From patchwork Tue Dec 14 05:59:24 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Selva Nair X-Patchwork-Id: 2166 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director14.mail.ord1d.rsapps.net ([172.30.191.6]) by backend41.mail.ord1d.rsapps.net with LMTP id 4D/tGuDNuGFtWAAAqwncew (envelope-from ) for ; Tue, 14 Dec 2021 12:01:20 -0500 Received: from proxy3.mail.ord1d.rsapps.net ([172.30.191.6]) by director14.mail.ord1d.rsapps.net with LMTP id iMWJAOHNuGG0fAAAeJ7fFg (envelope-from ) for ; Tue, 14 Dec 2021 12:01:21 -0500 Received: from smtp17.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy3.mail.ord1d.rsapps.net with LMTPS id MBFkAOHNuGEKeAAA7WKfLA (envelope-from ) for ; Tue, 14 Dec 2021 12:01:21 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp17.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dkim=fail (signature verification failed) header.d=gmail.com; dmarc=fail (p=none; dis=none) header.from=gmail.com X-Suspicious-Flag: YES X-Classification-ID: 7522508c-5cff-11ec-935c-5254008de1cb-1-1 Received: from [216.105.38.7] ([216.105.38.7:38784] helo=lists.sourceforge.net) by smtp17.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 5E/52-05173-FDDC8B16; Tue, 14 Dec 2021 12:01:20 -0500 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.94.2) (envelope-from ) id 1mxBA4-0003Bc-B0; Tue, 14 Dec 2021 17:00:21 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1mxB9z-000382-7e for openvpn-devel@lists.sourceforge.net; Tue, 14 Dec 2021 17:00:16 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Emsh0wcvZOITNXYbh9tMik+VJtrZO7eUfU31oTMfpUU=; b=a76WstsUbCR+NeT1VGmZQl4ZHp NIo5MtXHf+u3I9CAr4vRYhimuofkSOGPx19nWS7cF8rWvXeg3YLEEjyEhxSeQi9FRmRl/rLk/65WE SYEF05k7x1vSLuJIn+1zCPfn1gxMdl6oOEivEqkPpZOhywgHfz9yll8p15ZHkclplmsE=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=Emsh0wcvZOITNXYbh9tMik+VJtrZO7eUfU31oTMfpUU=; b=IIlpXvmTsQ06+O+Rmok4AKTsVw fL6lRN6qEzRFAGwU8saHOhSv4yFmszy9MiipegbZpdeH46mimLXY2qTpiS5U+5ZJZjaVKDxjZ63pR j9wTdQ0cULQkb43I7Ti5NoZI+bOwPJSvGWienK2nvozQmtRgyne1bMlPit9F+Z4KbT5k=; Received: from mail-io1-f52.google.com ([209.85.166.52]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.92.3) id 1mxB9t-0000bm-HJ for openvpn-devel@lists.sourceforge.net; Tue, 14 Dec 2021 17:00:16 +0000 Received: by mail-io1-f52.google.com with SMTP id 14so25235514ioe.2 for ; Tue, 14 Dec 2021 09:00:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Emsh0wcvZOITNXYbh9tMik+VJtrZO7eUfU31oTMfpUU=; b=B9PUaSTVt+Q9PwzmhQE2/PmYj/mvJjLMbsh9wL1QGXxSdv9i2uK29TW2BMIaSnb5DG UsR3Rd28yDkK9yjaJelHykPIGGuQICxB7sV5AZigOB9PUID2T8eOV92ZZshKRM911v/u RR9H9dEe9+DgQg0u3mPonBRpGqL3+2njhk8d+MqGPunSsNMN3HLwumZLUcqXToZsnmVq Icz00A33Bixlo4wsXetR7pkBX613IPSfSkuCQKhJpMqQODzEqiZyWTDpiV5uRnHmmj7w jo5S3UZdN213OJOA5P6cQ2I26S9TjJOr8q6CLztmpZQ1DeXzAGOdQZiMcTF1YVhBBtXS lsJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Emsh0wcvZOITNXYbh9tMik+VJtrZO7eUfU31oTMfpUU=; b=ad1x89/XHQJr38Me0yJ7lI78lk5Wwn8X+iDOJlorhT9gX1UdeRe5UhLQfHd8nRjjSY 8WLeO9sePSnK5Vz4qrMbSONOjllEQr5VXHASqJ1dPwRL7SfF4YM9EjziLmOvpTf3THe9 McCoPbWDEfkuZSaZtEVto4PfaLtne50IISbpbgmELo/oMLLKRm4rkU33A3iHD2tC50nt WTTlNkpdUK1RcyeNufrGIaxjA0pXuyHeJ4dszMbP5/PwV74k7YUR+0AgxQKtAxF/jXxV MBIoENemPN8aOwI+SZ25qOS/YOgv4C+gcTmgmWES4xFhnwTE8Dk2qip3Mc6X+9zgmP7p c2Yw== X-Gm-Message-State: AOAM531v0Z+24gobnbRjJa19Ed9UoGucr+i1sfbAbexQfcRrtsWeESC3 l4yjU+W73bo38B89pCMc2EeipywjM4A= X-Google-Smtp-Source: ABdhPJydYcqeRafv2G1zgH6BZxZ+eTCqGn9uZvIQtd4QtAb5UzPDPL9S+t7djnqDiw9XHpH8lIebmw== X-Received: by 2002:a05:6638:150f:: with SMTP id b15mr3962826jat.356.1639501203729; Tue, 14 Dec 2021 09:00:03 -0800 (PST) Received: from uranus.home.sansel.ca (bras-vprn-tnhlon4053w-lp130-02-70-51-223-8.dsl.bell.ca. [70.51.223.8]) by smtp.gmail.com with ESMTPSA id e9sm178778ilm.44.2021.12.14.09.00.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Dec 2021 09:00:03 -0800 (PST) From: selva.nair@gmail.com To: openvpn-devel@lists.sourceforge.net Date: Tue, 14 Dec 2021 11:59:24 -0500 Message-Id: <20211214165928.30676-15-selva.nair@gmail.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211214165928.30676-1-selva.nair@gmail.com> References: <20211214165928.30676-1-selva.nair@gmail.com> MIME-Version: 1.0 X-Spam-Report: Spam detection software, running on the system "util-spamd-1.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Selva Nair - Load the 'private key' handle through the provider and set it in SSL_CTX - Add a sign op function to interface provider with pkcs11-helper. Previously we used its "OpenSSL Session" which internally [...] Content analysis details: (-0.2 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [209.85.166.52 listed in list.dnswl.org] -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [209.85.166.52 listed in wl.mailspike.net] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [selva.nair[at]gmail.com] -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-Headers-End: 1mxB9t-0000bm-HJ Subject: [Openvpn-devel] [PATCH v3 14/18] pkcs11: Interface the xkey provider with pkcs11-helper X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: Selva Nair - Load the 'private key' handle through the provider and set it in SSL_CTX - Add a sign op function to interface provider with pkcs11-helper. Previously we used its "OpenSSL Session" which internally sets up callbacks in RSA and EC key methods. Not useful for the provider interface, so, we directly call the PKCS#11 sign operation as done with mbedTLS. - tls_libctx is made global for accessing from pkcs11_openssl.c Supports ECDSA and RSA_PKCS1_PADDING signatures. PSS support will be added when pkcs11-helper with our PR for specifying CK_MECHANISM variable in sign operations is released. (i.e., next release of pkcs11-helper). Signed-off-by: Selva Nair Acked-By: Arne Schwabe --- src/openvpn/pkcs11_openssl.c | 151 +++++++++++++++++++++++++++++++++++ src/openvpn/ssl_openssl.c | 2 +- src/openvpn/xkey_common.h | 2 + 3 files changed, 154 insertions(+), 1 deletion(-) diff --git a/src/openvpn/pkcs11_openssl.c b/src/openvpn/pkcs11_openssl.c index b29504b6..9cf46b2c 100644 --- a/src/openvpn/pkcs11_openssl.c +++ b/src/openvpn/pkcs11_openssl.c @@ -39,12 +39,163 @@ #include "errlevel.h" #include "pkcs11_backend.h" #include "ssl_verify.h" +#include "xkey_common.h" #include +#ifdef HAVE_XKEY_PROVIDER +static XKEY_EXTERNAL_SIGN_fn xkey_pkcs11h_sign; + +/** + * Sign op called from xkey provider + * + * We support ECDSA, RSA_NO_PADDING, RSA_PKCS1_PADDING + */ +static int +xkey_pkcs11h_sign(void *handle, unsigned char *sig, + size_t *siglen, const unsigned char *tbs, size_t tbslen, XKEY_SIGALG sigalg) +{ + pkcs11h_certificate_t cert = handle; + CK_MECHANISM mech = {CKM_RSA_PKCS, NULL, 0}; /* default value */ + + unsigned char buf[EVP_MAX_MD_SIZE]; + size_t buflen; + + if (!strcmp(sigalg.op, "DigestSign")) + { + dmsg(D_LOW, "xkey_pkcs11h_sign: computing digest"); + if (xkey_digest(tbs, tbslen, buf, &buflen, sigalg.mdname)) + { + tbs = buf; + tbslen = (size_t) buflen; + sigalg.op = "Sign"; + } + else + { + return 0; + } + } + + if (!strcmp(sigalg.keytype, "EC")) + { + mech.mechanism = CKM_ECDSA; + } + else if (!strcmp(sigalg.keytype, "RSA")) + { + if (!strcmp(sigalg.padmode,"none")) + { + mech.mechanism = CKM_RSA_X_509; + } + else if (!strcmp(sigalg.padmode, "pss")) + { + msg(M_NONFATAL, "PKCS#11: Error: PSS padding is not yet supported."); + return 0; + } + else if (!strcmp(sigalg.padmode, "pkcs1")) + { + /* CMA_RSA_PKCS needs pkcs1 encoded digest */ + + unsigned char enc[EVP_MAX_MD_SIZE + 32]; /* 32 bytes enough for DigestInfo header */ + size_t enc_len = sizeof(enc); + + if (!encode_pkcs1(enc, &enc_len, sigalg.mdname, tbs, tbslen)) + { + return 0; + } + tbs = enc; + tbslen = enc_len; + } + else /* should not happen */ + { + msg(M_WARN, "PKCS#11: Unknown padmode <%s>", sigalg.padmode); + } + } + else + { + ASSERT(0); /* coding error -- we couldnt have created any such key */ + } + + return CKR_OK == pkcs11h_certificate_signAny(cert, mech.mechanism, + tbs, tbslen, sig, siglen); +} + +/* wrapper for handle free */ +static void +xkey_handle_free(void *handle) +{ + pkcs11h_certificate_freeCertificate(handle); +} + + +/** + * Load certificate and public key from pkcs11h to SSL_CTX + * through xkey provider. + * + * @param certificate pkcs11h certificate object + * @param ctx OpenVPN root tls context + * + * @returns 1 on success, 0 on error to match + * other xkey_load_.. routines + */ +static int +xkey_load_from_pkcs11h(pkcs11h_certificate_t certificate, + struct tls_root_ctx *const ctx) +{ + int ret = 0; + + X509 *x509 = pkcs11h_openssl_getX509(certificate); + if (!x509) + { + msg(M_WARN, "PKCS#11: Unable get x509 certificate object"); + return 0; + } + + EVP_PKEY *pubkey = X509_get0_pubkey(x509); + + XKEY_PRIVKEY_FREE_fn *free_op = xkey_handle_free; /* it calls pkcs11h_..._freeCertificate() */ + XKEY_EXTERNAL_SIGN_fn *sign_op = xkey_pkcs11h_sign; + + EVP_PKEY *pkey = xkey_load_generic_key(tls_libctx, certificate, pubkey, sign_op, free_op); + if (!pkey) + { + msg(M_WARN, "PKCS#11: Failed to load private key into xkey provider"); + goto cleanup; + } + /* provider took ownership of the pkcs11h certificate object -- do not free below */ + certificate = NULL; + + if (!SSL_CTX_use_cert_and_key(ctx->ctx, x509, pkey, NULL, 0)) + { + msg(M_WARN, "PKCS#11: Failed to set cert and private key for OpenSSL"); + goto cleanup; + } + ret = 1; + +cleanup: + if (x509) + { + X509_free(x509); + } + if (pkey) + { + EVP_PKEY_free(pkey); + } + if (certificate) + { + pkcs11h_certificate_freeCertificate(certificate); + } + return ret; +} +#endif /* HAVE_XKEY_PROVIDER */ + int pkcs11_init_tls_session(pkcs11h_certificate_t certificate, struct tls_root_ctx *const ssl_ctx) { + +#ifdef HAVE_XKEY_PROVIDER + return (xkey_load_from_pkcs11h(certificate, ssl_ctx) == 0); /* inverts the return value */ +#endif + int ret = 1; X509 *x509 = NULL; diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index 8f0281b1..b48845eb 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -70,7 +70,7 @@ #include #endif -static OSSL_LIB_CTX *tls_libctx; +OSSL_LIB_CTX *tls_libctx; /* Global */ static void unload_xkey_provider(void); diff --git a/src/openvpn/xkey_common.h b/src/openvpn/xkey_common.h index e2ddc178..8eac4c7c 100644 --- a/src/openvpn/xkey_common.h +++ b/src/openvpn/xkey_common.h @@ -151,6 +151,8 @@ EVP_PKEY * xkey_load_generic_key(OSSL_LIB_CTX *libctx, void *handle, EVP_PKEY *pubkey, XKEY_EXTERNAL_SIGN_fn sign_op, XKEY_PRIVKEY_FREE_fn free_op); +extern OSSL_LIB_CTX *tls_libctx; /* Global */ + #endif /* HAVE_XKEY_PROVIDER */ #endif /* XKEY_COMMON_H_ */