From patchwork Thu Feb 17 05:31:59 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Antonio Quartulli X-Patchwork-Id: 2301 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director14.mail.ord1d.rsapps.net ([172.30.191.6]) by backend41.mail.ord1d.rsapps.net with LMTP id aO7KH6N4DmLvcAAAqwncew (envelope-from ) for ; Thu, 17 Feb 2022 11:32:35 -0500 Received: from proxy4.mail.ord1d.rsapps.net ([172.30.191.6]) by director14.mail.ord1d.rsapps.net with LMTP id 8KSDI6N4DmLQSwAAeJ7fFg (envelope-from ) for ; Thu, 17 Feb 2022 11:32:35 -0500 Received: from smtp33.gate.ord1c ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy4.mail.ord1d.rsapps.net with LMTPS id 6IU8I6N4DmLQdAAAiYrejw (envelope-from ) for ; Thu, 17 Feb 2022 11:32:35 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp33.gate.ord1c.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=unstable.cc X-Suspicious-Flag: YES X-Classification-ID: 35a9f214-900f-11ec-9058-54520067fec4-1-1 Received: from [216.105.38.7] ([216.105.38.7:46086] helo=lists.sourceforge.net) by smtp33.gate.ord1c.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 25/63-00371-2A87E026; Thu, 17 Feb 2022 11:32:35 -0500 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.94.2) (envelope-from ) id 1nKjh4-0001oF-GL; Thu, 17 Feb 2022 16:31:45 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nKjh3-0001o9-DC for openvpn-devel@lists.sourceforge.net; Thu, 17 Feb 2022 16:31:43 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=DiEJRxafiSrTu/G6f7q2SGAoqOJ4q3Jpbl5zUZe/OAY=; b=L6CDA7T/NGhvM379IlnbnPWwr+ TwiDnPJmiW7kJ3vMxNq8k+WuFYydycvsIKnhFR8cgcgAvuPwZGUGnAJOjn1XvXCW9HjSyxGCpCMjx QrBpwencSowbkSEdONHLm5/usmLwqCQ6WG62r8wHjlizfDh3AUljoRPso/02t3iw9f30=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=DiEJRxafiSrTu/G6f7q2SGAoqOJ4q3Jpbl5zUZe/OAY=; b=Vqi+4UHK3m/lQ0qZDpM/iB9R84 oD1U2AZ3Eppof4Yltd2iZ+f0Li4anVtGj/spgBBrtvJYI4VlXUsHB2U0wGyWxGi7+4sEvAuaeytXz 24zUlK2+NLXnFvfV312P6+/6nAQAtLEBR03tVx3bAsl6fmQUAP/jJdA9SKrrj+PfSAUw=; Received: from s2.neomailbox.net ([5.148.176.60]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.94.2) id 1nKjh0-0003DE-IZ for openvpn-devel@lists.sourceforge.net; Thu, 17 Feb 2022 16:31:43 +0000 From: Antonio Quartulli To: openvpn-devel@lists.sourceforge.net Date: Thu, 17 Feb 2022 17:31:59 +0100 Message-Id: <20220217163159.7936-1-a@unstable.cc> In-Reply-To: <20220217143241.18766-1-a@unstable.cc> References: <20220217143241.18766-1-a@unstable.cc> MIME-Version: 1.0 X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: At the moment we have tls_crypt_kt() and auth_token_kt that basically do the same thing, but with different algorithms used to initialise the structure. In order to avoid code duplication and copy/paste errors, unify code and make it parametric, so that it can be re-used in various places. Content analysis details: (-0.0 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 T_SCC_BODY_TEXT_LINE No description available. X-Headers-End: 1nKjh0-0003DE-IZ Subject: [Openvpn-devel] [PATCH v3] crypto: unify key_type creation code X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Antonio Quartulli Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox At the moment we have tls_crypt_kt() and auth_token_kt that basically do the same thing, but with different algorithms used to initialise the structure. In order to avoid code duplication and copy/paste errors, unify code and make it parametric, so that it can be re-used in various places. Signed-off-by: Antonio Quartulli Acked-by: Gert Doering --- Changes from v1: * added doc for optname param Changes from v2: * restore original helper functions and reduce their bodies to calling the generic create_kt(). This way users of those funcs are not harmed. --- src/openvpn/auth_token.c | 14 +------------- src/openvpn/crypto.h | 31 +++++++++++++++++++++++++++++++ src/openvpn/tls_crypt.c | 17 +---------------- 3 files changed, 33 insertions(+), 29 deletions(-) diff --git a/src/openvpn/auth_token.c b/src/openvpn/auth_token.c index 10c9dde6..9a85655f 100644 --- a/src/openvpn/auth_token.c +++ b/src/openvpn/auth_token.c @@ -33,21 +33,9 @@ const char *auth_token_pem_name = "OpenVPN auth-token server key"; static struct key_type auth_token_kt(void) { - struct key_type kt = { 0 }; - /* We do not encrypt our session tokens */ - kt.cipher = "none"; - kt.digest = "SHA256"; - - if (!md_valid(kt.digest)) - { - msg(M_WARN, "ERROR: --tls-crypt requires HMAC-SHA-256 support."); - return (struct key_type) { 0 }; - } - - return kt; + return create_kt("none", "SHA256", "auth-gen-token"); } - void add_session_token_env(struct tls_session *session, struct tls_multi *multi, const struct user_pass *up) diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h index 6e505517..806632ed 100644 --- a/src/openvpn/crypto.h +++ b/src/openvpn/crypto.h @@ -547,4 +547,35 @@ key_ctx_bi_defined(const struct key_ctx_bi *key) */ const char *print_key_filename(const char *str, bool is_inline); +/** + * Creates and validates an instance of struct key_type with the provided + * algs. + * + * @param cipher the cipher algorithm to use (must be a string literal) + * @param md the digest algorithm to use (must be a string literal) + * @param optname the name of the option requiring the key_type object + * + * @return the initialized key_type instance + */ +static inline struct key_type +create_kt(const char *cipher, const char *md, const char *optname) +{ + struct key_type kt; + kt.cipher = cipher; + kt.digest = md; + + if (cipher_defined(kt.cipher) && !cipher_valid(kt.cipher)) + { + msg(M_WARN, "ERROR: --%s requires %s support.", optname, kt.cipher); + return (struct key_type) { 0 }; + } + if (md_defined(kt.digest) && !md_valid(kt.digest)) + { + msg(M_WARN, "ERROR: --%s requires %s support.", optname, kt.digest); + return (struct key_type) { 0 }; + } + + return kt; +} + #endif /* CRYPTO_H */ diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c index aae2a917..88730a99 100644 --- a/src/openvpn/tls_crypt.c +++ b/src/openvpn/tls_crypt.c @@ -50,22 +50,7 @@ static const uint8_t TLS_CRYPT_METADATA_TYPE_TIMESTAMP = 0x01; static struct key_type tls_crypt_kt(void) { - struct key_type kt; - kt.cipher = "AES-256-CTR"; - kt.digest = "SHA256"; - - if (!cipher_valid(kt.cipher)) - { - msg(M_WARN, "ERROR: --tls-crypt requires AES-256-CTR support."); - return (struct key_type) { 0 }; - } - if (!md_valid(kt.digest)) - { - msg(M_WARN, "ERROR: --tls-crypt requires HMAC-SHA-256 support."); - return (struct key_type) { 0 }; - } - - return kt; + return create_kt("AES-256-CTR", "SHA256", "tls-crypt"); } int