From patchwork Sun Mar 21 22:14:14 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 1649 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director8.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id EBOjFkBgWGASPAAAIUCqbw (envelope-from ) for ; Mon, 22 Mar 2021 05:15:44 -0400 Received: from proxy12.mail.ord1d.rsapps.net ([172.30.191.6]) by director8.mail.ord1d.rsapps.net with LMTP id UJ6RFkBgWGAUPAAAfY0hYg (envelope-from ) for ; Mon, 22 Mar 2021 05:15:44 -0400 Received: from smtp1.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy12.mail.ord1d.rsapps.net with LMTPS id iANPFkBgWGD/WQAA7PHxkg (envelope-from ) for ; Mon, 22 Mar 2021 05:15:44 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp1.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 2dccdef6-8aef-11eb-ad0f-5254002d775b-1-1 Received: from [216.105.38.7] ([216.105.38.7:60794] helo=lists.sourceforge.net) by smtp1.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id B6/1E-04360-F3068506; Mon, 22 Mar 2021 05:15:44 -0400 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1lOGeB-0005A4-6Y; Mon, 22 Mar 2021 09:14:51 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lOGdr-00055M-TG for openvpn-devel@lists.sourceforge.net; Mon, 22 Mar 2021 09:14:31 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:To: From:Sender:Reply-To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=CVDLrZiaPS4FTRkZRRR3VgPT6czMgijPUyHSRGdEnbE=; b=T477eviWeeyXxZuc96x9orvj5N N54z6YYGXPEp0p6uDBKkeSEmJCsm874pNtQ9ytSfqO/rwhVIOB5buiqMz79vj9MXWBvzeqLdEUhNJ Ts9XxEEOOZ95PKkt8RYi4CmXpltzNTPajaKt2HzXQprjuW3NBxKAjaAqqS8pgucgEEB4=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=CVDLrZiaPS4FTRkZRRR3VgPT6czMgijPUyHSRGdEnbE=; b=JLBypWarQbMaD8I0W3Gnv7j2xr Yayod997lfsAL1Oy0LLdU0Aa/jAeTDWMn7akIwStcmzeYf32uLlyxx7cCydLbA+tUqSfEuwuygfr7 Pw9/HnVLF6Uq/9UnlezMGMED8oZqvYxN7OUzkEytd9NXWAZV8G9nBSQLGy+rOLPXcPAo=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92.2) id 1lOGdh-00DT3O-9T for openvpn-devel@lists.sourceforge.net; Mon, 22 Mar 2021 09:14:31 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.94 (FreeBSD)) (envelope-from ) id 1lOGda-0005m0-3Z for openvpn-devel@lists.sourceforge.net; Mon, 22 Mar 2021 10:14:14 +0100 Received: (nullmailer pid 7577 invoked by uid 10006); Mon, 22 Mar 2021 09:14:14 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Mon, 22 Mar 2021 10:14:14 +0100 Message-Id: <20210322091414.7533-1-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210319142001.2201-3-arne@rfc2549.org> References: <20210319142001.2201-3-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record X-Headers-End: 1lOGdh-00DT3O-9T Subject: [Openvpn-devel] [PATCH v3 3/5] Support fingerprint authentication without CA certificate X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: "Jason A. Donenfeld" OpenVPN traditionally works around CAs. However many TLS-based protocols also allow an alternative simpler mode in which rather than verify certificates against CAs, the certificate itself is hashed and compared against a pre-known set of acceptable hashes. This is usually referred to as "fingerprint verification". It's popular across SMTP servers, IRC servers, XMPP servers, and even in the context of HTTP with pinning. * Allow not specifying the --ca parameter, to specify that certificates should not be checked against a CA. I've included some instructions on how to use all of this. Server side: Acked-by: Antonio Quartulli ============ Make self-signed cert: $ openssl req -x509 -newkey ec:<(openssl ecparam -name secp384r1) -keyout serverkey.pem -out servercert.pem -nodes -sha256 -days 3650 -subj '/CN=server' Record our fingerprint in an environment variable for the client to use later: $ server_fingerprint="$(openssl x509 -in servercert.pem -noout -sha256 -fingerprint | sed 's/.*=//;s/\(.*\)/\1/')" Client side: ============ Make self-signed cert: $ openssl req -x509 -newkey ec:<(openssl ecparam -name secp384r1) -keyout clientkey.pem -out clientcert.pem -nodes -sha256 -days 3650 -subj '/CN=client' Record our fingerprint in an environment variable for the server to use later: $ client_fingerprint="$(openssl x509 -in clientcert.pem -noout -sha256 -fingerprint | sed 's/.*=//;s/\(.*\)/\1/')" Start server/client =================== Start openvpn with peer fingerprint verification: $ sudo openvpn --server 10.66.0.0 255.255.255.0 --dev tun --dh none --cert servercert.pem --key serverkey.pem --peer-fingerprint "$client_fingerprint" $ sudo openvpn --client --remote 127.0.0.1 --dev tun --cert clientcert.pem --key clientkey.pem --peer-fingerprint "$server_fingerprint" --nobind Signed-off-by: Jason A. Donenfeld Patch V2: Changes in V2 (by Arne Schwabe): - Only check peer certificates, not all cert levels, if you need multiple levels of certificate you should use a real CA - Use peer-fingerprint instead tls-verify on server side in example. - rename variable ca_file_none to verify_hash_no_ca - do no require --ca none but allow --ca simply to be absent when --peer-fingprint is present - adjust warnings/errors messages to also point to peer-fingerprint as valid verification method. - Fix mbed TLS version of not requiring CA not working Patch v3: Fix minor style. Remove unessary check of verify_hash_no_ca in ssl.c. Signed-off-by: Arne Schwabe --- src/openvpn/init.c | 1 + src/openvpn/options.c | 27 +++++++++++++++++++++------ src/openvpn/options.h | 1 + src/openvpn/ssl_common.h | 1 + src/openvpn/ssl_verify_mbedtls.c | 16 ++++++++++++++++ src/openvpn/ssl_verify_openssl.c | 2 +- 6 files changed, 41 insertions(+), 7 deletions(-) diff --git a/src/openvpn/init.c b/src/openvpn/init.c index 731b0cf2..c56dac87 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -2928,6 +2928,7 @@ do_init_crypto_tls(struct context *c, const unsigned int flags) to.verify_hash = options->verify_hash; to.verify_hash_algo = options->verify_hash_algo; to.verify_hash_depth = options->verify_hash_depth; + to.verify_hash_no_ca = options->verify_hash_no_ca; #ifdef ENABLE_X509ALTUSERNAME memcpy(to.x509_username_field, options->x509_username_field, sizeof(to.x509_username_field)); #else diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 38ced536..4eee3a8a 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -2711,18 +2711,23 @@ options_postprocess_verify_ce(const struct options *options, else { #ifdef ENABLE_CRYPTO_MBEDTLS - if (!(options->ca_file)) + if (!(options->ca_file || options->verify_hash_no_ca)) { - msg(M_USAGE, "You must define CA file (--ca)"); + msg(M_USAGE, "You must define CA file (--ca) and/or " + "peer fingeprint verification " + "(--peer-fingerprint)"); } if (options->ca_path) { msg(M_USAGE, "Parameter --capath cannot be used with the mbed TLS version version of OpenVPN."); } #else /* ifdef ENABLE_CRYPTO_MBEDTLS */ - if ((!(options->ca_file)) && (!(options->ca_path))) + if ((!(options->ca_file)) && (!(options->ca_path)) + && (!(options->verify_hash_no_ca))) { - msg(M_USAGE, "You must define CA file (--ca) or CA path (--capath)"); + msg(M_USAGE, "You must define CA file (--ca) or CA path " + "(--capath) and/or peer fingeprint verification " + "(--peer-fingerprint)"); } #endif if (pull) @@ -3205,6 +3210,13 @@ options_postprocess_mutate(struct options *o) options_postprocess_http_proxy_override(o); } #endif + if (!o->ca_file && !o->ca_path && o->verify_hash + && o->verify_hash_depth == 0) + { + msg(M_INFO, "Using certificate fingerprint to verify peer (no CA " + "option set). "); + o->verify_hash_no_ca = true; + } #if P2MP /* @@ -3440,8 +3452,11 @@ options_postprocess_filechecks(struct options *options) errs |= check_file_access_inline(options->dh_file_inline, CHKACC_FILE, options->dh_file, R_OK, "--dh"); - errs |= check_file_access_inline(options->ca_file_inline, CHKACC_FILE, - options->ca_file, R_OK, "--ca"); + if (!options->verify_hash_no_ca) + { + errs |= check_file_access_inline(options->ca_file_inline, CHKACC_FILE, + options->ca_file, R_OK, "--ca"); + } errs |= check_file_access_chroot(options->chroot_dir, CHKACC_FILE, options->ca_path, R_OK, "--capath"); diff --git a/src/openvpn/options.h b/src/openvpn/options.h index 30ec53d6..c68e89d2 100644 --- a/src/openvpn/options.h +++ b/src/openvpn/options.h @@ -561,6 +561,7 @@ struct options struct verify_hash_list *verify_hash; hash_algo_type verify_hash_algo; int verify_hash_depth; + bool verify_hash_no_ca; unsigned int ssl_flags; /* set to SSLF_x flags from ssl.h */ #ifdef ENABLE_PKCS11 diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h index 2b1b87fb..4e1ff6c8 100644 --- a/src/openvpn/ssl_common.h +++ b/src/openvpn/ssl_common.h @@ -285,6 +285,7 @@ struct tls_options const char *remote_cert_eku; struct verify_hash_list *verify_hash; int verify_hash_depth; + bool verify_hash_no_ca; hash_algo_type verify_hash_algo; #ifdef ENABLE_X509ALTUSERNAME char *x509_username_field[MAX_PARMS]; diff --git a/src/openvpn/ssl_verify_mbedtls.c b/src/openvpn/ssl_verify_mbedtls.c index 93891038..ef3847bb 100644 --- a/src/openvpn/ssl_verify_mbedtls.c +++ b/src/openvpn/ssl_verify_mbedtls.c @@ -62,6 +62,22 @@ verify_callback(void *session_obj, mbedtls_x509_crt *cert, int cert_depth, struct buffer cert_fingerprint = x509_get_sha256_fingerprint(cert, &gc); cert_hash_remember(session, cert_depth, &cert_fingerprint); + if (session->opt->verify_hash_no_ca) + { + /* + * If we decide to verify the peer certificate based on the fingerprint + * we ignore wrong dates and the certificate not being trusted. + * Any other problem with the certificate (wrong key, bad cert,...) + * will still trigger an error. + * Clearing these flags relies on verify_cert will later rejecting a + * certificate that has no matching fingerprint. + */ + uint32_t flags_ignore = MBEDTLS_X509_BADCERT_NOT_TRUSTED + | MBEDTLS_X509_BADCERT_EXPIRED + | MBEDTLS_X509_BADCERT_FUTURE; + *flags = *flags & ~flags_ignore; + } + /* did peer present cert which was signed by our root cert? */ if (*flags != 0) { diff --git a/src/openvpn/ssl_verify_openssl.c b/src/openvpn/ssl_verify_openssl.c index d063aeda..8b1f1969 100644 --- a/src/openvpn/ssl_verify_openssl.c +++ b/src/openvpn/ssl_verify_openssl.c @@ -67,7 +67,7 @@ verify_callback(int preverify_ok, X509_STORE_CTX *ctx) cert_hash_remember(session, X509_STORE_CTX_get_error_depth(ctx), &cert_hash); /* did peer present cert which was signed by our root cert? */ - if (!preverify_ok) + if (!preverify_ok && !session->opt->verify_hash_no_ca) { /* get the X509 name */ char *subject = x509_get_subject(current_cert, &gc);