv6 use IPv6\n");
@@ -109,7 +110,8 @@ static identification_t *find_client_id()
*/
static int run_client(host_t *host, identification_t *server,
identification_t *client, int times, tls_cache_t *cache,
tls_version_t min_version, tls_version_t max_version)
tls_version_t min_version, tls_version_t max_version,
tls_flag_t flags)
{
tls_socket_t *tls;
int fd, res;
@@ -131,7 +133,7 @@ static int run_client(host_t *host, identification_t *server,
return 1;
}
tls = tls_socket_create(FALSE, server, client, fd, cache, min_version,
max_version, TRUE);
max_version, flags);
if (!tls)
{
close(fd);
@@ -153,7 +155,7 @@ static int run_client(host_t *host, identification_t *server,
*/
static int serve(host_t *host, identification_t *server, identification_t *client,
int times, tls_cache_t *cache, tls_version_t min_version,
tls_version_t max_version)
tls_version_t max_version, tls_flag_t flags)
{
tls_socket_t *tls;
int fd, cfd;
@@ -190,7 +192,7 @@ static int serve(host_t *host, identification_t *server, identification_t *clien
DBG1(DBG_TLS, "%#H connected", host);
tls = tls_socket_create(TRUE, server, client, cfd, cache, min_version,
max_version, TRUE);
max_version, flags);
if (!tls)
{
close(fd);
@@ -301,6 +303,7 @@ int main(int argc, char *argv[])
int port = 0, times = -1, res, family = AF_UNSPEC;
identification_t *server, *client = NULL;
tls_version_t min_version = TLS_SUPPORTED_MIN, max_version = TLS_SUPPORTED_MAX;
tls_flag_t flags = TLS_FLAG_ENCRYPTION_OPTIONAL;
tls_cache_t *cache;
host_t *host;
@@ -309,20 +312,21 @@ int main(int argc, char *argv[])
while (TRUE)
{
struct option long_opts[] = {
{"help", no_argument, NULL, 'h' },
{"connect", required_argument, NULL, 'c' },
{"listen", required_argument, NULL, 'l' },
{"port", required_argument, NULL, 'p' },
{"cert", required_argument, NULL, 'x' },
{"key", required_argument, NULL, 'k' },
{"cacert", required_argument, NULL, 'f' },
{"times", required_argument, NULL, 't' },
{"ipv4", no_argument, NULL, '4' },
{"ipv6", no_argument, NULL, '6' },
{"min-version", required_argument, NULL, 'm' },
{"max-version", required_argument, NULL, 'M' },
{"version", required_argument, NULL, 'v' },
{"debug", required_argument, NULL, 'd' },
{"help", no_argument, NULL, 'h' },
{"connect", required_argument, NULL, 'c' },
{"listen", required_argument, NULL, 'l' },
{"port", required_argument, NULL, 'p' },
{"cert", required_argument, NULL, 'x' },
{"key", required_argument, NULL, 'k' },
{"cacert", required_argument, NULL, 'f' },
{"times", required_argument, NULL, 't' },
{"ipv4", no_argument, NULL, '4' },
{"ipv6", no_argument, NULL, '6' },
{"min-version", required_argument, NULL, 'm' },
{"max-version", required_argument, NULL, 'M' },
{"version", required_argument, NULL, 'v' },
{"auth-optional", no_argument, NULL, 'n' },
{"debug", required_argument, NULL, 'd' },
{0,0,0,0 }
};
switch (getopt_long(argc, argv, "", long_opts, NULL))
@@ -402,6 +406,9 @@ int main(int argc, char *argv[])
}
max_version = min_version;
continue;
case 'n':
flags |= TLS_FLAG_CLIENT_AUTH_OPTIONAL;
continue;
default:
usage(stderr, argv[0]);
return 1;
@@ -423,14 +430,15 @@ int main(int argc, char *argv[])
cache = tls_cache_create(100, 30);
if (listen)
{
res = serve(host, server, client, times, cache, min_version, max_version);
res = serve(host, server, client, times, cache, min_version,
max_version, flags);
}
else
{
DESTROY_IF(client);
client = find_client_id();
res = run_client(host, server, client, times, cache, min_version,
max_version);
max_version, flags);
DESTROY_IF(client);
}
cache->destroy(cache);
src/libcharon/plugins/eap_peap/eap_peap.c
+1 -1
View File
@@ -173,7 +173,7 @@ static eap_peap_t *eap_peap_create(private_eap_peap_t * this,
include_length = lib->settings->get_bool(lib->settings,
"%s.plugins.eap-peap.include_length", FALSE, lib->ns);
tls = tls_create(is_server, server, peer, TLS_PURPOSE_EAP_PEAP,
application, NULL);
application, NULL, 0);
this->tls_eap = tls_eap_create(EAP_PEAP, tls, frag_size, max_msg_count,
include_length);
if (!this->tls_eap)
src/libcharon/plugins/eap_tls/eap_tls.c
+1 -1
View File
@@ -158,7 +158,7 @@ static eap_tls_t *eap_tls_create(identification_t *server,
lib->ns);
include_length = lib->settings->get_bool(lib->settings,
"%s.plugins.eap-tls.include_length", TRUE, lib->ns);
tls = tls_create(is_server, server, peer, TLS_PURPOSE_EAP_TLS, NULL, NULL);
tls = tls_create(is_server, server, peer, TLS_PURPOSE_EAP_TLS, NULL, NULL, 0);
this->tls_eap = tls_eap_create(EAP_TLS, tls, frag_size, max_msg_count,
include_length);
if (!this->tls_eap)
src/libcharon/plugins/eap_ttls/eap_ttls.c
+1 -1
View File
@@ -170,7 +170,7 @@ static eap_ttls_t *eap_ttls_create(identification_t *server,
include_length = lib->settings->get_bool(lib->settings,
"%s.plugins.eap-ttls.include_length", TRUE, lib->ns);
tls = tls_create(is_server, server, peer, TLS_PURPOSE_EAP_TTLS,
application, NULL);
application, NULL, 0);
this->tls_eap = tls_eap_create(EAP_TTLS, tls, frag_size, max_msg_count,
include_length);
if (!this->tls_eap)
src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c
+1 -1
View File
@@ -877,7 +877,7 @@ static bool soap_init(private_tnc_ifmap_soap_t *this)
/* open TLS socket */
this->tls = tls_socket_create(FALSE, server_id, client_id, this->fd,
NULL, TLS_UNSPEC, TLS_UNSPEC, FALSE);
NULL, TLS_UNSPEC, TLS_UNSPEC, 0);
if (!this->tls)
{
DBG1(DBG_TNC, "creating TLS socket failed");
src/libpttls/pt_tls_client.c
+1 -1
View File
@@ -85,7 +85,7 @@ static bool make_connection(private_pt_tls_client_t *this)
}
this->tls = tls_socket_create(FALSE, this->server, this->client, fd,
NULL, TLS_UNSPEC, TLS_UNSPEC, FALSE);
NULL, TLS_UNSPEC, TLS_UNSPEC, 0);
if (!this->tls)
{
close(fd);
src/libpttls/pt_tls_server.c
+19 -2
View File
@@ -524,6 +524,21 @@ pt_tls_server_t *pt_tls_server_create(identification_t *server, int fd,
pt_tls_auth_t auth, tnccs_t *tnccs)
{
private_pt_tls_server_t *this;
identification_t *client = NULL;
tls_flag_t flags = 0;
switch (auth)
{
case PT_TLS_AUTH_TLS_OR_SASL:
flags |= TLS_FLAG_CLIENT_AUTH_OPTIONAL;
/* fall-through */
case PT_TLS_AUTH_TLS:
case PT_TLS_AUTH_TLS_AND_SASL:
client = identification_create_from_encoding(ID_ANY, chunk_empty);
break;
default:
break;
}
INIT(this,
.public = {
@@ -532,12 +547,14 @@ pt_tls_server_t *pt_tls_server_create(identification_t *server, int fd,
.destroy = _destroy,
},
.state = PT_TLS_SERVER_VERSION,
.tls = tls_socket_create(TRUE, server, NULL, fd, NULL, TLS_UNSPEC,
TLS_UNSPEC, FALSE),
.tls = tls_socket_create(TRUE, server, client, fd, NULL, TLS_UNSPEC,
TLS_UNSPEC, flags),
.tnccs = (tls_t*)tnccs,
.auth = auth,
);
DESTROY_IF(client);
if (!this->tls)
{
this->tnccs->destroy(this->tnccs);
src/libtls/tests/suites/test_socket.c
+4 -2
View File
@@ -412,7 +412,8 @@ static job_requeue_t serve_echo(echo_server_config_t *config)
}
tls = tls_socket_create(TRUE, server, client, cfd, NULL,
TLS_SUPPORTED_MIN, config->version, TRUE);
TLS_SUPPORTED_MIN, config->version,
TLS_FLAG_ENCRYPTION_OPTIONAL);
ck_assert(tls != NULL);
while (TRUE)
@@ -488,7 +489,8 @@ static void run_echo_client(echo_server_config_t *config)
ck_assert(connect(fd, host->get_sockaddr(host),
*host->get_sockaddr_len(host)) != -1);
tls = tls_socket_create(FALSE, server, client, fd, NULL,
TLS_SUPPORTED_MIN, config->version, TRUE);
TLS_SUPPORTED_MIN, config->version,
TLS_FLAG_ENCRYPTION_OPTIONAL);
ck_assert(tls != NULL);
wr = rd = 0;
src/libtls/tls.c
+15 -2
View File
@@ -202,6 +202,11 @@ struct private_tls_t {
*/
tls_purpose_t purpose;
/**
* Flags for this TLS stack
*/
tls_flag_t flags;
/**
* TLS record protection layer
*/
@@ -542,6 +547,12 @@ METHOD(tls_t, get_purpose, tls_purpose_t,
return this->purpose;
}
METHOD(tls_t, get_flags, tls_flag_t,
private_tls_t *this)
{
return this->flags;
}
METHOD(tls_t, is_complete, bool,
private_tls_t *this)
{
@@ -590,7 +601,8 @@ METHOD(tls_t, destroy, void,
*/
tls_t *tls_create(bool is_server, identification_t *server,
identification_t *peer, tls_purpose_t purpose,
tls_application_t *application, tls_cache_t *cache)
tls_application_t *application, tls_cache_t *cache,
tls_flag_t flags)
{
private_tls_t *this;
@@ -600,7 +612,6 @@ tls_t *tls_create(bool is_server, identification_t *server,
case TLS_PURPOSE_EAP_TTLS:
case TLS_PURPOSE_EAP_PEAP:
case TLS_PURPOSE_GENERIC:
case TLS_PURPOSE_GENERIC_NULLOK:
break;
default:
return NULL;
@@ -617,6 +628,7 @@ tls_t *tls_create(bool is_server, identification_t *server,
.get_version_min = _get_version_min,
.set_version = _set_version,
.get_purpose = _get_purpose,
.get_flags = _get_flags,
.is_complete = _is_complete,
.get_eap_msk = _get_eap_msk,
.get_auth = _get_auth,
@@ -625,6 +637,7 @@ tls_t *tls_create(bool is_server, identification_t *server,
.is_server = is_server,
.application = application,
.purpose = purpose,
.flags = flags,
);
lib->settings->add_fallback(lib->settings, "%s.tls", "libtls", lib->ns);
src/libtls/tls.h
+21 -3
View File
@@ -40,6 +40,7 @@ typedef enum tls_version_t tls_version_t;
typedef enum tls_content_type_t tls_content_type_t;
typedef enum tls_handshake_type_t tls_handshake_type_t;
typedef enum tls_purpose_t tls_purpose_t;
typedef enum tls_flag_t tls_flag_t;
typedef struct tls_t tls_t;
#include <library.h>
@@ -130,8 +131,6 @@ enum tls_purpose_t {
TLS_PURPOSE_EAP_PEAP,
/** non-EAP TLS */
TLS_PURPOSE_GENERIC,
/** non-EAP TLS accepting NULL encryption */
TLS_PURPOSE_GENERIC_NULLOK,
/** EAP binding for TNC */
TLS_PURPOSE_EAP_TNC
};
@@ -202,6 +201,16 @@ enum tls_name_type_t {
TLS_NAME_TYPE_HOST_NAME = 0,
};
/**
* Flags that control the behavior of the stack
*/
enum tls_flag_t {
/** set if cipher suites with null encryption are acceptable */
TLS_FLAG_ENCRYPTION_OPTIONAL = 1,
/** set if client authentication is optional even if cert req sent */
TLS_FLAG_CLIENT_AUTH_OPTIONAL = 2,
};
/**
* Enum names for tls_extension_t
*/
@@ -318,6 +327,13 @@ struct tls_t {
*/
tls_purpose_t (*get_purpose)(tls_t *this);
/**
* Get the flags controlling this TLS stack instance.
*
* @return flags given during construction
*/
tls_flag_t (*get_flags)(tls_t *this);
/**
* Check if TLS negotiation completed successfully.
*
@@ -359,10 +375,12 @@ void libtls_init(void);
* @param purpose purpose this TLS stack instance is used for
* @param application higher layer application or NULL if none
* @param cache session cache to use, or NULL
* @param flags flags that control the behavior of the TLS stack
* @return TLS stack
*/
tls_t *tls_create(bool is_server, identification_t *server,
identification_t *peer, tls_purpose_t purpose,
tls_application_t *application, tls_cache_t *cache);
tls_application_t *application, tls_cache_t *cache,
tls_flag_t flags);
#endif /** TLS_H_ @}*/
src/libtls/tls_crypto.c
+6 -6
View File
@@ -1116,22 +1116,22 @@ static void build_cipher_suite_list(private_tls_crypto_t *this)
{
suite_algs_t suites[countof(suite_algs)];
tls_version_t min_version, max_version, new_min_version, new_max_version;
bool require_encryption;
bool require_encryption = TRUE;
int count = 0, i;
switch (this->tls->get_purpose(this->tls))
{
case TLS_PURPOSE_EAP_TLS:
case TLS_PURPOSE_GENERIC_NULLOK:
require_encryption = FALSE;
break;
case TLS_PURPOSE_EAP_PEAP:
case TLS_PURPOSE_EAP_TTLS:
case TLS_PURPOSE_GENERIC:
require_encryption = TRUE;
if (this->tls->get_flags(this->tls) & TLS_FLAG_ENCRYPTION_OPTIONAL)
{
require_encryption = FALSE;
}
break;
default:
return;
break;
}
min_version = this->tls->get_version_min(this->tls);
src/libtls/tls_eap.c
+1 -1
View File
@@ -394,7 +394,7 @@ METHOD(tls_eap_t, process, status_t,
switch (status)
{
case INVALID_STATE:
if (this->tls->is_complete(this->tls))
if (this->is_server && this->tls->is_complete(this->tls))
{
return SUCCESS;
}
src/libtls/tls_server.c
+18 -3
View File
@@ -705,9 +705,18 @@ static status_t process_certificate(private_tls_server_t *this,
certs = bio_reader_create(data);
if (!certs->remaining(certs))
{
DBG1(DBG_TLS, "no certificate sent by peer");
this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
return NEED_MORE;
if (this->tls->get_flags(this->tls) & TLS_FLAG_CLIENT_AUTH_OPTIONAL)
{
/* client authentication is not required so we clear the identity */
DESTROY_IF(this->peer);
this->peer = NULL;
}
else
{
DBG1(DBG_TLS, "no certificate sent by peer");
this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
return NEED_MORE;
}
}
while (certs->remaining(certs))
{
@@ -729,6 +738,12 @@ static status_t process_certificate(private_tls_server_t *this,
DBG1(DBG_TLS, "received TLS peer certificate '%Y'",
cert->get_subject(cert));
first = FALSE;
if (this->peer && this->peer->get_type(this->peer) == ID_ANY)
{
this->peer->destroy(this->peer);
this->peer = cert->get_subject(cert);
this->peer = this->peer->clone(this->peer);
}
}
else
{
src/libtls/tls_socket.c
+3 -13
View File
@@ -423,10 +423,9 @@ METHOD(tls_socket_t, destroy, void,
tls_socket_t *tls_socket_create(bool is_server, identification_t *server,
identification_t *peer, int fd,
tls_cache_t *cache, tls_version_t min_version,
tls_version_t max_version, bool nullok)
tls_version_t max_version, tls_flag_t flags)
{
private_tls_socket_t *this;
tls_purpose_t purpose;
INIT(this,
.public = {
@@ -448,17 +447,8 @@ tls_socket_t *tls_socket_create(bool is_server, identification_t *server,
.fd = fd,
);
if (nullok)
{
purpose = TLS_PURPOSE_GENERIC_NULLOK;
}
else
{
purpose = TLS_PURPOSE_GENERIC;
}
this->tls = tls_create(is_server, server, peer, purpose,
&this->app.application, cache);
this->tls = tls_create(is_server, server, peer, TLS_PURPOSE_GENERIC,
&this->app.application, cache, flags);
if (!this->tls ||
!this->tls->set_version(this->tls, min_version, max_version))
{
src/libtls/tls_socket.h
+2 -2
View File
@@ -108,12 +108,12 @@ struct tls_socket_t {
* @param cache session cache to use, or NULL
* @param min_version minimum TLS version to negotiate or TLS_UNSPEC
* @param max_version maximum TLS version to negotiate or TLS_UNSPEC
* @param nullok accept NULL encryption ciphers
* @param flags flags controlling the TLS stack
* @return TLS socket wrapper
*/
tls_socket_t *tls_socket_create(bool is_server, identification_t *server,
identification_t *peer, int fd,
tls_cache_t *cache, tls_version_t min_version,
tls_version_t max_version, bool nullok);
tls_version_t max_version, tls_flag_t flags);
#endif /** TLS_SOCKET_H_ @}*/
testing/tests/ikev2/rw-eap-tls-only/evaltest.dat
+1 -1
View File
@@ -1,6 +1,6 @@
carol::cat /var/log/daemon.log::server requested EAP_TLS authentication::YES
carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
carol::cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_GCM_SHA256::YES
carol::cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_256_GCM_SHA384::YES
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org' with EAP successful::YES
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES
testing/tests/swanctl/rw-eap-tls-only/evaltest.dat
+1 -1
View File
@@ -1,6 +1,6 @@
carol::cat /var/log/daemon.log::server requested EAP_TLS authentication::YES
carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
carol::cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_GCM_SHA256::YES
carol::cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_256_GCM_SHA384::YES
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org' with EAP successful::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES