Clean up --show-tls output for OpenSSL builds

PATCH In review Steffan Karger 3 participants 10 messages Mar 1, 2014 – Mar 23, 2014

lore

Share & tools

lore

Steffan Karger

author

2014-03-01 14:36 UTC #0 lore raw

PATCH 1/1 Clean up --show-tls output for OpenSSL builds

Hi,

The following two (small) patches are usability improvements.

1/2 removes some of the warnings OpenVPN-with-OpenSSL issue when a user specifies valid OpenSSL TLS cipher group names with --tls-cipher. PolarSSL does not support group names, so these are not applicable for PolarSSL.

2/2 changes the default cipher list for OpenSSL to explicitly disable a number of unsupported TLS cipher groups. Although ECDH support is not yet in, I did not add it here because, well, it should get in soon. This should reduce the problems described in ticket #304.

-Steffan

Steffan Karger

author

2014-03-01 14:36 UTC #1 lore raw

PATCH 1/2 Add openssl-specific common cipher list names to ssl.c.

This adds a number of commonly used cipher list names to ssl.c, which makes OpenVPN not give a "translation not found" warning when using these.

Signed-off-by Steffan Karger <[email protected]...>

---
 src/openvpn/ssl.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

src/openvpn/ssl.c +13 -0

index c61701a..d4acc0f 100644
@@ -235,6 +235,19 @@ static const tls_cipher_name_pair tls_cipher_name_translation_table[] = {
     {"SRP-RSA-3DES-EDE-CBC-SHA", "TLS-SRP-SHA-RSA-WITH-3DES-EDE-CBC-SHA"},
     {"SRP-RSA-AES-128-CBC-SHA", "TLS-SRP-SHA-RSA-WITH-AES-128-CBC-SHA"},
     {"SRP-RSA-AES-256-CBC-SHA", "TLS-SRP-SHA-RSA-WITH-AES-256-CBC-SHA"},
+#ifdef ENABLE_CRYPTO_OPENSSL
+    {"DEFAULT", "DEFAULT"},
+    {"ALL", "ALL"},
+    {"HIGH", "HIGH"},
+    {"MEDIUM", "MEDIUM"},
+    {"LOW", "LOW"},
+    {"ECDH", "ECDH"},
+    {"ECDSA", "ECDSA"},
+    {"EDH", "EDH"},
+    {"EXP", "EXP"},
+    {"RSA", "RSA"},
+    {"SRP", "SRP"},
+#endif
     {NULL, NULL}
 };

Signature · 1 line

1.8.3.2

Steffan Karger

author

2014-03-01 14:36 UTC #5 lore raw

PATCH 2/2 Disable unsupported TLS cipher modes by default, cleans --show-tls output.

In reply to Steffan Karger

This explicitly disables a number of tls ciphers that OpenVPN has currently no support for. OpenSSL will automatically detect this during negotiation, but --show-tls would erroneously show a number of unsupported ciphers.

Signed-off-by Steffan Karger <[email protected]...>

---
 src/openvpn/ssl_openssl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

src/openvpn/ssl_openssl.c +2 -2

index f079652..c7531d9 100644
@@ -219,8 +219,8 @@ tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers)
 {
   if (ciphers == NULL)
     {
-      /* Use sane default */
-      if(!SSL_CTX_set_cipher_list(ctx->ctx, "DEFAULT:!EXP"))
+      /* Use sane default (disable export, and unsupported cipher modes) */
+      if(!SSL_CTX_set_cipher_list(ctx->ctx, "DEFAULT:!EXP:!PSK:!SRP"))
         msg(M_SSLERR, "Failed to set default TLS cipher list.");
       return;
     }

Signature · 1 line

1.8.3.2

Gert Doering

2014-03-01 15:34 UTC #8 lore raw

In reply to Steffan Karger

Hi,

Quoted 1 line · Steffan Karger

The following two (small) patches are usability improvements.

is this master-only, or does it make sense for 2.3 as well?

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

Steffan Karger

author

2014-03-01 21:09 UTC #9 lore raw

Hi,

Quoted 4 lines · Gert Doering

Quoted 1 line · Steffan Karger
The following two (small) patches are usability improvements.
is this master-only, or does it make sense for 2.3 as well?

Good point, I forgot to mention:
1/2 Makes sense for 2.3 too, 2.3 contains the same translation table and the patch will also suppress useless warnings.
2/2 Makes no sense for 2.3, 2.3 does not have the default cipher list.

-Steffan

Arne Schwabe

2014-03-23 13:35 UTC #2 lore raw

Re: [Openvpn-devel] [PATCH 1/2] Add openssl-specific common cipher list names to ssl.c.

In reply to Steffan Karger

Quoted 4 lines · Steffan Karger

This adds a number of commonly used cipher list names to ssl.c, which makes OpenVPN not give a "translation not found" warning when using these.

ACK.

Arne

Arne Schwabe

2014-03-23 13:35 UTC #6 lore raw

Re: [Openvpn-devel] [PATCH 2/2] Disable unsupported TLS cipher modes by default, cleans --show-tls output.

In reply to Steffan Karger

Quoted 5 lines · Steffan Karger

This explicitly disables a number of tls ciphers that OpenVPN has currently no support for. OpenSSL will automatically detect this during negotiation, but --show-tls would erroneously show a number of unsupported ciphers.

ACK.

Arne

Gert Doering

2014-03-23 21:13 UTC #3 lore raw

[Openvpn-devel] [PATCH applied] Re: Add openssl-specific common cipher list names to ssl.c.

In reply to Steffan Karger

Your patch has been applied to the master and release/2.3 branch.

commit 0146fd00c3bd70a470290be7be27ee75db2db63b (master) commit a39ceebc4f7cf05f07941556c9d11430cf855e22 (master)

Author: Steffan Karger
Date:   Sat Mar 1 15:36:14 2014 +0100

     Add openssl-specific common cipher list names to ssl.c.

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/8316
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

2014-03-23 21:13 UTC #7 lore raw

[Openvpn-devel] [PATCH applied] Re: Disable unsupported TLS cipher modes by default, cleans --show-tls output.

In reply to Steffan Karger

Your patch has been applied to the master branch.

commit f8c4e88280b060ee8aa77ac5d00133848689694b

Author: Steffan Karger
Date:   Sat Mar 1 15:36:15 2014 +0100

     Disable unsupported TLS cipher modes by default, cleans --show-tls output.

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/8318
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

2014-03-23 21:20 UTC #4 lore raw

Re: [Openvpn-devel] [PATCH applied] Re: Add openssl-specific common cipher list names to ssl.c.

In reply to Gert Doering

Hi,

Quoted 4 lines · Gert Doering

Your patch has been applied to the master and release/2.3 branch.
commit 0146fd00c3bd70a470290be7be27ee75db2db63b (master) commit a39ceebc4f7cf05f07941556c9d11430cf855e22 (master)

The second line should, obviously, have been "(release/2.3)". Too quick...

But the commit ID is right :-)

And now, a new episode of "watch buildbot burn"... *some* of these many patches pushed today might have actually fixed OpenSolaris' socket problems... let's see which buildbots had too old OpenSSL versions...

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...