Migrate to mbed TLS 2.x

PATCH In review Steffan Karger 3 participants 10 messages Apr 17, 2016 – Apr 28, 2016

lore

Share & tools

lore

Steffan Karger

author

2016-04-17 18:35 UTC #0 lore raw

PATCH 1/2 Migrate to mbed TLS 2.x

PolarSSL / mbed TLS 1.3 is going end-of-life by 2016-12-31, so let's move the master branch on to the 2.x series.

This patch purges all references to polarssl, except for file names and some comments referring to 1.2 and earlier, which were never released as 'mbed TLS'. A separate patch for the file names follows, so the real changes are easier to spot without git-fu.

This patch intends to not change any behaviour.

The vast majority of this patch is just renaming functions and structs. There are some small changes in the implementation:
* In ssl_polarssl.c: the debug callback prototype changed, so our implementation changed a bit too.
* in ssl_polarssl.c: the old polarssl ssl_context is now split into a mbedtls_ssl_config and mbedtls_ssl_context. The intention is that mbedtls_ssl_config is shared among connections, and mbedtls_ssl_context contains the per-connection state. That doesn't work for us, because we use per-connection verify callback data, while the verify callback is registered on mbed_tls_config. Therefore we still need to init a mbed_tls_config struct for each connection.
* in ssl_polarssl.c: the mbed bio handling changed, so our implementation changed a bit too.
* in ssl_polarssl.c and ssl_verify_polarssl.c: the mbedtls x509 parse functions now fail if we don't provide a NUL-terminated string, so use strlen()+1 as the length argument to include the terminating NUL.

I tested this patch to work with:
* 'make check' (with 2.0.0 and 2.2.1, other tests just with 2.2.1)
* static key mode
* TLS mode with PEM key file
* TLS mode with password protected PEM key file
* TLS mode with management-external-key
* TLS mode with PKCS#11
* TLS mode with inline ca/key/cert/dh

Signed-off-by Steffan Karger <[email protected]...>

---
 configure.ac                      |  72 +++----
 include/openvpn-plugin.h.in       |  10 +-
 src/openvpn/crypto_backend.h      |   4 +-
 src/openvpn/crypto_polarssl.c     | 263 ++++++++++++-----------
 src/openvpn/crypto_polarssl.h     |  76 +++----
 src/openvpn/options.c             |  44 ++--
 src/openvpn/options.h             |   4 +-
 src/openvpn/pkcs11_polarssl.c     |  53 ++---
 src/openvpn/plugin.h              |   2 +-
 src/openvpn/ssl.c                 |   2 +-
 src/openvpn/ssl_backend.h         |   8 +-
 src/openvpn/ssl_polarssl.c        | 433 ++++++++++++++++++++------------------
 src/openvpn/ssl_polarssl.h        |  35 +--
 src/openvpn/ssl_verify.h          |   2 +-
 src/openvpn/ssl_verify_polarssl.c | 124 +++++------
 src/openvpn/ssl_verify_polarssl.h |  20 +-
 src/openvpn/syshead.h             |   6 +-
 17 files changed, 594 insertions(+), 564 deletions(-)

configure.ac +34 ~~-38~~

index b75d51f..3b8bf96 100644
@@ -291,10 +291,10 @@ AC_ARG_WITH(
 
 AC_ARG_WITH(
 	[crypto-library],
-	[AS_HELP_STRING([--with-crypto-library=library], [build with the given crypto library, TYPE=openssl|polarssl @<:@default=openssl@:>@])],
+	[AS_HELP_STRING([--with-crypto-library=library], [build with the given crypto library, TYPE=openssl|mbedtls @<:@default=openssl@:>@])],
 	[
 		case "${withval}" in 
-			openssl|polarssl) ;;
+			openssl|mbedtls) ;;
 			*) AC_MSG_ERROR([bad value ${withval} for --with-crypto-library]) ;;
 		esac
 	],

@@ -835,81 +835,77 @@ if test "${with_crypto_library}" = "openssl"; then
 	AC_DEFINE([ENABLE_CRYPTO_OPENSSL], [1], [Use OpenSSL library])
 	CRYPTO_CFLAGS="${OPENSSL_CFLAGS}"
 	CRYPTO_LIBS="${OPENSSL_LIBS}"
-elif test "${with_crypto_library}" = "polarssl"; then
-	AC_ARG_VAR([POLARSSL_CFLAGS], [C compiler flags for polarssl])
-	AC_ARG_VAR([POLARSSL_LIBS], [linker flags for polarssl])
+elif test "${with_crypto_library}" = "mbedtls"; then
+	AC_ARG_VAR([MBEDTLS_CFLAGS], [C compiler flags for mbedtls])
+	AC_ARG_VAR([MBEDTLS_LIBS], [linker flags for mbedtls])
 
 	saved_CFLAGS="${CFLAGS}"
 	saved_LIBS="${LIBS}"
 
-	if test -z "${POLARSSL_CFLAGS}" -a -z "${POLARSSL_LIBS}"; then
-        # if the user did not explicitly specify flags, try to autodetect
-		AC_SEARCH_LIBS(
-			[ssl_init],
-			[mbedtls polarssl],
-			[
-				if test "${ac_cv_search_ssl_init}" != "none required"; then
-					POLARSSL_LIBS=${ac_cv_search_ssl_init}
-				fi
-			],
-			[AC_MSG_ERROR([Could not find PolarSSL/mbed TLS.])],
+	if test -z "${MBEDTLS_CFLAGS}" -a -z "${MBEDTLS_LIBS}"; then
+	# if the user did not explicitly specify flags, try to autodetect
+		AC_CHECK_LIB(
+			[mbedtls],
+			[mbedtls_ssl_init],
+			[MBEDTLS_LIBS="-lmbedtls -lmbedcrypto -lmbedx509"],
+			[AC_MSG_ERROR([Could not find mbed TLS.])],
 			[${PKCS11_HELPER_LIBS}]
 		)
 	fi
 
-	CFLAGS="${POLARSSL_CFLAGS} ${PKCS11_HELPER_CFLAGS} ${CFLAGS}"
-	LIBS="${POLARSSL_LIBS} ${PKCS11_HELPER_LIBS} ${LIBS}"
+	CFLAGS="${MBEDTLS_CFLAGS} ${PKCS11_HELPER_CFLAGS} ${CFLAGS}"
+	LIBS="${MBEDTLS_LIBS} ${PKCS11_HELPER_LIBS} ${LIBS}"
 
-	AC_MSG_CHECKING([polarssl version])
+	AC_MSG_CHECKING([mbedtls version])
 	AC_COMPILE_IFELSE(
 		[AC_LANG_PROGRAM(
 			[[
-#include <polarssl/version.h>
+#include <mbedtls/version.h>
 			]],
 			[[
-#if POLARSSL_VERSION_NUMBER < 0x01030800 || POLARSSL_VERSION_NUMBER >= 0x01040000
+#if MBEDTLS_VERSION_NUMBER < 0x02000000 || MBEDTLS_VERSION_NUMBER >= 0x03000000
 #error invalid version
 #endif
 			]]
 		)],
 		[AC_MSG_RESULT([ok])],
-		[AC_MSG_ERROR([PolarSSL 1.3.x required and must be 1.3.8 or later])]
+		[AC_MSG_ERROR([mbed TLS 2.y.z required])]
 	)
 
-	polarssl_with_pkcs11="no"
+	mbedtls_with_pkcs11="no"
 	AC_COMPILE_IFELSE(
 		[AC_LANG_PROGRAM(
 			[[
-#include <polarssl/config.h>
+#include <mbedtls/config.h>
 			]],
 			[[
-#ifndef POLARSSL_PKCS11_C
+#ifndef MBEDTLS_PKCS11_C
 #error pkcs11 wrapper missing
 #endif
 			]]
 		)],
-		polarssl_with_pkcs11="yes")
+		mbedtls_with_pkcs11="yes")
 
-	AC_MSG_CHECKING([polarssl pkcs11 support])
+	AC_MSG_CHECKING([mbedtls pkcs11 support])
 	if test "${enable_pkcs11}" = "yes"; then
-		if test "${polarssl_with_pkcs11}" = "yes"; then
+		if test "${mbedtls_with_pkcs11}" = "yes"; then
 			AC_MSG_RESULT([ok])
 		else
-			AC_MSG_ERROR([polarssl has no pkcs11 wrapper compiled in])
+			AC_MSG_ERROR([mbedtls has no pkcs11 wrapper compiled in])
 		fi
 	else
-		if test "${polarssl_with_pkcs11}" != "yes"; then
+		if test "${mbedtls_with_pkcs11}" != "yes"; then
 			AC_MSG_RESULT([ok])
 		else
-			AC_MSG_ERROR([PolarSSL compiled with PKCS11, while OpenVPN is not])
+			AC_MSG_ERROR([mbed TLS compiled with PKCS11, while OpenVPN is not])
 		fi
 	fi
 
 	have_crypto_aead_modes="yes"
 	AC_CHECK_FUNCS(
 		[ \
-			cipher_write_tag \
-			cipher_check_tag \
+			mbedtls_cipher_write_tag \
+			mbedtls_cipher_check_tag \
 		],
 		,
 		[have_crypto_aead_modes="no"; break]

@@ -918,9 +914,9 @@ elif test "${with_crypto_library}" = "polarssl"; then
 	CFLAGS="${saved_CFLAGS}"
 	LIBS="${saved_LIBS}"
 	have_crypto="yes"
-	AC_DEFINE([ENABLE_CRYPTO_POLARSSL], [1], [Use PolarSSL library])
-	CRYPTO_CFLAGS="${POLARSSL_CFLAGS}"
-	CRYPTO_LIBS="${POLARSSL_LIBS}"
+	AC_DEFINE([ENABLE_CRYPTO_MBEDTLS], [1], [Use mbed TLS library])
+	CRYPTO_CFLAGS="${MBEDTLS_CFLAGS}"
+	CRYPTO_LIBS="${MBEDTLS_LIBS}"
 else
 	AC_MSG_ERROR([Invalid crypto library: ${with_crypto_library}])
 fi

@@ -1048,8 +1044,8 @@ fi
 
 dnl enable --x509-username-field feature if requested
 if test "${enable_x509_alt_username}" = "yes"; then
-	if test "${with_crypto_library}" = "polarssl" ; then
-		AC_MSG_ERROR([PolarSSL does not support the --x509-username-field feature])
+	if test "${with_crypto_library}" = "mbedtls" ; then
+		AC_MSG_ERROR([mbed TLS does not support the --x509-username-field feature])
 	fi
 
 	AC_DEFINE([ENABLE_X509ALTUSERNAME], [1], [Enable --x509-username-field feature])

include/openvpn-plugin.h.in +5 -5

index d4bf622..b03a9df 100644
@@ -28,11 +28,11 @@
 #define OPENVPN_PLUGIN_VERSION 3
 
 #ifdef ENABLE_CRYPTO
-#ifdef ENABLE_CRYPTO_POLARSSL
-#include <polarssl/x509_crt.h>
+#ifdef ENABLE_CRYPTO_MBEDTLS
+#include <mbedtls/x509_crt.h>
 #ifndef __OPENVPN_X509_CERT_T_DECLARED
 #define __OPENVPN_X509_CERT_T_DECLARED
-typedef x509_crt openvpn_x509_cert_t;
+typedef mbedtls_x509_crt openvpn_x509_cert_t;
 #endif
 #else
 #include <openssl/x509.h>

@@ -277,13 +277,13 @@ struct openvpn_plugin_callbacks
 /**
  * Used by the openvpn_plugin_open_v3() function to indicate to the
  * plug-in what kind of SSL implementation OpenVPN uses.  This is
- * to avoid SEGV issues when OpenVPN is complied against PolarSSL
+ * to avoid SEGV issues when OpenVPN is complied against mbed TLS
  * and the plug-in against OpenSSL.
  */
 typedef enum {
   SSLAPI_NONE,
   SSLAPI_OPENSSL,
-  SSLAPI_POLARSSL
+  SSLAPI_MBEDTLS
 } ovpnSSLAPI;
 
 /**

src/openvpn/crypto_backend.h +2 -2

index fb7c351..c4986f5 100644
@@ -33,7 +33,7 @@
 #ifdef ENABLE_CRYPTO_OPENSSL
 #include "crypto_openssl.h"
 #endif
-#ifdef ENABLE_CRYPTO_POLARSSL
+#ifdef ENABLE_CRYPTO_MBEDTLS
 #include "crypto_polarssl.h"
 #endif
 #include "basic.h"

@@ -294,7 +294,7 @@ bool cipher_kt_mode_aead(const cipher_kt_t *cipher);
  * @param key_len 	Length of the key, in bytes
  * @param kt		Static cipher parameters to use
  * @param enc		Whether to encrypt or decrypt (either
- * 			\c POLARSSL_OP_ENCRYPT or \c POLARSSL_OP_DECRYPT).
+ * 			\c MBEDTLS_OP_ENCRYPT or \c MBEDTLS_OP_DECRYPT).
  */
 void cipher_ctx_init (cipher_ctx_t *ctx, uint8_t *key, int key_len,
     const cipher_kt_t *kt, int enc);

src/openvpn/crypto_polarssl.c +136 ~~-127~~

660 lines not on this page · raw message

src/openvpn/crypto_polarssl.h +38 ~~-38~~

156 lines not on this page · raw message

src/openvpn/options.c +22 ~~-22~~

149 lines not on this page · raw message

src/openvpn/options.h +2 -2

index ffbe5e1..18d8376 100644
@@ -78,8 +78,8 @@ struct options_pre_pull
 };
 
 #endif
-#if defined(ENABLE_CRYPTO) && !defined(ENABLE_CRYPTO_OPENSSL) && !defined(ENABLE_CRYPTO_POLARSSL)
-# error "At least one of OpenSSL or PolarSSL needs to be defined."
+#if defined(ENABLE_CRYPTO) && !defined(ENABLE_CRYPTO_OPENSSL) && !defined(ENABLE_CRYPTO_MBEDTLS)
+# error "At least one of OpenSSL or mbed TLS needs to be defined."
 #endif
 
 struct connection_entry

src/openvpn/pkcs11_polarssl.c +27 ~~-26~~

112 lines not on this page · raw message

src/openvpn/plugin.h +1 -1

index 77b6e81..74ac8b1 100644
@@ -32,7 +32,7 @@
 #ifdef ENABLE_CRYPTO_OPENSSL
 #include "ssl_verify_openssl.h"
 #endif
-#ifdef ENABLE_CRYPTO_POLARSSL
+#ifdef ENABLE_CRYPTO_MBEDTLS
 #include "ssl_verify_polarssl.h"
 #endif
 #include "openvpn-plugin.h"

src/openvpn/ssl.c +1 -1

index d1a6fa8..ddd0c9b 100644
@@ -591,7 +591,7 @@ init_ssl (const struct options *options, struct tls_root_ctx *new_ctx)
   /* Allowable ciphers */
   tls_ctx_restrict_ciphers(new_ctx, options->cipher_list);
 
-#ifdef ENABLE_CRYPTO_POLARSSL
+#ifdef ENABLE_CRYPTO_MBEDTLS
   /* Personalise the random by mixing in the certificate */
   tls_ctx_personalise_random (new_ctx);
 #endif

src/openvpn/ssl_backend.h +4 -4

index ac28f5f..dfccb44 100644
@@ -38,10 +38,10 @@
 #include "ssl_verify_openssl.h"
 #define SSLAPI SSLAPI_OPENSSL
 #endif
-#ifdef ENABLE_CRYPTO_POLARSSL
+#ifdef ENABLE_CRYPTO_MBEDTLS
 #include "ssl_polarssl.h"
 #include "ssl_verify_polarssl.h"
-#define SSLAPI SSLAPI_POLARSSL
+#define SSLAPI SSLAPI_MBEDTLS
 #endif
 
 /* Ensure that SSLAPI got a sane value if SSL is disabled or unknown */

@@ -308,9 +308,9 @@ void tls_ctx_load_extra_certs (struct tls_root_ctx *ctx, const char *extra_certs
     const char *extra_certs_file_inline
     );
 
-#ifdef ENABLE_CRYPTO_POLARSSL
+#ifdef ENABLE_CRYPTO_MBEDTLS
 /**
- * Add a personalisation string to the PolarSSL RNG, based on the certificate
+ * Add a personalisation string to the mbed TLS RNG, based on the certificate
  * loaded into the given context.
  *
  * @param ctx			TLS context to use

src/openvpn/ssl_polarssl.c +223 ~~-210~~

874 lines not on this page · raw message

src/openvpn/ssl_polarssl.h +20 ~~-15~~

index b80a509..6f778ef 100644
@@ -24,19 +24,19 @@
  */
 
 /**
- * @file Control Channel PolarSSL Backend
+ * @file Control Channel mbed TLS Backend
  */
 
-#ifndef SSL_POLARSSL_H_
-#define SSL_POLARSSL_H_
+#ifndef SSL_MBEDTLS_H_
+#define SSL_MBEDTLS_H_
 
 #include "syshead.h"
 
-#include <polarssl/ssl.h>
-#include <polarssl/x509_crt.h>
+#include <mbedtls/ssl.h>
+#include <mbedtls/x509_crt.h>
 
 #if defined(ENABLE_PKCS11)
-#include <polarssl/pkcs11.h>
+#include <mbedtls/pkcs11.h>
 #endif
 
 typedef struct _buffer_entry buffer_entry;

@@ -53,6 +53,11 @@ typedef struct {
     buffer_entry *last_block;
 } endless_buffer;
 
+typedef struct {
+    endless_buffer in;
+    endless_buffer out;
+} bio_ctx;
+
 /**
  * Structure that wraps the TLS context. Contents differ depending on the
  * SSL library used.

@@ -64,12 +69,12 @@ struct tls_root_ctx {
 
     int endpoint; 		/**< Whether or not this is a server or a client */
 
-    dhm_context *dhm_ctx;	/**< Diffie-Helmann-Merkle context */
-    x509_crt *crt_chain;	/**< Local Certificate chain */
-    x509_crt *ca_chain;		/**< CA chain for remote verification */
-    pk_context *priv_key;	/**< Local private key */
+    mbedtls_dhm_context *dhm_ctx;	/**< Diffie-Helmann-Merkle context */
+    mbedtls_x509_crt *crt_chain;	/**< Local Certificate chain */
+    mbedtls_x509_crt *ca_chain;		/**< CA chain for remote verification */
+    mbedtls_pk_context *priv_key;	/**< Local private key */
 #if defined(ENABLE_PKCS11)
-    pkcs11_context *priv_key_pkcs11;	/**< PKCS11 private key */
+    mbedtls_pkcs11_context *priv_key_pkcs11;	/**< PKCS11 private key */
 #endif
 #ifdef MANAGMENT_EXTERNAL_KEY
     struct external_context *external_key; /**< Management external key */

@@ -78,10 +83,10 @@ struct tls_root_ctx {
 };
 
 struct key_state_ssl {
-        ssl_context *ctx;
-        endless_buffer *ct_in;
-        endless_buffer *ct_out;
+    mbedtls_ssl_config ssl_config;	/**< mbedTLS global ssl config */
+    mbedtls_ssl_context *ctx;		/**< mbedTLS connection context */
+    bio_ctx bio_ctx;
 };
 
 
-#endif /* SSL_POLARSSL_H_ */
+#endif /* SSL_MBEDTLS_H_ */

src/openvpn/ssl_verify.h +1 -1

index 8527415..5eb1843 100644
@@ -40,7 +40,7 @@
 #ifdef ENABLE_CRYPTO_OPENSSL
 #include "ssl_verify_openssl.h"
 #endif
-#ifdef ENABLE_CRYPTO_POLARSSL
+#ifdef ENABLE_CRYPTO_MBEDTLS
 #include "ssl_verify_polarssl.h"
 #endif

src/openvpn/ssl_verify_polarssl.c +65 ~~-59~~

341 lines not on this page · raw message

src/openvpn/ssl_verify_polarssl.h +10 ~~-10~~

index 2076f2e..e26d08f 100644
@@ -24,18 +24,18 @@
  */
 
 /**
- * @file Control Channel Verification Module PolarSSL backend
+ * @file Control Channel Verification Module mbed TLS backend
  */
 
-#ifndef SSL_VERIFY_POLARSSL_H_
-#define SSL_VERIFY_POLARSSL_H_
+#ifndef SSL_VERIFY_MBEDTLS_H_
+#define SSL_VERIFY_MBEDTLS_H_
 
 #include "syshead.h"
-#include <polarssl/x509_crt.h>
+#include <mbedtls/x509_crt.h>
 
 #ifndef __OPENVPN_X509_CERT_T_DECLARED
 #define __OPENVPN_X509_CERT_T_DECLARED
-typedef x509_crt openvpn_x509_cert_t;
+typedef mbedtls_x509_crt openvpn_x509_cert_t;
 #endif
 
 /** @name Function for authenticating a new connection from a remote OpenVPN peer

@@ -50,7 +50,7 @@ typedef x509_crt openvpn_x509_cert_t;
  * determine whether the remote OpenVPN peer's certificate is allowed to
  * connect. It is called for once for every certificate in the chain. The
  * callback functionality is configured in the \c init_ssl() function, which
- * calls the PolarSSL library's \c ssl_set_verify_callback() function with \c
+ * calls the mbed TLS library's \c ssl_set_verify_callback() function with \c
  * verify_callback() as its callback argument.
  *
  * It checks *flags and registers the certificate hash. If these steps succeed,

@@ -59,7 +59,7 @@ typedef x509_crt openvpn_x509_cert_t;
  *
  * @param session_obj  - The OpenVPN \c tls_session associated with this object,
  *                       as set during SSL session setup.
- * @param cert         - The certificate used by PolarSSL.
+ * @param cert         - The certificate used by mbed TLS.
  * @param cert_depth   - The depth of the current certificate in the chain, with
  *                       0 being the actual certificate.
  * @param flags        - Whether the remote OpenVPN peer's certificate

@@ -70,9 +70,9 @@ typedef x509_crt openvpn_x509_cert_t;
  *
  * @return The return value is 0 unless a fatal error occurred.
  */
-int verify_callback (void *session_obj, x509_crt *cert, int cert_depth,
-    int *flags);
+int verify_callback (void *session_obj, mbedtls_x509_crt *cert, int cert_depth,
+    uint32_t *flags);
 
 /** @} name Function for authenticating a new connection from a remote OpenVPN peer */
 
-#endif /* SSL_VERIFY_POLARSSL_H_ */
+#endif /* SSL_VERIFY_MBEDTLS_H_ */

src/openvpn/syshead.h +3 -3

index 1c9248f..c8391ca 100644
@@ -564,10 +564,10 @@ socket_defined (const socket_descriptor_t sd)
 #define MANAGMENT_EXTERNAL_KEY
 #endif
 
-/* Enable PolarSSL RNG prediction resistance support */
-#ifdef ENABLE_CRYPTO_POLARSSL
+/* Enable mbed TLS RNG prediction resistance support */
+#ifdef ENABLE_CRYPTO_MBEDTLS
 #define ENABLE_PREDICTION_RESISTANCE
-#endif /* ENABLE_CRYPTO_POLARSSL */
+#endif /* ENABLE_CRYPTO_MBEDTLS */
 
 /*
  * MANAGEMENT_IN_EXTRA allows the management interface to

Signature · 1 line

2.5.0

Steffan Karger

author

2016-04-17 18:35 UTC #1 lore raw

PATCH 2/2 Rename files with 'polarssl' in the name to 'mbedtls'

The patch looks huge, but it's just file renames, and required changes in includes / Makefiles. Use 'git diff -C' or a tool like gitk to easily review this patch.

Signed-off-by Steffan Karger <[email protected]...>

---
 src/openvpn/Makefile.am           |    8 +-
 src/openvpn/crypto_backend.h      |    2 +-
 src/openvpn/crypto_mbedtls.c      |  758 ++++++++++++++++++++++++
 src/openvpn/crypto_mbedtls.h      |  146 +++++
 src/openvpn/crypto_polarssl.c     |  758 ------------------------
 src/openvpn/crypto_polarssl.h     |  146 -----
 src/openvpn/pkcs11_mbedtls.c      |  129 ++++
 src/openvpn/pkcs11_polarssl.c     |  129 ----
 src/openvpn/plugin.h              |    2 +-
 src/openvpn/ssl_backend.h         |    4 +-
 src/openvpn/ssl_mbedtls.c         | 1184 +++++++++++++++++++++++++++++++++++++
 src/openvpn/ssl_mbedtls.h         |   92 +++
 src/openvpn/ssl_polarssl.c        | 1184 -------------------------------------
 src/openvpn/ssl_polarssl.h        |   92 ---
 src/openvpn/ssl_verify.h          |    2 +-
 src/openvpn/ssl_verify_mbedtls.c  |  508 ++++++++++++++++
 src/openvpn/ssl_verify_mbedtls.h  |   78 +++
 src/openvpn/ssl_verify_polarssl.c |  508 ----------------
 src/openvpn/ssl_verify_polarssl.h |   78 ---
 19 files changed, 2904 insertions(+), 2904 deletions(-)
 create mode 100644 src/openvpn/crypto_mbedtls.c
 create mode 100644 src/openvpn/crypto_mbedtls.h
 delete mode 100644 src/openvpn/crypto_polarssl.c
 delete mode 100644 src/openvpn/crypto_polarssl.h
 create mode 100644 src/openvpn/pkcs11_mbedtls.c
 delete mode 100644 src/openvpn/pkcs11_polarssl.c
 create mode 100644 src/openvpn/ssl_mbedtls.c
 create mode 100644 src/openvpn/ssl_mbedtls.h
 delete mode 100644 src/openvpn/ssl_polarssl.c
 delete mode 100644 src/openvpn/ssl_polarssl.h
 create mode 100644 src/openvpn/ssl_verify_mbedtls.c
 create mode 100644 src/openvpn/ssl_verify_mbedtls.h
 delete mode 100644 src/openvpn/ssl_verify_polarssl.c
 delete mode 100644 src/openvpn/ssl_verify_polarssl.h

src/openvpn/Makefile.am +4 -4

index bf1d749..9d4bf61 100644
@@ -46,7 +46,7 @@ openvpn_SOURCES = \
 	comp-lz4.c comp-lz4.h \
 	crypto.c crypto.h crypto_backend.h \
 	crypto_openssl.c crypto_openssl.h \
-	crypto_polarssl.c crypto_polarssl.h \
+	crypto_mbedtls.c crypto_mbedtls.h \
 	dhcp.c dhcp.h \
 	errlevel.h \
 	error.c error.h \

@@ -80,7 +80,7 @@ openvpn_SOURCES = \
 	occ.c occ.h occ-inline.h \
 	pkcs11.c pkcs11.h pkcs11_backend.h \
 	pkcs11_openssl.c \
-	pkcs11_polarssl.c \
+	pkcs11_mbedtls.c \
 	openvpn.c openvpn.h \
 	options.c options.h \
 	otime.c otime.h \

@@ -105,11 +105,11 @@ openvpn_SOURCES = \
 	socks.c socks.h \
 	ssl.c ssl.h  ssl_backend.h \
 	ssl_openssl.c ssl_openssl.h \
-	ssl_polarssl.c ssl_polarssl.h \
+	ssl_mbedtls.c ssl_mbedtls.h \
 	ssl_common.h \
 	ssl_verify.c ssl_verify.h ssl_verify_backend.h \
 	ssl_verify_openssl.c ssl_verify_openssl.h \
-	ssl_verify_polarssl.c ssl_verify_polarssl.h \
+	ssl_verify_mbedtls.c ssl_verify_mbedtls.h \
 	status.c status.h \
 	syshead.h \
 	tun.c tun.h \

src/openvpn/crypto_backend.h +1 -1

index c4986f5..3893f14 100644
@@ -34,7 +34,7 @@
 #include "crypto_openssl.h"
 #endif
 #ifdef ENABLE_CRYPTO_MBEDTLS
-#include "crypto_polarssl.h"
+#include "crypto_mbedtls.h"
 #endif
 #include "basic.h"

src/openvpn/crypto_mbedtls.c new file +758 -0

758 lines not on this page · raw message

src/openvpn/crypto_mbedtls.h new file +146 -0

146 lines not on this page · raw message

src/openvpn/crypto_polarssl.c deleted +0 ~~-758~~

758 lines not on this page · raw message

src/openvpn/crypto_polarssl.h deleted +0 ~~-146~~

146 lines not on this page · raw message

src/openvpn/pkcs11_mbedtls.c new file +129 -0

129 lines not on this page · raw message

src/openvpn/pkcs11_polarssl.c deleted +0 ~~-129~~

129 lines not on this page · raw message

src/openvpn/plugin.h +1 -1

index 74ac8b1..3c01047 100644
@@ -33,7 +33,7 @@
 #include "ssl_verify_openssl.h"
 #endif
 #ifdef ENABLE_CRYPTO_MBEDTLS
-#include "ssl_verify_polarssl.h"
+#include "ssl_verify_mbedtls.h"
 #endif
 #include "openvpn-plugin.h"

src/openvpn/ssl_backend.h +2 -2

index dfccb44..542c373 100644
@@ -39,8 +39,8 @@
 #define SSLAPI SSLAPI_OPENSSL
 #endif
 #ifdef ENABLE_CRYPTO_MBEDTLS
-#include "ssl_polarssl.h"
-#include "ssl_verify_polarssl.h"
+#include "ssl_mbedtls.h"
+#include "ssl_verify_mbedtls.h"
 #define SSLAPI SSLAPI_MBEDTLS
 #endif

src/openvpn/ssl_mbedtls.c new file +1184 -0

879 lines not on this page · raw message

src/openvpn/ssl_mbedtls.h new file +92 -0

92 lines not on this page · raw message

src/openvpn/ssl_polarssl.c deleted +0 ~~-1184~~

1,184 lines not on this page · raw message

src/openvpn/ssl_polarssl.h deleted +0 ~~-92~~

92 lines not on this page · raw message

src/openvpn/ssl_verify.h +1 -1

index 5eb1843..f693b2a 100644

Lines of this file are not shown. View the raw message.

src/openvpn/ssl_verify_mbedtls.c new file +508 -0

508 lines not on this page · raw message

src/openvpn/ssl_verify_mbedtls.h new file +78 -0

78 lines not on this page · raw message

src/openvpn/ssl_verify_polarssl.c deleted +0 ~~-508~~

508 lines not on this page · raw message

src/openvpn/ssl_verify_polarssl.h deleted +0 ~~-78~~

78 lines not on this page · raw message

The rest of this diff is not shown. View the raw message.

Signature · 1 line

2.5.0

Part of the diff is not shown here. View the raw message.

Arne Schwabe

2016-04-27 11:01 UTC #2 lore raw

Re: [Openvpn-devel] [PATCH 2/2] Rename files with 'polarssl' in the name to 'mbedtls'

Am 17.04.16 um 21:35 schrieb Steffan Karger:

Quoted 3 lines

The patch looks huge, but it's just file renames, and required changes in includes / Makefiles. Use 'git diff -C' or a tool like gitk to easily review this patch.

ACK.

Arne

Gert Doering

2016-04-28 15:02 UTC #3 lore raw

[Openvpn-devel] [PATCH applied] Re: Rename files with 'polarssl' in the name to 'mbedtls'

In reply to Steffan Karger

Your patch has been applied to the master branch.

commit 74586c6508e5dd283eaef9d098644a7800beec01

Author: Steffan Karger
Date:   Sun Apr 17 20:35:43 2016 +0200

     Rename files with 'polarssl' in the name to 'mbedtls'

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/11459
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

Arne Schwabe

2016-04-27 10:39 UTC #4 lore raw

In reply to Steffan Karger

Am 17.04.16 um 21:35 schrieb Steffan Karger:

Quoted 1 line

#ifdef HAVE_AEAD_CIPHER_MODES

Are there actually mbedTLS version >= 2 without AEAD?

Arne

Arne Schwabe

2016-04-27 11:00 UTC #5 lore raw

In reply to Steffan Karger

Am 17.04.16 um 21:35 schrieb Steffan Karger:

Quoted 1 line

#ifdef HAVE_AEAD_CIPHER_MODES

Are there actually mBedTLS >=2.0 without this?

The rest looks fine, so ACK for me.

Arne

P.S.: This was probably one of the most boring reviews I did (for most part of the changes).

Gert Doering

2016-04-27 17:51 UTC #6 lore raw

Hi,

Quoted 1 line · Arne Schwabe

The rest looks fine, so ACK for me.

While I totally love to just merge stuff other folks have reviewed, this patch just doesn't apply to my tree :-( - and the rejects are too many to try to mangle by hand.

Patching file configure.ac using Plan A...
Hunk #1 failed at 291.
Patching file src/openvpn/options.c using Plan A... Hunk #11 failed at 6584.
Patching file src/openvpn/ssl_verify_polarssl.c using Plan A... Hunk #2 failed at 35.
Hunk #6 failed at 160.
Hunk #7 failed at 216.
Hunk #8 failed at 232.
Hunk #9 failed at 263.
No such line 417 in input file, ignoring

I'm fairly sure I understand why this is happening - Steffan has polar- related patches in his tree that have not yet been merged - but "as is", I can't merge this...

OTOH, it might apply if we get the James-reworked-by-Steffan patch series in... Arne, did you find time to take a look at them?

(Sorry for having such a messy tree with too many open patches out there)

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

Steffan Karger

author

2016-04-27 19:51 UTC #7 lore raw

Quoted 17 lines · Gert Doering

While I totally love to just merge stuff other folks have reviewed, this patch just doesn't apply to my tree :-( - and the rejects are too many to try to mangle by hand.
Patching file configure.ac using Plan A...
Hunk #1 failed at 291.
Patching file src/openvpn/options.c using Plan A... Hunk #11 failed at 6584.
Patching file src/openvpn/ssl_verify_polarssl.c using Plan A... Hunk #2 failed at 35.
Hunk #6 failed at 160.
Hunk #7 failed at 216.
Hunk #8 failed at 232.
Hunk #9 failed at 263.
No such line 417 in input file, ignoring

Quoted 6 lines

I'm fairly sure I understand why this is happening - Steffan has polar- related patches in his tree that have not yet been merged - but "as is", I can't merge this...
OTOH, it might apply if we get the James-reworked-by-Steffan patch series in...

This should indeed be the case.

-Steffan

Steffan Karger

author

2016-04-27 19:55 UTC #8 lore raw

In reply to Arne Schwabe

Quoted 4 lines · Arne Schwabe

Am 17.04.16 um 21:35 schrieb Steffan Karger:
Quoted 1 line
#ifdef HAVE_AEAD_CIPHER_MODES
Are there actually mBedTLS >=2.0 without this?

It's possible to compile mbed TLS without GCM, yes. Though I could imagine getting rid of HAVE_AEAD_CIPHER_MODES, and just fail if GCM support is missing. If there are more in favour of that approach, I'll either send a v2, or a follow-up patch.

Quoted 2 lines

P.S.: This was probably one of the most boring reviews I did (for most part of the changes).

Hehe, yes, I can imagine. Writing this patch wasn't exactly exciting either ;) Let's hope mbed TLS sticks to this naming scheme for a while...

-Steffan

Gert Doering

2016-04-28 14:59 UTC #9 lore raw

In reply to Steffan Karger

Your patch has been applied to the master branch.

(One minor whitespace fix to configure.ac)

Just to point it out here again, in case someone is frustrated and googles for it: mbedTLS 2.x refuses RSA keys < 2048 bits by default - so if your setup is nicely working with shorter RSA keys and PolarSSL 1.3 today, this commit *will break it* - and it won't tell you why ("VERIFY FAILED" is all you get). A patch with a more helpful error message is forthcoming.

commit 86d8cd6860dfc74cb1a040ff8fe03140ebe7f930

Author: Steffan Karger
Date:   Sun Apr 17 20:35:42 2016 +0200

     Migrate to mbed TLS 2.x

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/11458
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering