19 months agoVersion bump to 5.9.2rc2 5.9.2rc2
Andreas Steffen [Sun, 21 Feb 2021 09:40:34 +0000 (10:40 +0100)]
Version bump to 5.9.2rc2

19 months agotesting: Use TLS 1.3 in TNC PT-TLS tests
Andreas Steffen [Sun, 21 Feb 2021 08:48:34 +0000 (09:48 +0100)]
testing: Use TLS 1.3 in TNC PT-TLS tests

19 months agotesting: Added mgf1 plugin to load statement
Andreas Steffen [Fri, 19 Feb 2021 16:41:44 +0000 (17:41 +0100)]
testing: Added mgf1 plugin to load statement

19 months agoMerge branch 'tls-fixes' 5.9.2rc1
Andreas Steffen [Thu, 18 Feb 2021 19:28:33 +0000 (20:28 +0100)]
Merge branch 'tls-fixes'

19 months agoVersion bump to 5.9.2rc1
Andreas Steffen [Wed, 17 Feb 2021 12:34:06 +0000 (13:34 +0100)]
Version bump to 5.9.2rc1

19 months agopt-tls-server: Make TLS client authentication optional as appropriate
Tobias Brunner [Thu, 18 Feb 2021 14:41:52 +0000 (15:41 +0100)]
pt-tls-server: Make TLS client authentication optional as appropriate

19 months agotls-test: Add option to make client authentication optional
Tobias Brunner [Thu, 18 Feb 2021 14:36:59 +0000 (15:36 +0100)]
tls-test: Add option to make client authentication optional

19 months agotls-server: Add flag that makes client authentication optional
Tobias Brunner [Thu, 18 Feb 2021 14:10:42 +0000 (15:10 +0100)]
tls-server: Add flag that makes client authentication optional

This allows clients to send an empty certificate payload if the server
sent a certificate request.  If an identity was set previously, it will
be reset so get_peer_id() may be used to check if the client was

19 months agolibtls: Add control flags and replace GENERIC_NULLOK purpose with one
Tobias Brunner [Thu, 18 Feb 2021 14:03:29 +0000 (15:03 +0100)]
libtls: Add control flags and replace GENERIC_NULLOK purpose with one

19 months agopt-tls-server: Explicitly request client authentication if necessary
Tobias Brunner [Thu, 18 Feb 2021 11:34:29 +0000 (12:34 +0100)]
pt-tls-server: Explicitly request client authentication if necessary

The PT_TLS_AUTH_TLS_OR_SASL case currently can't be implemented properly
as TLS authentication will be enforced if a client identity is configured
on the TLS server socket.

19 months agotls-server: Use subject DN as peer identity if it was ID_ANY
Tobias Brunner [Thu, 18 Feb 2021 11:31:17 +0000 (12:31 +0100)]
tls-server: Use subject DN as peer identity if it was ID_ANY

To request client authentication if we don't know the client's identity,
it's possible to use ID_ANY.  However, if we don't change the identity
get_peer_id() would still report ID_ANY after the authentication.

19 months agotesting: Adapt some checks as SHA-384 is now preferred for TLS signatures
Tobias Brunner [Thu, 18 Feb 2021 11:01:02 +0000 (12:01 +0100)]
testing: Adapt some checks as SHA-384 is now preferred for TLS signatures

19 months agotls-eap: Only servers conclude EAP method after processing packets
Tobias Brunner [Thu, 18 Feb 2021 09:46:56 +0000 (10:46 +0100)]
tls-eap: Only servers conclude EAP method after processing packets

As client with older TLS versions, we have to ack the receipt of the server's
Finished message instead.

Fixes: 083f38259c79 ("tls-eap: Conclude EAP method also after processing packets")

19 months agoike-sa: Properly set timing info for delete after rekeying
Stefan Berghofer [Thu, 18 Feb 2021 08:43:10 +0000 (09:43 +0100)]
ike-sa: Properly set timing info for delete after rekeying

The job is queued properly, yet the timing information is wrong.

Signed-off-by: Stefan Berghofer <>
Fixes: ee61471113c2 ("implemented RFC4478 (repeated authentication)...")

19 months agoNEWS: Add news for 5.9.2
Tobias Brunner [Wed, 17 Feb 2021 14:24:36 +0000 (15:24 +0100)]
NEWS: Add news for 5.9.2

19 months agodhcp: Properly initialize struct when binding to interface
Tobias Brunner [Tue, 16 Feb 2021 14:22:18 +0000 (15:22 +0100)]
dhcp: Properly initialize struct when binding to interface

19 months agopts: Don't rely on BIOS event buffer to be null terminated
Tobias Brunner [Tue, 16 Feb 2021 14:15:38 +0000 (15:15 +0100)]
pts: Don't rely on BIOS event buffer to be null terminated

19 months agotls-crypto: Fix potential memory leak
Tobias Brunner [Tue, 16 Feb 2021 13:50:50 +0000 (14:50 +0100)]
tls-crypto: Fix potential memory leak

Fixes: d8e42a3d4e3c ("tls-crypto: Share private key search between client and server")

19 months agoike-sa-manager: Ensure we were able to create a new IKE_SA
Tobias Brunner [Tue, 16 Feb 2021 13:43:52 +0000 (14:43 +0100)]
ike-sa-manager: Ensure we were able to create a new IKE_SA

This may happen if we are unable to allocate an SPI.

19 months agogithub: Bump wolfSSL to 4.7.0
Tobias Brunner [Tue, 16 Feb 2021 08:08:12 +0000 (09:08 +0100)]
github: Bump wolfSSL to 4.7.0

19 months agocirrus: Use FreeBSD 12.2
Fedor Korotkov [Mon, 15 Feb 2021 18:58:55 +0000 (13:58 -0500)]
cirrus: Use FreeBSD 12.2

This seems to fix the build with Autotools that recently started to fail

autom4te-2.69: need GNU m4 1.4 or later: /usr/local/bin/gm4
aclocal: error: /usr/local/bin/autom4te-2.69 failed with exit status: 1
autoreconf-2.69: aclocal failed with exit status: 1

Closes strongswan/strongswan#197.

19 months agogithub: Fix emojis in templates
Tobias Brunner [Mon, 15 Feb 2021 14:30:03 +0000 (15:30 +0100)]
github: Fix emojis in templates

19 months agogithub: Add security policy
Tobias Brunner [Thu, 21 Jan 2021 16:10:22 +0000 (17:10 +0100)]
github: Add security policy

19 months agogithub: Add issue templates
Tobias Brunner [Thu, 21 Jan 2021 15:19:25 +0000 (16:19 +0100)]
github: Add issue templates

19 months agobotan: Use strongSwan's RNG interface in Botan plugin
René Fischer [Fri, 22 Jan 2021 12:38:01 +0000 (13:38 +0100)]
botan: Use strongSwan's RNG interface in Botan plugin

This allows using rng_t implementations provided by other plugins to
serve as RNG for Botan.

Closes strongswan/strongswan#192.

19 months agobotan: Extract helper function to map RNG quality to Botan RNG names
Tobias Brunner [Fri, 29 Jan 2021 15:48:03 +0000 (16:48 +0100)]
botan: Extract helper function to map RNG quality to Botan RNG names

19 months agobotan: Look for Botan 3 in configure script
Tobias Brunner [Fri, 29 Jan 2021 15:45:02 +0000 (16:45 +0100)]
botan: Look for Botan 3 in configure script

19 months agoike-sa: Avoid possible integer underflow when scheduling reauth after rekeying
Tobias Brunner [Fri, 15 Jan 2021 15:19:49 +0000 (16:19 +0100)]
ike-sa: Avoid possible integer underflow when scheduling reauth after rekeying

If the reauthentication is scheduled while rekeying, the difference
might be negative, however, schedule_job() takes an unsigned int,
so the reauth would get scheduled very far in the future.

19 months agoha: Register new IKE_SAs before calling inherit_post()
Tobias Brunner [Fri, 15 Jan 2021 15:28:24 +0000 (16:28 +0100)]
ha: Register new IKE_SAs before calling inherit_post()

19 months agoike-rekey: Register new IKE_SA before calling inherit_post()
Tobias Brunner [Fri, 15 Jan 2021 15:25:54 +0000 (16:25 +0100)]
ike-rekey: Register new IKE_SA before calling inherit_post()

If rekeying and reauthetication coincided, the reauth job could get
scheduled to run immediately i.e. before checkin() was called.  So the
new IKE_SA would not get reauthenticated, however, the further delayed
delete job would later find the new IKE_SA and delete it.

19 months agoike-sa-manager: Add a method to register/check out new IKE_SAs
Tobias Brunner [Fri, 15 Jan 2021 15:09:59 +0000 (16:09 +0100)]
ike-sa-manager: Add a method to register/check out new IKE_SAs

This way, jobs for new IKE_SAs (created via create_new()) may be
scheduled/queued before checkin() is called.  If they run before
that happens, they will now correctly block in checkout() instead of
doing nothing because the IKE_SA was not found.

19 months agoike-sa-manager: Rename checkout_new() to create_new()
Tobias Brunner [Fri, 15 Jan 2021 15:08:20 +0000 (16:08 +0100)]
ike-sa-manager: Rename checkout_new() to create_new()

We don't actually check that SA out (i.e. it's not registered with the
manager).  That was originally different but had to be changed with
86993d6b9037 to avoid that SAs created for rekeying don't block other
threads on the manager.

19 months agoRemove redundant calls to set peer config after checking out IKE_SAs by config
Tobias Brunner [Fri, 15 Jan 2021 16:14:07 +0000 (17:14 +0100)]
Remove redundant calls to set peer config after checking out IKE_SAs by config

19 months agoike-sa-manager: Make checkout_by_config() atomic
Tobias Brunner [Tue, 17 Mar 2020 08:39:17 +0000 (09:39 +0100)]
ike-sa-manager: Make checkout_by_config() atomic

These changes should ensure that concurrent calls to checkout_by_config()
result in a single IKE_SA.  For instance, when acquires for different
children of the same connection are triggered concurrently.

There are two major changes to the interface:

 1) The peer config object is now always set on the returned IKE_SA.
    That was previously only the case if an existing IKE_SA was

 2) The IKE_SA is now always registered with the manager and properly
    checked out, which also was only the case for existing IKE_SAs

19 months agoMerge branch 'tls13'
Tobias Brunner [Fri, 12 Feb 2021 14:14:37 +0000 (15:14 +0100)]
Merge branch 'tls13'

This adds support for TLS 1.3 to libtls and adds several new features to
existing TLS versions (e.g. support for x25519/x448, EdDSA or RSA-PSS).

Unfortunately, TLS 1.3 is not really usable for TLS-based EAP methods in
practice because, in particular, key derivation is not yet standardized.
While it works between two strongSwan instances and even FreeRADIUS 3.0.21,
there will be compatibility issues in the future when implementations move
to a standardized scheme.  There are currently two Internet-Drafts in
development to specify that (see 121ac4b9e37e for details).  Until they are
more stable, the default maximum version is set to 1.2.

The default minimum version has also been increased to 1.2 and several
older/weaker cipher suites have been removed (e.g. with 3DES and MD5).

19 months agotls-crypto: Simplify and extend cipher config filter
Tobias Brunner [Thu, 11 Feb 2021 17:10:56 +0000 (18:10 +0100)]
tls-crypto: Simplify and extend cipher config filter

This way we automatically can filter for newer algorithms (e.g.

19 months agoproposal: Add aliases for AES-GCM/CCM without explicit ICV length
Tobias Brunner [Thu, 11 Feb 2021 17:06:49 +0000 (18:06 +0100)]
proposal: Add aliases for AES-GCM/CCM without explicit ICV length

These are mapped to use the default, maximum ICV length of 16 bytes.

19 months agotls-server: Support x25519/448 for TLS 1.2
Tobias Brunner [Thu, 11 Feb 2021 16:47:55 +0000 (17:47 +0100)]
tls-server: Support x25519/448 for TLS 1.2

19 months agotls-crypto: Fallback to any supported ECDH group
Tobias Brunner [Thu, 11 Feb 2021 16:46:17 +0000 (17:46 +0100)]
tls-crypto: Fallback to any supported ECDH group

If the default group listed in the cipher suite is not supported, we try
to use any other supported group (the groups are negotiated separately
so we are not locked in to a specific group).

19 months agotls-crypto: Don't filter suites with specific ECDH group if any is available
Tobias Brunner [Thu, 11 Feb 2021 16:09:04 +0000 (17:09 +0100)]
tls-crypto: Don't filter suites with specific ECDH group if any is available

Since DH groups (or with TLS < 1.3 curves) are negotiated separately,
it doesn't matter which one is listed in the cipher suite as any one could
be used.

19 months agodiffie-hellman: Classify x25519 and x448 as ECDH methods
Tobias Brunner [Thu, 11 Feb 2021 16:00:05 +0000 (17:00 +0100)]
diffie-hellman: Classify x25519 and x448 as ECDH methods

19 months agotls-crypto: Add signature scheme config file filter
Pascal Knecht [Mon, 1 Feb 2021 20:41:56 +0000 (21:41 +0100)]
tls-crypto: Add signature scheme config file filter

And add signature scheme unit tests.

19 months agotls-crypto: Rename DH group/key exchange method config option
Pascal Knecht [Mon, 18 Jan 2021 17:11:55 +0000 (18:11 +0100)]
tls-crypto: Rename DH group/key exchange method config option

TLS key exchange methods are now configured with `ke_group`.

19 months agolibtls: Increase default min version to 1.2
Tobias Brunner [Wed, 27 Jan 2021 13:40:22 +0000 (14:40 +0100)]
libtls: Increase default min version to 1.2

The older versions are generally considered deprecated (there is an
Internet-Draft that aims to do that formally).

19 months agotls-peer: Verify server selects the same cipher suite after HelloRetryRequest
Tobias Brunner [Fri, 22 Jan 2021 09:19:57 +0000 (10:19 +0100)]
tls-peer: Verify server selects the same cipher suite after HelloRetryRequest

This is as per RFC 8446, section 4.1.4.

19 months agotls-server: Select cipher suite also when handling HelloRetryRequest
Tobias Brunner [Fri, 22 Jan 2021 09:06:05 +0000 (10:06 +0100)]
tls-server: Select cipher suite also when handling HelloRetryRequest

This was previously treated like a resumption, which it is clearly not.
Also added a check that verifies that the same cipher suite is selected
during the retry, as per RFC 8446, section 4.1.4.

19 months agotls-server: Remove unused variable
Tobias Brunner [Fri, 22 Jan 2021 08:41:22 +0000 (09:41 +0100)]
tls-server: Remove unused variable

19 months agolibtls: Add downgrade protection for TLS 1.3 and TLS 1.2
Pascal Knecht [Sun, 17 Jan 2021 15:33:02 +0000 (16:33 +0100)]
libtls: Add downgrade protection for TLS 1.3 and TLS 1.2

Section 4.1.3 in RFC 8446 defines a new downgrade protection mechanism
that also affects TLS 1.2.

19 months agotls-server: Optionally omit CAs in CertificateRequest messages
Shmulik Ladkani [Fri, 15 Jan 2021 13:45:34 +0000 (14:45 +0100)]
tls-server: Optionally omit CAs in CertificateRequest messages

Usually, the DNs of all loaded CA certificates are included in the
CertificateRequest messages sent by the server.

Alas, certain EAP-TLS clients fail to process this message if the
list is too long, returning the fatal TLS alert 'illegal parameter'.

This new option allows configuring whether CAs are included or an
empty list is sent (TLS 1.2), or the certificate_authorities extension
is omitted (TLS 1.3).  The list only serves as hint/constraint
for clients during certificate selection, they still have to provide
a certificate but are free to select any one they have available.

Closes strongswan/strongswan#187.

19 months agotls-eap: Conclude EAP method also after processing packets
Tobias Brunner [Thu, 14 Jan 2021 17:02:00 +0000 (18:02 +0100)]
tls-eap: Conclude EAP method also after processing packets

With TLS 1.3, the server sends its Finished message first, so the
session is complete after processing the client's Finished message,
without having to send anything else (in particular no acknowledgement
as the last message from the client is no fragment).

19 months agolibtls: Only run socket tests with EdDSA keys if they are supported
Tobias Brunner [Thu, 14 Jan 2021 14:45:34 +0000 (15:45 +0100)]
libtls: Only run socket tests with EdDSA keys if they are supported

ECDSA support is currently required to run the tests because ECDSA
cipher suites are not filtered when determining the supported cipher
suites.  Also required are ECDH groups.

19 months agotls-peer: Don't log anything if we are not sending supported groups
Tobias Brunner [Thu, 14 Jan 2021 15:14:47 +0000 (16:14 +0100)]
tls-peer: Don't log anything if we are not sending supported groups

19 months agotls-crypto: Only log modified TLS versions if successfully set
Tobias Brunner [Thu, 14 Jan 2021 14:11:13 +0000 (15:11 +0100)]
tls-crypto: Only log modified TLS versions if successfully set

If no cipher suites are available, the new versions are the previous
values but reversed (i.e. the versions were not changed but we still
ended up with a log message saying "TLS min/max TLS 1.3/TLS 1.0 ...").

Also switched to using the numeric version names to avoid the repeated
"TLS" prefix.

19 months agolibtls: Reduce default max version to 1.2
Tobias Brunner [Wed, 13 Jan 2021 14:26:33 +0000 (15:26 +0100)]
libtls: Reduce default max version to 1.2

Using TLS 1.3 with various EAP methods is not yet fully standardized, so we
don't enable it by default yet.

19 months agolibtls: Make min/max TLS version configurable
Tobias Brunner [Wed, 13 Jan 2021 13:40:40 +0000 (14:40 +0100)]
libtls: Make min/max TLS version configurable

Except for the tls_test tool, the versions now default to those
configured in strongswan.conf.

19 months agotest-hkdf: Add two test cases and restructure all tests
Pascal Knecht [Sun, 22 Nov 2020 20:37:37 +0000 (21:37 +0100)]
test-hkdf: Add two test cases and restructure all tests

RFC 8448 contains multiple TLS 1.3 message traces, this commit adds two
new test cases focusing on key derivation:

- Simple 1-RTT Handshake
- Resumed 0-RTT Handshake

Additionally, the whole test suite is restructured and duplicate code is
removed and consolidated.

19 months agotls-hkdf: Implement binder PSK generation
Pascal Knecht [Fri, 4 Dec 2020 18:01:00 +0000 (19:01 +0100)]
tls-hkdf: Implement binder PSK generation

19 months agotls-hkdf: Implement resumption key generation
Pascal Knecht [Sun, 22 Nov 2020 20:30:45 +0000 (21:30 +0100)]
tls-hkdf: Implement resumption key generation

19 months agotls-peer: Mutual authentication support for TLS 1.3
Pascal Knecht [Tue, 10 Nov 2020 13:50:59 +0000 (14:50 +0100)]
tls-peer: Mutual authentication support for TLS 1.3

19 months agotls-peer: Derive application traffic keys after server finished message
Pascal Knecht [Tue, 10 Nov 2020 13:44:51 +0000 (14:44 +0100)]
tls-peer: Derive application traffic keys after server finished message

The inbound key is used right away, the outbound key only after the
client finished message has been sent.

19 months agotls-peer: Use private key enumeration also in TLS versions < 1.2
Pascal Knecht [Tue, 17 Nov 2020 16:54:55 +0000 (17:54 +0100)]
tls-peer: Use private key enumeration also in TLS versions < 1.2

Until now, key selection was based on tls_client_certificate_type_t and now
uses a simple mapping from these types to tls_signature_scheme_t.

19 months agotls-crypto: Share private key search between client and server
Pascal Knecht [Tue, 10 Nov 2020 09:22:12 +0000 (10:22 +0100)]
tls-crypto: Share private key search between client and server

This way the client also properly considers the TLS version and the signature
schemes supported by the server.

Co-authored-by: Tobias Brunner <>
19 months agotls-test: Add support to require/verify client certificates
Pascal Knecht [Sun, 1 Nov 2020 15:39:00 +0000 (16:39 +0100)]
tls-test: Add support to require/verify client certificates

Also add detailed usage output with description of all options.

19 months agotls-server: Mutual authentication support for TLS 1.3
Pascal Knecht [Fri, 30 Oct 2020 14:15:30 +0000 (15:15 +0100)]
tls-server: Mutual authentication support for TLS 1.3

This commit also addresses the side effect that additional messages have
an influence on the derivation of the application traffic secrets. Therefore,
key derivation is relocated after the server finished message has been sent,
so the additional messages from the client (Certificate, CertificateVerify)
don't affect the key derivation. Only the outbound key is switched there, the
inbound key remains in use until the client's finished message has been

19 months agotls-server: Terminate connection if peer certificate is required but not sent
Pascal Knecht [Wed, 4 Nov 2020 12:07:49 +0000 (13:07 +0100)]
tls-server: Terminate connection if peer certificate is required but not sent

This change mainly affects legacy TLS versions because TLS 1.3
connections are terminated by the server once the peer does not send a
CertificateVerify message next to its empty Certificate message.

19 months agotls-server: Make CertificateRequest conditional in old TLS versions
Pascal Knecht [Wed, 4 Nov 2020 11:22:58 +0000 (12:22 +0100)]
tls-server: Make CertificateRequest conditional in old TLS versions

The server implementation now only sends a CertificateRequest message if
it has identity information to verify client certificates.

19 months agotls-server: Share trusted public key search between client and server
Pascal Knecht [Sun, 1 Nov 2020 16:01:14 +0000 (17:01 +0100)]
tls-server: Share trusted public key search between client and server

19 months agotls-crypto: Move AEAD ownership to the protection layer
Pascal Knecht [Wed, 28 Oct 2020 20:54:09 +0000 (21:54 +0100)]
tls-crypto: Move AEAD ownership to the protection layer

This separates key derivation from key switching.

19 months agotls-hkdf: Always use correct base key to derive finished message
Pascal Knecht [Sun, 8 Nov 2020 14:34:39 +0000 (15:34 +0100)]
tls-hkdf: Always use correct base key to derive finished message

The cached traffic secrets change once the application traffic secrets
are derived, but we must always use the correct base key to derive the
finished message, which are the handshake traffic secrets (RFC 8446,
section 4.4).

19 months agolibtls: Add unit tests for Ed25519 and Ed448 keys
Pascal Knecht [Fri, 23 Oct 2020 20:56:03 +0000 (22:56 +0200)]
libtls: Add unit tests for Ed25519 and Ed448 keys

TLS 1.0 to TLS 1.3 socket connection tests with each key type.

19 months agotls-test: Load keys of any type
Pascal Knecht [Fri, 23 Oct 2020 14:01:03 +0000 (16:01 +0200)]
tls-test: Load keys of any type

Only RSA keys were possible until now.

19 months agotls-crypto: Support EdDSA keys with ECDSA cipher suites
Pascal Knecht [Fri, 23 Oct 2020 14:17:16 +0000 (16:17 +0200)]
tls-crypto: Support EdDSA keys with ECDSA cipher suites

Ed25519 and Ed448 are now usable in all TLS versions for connections that
use an ECDSA cipher suite, as per RFC 8422.

19 months agotls-server: Consider supported signature algorithms when selecting key/certificate
Pascal Knecht [Mon, 12 Oct 2020 16:58:53 +0000 (18:58 +0200)]
tls-server: Consider supported signature algorithms when selecting key/certificate

This won't work if the client doesn't send a `signature_algorithms`
extension.  But since the default is SHA1/RSA, most will send it to at
least announce stronger hash algorithms if not ECDSA.

19 months agotls-crypto: Distinguish between signing and verifying signature schemes
Pascal Knecht [Tue, 13 Oct 2020 11:54:38 +0000 (13:54 +0200)]
tls-crypto: Distinguish between signing and verifying signature schemes

strongSwan supports RSA_PSS_RSAE schemes for signing but does not
differentiate between rsaEncryption and rsassaPss encoding. Thus
RSA_PSS_PSS schemes are only used for verifying signatures.

19 months agotls-server: Check if peer sent hash and signature algorithms
Pascal Knecht [Fri, 16 Oct 2020 07:28:49 +0000 (09:28 +0200)]
tls-server: Check if peer sent hash and signature algorithms

It is mandatory to receive the `signature_algorithms` extension when a
server is authenticating with a certificate, which is always the case.

19 months agotls-crypto: Add missing signature scheme constants
Pascal Knecht [Sat, 10 Oct 2020 15:10:37 +0000 (17:10 +0200)]
tls-crypto: Add missing signature scheme constants

Some peers, e.g. Firefox, send a wide range of signature algorithms. To
prevent numeric identifiers in the log these algorithms are added here.

19 months agotls-server: Fix invalid signature algorithm and supported groups parsing
Pascal Knecht [Fri, 9 Oct 2020 17:14:11 +0000 (19:14 +0200)]
tls-server: Fix invalid signature algorithm and supported groups parsing

The extension's content length field was wrongly added to the content data.

Fixes: 06109c4717 ("Implemented "signature algorithm" hello extension")

19 months agotls-server: Support multiple client key shares
Pascal Knecht [Fri, 2 Oct 2020 16:11:45 +0000 (18:11 +0200)]
tls-server: Support multiple client key shares

A client can send one or multiple key shares from which the server picks
one it supports (checked in its preferred order).  A retry is requested if
none of the key shares are supported.

19 months agolibtls: Add TLS version negotiation test cases
Pascal Knecht [Tue, 29 Sep 2020 12:15:19 +0000 (14:15 +0200)]
libtls: Add TLS version negotiation test cases

These client to server negotiation test cases are implemented:
- TLS 1.0 => TLS 1.3
- TLS 1.1 => TLS 1.3
- TLS 1.2 => TLS 1.3
- TLS 1.3 => TLS 1.3

- TLS 1.3 => TLS 1.0
- TLS 1.3 => TLS 1.1
- TLS 1.3 => TLS 1.2
- TLS 1.3 => TLS 1.3

- TLS 1.0 => TLS 1.2
- TLS 1.1 => TLS 1.2
- TLS 1.2 => TLS 1.2
- TLS 1.3 => TLS 1.2

19 months agotls-server: Support HelloRetryRequest (HRR)
Pascal Knecht [Sat, 26 Sep 2020 11:17:43 +0000 (13:17 +0200)]
tls-server: Support HelloRetryRequest (HRR)

Adds support to request and handle retries with a different DH group.

Only the first key share extension sent by the client is currently
considered, so this might result in protocol errors if the server requests
a group for which the client already sent a key share.

19 months agotls-crypto: Add support to configure DH groups to use
Pascal Knecht [Sat, 26 Sep 2020 20:19:16 +0000 (22:19 +0200)]
tls-crypto: Add support to configure DH groups to use

And add new test cases to test TLS 1.3 connections for each supported DH

19 months agodiffie-hellman: Add enum names that match proposal keywords
Tobias Brunner [Wed, 27 Jan 2021 13:35:37 +0000 (14:35 +0100)]
diffie-hellman: Add enum names that match proposal keywords

19 months agotls-crypto: Generalizing DH group to TLS group mapping
Pascal Knecht [Wed, 30 Sep 2020 12:57:14 +0000 (14:57 +0200)]
tls-crypto: Generalizing DH group to TLS group mapping

This simplifies writing the key share extension as the TLS group does
not have to be cached.

19 months agotls-server: Support KeyUpdate requests and answers
Pascal Knecht [Sun, 27 Sep 2020 14:43:08 +0000 (16:43 +0200)]
tls-server: Support KeyUpdate requests and answers

19 months agotls-server: Refactor writing of key share extensions
Pascal Knecht [Mon, 21 Sep 2020 20:19:34 +0000 (22:19 +0200)]
tls-server: Refactor writing of key share extensions

Client and server now share the same code to write this extension.

19 months agotls-server: TLS 1.3 support for TLS server implementation
Pascal Knecht [Tue, 8 Sep 2020 13:58:14 +0000 (15:58 +0200)]
tls-server: TLS 1.3 support for TLS server implementation

Add basic support to establish a TLS 1.3 connection with a client capable
of the same protocol version.

19 months agotls-crypto: Rename parameter to be more consistent
Pascal Knecht [Wed, 16 Sep 2020 12:10:57 +0000 (14:10 +0200)]
tls-crypto: Rename parameter to be more consistent

Also add missing parameter in documentation of calculate_finished method.

19 months agotls-crypto: Fix invalid signature algorithm list building
Pascal Knecht [Wed, 16 Sep 2020 06:54:54 +0000 (08:54 +0200)]
tls-crypto: Fix invalid signature algorithm list building

List building also added an additional length field which is required by
client-side TLS extensions but not for server-side certificate request
extension. Now the method only returns a list of supported signature
algorithms and the implementation is responsible to add additional
length fields.

Fixes: 07f826af673d ("Fixed encoding of TLS extensions (elliptic_curves and signature_algorithms)")

19 months agolibtls: Add missing cipher suite and TLS extension constants
Pascal Knecht [Tue, 15 Sep 2020 14:08:08 +0000 (16:08 +0200)]
libtls: Add missing cipher suite and TLS extension constants


- Encrypt then MAC
- Extended master secret
- Session ticket

and also add missing suites in the unit test.

19 months agotls-crypto: Rework cipher suite preference order
Pascal Knecht [Fri, 4 Sep 2020 17:36:40 +0000 (19:36 +0200)]
tls-crypto: Rework cipher suite preference order

The reworked list follows the order of modern browsers such as
Firefox. The new order prefers more secure ciphers over weaker ones.

19 months agotls-server: Determine supported/configured suites and versions early
Tobias Brunner [Thu, 19 Nov 2020 13:40:30 +0000 (14:40 +0100)]
tls-server: Determine supported/configured suites and versions early

If we don't do this, we might negotiate a TLS version for which we don't
have any suites configured, so that the cipher suite negotiation
subsequently fails.

19 months agotls-crypto: Check if TLS versions and cipher suites match
Pascal Knecht [Fri, 4 Sep 2020 16:29:43 +0000 (18:29 +0200)]
tls-crypto: Check if TLS versions and cipher suites match

Only suggest TLS versions of supported cipher suites.  For instance, do not
suggest TLS 1.3 if none of its cipher suites (requiring GCM/CCM or
ChaPoly) are available.

19 months agotls-peer: Don't initiate TLS connection if no cipher suites are supported
Pascal Knecht [Thu, 3 Sep 2020 19:53:52 +0000 (21:53 +0200)]
tls-peer: Don't initiate TLS connection if no cipher suites are supported

If zero cipher suites are left after all filters, tls-peer does not
try to establish a connection to the server anymore.

19 months agotls-test: Make plugin list configurable via environment variable
Tobias Brunner [Thu, 3 Sep 2020 13:56:14 +0000 (15:56 +0200)]
tls-test: Make plugin list configurable via environment variable

19 months agotls-peer: Return INVALID_STATE after changing TLS 1.3 keys
Tobias Brunner [Tue, 1 Sep 2020 16:59:17 +0000 (18:59 +0200)]
tls-peer: Return INVALID_STATE after changing TLS 1.3 keys

Even though we return from build(), we are not actually sending a response,
so we can't return NEED_MORE (would send an invalid ClientHello message) and
if we return SUCCESS, the EAP layer treats this as failure (there is a comment
in eap_authenticator_t about client methods never returning SUCCESS from
process()).  Instead we return INVALID_STATE, which allows to
exit from the build() loop immediately and send the already generated Finished

19 months agotls-crypto: Generate MSK for TLS 1.3
Tobias Brunner [Tue, 1 Sep 2020 16:51:32 +0000 (18:51 +0200)]
tls-crypto: Generate MSK for TLS 1.3

We generate material for both MSK and EMSK even though we only need the
former.  Because HKDF-Expand-Label(), on which the export functionality
is based, encodes the requested key length, we have to allocate the same
number of bytes as e.g. FreeRADIUS does (i.e. if we only request 64
bytes, those won't be the same as the first 64 bytes after requesting
128 bytes).

Unfortunately, key derivation for TLS-based methods is currently not
standardized for TLS 1.3.  There is a draft [1], which defines a scheme
that's different from previous versions (instead of individual label
strings it uses a single one and passes the EAP type/code as context
value to TLS-Export()).  The current code is compatible to FreeRADIUS
3.0.x, which doesn't implement it according to that draft yet (there are
unreleased changes for EAP-TLS, not for the other methods, but these only
switch the label, no context value is passed).  In a separate draft
for EAP-TLS [2] there is an altogether different scheme defined in the
latest version (label combined with EAP method, no context and separate
derivation for MSK and EMSK).

So this is a mess and we will have to change this later with the inevitable
compatibility issues (we should definitely disable TLS 1.3 by default).


19 months agotls-hkdf: Add method that allows exporting key material
Tobias Brunner [Tue, 1 Sep 2020 16:50:47 +0000 (18:50 +0200)]
tls-hkdf: Add method that allows exporting key material

19 months agotls-hkdf: Handle label expansion inside expand_label()
Tobias Brunner [Tue, 1 Sep 2020 16:48:41 +0000 (18:48 +0200)]
tls-hkdf: Handle label expansion inside expand_label()

We have to expand arbitrary external labels the same way when exporting
key material.

19 months agotls-hkdf: Pass secret to derive_secret() explicitly
Tobias Brunner [Tue, 1 Sep 2020 16:35:02 +0000 (18:35 +0200)]
tls-hkdf: Pass secret to derive_secret() explicitly

19 months agotls-hkdf: Store OKM in local variables
Tobias Brunner [Mon, 31 Aug 2020 15:08:07 +0000 (17:08 +0200)]
tls-hkdf: Store OKM in local variables