ims-volte-vowifi
/
strongswan
1
0
Fork 0
Code Pull Requests Releases Activity

tls-crypto: Add signature scheme config file filter

Browse Source 
And add signature scheme unit tests.
laforge/swu
Pascal Knecht 2 years ago committed by Tobias Brunner
parent e5b6565730
commit e3757300eb
4 changed files with 188 additions and 14 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 3
      conf/options/charon.opt
  2. 104
      src/libtls/tests/suites/test_socket.c
  3. 83
      src/libtls/tls_crypto.c
  4. 12
      src/libtls/tls_crypto.h

3
conf/options/charon.opt
Unescape View File

@ -476,6 +476,9 @@ charon.tls.suites
charon.tls.ke_group
List of TLS key exchange groups.
charon.tls.signature
List of TLS signature schemes.
charon.tls.send_certreq_authorities = yes
Whether to include CAs in a server's CertificateRequest message.

104
src/libtls/tests/suites/test_socket.c
Unescape View File

@ -308,7 +308,11 @@ static void setup_credentials(chunk_t key_data, chunk_t cert_data)
private_key_t *key;
certificate_t *cert;
creds = mem_cred_create();
if (!creds)
{
creds = mem_cred_create();
lib->credmgr->add_set(lib->credmgr, &creds->set);
}
key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
BUILD_BLOB, chunk_from_thing(rsa), BUILD_END);
@ -334,8 +338,6 @@ static void setup_credentials(chunk_t key_data, chunk_t cert_data)
{
creds->add_cert(creds, TRUE, cert);
}
lib->credmgr->add_set(lib->credmgr, &creds->set);
}
START_SETUP(setup_creds)
@ -356,10 +358,19 @@ START_SETUP(setup_ed448_creds)
}
END_SETUP
START_SETUP(setup_all_creds)
{
setup_credentials(chunk_from_thing(ecdsa), chunk_from_thing(ecdsa_crt));
setup_credentials(chunk_from_thing(ed25519), chunk_from_thing(ed25519_crt));
setup_credentials(chunk_from_thing(ed448), chunk_from_thing(ed448_crt));
}
END_SETUP
START_TEARDOWN(teardown_creds)
{
lib->credmgr->remove_set(lib->credmgr, &creds->set);
creds->destroy(creds);
creds = NULL;
}
END_TEARDOWN
@ -587,6 +598,37 @@ static void test_tls_ke_groups(tls_version_t version, uint16_t port, bool cauth,
free(config);
}
/**
* TLS signature test wrapper function
*/
static void test_tls_signature_schemes(tls_version_t version, uint16_t port,
bool cauth, u_int i)
{
echo_server_config_t *config;
tls_signature_scheme_t *schemes;
char signature[128];
int count;
config = create_config(version, port, cauth);
start_echo_server(config);
count = tls_crypto_get_supported_signatures(version, &schemes);
ck_assert(i < count);
snprintf(signature, sizeof(signature), "%N", tls_signature_scheme_names,
schemes[i]);
lib->settings->set_str(lib->settings, "%s.tls.signature", signature, lib->ns);
run_echo_client(config);
free(schemes);
shutdown(config->fd, SHUT_RDWR);
close(config->fd);
free(config);
}
/**
* TLS server version test wrapper function
*/
@ -637,25 +679,49 @@ static void test_tls_client(tls_version_t version, uint16_t port, bool cauth,
START_TEST(test_tls_12_server)
{
test_tls_server(TLS_1_2, 5665, FALSE, _i);
test_tls_server(TLS_1_2, 5661, FALSE, _i);
}
END_TEST
START_TEST(test_tls_13_server)
{
test_tls_server(TLS_1_3, 5666, FALSE, _i);
test_tls_server(TLS_1_3, 5662, FALSE, _i);
}
END_TEST
START_TEST(test_tls_13_client)
{
test_tls_client(TLS_1_3, 5667, FALSE, _i);
test_tls_client(TLS_1_3, 5663, FALSE, _i);
}
END_TEST
START_TEST(test_tls13_ke_groups)
{
test_tls_ke_groups(TLS_1_3, 5668, FALSE, _i);
test_tls_ke_groups(TLS_1_3, 5664, FALSE, _i);
}
END_TEST
START_TEST(test_tls13_signature_schemes)
{
test_tls_signature_schemes(TLS_1_3, 5665, FALSE, _i);
}
END_TEST
START_TEST(test_tls12_signature_schemes)
{
test_tls_signature_schemes(TLS_1_2, 5666, FALSE, _i);
}
END_TEST
START_TEST(test_tls11_signature_schemes)
{
test_tls_signature_schemes(TLS_1_1, 5667, FALSE, _i);
}
END_TEST
START_TEST(test_tls10_signature_schemes)
{
test_tls_signature_schemes(TLS_1_0, 5668, FALSE, _i);
}
END_TEST
@ -742,6 +808,30 @@ Suite *socket_suite_create()
tls_crypto_get_supported_groups(NULL));
suite_add_tcase(s, tc);
tc = tcase_create("TLS 1.3/signature schemes");
tcase_add_checked_fixture(tc, setup_all_creds, teardown_creds);
tcase_add_loop_test(tc, test_tls13_signature_schemes, 0,
tls_crypto_get_supported_signatures(TLS_1_3, NULL));
suite_add_tcase(s, tc);
tc = tcase_create("TLS 1.2/signature schemes");
tcase_add_checked_fixture(tc, setup_all_creds, teardown_creds);
tcase_add_loop_test(tc, test_tls12_signature_schemes, 0,
tls_crypto_get_supported_signatures(TLS_1_2, NULL));
suite_add_tcase(s, tc);
tc = tcase_create("TLS 1.1/signature schemes");
tcase_add_checked_fixture(tc, setup_all_creds, teardown_creds);
tcase_add_loop_test(tc, test_tls11_signature_schemes, 0,
tls_crypto_get_supported_signatures(TLS_1_1, NULL));
suite_add_tcase(s, tc);
tc = tcase_create("TLS 1.0/signature schemes");
tcase_add_checked_fixture(tc, setup_all_creds, teardown_creds);
tcase_add_loop_test(tc, test_tls10_signature_schemes, 0,
tls_crypto_get_supported_signatures(TLS_1_0, NULL));
suite_add_tcase(s, tc);
tc = tcase_create("TLS 1.3/anon");
tcase_add_checked_fixture(tc, setup_creds, teardown_creds);
add_tls_test(test_tls13, TLS_1_3);

83
src/libtls/tls_crypto.c
Unescape View File

@ -1442,16 +1442,18 @@ PSS_PARAMS(256);
PSS_PARAMS(384);
PSS_PARAMS(512);
/**
* Map TLS signature schemes, ordered by preference
*/
static struct {
typedef struct {
tls_signature_scheme_t sig;
signature_params_t params;
/* min/max versions for use in CertificateVerify */
tls_version_t min_version;
tls_version_t max_version;
} schemes[] = {
} scheme_algs_t;
/**
* Map TLS signature schemes, ordered by preference
*/
static scheme_algs_t schemes[] = {
{ TLS_SIG_ECDSA_SHA256, { .scheme = SIGN_ECDSA_WITH_SHA256_DER },
TLS_1_0, TLS_1_3 },
{ TLS_SIG_ECDSA_SHA384, { .scheme = SIGN_ECDSA_WITH_SHA384_DER },
@ -1484,6 +1486,35 @@ static struct {
TLS_1_0, TLS_1_2 },
};
/**
* Filter signature scheme config
*/
static bool filter_signature_scheme_config(tls_signature_scheme_t signature)
{
enumerator_t *enumerator;
char *token, *config;
config = lib->settings->get_str(lib->settings, "%s.tls.signature", NULL,
lib->ns);
if (config)
{
enumerator = enumerator_create_token(config, ",", " ");
while (enumerator->enumerate(enumerator, &token))
{
tls_signature_scheme_t sig;
if (enum_from_name(tls_signature_scheme_names, token, &sig) &&
sig == signature)
{
enumerator->destroy(enumerator);
return TRUE;
}
}
enumerator->destroy(enumerator);
}
return !config;
}
METHOD(tls_crypto_t, get_signature_algorithms, void,
private_tls_crypto_t *this, bio_writer_t *writer, bool cert)
{
@ -1504,7 +1535,8 @@ METHOD(tls_crypto_t, get_signature_algorithms, void,
if ((cert || (schemes[i].min_version <= max_version &&
schemes[i].max_version >= min_version)) &&
lib->plugins->has_feature(lib->plugins,
PLUGIN_PROVIDE(PUBKEY_VERIFY, schemes[i].params.scheme)))
PLUGIN_PROVIDE(PUBKEY_VERIFY, schemes[i].params.scheme)) &&
filter_signature_scheme_config(schemes[i].sig))
{
supported->write_uint16(supported, schemes[i].sig);
}
@ -2496,6 +2528,45 @@ int tls_crypto_get_supported_groups(diffie_hellman_group_t **out)
return count;
}
/**
* See header.
*/
int tls_crypto_get_supported_signatures(tls_version_t version,
tls_signature_scheme_t **out)
{
scheme_algs_t sigs[countof(schemes)];
int count = 0, i;
/* initialize copy of signature scheme list */
for (i = 0; i < countof(schemes); i++)
{
/* only RSA_PSS_RSAE schemes supported for signing and verifying */
if (schemes[i].sig == TLS_SIG_RSA_PSS_PSS_SHA256 ||
schemes[i].sig == TLS_SIG_RSA_PSS_PSS_SHA384 ||
schemes[i].sig == TLS_SIG_RSA_PSS_PSS_SHA512)
{
continue;
}
if (schemes[i].min_version <= version &&
schemes[i].max_version >= version &&
lib->plugins->has_feature(lib->plugins,
PLUGIN_PROVIDE(PUBKEY_VERIFY, schemes[i].params.scheme)))
{
sigs[count++] = schemes[i];
}
}
if (out)
{
*out = calloc(count, sizeof(tls_signature_scheme_t));
for (i = 0; i < count; i++)
{
(*out)[i] = sigs[i].sig;
}
}
return count;
}
/**
* See header.
*/

12
src/libtls/tls_crypto.h
Unescape View File

@ -1,6 +1,6 @@
/*
* Copyright (C) 2020 Tobias Brunner
* Copyright (C) 2020 Pascal Knecht
* Copyright (C) 2020-2021 Pascal Knecht
* Copyright (C) 2020 Méline Sieber
* HSR Hochschule fuer Technik Rapperswil
*
@ -683,6 +683,16 @@ int tls_crypto_get_supported_suites(bool null, tls_version_t version,
*/
int tls_crypto_get_supported_groups(diffie_hellman_group_t **groups);
/**
* Get a list of all supported TLS signature schemes.
*
* @param version TLS version
* @param schemes pointer to allocated signature array, to free(), or NULL
* @return number of signature schemes supported
*/
int tls_crypto_get_supported_signatures(tls_version_t version,
tls_signature_scheme_t **schemes);
/**
* Get the TLS curve of a given EC DH group
*

Write Preview
Loading…
Cancel
Save