18 months agotls-hkdf: Implement binder PSK generation
Pascal Knecht [Fri, 4 Dec 2020 18:01:00 +0000 (19:01 +0100)]
tls-hkdf: Implement binder PSK generation

18 months agotls-hkdf: Implement resumption key generation
Pascal Knecht [Sun, 22 Nov 2020 20:30:45 +0000 (21:30 +0100)]
tls-hkdf: Implement resumption key generation

18 months agotls-peer: Mutual authentication support for TLS 1.3
Pascal Knecht [Tue, 10 Nov 2020 13:50:59 +0000 (14:50 +0100)]
tls-peer: Mutual authentication support for TLS 1.3

18 months agotls-peer: Derive application traffic keys after server finished message
Pascal Knecht [Tue, 10 Nov 2020 13:44:51 +0000 (14:44 +0100)]
tls-peer: Derive application traffic keys after server finished message

The inbound key is used right away, the outbound key only after the
client finished message has been sent.

18 months agotls-peer: Use private key enumeration also in TLS versions < 1.2
Pascal Knecht [Tue, 17 Nov 2020 16:54:55 +0000 (17:54 +0100)]
tls-peer: Use private key enumeration also in TLS versions < 1.2

Until now, key selection was based on tls_client_certificate_type_t and now
uses a simple mapping from these types to tls_signature_scheme_t.

18 months agotls-crypto: Share private key search between client and server
Pascal Knecht [Tue, 10 Nov 2020 09:22:12 +0000 (10:22 +0100)]
tls-crypto: Share private key search between client and server

This way the client also properly considers the TLS version and the signature
schemes supported by the server.

Co-authored-by: Tobias Brunner <>
18 months agotls-test: Add support to require/verify client certificates
Pascal Knecht [Sun, 1 Nov 2020 15:39:00 +0000 (16:39 +0100)]
tls-test: Add support to require/verify client certificates

Also add detailed usage output with description of all options.

18 months agotls-server: Mutual authentication support for TLS 1.3
Pascal Knecht [Fri, 30 Oct 2020 14:15:30 +0000 (15:15 +0100)]
tls-server: Mutual authentication support for TLS 1.3

This commit also addresses the side effect that additional messages have
an influence on the derivation of the application traffic secrets. Therefore,
key derivation is relocated after the server finished message has been sent,
so the additional messages from the client (Certificate, CertificateVerify)
don't affect the key derivation. Only the outbound key is switched there, the
inbound key remains in use until the client's finished message has been

18 months agotls-server: Terminate connection if peer certificate is required but not sent
Pascal Knecht [Wed, 4 Nov 2020 12:07:49 +0000 (13:07 +0100)]
tls-server: Terminate connection if peer certificate is required but not sent

This change mainly affects legacy TLS versions because TLS 1.3
connections are terminated by the server once the peer does not send a
CertificateVerify message next to its empty Certificate message.

18 months agotls-server: Make CertificateRequest conditional in old TLS versions
Pascal Knecht [Wed, 4 Nov 2020 11:22:58 +0000 (12:22 +0100)]
tls-server: Make CertificateRequest conditional in old TLS versions

The server implementation now only sends a CertificateRequest message if
it has identity information to verify client certificates.

18 months agotls-server: Share trusted public key search between client and server
Pascal Knecht [Sun, 1 Nov 2020 16:01:14 +0000 (17:01 +0100)]
tls-server: Share trusted public key search between client and server

18 months agotls-crypto: Move AEAD ownership to the protection layer
Pascal Knecht [Wed, 28 Oct 2020 20:54:09 +0000 (21:54 +0100)]
tls-crypto: Move AEAD ownership to the protection layer

This separates key derivation from key switching.

18 months agotls-hkdf: Always use correct base key to derive finished message
Pascal Knecht [Sun, 8 Nov 2020 14:34:39 +0000 (15:34 +0100)]
tls-hkdf: Always use correct base key to derive finished message

The cached traffic secrets change once the application traffic secrets
are derived, but we must always use the correct base key to derive the
finished message, which are the handshake traffic secrets (RFC 8446,
section 4.4).

18 months agolibtls: Add unit tests for Ed25519 and Ed448 keys
Pascal Knecht [Fri, 23 Oct 2020 20:56:03 +0000 (22:56 +0200)]
libtls: Add unit tests for Ed25519 and Ed448 keys

TLS 1.0 to TLS 1.3 socket connection tests with each key type.

18 months agotls-test: Load keys of any type
Pascal Knecht [Fri, 23 Oct 2020 14:01:03 +0000 (16:01 +0200)]
tls-test: Load keys of any type

Only RSA keys were possible until now.

18 months agotls-crypto: Support EdDSA keys with ECDSA cipher suites
Pascal Knecht [Fri, 23 Oct 2020 14:17:16 +0000 (16:17 +0200)]
tls-crypto: Support EdDSA keys with ECDSA cipher suites

Ed25519 and Ed448 are now usable in all TLS versions for connections that
use an ECDSA cipher suite, as per RFC 8422.

18 months agotls-server: Consider supported signature algorithms when selecting key/certificate
Pascal Knecht [Mon, 12 Oct 2020 16:58:53 +0000 (18:58 +0200)]
tls-server: Consider supported signature algorithms when selecting key/certificate

This won't work if the client doesn't send a `signature_algorithms`
extension.  But since the default is SHA1/RSA, most will send it to at
least announce stronger hash algorithms if not ECDSA.

18 months agotls-crypto: Distinguish between signing and verifying signature schemes
Pascal Knecht [Tue, 13 Oct 2020 11:54:38 +0000 (13:54 +0200)]
tls-crypto: Distinguish between signing and verifying signature schemes

strongSwan supports RSA_PSS_RSAE schemes for signing but does not
differentiate between rsaEncryption and rsassaPss encoding. Thus
RSA_PSS_PSS schemes are only used for verifying signatures.

18 months agotls-server: Check if peer sent hash and signature algorithms
Pascal Knecht [Fri, 16 Oct 2020 07:28:49 +0000 (09:28 +0200)]
tls-server: Check if peer sent hash and signature algorithms

It is mandatory to receive the `signature_algorithms` extension when a
server is authenticating with a certificate, which is always the case.

18 months agotls-crypto: Add missing signature scheme constants
Pascal Knecht [Sat, 10 Oct 2020 15:10:37 +0000 (17:10 +0200)]
tls-crypto: Add missing signature scheme constants

Some peers, e.g. Firefox, send a wide range of signature algorithms. To
prevent numeric identifiers in the log these algorithms are added here.

18 months agotls-server: Fix invalid signature algorithm and supported groups parsing
Pascal Knecht [Fri, 9 Oct 2020 17:14:11 +0000 (19:14 +0200)]
tls-server: Fix invalid signature algorithm and supported groups parsing

The extension's content length field was wrongly added to the content data.

Fixes: 06109c4717 ("Implemented "signature algorithm" hello extension")

18 months agotls-server: Support multiple client key shares
Pascal Knecht [Fri, 2 Oct 2020 16:11:45 +0000 (18:11 +0200)]
tls-server: Support multiple client key shares

A client can send one or multiple key shares from which the server picks
one it supports (checked in its preferred order).  A retry is requested if
none of the key shares are supported.

18 months agolibtls: Add TLS version negotiation test cases
Pascal Knecht [Tue, 29 Sep 2020 12:15:19 +0000 (14:15 +0200)]
libtls: Add TLS version negotiation test cases

These client to server negotiation test cases are implemented:
- TLS 1.0 => TLS 1.3
- TLS 1.1 => TLS 1.3
- TLS 1.2 => TLS 1.3
- TLS 1.3 => TLS 1.3

- TLS 1.3 => TLS 1.0
- TLS 1.3 => TLS 1.1
- TLS 1.3 => TLS 1.2
- TLS 1.3 => TLS 1.3

- TLS 1.0 => TLS 1.2
- TLS 1.1 => TLS 1.2
- TLS 1.2 => TLS 1.2
- TLS 1.3 => TLS 1.2

18 months agotls-server: Support HelloRetryRequest (HRR)
Pascal Knecht [Sat, 26 Sep 2020 11:17:43 +0000 (13:17 +0200)]
tls-server: Support HelloRetryRequest (HRR)

Adds support to request and handle retries with a different DH group.

Only the first key share extension sent by the client is currently
considered, so this might result in protocol errors if the server requests
a group for which the client already sent a key share.

18 months agotls-crypto: Add support to configure DH groups to use
Pascal Knecht [Sat, 26 Sep 2020 20:19:16 +0000 (22:19 +0200)]
tls-crypto: Add support to configure DH groups to use

And add new test cases to test TLS 1.3 connections for each supported DH

18 months agodiffie-hellman: Add enum names that match proposal keywords
Tobias Brunner [Wed, 27 Jan 2021 13:35:37 +0000 (14:35 +0100)]
diffie-hellman: Add enum names that match proposal keywords

18 months agotls-crypto: Generalizing DH group to TLS group mapping
Pascal Knecht [Wed, 30 Sep 2020 12:57:14 +0000 (14:57 +0200)]
tls-crypto: Generalizing DH group to TLS group mapping

This simplifies writing the key share extension as the TLS group does
not have to be cached.

18 months agotls-server: Support KeyUpdate requests and answers
Pascal Knecht [Sun, 27 Sep 2020 14:43:08 +0000 (16:43 +0200)]
tls-server: Support KeyUpdate requests and answers

18 months agotls-server: Refactor writing of key share extensions
Pascal Knecht [Mon, 21 Sep 2020 20:19:34 +0000 (22:19 +0200)]
tls-server: Refactor writing of key share extensions

Client and server now share the same code to write this extension.

18 months agotls-server: TLS 1.3 support for TLS server implementation
Pascal Knecht [Tue, 8 Sep 2020 13:58:14 +0000 (15:58 +0200)]
tls-server: TLS 1.3 support for TLS server implementation

Add basic support to establish a TLS 1.3 connection with a client capable
of the same protocol version.

18 months agotls-crypto: Rename parameter to be more consistent
Pascal Knecht [Wed, 16 Sep 2020 12:10:57 +0000 (14:10 +0200)]
tls-crypto: Rename parameter to be more consistent

Also add missing parameter in documentation of calculate_finished method.

18 months agotls-crypto: Fix invalid signature algorithm list building
Pascal Knecht [Wed, 16 Sep 2020 06:54:54 +0000 (08:54 +0200)]
tls-crypto: Fix invalid signature algorithm list building

List building also added an additional length field which is required by
client-side TLS extensions but not for server-side certificate request
extension. Now the method only returns a list of supported signature
algorithms and the implementation is responsible to add additional
length fields.

Fixes: 07f826af673d ("Fixed encoding of TLS extensions (elliptic_curves and signature_algorithms)")

18 months agolibtls: Add missing cipher suite and TLS extension constants
Pascal Knecht [Tue, 15 Sep 2020 14:08:08 +0000 (16:08 +0200)]
libtls: Add missing cipher suite and TLS extension constants


- Encrypt then MAC
- Extended master secret
- Session ticket

and also add missing suites in the unit test.

18 months agotls-crypto: Rework cipher suite preference order
Pascal Knecht [Fri, 4 Sep 2020 17:36:40 +0000 (19:36 +0200)]
tls-crypto: Rework cipher suite preference order

The reworked list follows the order of modern browsers such as
Firefox. The new order prefers more secure ciphers over weaker ones.

18 months agotls-server: Determine supported/configured suites and versions early
Tobias Brunner [Thu, 19 Nov 2020 13:40:30 +0000 (14:40 +0100)]
tls-server: Determine supported/configured suites and versions early

If we don't do this, we might negotiate a TLS version for which we don't
have any suites configured, so that the cipher suite negotiation
subsequently fails.

18 months agotls-crypto: Check if TLS versions and cipher suites match
Pascal Knecht [Fri, 4 Sep 2020 16:29:43 +0000 (18:29 +0200)]
tls-crypto: Check if TLS versions and cipher suites match

Only suggest TLS versions of supported cipher suites.  For instance, do not
suggest TLS 1.3 if none of its cipher suites (requiring GCM/CCM or
ChaPoly) are available.

18 months agotls-peer: Don't initiate TLS connection if no cipher suites are supported
Pascal Knecht [Thu, 3 Sep 2020 19:53:52 +0000 (21:53 +0200)]
tls-peer: Don't initiate TLS connection if no cipher suites are supported

If zero cipher suites are left after all filters, tls-peer does not
try to establish a connection to the server anymore.

18 months agotls-test: Make plugin list configurable via environment variable
Tobias Brunner [Thu, 3 Sep 2020 13:56:14 +0000 (15:56 +0200)]
tls-test: Make plugin list configurable via environment variable

18 months agotls-peer: Return INVALID_STATE after changing TLS 1.3 keys
Tobias Brunner [Tue, 1 Sep 2020 16:59:17 +0000 (18:59 +0200)]
tls-peer: Return INVALID_STATE after changing TLS 1.3 keys

Even though we return from build(), we are not actually sending a response,
so we can't return NEED_MORE (would send an invalid ClientHello message) and
if we return SUCCESS, the EAP layer treats this as failure (there is a comment
in eap_authenticator_t about client methods never returning SUCCESS from
process()).  Instead we return INVALID_STATE, which allows to
exit from the build() loop immediately and send the already generated Finished

18 months agotls-crypto: Generate MSK for TLS 1.3
Tobias Brunner [Tue, 1 Sep 2020 16:51:32 +0000 (18:51 +0200)]
tls-crypto: Generate MSK for TLS 1.3

We generate material for both MSK and EMSK even though we only need the
former.  Because HKDF-Expand-Label(), on which the export functionality
is based, encodes the requested key length, we have to allocate the same
number of bytes as e.g. FreeRADIUS does (i.e. if we only request 64
bytes, those won't be the same as the first 64 bytes after requesting
128 bytes).

Unfortunately, key derivation for TLS-based methods is currently not
standardized for TLS 1.3.  There is a draft [1], which defines a scheme
that's different from previous versions (instead of individual label
strings it uses a single one and passes the EAP type/code as context
value to TLS-Export()).  The current code is compatible to FreeRADIUS
3.0.x, which doesn't implement it according to that draft yet (there are
unreleased changes for EAP-TLS, not for the other methods, but these only
switch the label, no context value is passed).  In a separate draft
for EAP-TLS [2] there is an altogether different scheme defined in the
latest version (label combined with EAP method, no context and separate
derivation for MSK and EMSK).

So this is a mess and we will have to change this later with the inevitable
compatibility issues (we should definitely disable TLS 1.3 by default).


18 months agotls-hkdf: Add method that allows exporting key material
Tobias Brunner [Tue, 1 Sep 2020 16:50:47 +0000 (18:50 +0200)]
tls-hkdf: Add method that allows exporting key material

18 months agotls-hkdf: Handle label expansion inside expand_label()
Tobias Brunner [Tue, 1 Sep 2020 16:48:41 +0000 (18:48 +0200)]
tls-hkdf: Handle label expansion inside expand_label()

We have to expand arbitrary external labels the same way when exporting
key material.

18 months agotls-hkdf: Pass secret to derive_secret() explicitly
Tobias Brunner [Tue, 1 Sep 2020 16:35:02 +0000 (18:35 +0200)]
tls-hkdf: Pass secret to derive_secret() explicitly

18 months agotls-hkdf: Store OKM in local variables
Tobias Brunner [Mon, 31 Aug 2020 15:08:07 +0000 (17:08 +0200)]
tls-hkdf: Store OKM in local variables

18 months agotls-crypto: Add support for RSA-PSS signatures
Tobias Brunner [Fri, 28 Aug 2020 06:59:37 +0000 (08:59 +0200)]
tls-crypto: Add support for RSA-PSS signatures

PKCS#1 v1.5 signatures are not defined for use with TLS 1.3 (they can
only appear in certificates, we now send a signature_algorithms_cert
extension to indicate support for them).  So for RSA certificates, we
must support RSA-PSS signatures.

There are two sets of schemes, that are differentiated by the type of
RSA key used for the signature, one is for classic RSA keys (rsaEncryption
OID), which can also be used with PKCS#1 when using TLS 1.2, the other
is for RSA-PSS keys (RSASSA-PSS OID), which are not yet commonly
used (and can't be generated by our pki tool).  According to the RFC,
PSS must also be supported for TLS 1.2 if the schemes are included in
the signature_algorithms extension (e.g. OpenSSL does not use PKCS#1 v1.5
anymore if PSS is proposed).

This changes how these schemes are stored and enumerated (they are not
treated as combination of hash algo and key type anymore).

Legacy schemes (MD5/SHA-1) are removed.

18 months agotls-peer: Support answering KeyUpdate requests
Tobias Brunner [Fri, 28 Aug 2020 08:23:43 +0000 (10:23 +0200)]
tls-peer: Support answering KeyUpdate requests

18 months agotls-socket: Change how EOF of the underlying socket is handled
Tobias Brunner [Fri, 28 Aug 2020 09:56:36 +0000 (11:56 +0200)]
tls-socket: Change how EOF of the underlying socket is handled

With the previous code, there was an issue when replying to TLS 1.3
post-handshake messages.  In this case, SUCCESS is eventually returned
from build(), however, no actual data has been received so in_done is 0.
This was interpreted as EOF, plain_eof was set to TRUE and no further data
was read from the socket afterwards.

Returning SUCCESS from build() if the exchange is initiated by
write_(), as is the case with the finished reply, never was a problem
because there the return value of 0 is not interpreted as EOF.

18 months agotls-peer: Add support to handle KeyUpdate message
Tobias Brunner [Thu, 27 Aug 2020 09:51:58 +0000 (11:51 +0200)]
tls-peer: Add support to handle KeyUpdate message

We currently don't support switching our own keys and sending the
message if requested by the server.

18 months agotls-crypto: Add method to update application traffic keys
Tobias Brunner [Thu, 27 Aug 2020 09:51:00 +0000 (11:51 +0200)]
tls-crypto: Add method to update application traffic keys

18 months agotls-hkdf: Support updating client/server traffic secrets
Tobias Brunner [Thu, 27 Aug 2020 09:50:00 +0000 (11:50 +0200)]
tls-hkdf: Support updating client/server traffic secrets

18 months agotls-socket: Don't fail reading if sending data failed
Tobias Brunner [Wed, 26 Aug 2020 15:42:21 +0000 (17:42 +0200)]
tls-socket: Don't fail reading if sending data failed

If data is processed that eventually includes a TLS close notify, build()
will fail after a close notify has been sent in turn.  However, propagating
that error immediately when reading prevented ever returning the data
already processed before the close notify was received.

18 months agotls-peer: Correctly handle classic ECDH key-share format
Tobias Brunner [Wed, 26 Aug 2020 14:08:26 +0000 (16:08 +0200)]
tls-peer: Correctly handle classic ECDH key-share format

Similar to TLS 1.2 but uses a 16-bit length header.

18 months agotls-test: Add options to configure TLS versions
Tobias Brunner [Wed, 26 Aug 2020 13:00:30 +0000 (15:00 +0200)]
tls-test: Add options to configure TLS versions

18 months agotls-socket: Allow configuring both minimum and maximum TLS versions
Tobias Brunner [Wed, 26 Aug 2020 12:40:51 +0000 (14:40 +0200)]
tls-socket: Allow configuring both minimum and maximum TLS versions

18 months agotls: Allow setting both minimum and maximum TLS versions
Tobias Brunner [Wed, 26 Aug 2020 12:37:59 +0000 (14:37 +0200)]
tls: Allow setting both minimum and maximum TLS versions

This allows to increase the initial minimum version and also prevents
sending a list of versions during retries when 1.3 was already

18 months agotls-peer: Handle HelloRetryRequest
Tobias Brunner [Tue, 25 Aug 2020 15:23:45 +0000 (17:23 +0200)]
tls-peer: Handle HelloRetryRequest

Adds support to handle retries with different DH group and/or a cookie

18 months agotls-crypto: Add method to hash handshake data and use result as initial transcript
Tobias Brunner [Tue, 25 Aug 2020 15:17:55 +0000 (17:17 +0200)]
tls-crypto: Add method to hash handshake data and use result as initial transcript

This is used for HelloRetryRequest.

18 months agotls-crypto: Destroy HKDF instance if keys are derived multiple times
Tobias Brunner [Tue, 25 Aug 2020 15:13:17 +0000 (17:13 +0200)]
tls-crypto: Destroy HKDF instance if keys are derived multiple times

This will be the case during a retry.

18 months agotls-peer: Refactor writing of extensions and use less hard-coded DH group
Tobias Brunner [Tue, 25 Aug 2020 14:18:27 +0000 (16:18 +0200)]
tls-peer: Refactor writing of extensions and use less hard-coded DH group

Note that this breaks connecting to many TLS 1.3 servers until we support
HelloRetryRequest as we now send a key_share for ECP_256 while still
proposing other groups, so many servers request to use CURVE_25519.

18 months agotls-peer: Refactor sending/processing finished message
Tobias Brunner [Tue, 25 Aug 2020 14:25:37 +0000 (16:25 +0200)]
tls-peer: Refactor sending/processing finished message

Also fixes leaks.

18 months agotls-peer: Simply ignore certificate request context
Tobias Brunner [Tue, 25 Aug 2020 15:21:02 +0000 (17:21 +0200)]
tls-peer: Simply ignore certificate request context

This SHALL be zero length for server authentication anyway.

18 months agotls-peer: Use existing code to verify certificate and signature
Tobias Brunner [Tue, 25 Aug 2020 14:17:27 +0000 (16:17 +0200)]
tls-peer: Use existing code to verify certificate and signature

18 months agotls-peer: Refactor parsing of TLS extensions
Tobias Brunner [Tue, 25 Aug 2020 14:14:54 +0000 (16:14 +0200)]
tls-peer: Refactor parsing of TLS extensions

Also adds proper error handling.

18 months agotls-peer: Fix parsing of encrypted extensions
Tobias Brunner [Fri, 28 Aug 2020 06:54:49 +0000 (08:54 +0200)]
tls-peer: Fix parsing of encrypted extensions

18 months agotls-peer: Fix parsing of intermediate CA certificates
Tobias Brunner [Tue, 25 Aug 2020 14:11:59 +0000 (16:11 +0200)]
tls-peer: Fix parsing of intermediate CA certificates

18 months agotls-crypto: Rename methods to calculate finished message
Tobias Brunner [Tue, 25 Aug 2020 14:52:20 +0000 (16:52 +0200)]
tls-crypto: Rename methods to calculate finished message

Instead of the version number use "legacy" for the one for earlier TLS

18 months agotls-crypto: Use internal PRF of tls-hkdf to generate finished message
Tobias Brunner [Tue, 25 Aug 2020 14:49:52 +0000 (16:49 +0200)]
tls-crypto: Use internal PRF of tls-hkdf to generate finished message

Also adds additional checks.

18 months agotls-hkdf: Add helper method to allocate data from the internal PRF
Tobias Brunner [Tue, 25 Aug 2020 14:44:17 +0000 (16:44 +0200)]
tls-hkdf: Add helper method to allocate data from the internal PRF

18 months agotls-hkdf: Cleanups and refactorings
Tobias Brunner [Tue, 25 Aug 2020 14:01:27 +0000 (16:01 +0200)]
tls-hkdf: Cleanups and refactorings

The main refactoring is how secrets (PSK/DH) are handled.

18 months agotls-crypto: Simplify signature creation/verification
Tobias Brunner [Tue, 25 Aug 2020 13:58:46 +0000 (15:58 +0200)]
tls-crypto: Simplify signature creation/verification

18 months agotls-crypto: Simplify handshake/application key derivation and rename methods
Tobias Brunner [Tue, 25 Aug 2020 11:22:04 +0000 (13:22 +0200)]
tls-crypto: Simplify handshake/application key derivation and rename methods

Also consistently change the ciphers outside of tls_crypto_t and
simplify key derivation in tls_peer_t and fix a memory leak.

18 months agotls-hkdf: Make labels enum a proper type
Tobias Brunner [Tue, 25 Aug 2020 11:35:54 +0000 (13:35 +0200)]
tls-hkdf: Make labels enum a proper type

18 months agotls-peer: Support x25519/448 for TLS 1.2
Tobias Brunner [Wed, 26 Aug 2020 13:23:53 +0000 (15:23 +0200)]
tls-peer: Support x25519/448 for TLS 1.2

These DH groups don't use the point format prefix (RFC 8422 deprecated
any other format anyway).  Since they are enumerated now, they can also
be used by servers for TLS 1.2.

18 months agotls-crypto: Enumerate x25519/448 and rename constant for consistency
Tobias Brunner [Tue, 25 Aug 2020 11:16:52 +0000 (13:16 +0200)]
tls-crypto: Enumerate x25519/448 and rename constant for consistency

18 months agotls-crypto: Simplify hash algorithm handling
Tobias Brunner [Tue, 25 Aug 2020 11:14:05 +0000 (13:14 +0200)]
tls-crypto: Simplify hash algorithm handling

18 months agotls-crypto: Delay instantiation of cipher suites
Tobias Brunner [Tue, 25 Aug 2020 13:46:29 +0000 (15:46 +0200)]
tls-crypto: Delay instantiation of cipher suites

This way we can take into account the version set via setter on tls_t.

18 months agotls-crypto: Filter TLS cipher suites by min/max version
Tobias Brunner [Tue, 25 Aug 2020 11:54:08 +0000 (13:54 +0200)]
tls-crypto: Filter TLS cipher suites by min/max version

There is no point proposing legacy (or future) cipher suites depending on
the proposed TLS versions. It was actually possible to negotiate and use
cipher suites only defined for TLS 1.2 with earlier TLS versions.

18 months agotls-crypto: Correctly filter cipher suites based on PRF algorithms
Tobias Brunner [Tue, 25 Aug 2020 11:47:00 +0000 (13:47 +0200)]
tls-crypto: Correctly filter cipher suites based on PRF algorithms

The previous check operated on the first array element.

18 months agotls-crypto: Use correct key length for ChaCha20/Poly1305
Tobias Brunner [Wed, 26 Aug 2020 10:18:06 +0000 (12:18 +0200)]
tls-crypto: Use correct key length for ChaCha20/Poly1305

18 months agolibtls: Some code style fixes
Tobias Brunner [Tue, 25 Aug 2020 14:32:40 +0000 (16:32 +0200)]
libtls: Some code style fixes

18 months agotls-test: Make address family configurable and simplify DNS/socket handling
Tobias Brunner [Tue, 25 Aug 2020 11:09:55 +0000 (13:09 +0200)]
tls-test: Make address family configurable and simplify DNS/socket handling

18 months agolibtls: Implement TLS 1.3 handshake on client-side
bytinbit [Thu, 21 May 2020 07:37:38 +0000 (09:37 +0200)]
libtls: Implement TLS 1.3 handshake on client-side

The code is a minimal handshake with the HelloRetryRequest message
implementation missing.
Can be tested with an OpenSSL server running TLS 1.3. The server must
be at least version 1.1.1 (September 2018).

Co-authored-by: ryru <>
18 months agolibtls: Implement HKDF for TLS 1.3
Pascal K [Thu, 21 May 2020 05:57:14 +0000 (07:57 +0200)]
libtls: Implement HKDF for TLS 1.3

TLS 1.3 uses HMAC-based Extract-and-Expand Key Derivation Function (HKDF)
as defined in RFC 5869 to compute traffic secrets.

Co-authored-by: bytinbit <>
18 months agolibtls: Add support to run unit tests with a custom plugin list
Tobias Brunner [Wed, 22 Apr 2020 14:27:00 +0000 (16:27 +0200)]
libtls: Add support to run unit tests with a custom plugin list

18 months agolibtls: Add TLS 1.3 implementation of tls_aead_t
Tobias Brunner [Wed, 22 Apr 2020 14:03:01 +0000 (16:03 +0200)]
libtls: Add TLS 1.3 implementation of tls_aead_t

The key material, in particular the nonce/IV, is derived differently and
the IV is also generated in a different way.  Additionally, the actual
content type is encrypted and there may be optional padding to mask the
actual size of the encrypted data.

18 months agolibtls: Allow tls_aead_t to change the content type
Tobias Brunner [Wed, 22 Apr 2020 13:44:31 +0000 (15:44 +0200)]
libtls: Allow tls_aead_t to change the content type

The actual content type is encrypted with TLS 1.3, the type in the record
header is always Application Data.

18 months agotesting: extended sleep time tkm/xfrmproxy tests 5.9.2dr2
Andreas Steffen [Fri, 12 Feb 2021 08:44:00 +0000 (09:44 +0100)]
testing: extended sleep time tkm/xfrmproxy tests

18 months agoVersion bump to 5.9.2dr2
Andreas Steffen [Wed, 10 Feb 2021 09:04:34 +0000 (10:04 +0100)]
Version bump to 5.9.2dr2

18 months agotesting: Copy /etc/resolv.conf from host in chroot script
Tobias Brunner [Fri, 18 Dec 2020 13:18:47 +0000 (14:18 +0100)]
testing: Copy /etc/resolv.conf from host in chroot script

This makes installing packages etc. easier.

18 months agoappveyor: Set timezone on the build system
Tobias Brunner [Thu, 11 Feb 2021 09:20:43 +0000 (10:20 +0100)]
appveyor: Set timezone on the build system

For some reason, setting the time zone via TZ to `GST-1GDT` in the utils test
doesn't work anymore (the DST zone is not considered, it's as if only `GST-1`
was configured).

18 months agoappveyor: Create dummy strongswan.conf file to avoid log messages
Tobias Brunner [Wed, 10 Feb 2021 17:04:41 +0000 (18:04 +0100)]
appveyor: Create dummy strongswan.conf file to avoid log messages

Only relevant when increasing the verbosity, but causes quite a lot of
them then.

18 months agoappveyor: Print OpenSSL version
Tobias Brunner [Wed, 10 Feb 2021 17:04:27 +0000 (18:04 +0100)]
appveyor: Print OpenSSL version

18 months agoopenssl: Allocate our own buffer for i2d_* wrapper macro
Tobias Brunner [Wed, 10 Feb 2021 16:55:06 +0000 (17:55 +0100)]
openssl: Allocate our own buffer for i2d_* wrapper macro

If we pass a pointer to NULL, the memory allocated by OpenSSL has to be
freed with OPENSSL_free().  Otherwise, this can lead to random
crashes/freezes for Windows builds as seen on AppVeyor.  To not
complicate things for callers of this macro, we allocate our own memory,
which we already do for other i2d_* calls.

18 months agoopenssl: Reset HMAC key if chunk_empty is passed
Tobias Brunner [Fri, 18 Dec 2020 13:17:37 +0000 (14:17 +0100)]
openssl: Reset HMAC key if chunk_empty is passed

If no valid key is configured (e.g. because it's inadvertently uninitialized),
we should not just reuse the previous key.

The `key_set` flag is not necessary anymore because a non-NULL key is set
during initialization since 6b347d5232c7 ("openssl: Ensure underlying hash
algorithm is available during HMAC init").

18 months agoandroid: Explicitly apply DNS servers to the TUN device
Tobias Brunner [Tue, 24 Nov 2020 15:50:55 +0000 (16:50 +0100)]
android: Explicitly apply DNS servers to the TUN device

If the peer deletes the CHILD_SA, we recreate it due to the close
action.  However, if we create a new TUN device, we do so with a new
VpnService.Builder object and on that the DNS servers were never applied.
The latter happened only on the fly in the attribute handler when an
IKE_SA was established.  Now we do this explicitly when creating the TUN
device, like the virtual IPs and routes.  While we could avoid the
recreation of the TUN device if the CHILD_SA is recreated, there is the
theoretical possibility that the remote traffic selectors change.  This
way we also avoid adding stuff to the builder in different places.

Fixes #3637.

18 months agoswanctl: Don't print status message if nothing was loaded to stderr
Tobias Brunner [Wed, 27 Jan 2021 13:51:56 +0000 (14:51 +0100)]
swanctl: Don't print status message if nothing was loaded to stderr

This is not an error (as reflected by the returned status code) so we
should not print to stderr as output there might still be considered an
error (or at least an audit-worthy event) by some scripts.

18 months agoplugin-loader: Add optional filter for plugin features
Thomas Egerer [Thu, 28 Jan 2021 17:49:08 +0000 (17:49 +0000)]
plugin-loader: Add optional filter for plugin features

In some cases, the algorithms that have been compiled into a plugin have
to be disabled at runtime. Based on the array returned by the get_features()
function the optionally provided function can strip algorithms or even
callbacks or registrations from a plugin, giving us a handy and powerful way
for runtime feature configuration aside from the plugin list.

Signed-off-by: Thomas Egerer <>
18 months agopath: Also accept / as directory separator on Windows
Tobias Brunner [Mon, 1 Feb 2021 13:35:09 +0000 (14:35 +0100)]
path: Also accept / as directory separator on Windows

This adds helper functions to determine the first or last directory separator
in a string and to check if a given character is a separator.

Paths starting with a separator are now also considered absolute on
Windows as these are rooted at the current drive.

Note that it's fine to use DIRECTORY_SEPARATOR when combining strings as
Windows API calls accept both forward and backward slashes as separators.

Co-authored-by: MichaƂ Skalski <>
References #3684.

18 months agoenumerator: Implement globbing enumerator on Windows
Tobias Brunner [Thu, 28 Jan 2021 14:10:52 +0000 (15:10 +0100)]
enumerator: Implement globbing enumerator on Windows

We don't have glob() available there.  This replacement should work
similarly for simple cases like `include conf.d/*.conf`.

Fixes #3684.

18 months agovici: Fix refcount for CA certificates when reloading authority sections
Tobias Brunner [Wed, 20 Jan 2021 14:52:33 +0000 (15:52 +0100)]
vici: Fix refcount for CA certificates when reloading authority sections

Fixes: 3c5e7eaa88b0 ("vici: Keep track of all CA certificates in vici_authority_t")