Commit Graph

17934 Commits

Author SHA1 Message Date
Pascal Knecht 9389fef78a test-hkdf: Add two test cases and restructure all tests
RFC 8448 contains multiple TLS 1.3 message traces, this commit adds two
new test cases focusing on key derivation:

- Simple 1-RTT Handshake
- Resumed 0-RTT Handshake

Additionally, the whole test suite is restructured and duplicate code is
removed and consolidated.
2021-02-12 14:35:23 +01:00
Pascal Knecht 7797c058d9 tls-hkdf: Implement binder PSK generation 2021-02-12 14:35:23 +01:00
Pascal Knecht 3e535c31b4 tls-hkdf: Implement resumption key generation 2021-02-12 14:35:23 +01:00
Pascal Knecht 9ef46cfaf9 tls-peer: Mutual authentication support for TLS 1.3 2021-02-12 14:35:23 +01:00
Pascal Knecht 2d933f318b tls-peer: Derive application traffic keys after server finished message
The inbound key is used right away, the outbound key only after the
client finished message has been sent.
2021-02-12 14:35:23 +01:00
Pascal Knecht d41d8b0039 tls-peer: Use private key enumeration also in TLS versions < 1.2
Until now, key selection was based on tls_client_certificate_type_t and now
uses a simple mapping from these types to tls_signature_scheme_t.
2021-02-12 14:35:23 +01:00
Pascal Knecht d8e42a3d4e tls-crypto: Share private key search between client and server
This way the client also properly considers the TLS version and the signature
schemes supported by the server.

Co-authored-by: Tobias Brunner <tobias@strongswan.org>
2021-02-12 14:35:23 +01:00
Pascal Knecht 299cc80094 tls-test: Add support to require/verify client certificates
Also add detailed usage output with description of all options.
2021-02-12 14:35:23 +01:00
Pascal Knecht d2fc9b0961 tls-server: Mutual authentication support for TLS 1.3
This commit also addresses the side effect that additional messages have
an influence on the derivation of the application traffic secrets. Therefore,
key derivation is relocated after the server finished message has been sent,
so the additional messages from the client (Certificate, CertificateVerify)
don't affect the key derivation. Only the outbound key is switched there, the
inbound key remains in use until the client's finished message has been
processed.
2021-02-12 14:35:23 +01:00
Pascal Knecht dc49d457a2 tls-server: Terminate connection if peer certificate is required but not sent
This change mainly affects legacy TLS versions because TLS 1.3
connections are terminated by the server once the peer does not send a
CertificateVerify message next to its empty Certificate message.
2021-02-12 14:35:23 +01:00
Pascal Knecht 4bba89fff3 tls-server: Make CertificateRequest conditional in old TLS versions
The server implementation now only sends a CertificateRequest message if
it has identity information to verify client certificates.
2021-02-12 14:35:23 +01:00
Pascal Knecht 4635f348fa tls-server: Share trusted public key search between client and server 2021-02-12 14:35:23 +01:00
Pascal Knecht 6b23543abd tls-crypto: Move AEAD ownership to the protection layer
This separates key derivation from key switching.
2021-02-12 14:35:23 +01:00
Pascal Knecht 534a781646 tls-hkdf: Always use correct base key to derive finished message
The cached traffic secrets change once the application traffic secrets
are derived, but we must always use the correct base key to derive the
finished message, which are the handshake traffic secrets (RFC 8446,
section 4.4).
2021-02-12 14:35:23 +01:00
Pascal Knecht 0aaf1242d9 libtls: Add unit tests for Ed25519 and Ed448 keys
TLS 1.0 to TLS 1.3 socket connection tests with each key type.
2021-02-12 14:35:23 +01:00
Pascal Knecht 5e579ebe8f tls-test: Load keys of any type
Only RSA keys were possible until now.
2021-02-12 14:35:23 +01:00
Pascal Knecht 34f66ce6cb tls-crypto: Support EdDSA keys with ECDSA cipher suites
Ed25519 and Ed448 are now usable in all TLS versions for connections that
use an ECDSA cipher suite, as per RFC 8422.
2021-02-12 14:35:23 +01:00
Pascal Knecht 9803fb82f4 tls-server: Consider supported signature algorithms when selecting key/certificate
This won't work if the client doesn't send a `signature_algorithms`
extension.  But since the default is SHA1/RSA, most will send it to at
least announce stronger hash algorithms if not ECDSA.
2021-02-12 14:35:23 +01:00
Pascal Knecht 06112f3fe2 tls-crypto: Distinguish between signing and verifying signature schemes
strongSwan supports RSA_PSS_RSAE schemes for signing but does not
differentiate between rsaEncryption and rsassaPss encoding. Thus
RSA_PSS_PSS schemes are only used for verifying signatures.
2021-02-12 14:35:23 +01:00
Pascal Knecht e731396280 tls-server: Check if peer sent hash and signature algorithms
It is mandatory to receive the `signature_algorithms` extension when a
server is authenticating with a certificate, which is always the case.
2021-02-12 14:35:23 +01:00
Pascal Knecht 91c9e4d576 tls-crypto: Add missing signature scheme constants
Some peers, e.g. Firefox, send a wide range of signature algorithms. To
prevent numeric identifiers in the log these algorithms are added here.
2021-02-12 14:35:23 +01:00
Pascal Knecht 0dfe1590b6 tls-server: Fix invalid signature algorithm and supported groups parsing
The extension's content length field was wrongly added to the content data.

Fixes: 06109c4717 ("Implemented "signature algorithm" hello extension")
2021-02-12 14:35:23 +01:00
Pascal Knecht 3767a4a655 tls-server: Support multiple client key shares
A client can send one or multiple key shares from which the server picks
one it supports (checked in its preferred order).  A retry is requested if
none of the key shares are supported.
2021-02-12 14:35:23 +01:00
Pascal Knecht 64e2506f5b libtls: Add TLS version negotiation test cases
These client to server negotiation test cases are implemented:
- TLS 1.0 => TLS 1.3
- TLS 1.1 => TLS 1.3
- TLS 1.2 => TLS 1.3
- TLS 1.3 => TLS 1.3

- TLS 1.3 => TLS 1.0
- TLS 1.3 => TLS 1.1
- TLS 1.3 => TLS 1.2
- TLS 1.3 => TLS 1.3

- TLS 1.0 => TLS 1.2
- TLS 1.1 => TLS 1.2
- TLS 1.2 => TLS 1.2
- TLS 1.3 => TLS 1.2
2021-02-12 14:35:23 +01:00
Pascal Knecht c3e7132468 tls-server: Support HelloRetryRequest (HRR)
Adds support to request and handle retries with a different DH group.

Only the first key share extension sent by the client is currently
considered, so this might result in protocol errors if the server requests
a group for which the client already sent a key share.
2021-02-12 14:35:23 +01:00
Pascal Knecht e53bee9dbe tls-crypto: Add support to configure DH groups to use
And add new test cases to test TLS 1.3 connections for each supported DH
group.
2021-02-12 14:35:23 +01:00
Tobias Brunner 9514aa2dcc diffie-hellman: Add enum names that match proposal keywords 2021-02-12 14:35:23 +01:00
Pascal Knecht 066ac8809c tls-crypto: Generalizing DH group to TLS group mapping
This simplifies writing the key share extension as the TLS group does
not have to be cached.
2021-02-12 14:35:23 +01:00
Pascal Knecht ab70f68cf9 tls-server: Support KeyUpdate requests and answers 2021-02-12 14:35:23 +01:00
Pascal Knecht 5c4cb40e47 tls-server: Refactor writing of key share extensions
Client and server now share the same code to write this extension.
2021-02-12 14:35:23 +01:00
Pascal Knecht 7fbe2e27ec tls-server: TLS 1.3 support for TLS server implementation
Add basic support to establish a TLS 1.3 connection with a client capable
of the same protocol version.
2021-02-12 14:35:23 +01:00
Pascal Knecht 328d7af6d2 tls-crypto: Rename parameter to be more consistent
Also add missing parameter in documentation of calculate_finished method.
2021-02-12 14:35:23 +01:00
Pascal Knecht 6549adb608 tls-crypto: Fix invalid signature algorithm list building
List building also added an additional length field which is required by
client-side TLS extensions but not for server-side certificate request
extension. Now the method only returns a list of supported signature
algorithms and the implementation is responsible to add additional
length fields.

Fixes: 07f826af67 ("Fixed encoding of TLS extensions (elliptic_curves and signature_algorithms)")
2021-02-12 14:35:23 +01:00
Pascal Knecht f81c04e9e3 libtls: Add missing cipher suite and TLS extension constants
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
- TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256

- Encrypt then MAC
- Extended master secret
- Session ticket

and also add missing suites in the unit test.
2021-02-12 14:35:23 +01:00
Pascal Knecht d107198fcb tls-crypto: Rework cipher suite preference order
The reworked list follows the order of modern browsers such as
Firefox. The new order prefers more secure ciphers over weaker ones.
2021-02-12 14:35:23 +01:00
Tobias Brunner 06424efa17 tls-server: Determine supported/configured suites and versions early
If we don't do this, we might negotiate a TLS version for which we don't
have any suites configured, so that the cipher suite negotiation
subsequently fails.
2021-02-12 14:35:23 +01:00
Pascal Knecht 8a6edc08a4 tls-crypto: Check if TLS versions and cipher suites match
Only suggest TLS versions of supported cipher suites.  For instance, do not
suggest TLS 1.3 if none of its cipher suites (requiring GCM/CCM or
ChaPoly) are available.
2021-02-12 14:35:23 +01:00
Pascal Knecht f920125304 tls-peer: Don't initiate TLS connection if no cipher suites are supported
If zero cipher suites are left after all filters, tls-peer does not
try to establish a connection to the server anymore.
2021-02-12 14:35:23 +01:00
Tobias Brunner 06aad98ff0 tls-test: Make plugin list configurable via environment variable 2021-02-12 14:35:23 +01:00
Tobias Brunner 00a6280aab tls-peer: Return INVALID_STATE after changing TLS 1.3 keys
Even though we return from build(), we are not actually sending a response,
so we can't return NEED_MORE (would send an invalid ClientHello message) and
if we return SUCCESS, the EAP layer treats this as failure (there is a comment
in eap_authenticator_t about client methods never returning SUCCESS from
process()).  Instead we return INVALID_STATE, which allows tls_t.build() to
exit from the build() loop immediately and send the already generated Finished
message.
2021-02-12 14:35:23 +01:00
Tobias Brunner 121ac4b9e3 tls-crypto: Generate MSK for TLS 1.3
We generate material for both MSK and EMSK even though we only need the
former.  Because HKDF-Expand-Label(), on which the export functionality
is based, encodes the requested key length, we have to allocate the same
number of bytes as e.g. FreeRADIUS does (i.e. if we only request 64
bytes, those won't be the same as the first 64 bytes after requesting
128 bytes).

Unfortunately, key derivation for TLS-based methods is currently not
standardized for TLS 1.3.  There is a draft [1], which defines a scheme
that's different from previous versions (instead of individual label
strings it uses a single one and passes the EAP type/code as context
value to TLS-Export()).  The current code is compatible to FreeRADIUS
3.0.x, which doesn't implement it according to that draft yet (there are
unreleased changes for EAP-TLS, not for the other methods, but these only
switch the label, no context value is passed).  In a separate draft
for EAP-TLS [2] there is an altogether different scheme defined in the
latest version (label combined with EAP method, no context and separate
derivation for MSK and EMSK).

So this is a mess and we will have to change this later with the inevitable
compatibility issues (we should definitely disable TLS 1.3 by default).

[1] https://tools.ietf.org/html/draft-ietf-emu-tls-eap-types
[2] https://tools.ietf.org/html/draft-ietf-emu-eap-tls13
2021-02-12 14:35:23 +01:00
Tobias Brunner d2fe921cf5 tls-hkdf: Add method that allows exporting key material 2021-02-12 11:45:44 +01:00
Tobias Brunner 86cda1a3c0 tls-hkdf: Handle label expansion inside expand_label()
We have to expand arbitrary external labels the same way when exporting
key material.
2021-02-12 11:45:44 +01:00
Tobias Brunner 3e89d26e1c tls-hkdf: Pass secret to derive_secret() explicitly 2021-02-12 11:45:44 +01:00
Tobias Brunner 4e2b8f9c71 tls-hkdf: Store OKM in local variables 2021-02-12 11:45:44 +01:00
Tobias Brunner 1b593e1d48 tls-crypto: Add support for RSA-PSS signatures
PKCS#1 v1.5 signatures are not defined for use with TLS 1.3 (they can
only appear in certificates, we now send a signature_algorithms_cert
extension to indicate support for them).  So for RSA certificates, we
must support RSA-PSS signatures.

There are two sets of schemes, that are differentiated by the type of
RSA key used for the signature, one is for classic RSA keys (rsaEncryption
OID), which can also be used with PKCS#1 when using TLS 1.2, the other
is for RSA-PSS keys (RSASSA-PSS OID), which are not yet commonly
used (and can't be generated by our pki tool).  According to the RFC,
PSS must also be supported for TLS 1.2 if the schemes are included in
the signature_algorithms extension (e.g. OpenSSL does not use PKCS#1 v1.5
anymore if PSS is proposed).

This changes how these schemes are stored and enumerated (they are not
treated as combination of hash algo and key type anymore).

Legacy schemes (MD5/SHA-1) are removed.
2021-02-12 11:45:47 +01:00
Tobias Brunner e02f19e3c6 tls-peer: Support answering KeyUpdate requests 2021-02-12 11:45:44 +01:00
Tobias Brunner 27360d3407 tls-socket: Change how EOF of the underlying socket is handled
With the previous code, there was an issue when replying to TLS 1.3
post-handshake messages.  In this case, SUCCESS is eventually returned
from build(), however, no actual data has been received so in_done is 0.
This was interpreted as EOF, plain_eof was set to TRUE and no further data
was read from the socket afterwards.

Returning SUCCESS from build() if the exchange is initiated by
write_(), as is the case with the finished reply, never was a problem
because there the return value of 0 is not interpreted as EOF.
2021-02-12 11:45:44 +01:00
Tobias Brunner bfcb49b393 tls-peer: Add support to handle KeyUpdate message
We currently don't support switching our own keys and sending the
message if requested by the server.
2021-02-12 11:45:44 +01:00
Tobias Brunner 1466d4da25 tls-crypto: Add method to update application traffic keys 2021-02-12 11:45:44 +01:00