From patchwork Thu Feb 13 02:50:47 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 994 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director8.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id gKSCJoJURV5xPwAAIUCqbw for ; Thu, 13 Feb 2020 08:52:02 -0500 Received: from proxy16.mail.ord1d.rsapps.net ([172.30.191.6]) by director8.mail.ord1d.rsapps.net with LMTP id OChvJoJURV59RwAAfY0hYg ; Thu, 13 Feb 2020 08:52:02 -0500 Received: from smtp19.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy16.mail.ord1d.rsapps.net with LMTP id QEp9JYJURV6rfAAAetu3IA ; Thu, 13 Feb 2020 08:52:02 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp19.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 020993a0-4e68-11ea-82b7-525400d67fa8-1-1 Received: from [216.105.38.7] ([216.105.38.7:56416] helo=lists.sourceforge.net) by smtp19.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 77/EE-23502-184554E5; Thu, 13 Feb 2020 08:52:01 -0500 Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1j2EtU-0001hD-2C; Thu, 13 Feb 2020 13:51:04 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1j2EtS-0001h4-NT for openvpn-devel@lists.sourceforge.net; Thu, 13 Feb 2020 13:51:02 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:To: From:Sender:Reply-To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=M+ymsTgVSFFgy7XCa+Ne27cET+piToz/DBhc4u9o49Y=; b=bTkoyiZ+CYazDwbu//QDb/HSNF Z0j7nvR7samUAzzbPhLOBZ89dH42UlBLKXxmGyc5pwuZw19u8fj29QwA5aT+II1oDo5Z0e94QnugC 89p/lzuGSB5LYYfSLZ1kOkW1VPthU8yMxMBR/+YPciblzfm28pdODa+ec4y8jOUCaixs=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=M+ymsTgVSFFgy7XCa+Ne27cET+piToz/DBhc4u9o49Y=; b=fb8BjxjI4T7cagxvPyjowzBoKn qXmHz7KAMD3jzYxHK6cbHmcX86OpND2s7+piYb24z08cVt2mOcoBMwJNV6TZRiYCluiJAkqPoS/Kh UiVkVUamCcEdg5JexgUXc1lkQnozNXJ1UwY2b+8dlDWLkdcR1MOBNGAZS8m+KRgWLoPA=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-4.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92.2) id 1j2EtO-002zWF-NH for openvpn-devel@lists.sourceforge.net; Thu, 13 Feb 2020 13:51:02 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.92.3 (FreeBSD)) (envelope-from ) id 1j2EtD-00024e-FC for openvpn-devel@lists.sourceforge.net; Thu, 13 Feb 2020 14:50:47 +0100 Received: (nullmailer pid 9065 invoked by uid 10006); Thu, 13 Feb 2020 13:50:47 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Thu, 13 Feb 2020 14:50:47 +0100 Message-Id: <20200213135047.9020-1-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: rfc2549.org] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record X-Headers-End: 1j2EtO-002zWF-NH Subject: [Openvpn-devel] [PATCH v2 2/5] Implement dynamic NCP negotiation X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox Our current NCP version is flawed in the way that it can only indicate support for AES-256-GCM and AES-128-GCM. While configuring client and server with different ncp-cipher configuration directive works, the server will blindly push the first cipher of that list to the client if the client sends IV_NCP=2. This patches introduces IV_CIPHER sent from the client to the server that contains the full list of cipers that the client is willing to support (*). The server will then pick the first ciphr of its own ncp-cipher list that the client indicates support for. We choose a textual representation of the ciphers instead of a binary sinc a binary would mean that we would need to have a central place to maintain a mapping between binary and the actual cipher name. Also the normal ncp-cipher list is quite short, so this should not be problem. It also provides the freedom to negioate new ciphers from SSL libraries without the need to upgrade OpenVPN/its binary cipher table. * the client/server will also accpt the cipher specifid in --cipher but eventually we want to get rid of --ciper. So this patch keeps a reasonable backwards compatbility (especially poor man's NCP) but does not encourage to use --cipher for negotiation in documentation or warning messages. Patch V2: Remove #include "ssl_ncp.h" Note to compile on windows the patch "Add strsep compat function" should be applied first Signed-off-by: Arne Schwabe Acked-by: Lev Stipakov --- doc/openvpn.8 | 10 +++- src/openvpn/init.c | 1 - src/openvpn/push.c | 32 +++++++---- src/openvpn/ssl.c | 111 +++++++++++++++++++++++++++++++++++++-- src/openvpn/ssl.h | 34 ++++++++++++ src/openvpn/ssl_common.h | 1 - 6 files changed, 171 insertions(+), 18 deletions(-) diff --git a/doc/openvpn.8 b/doc/openvpn.8 index b8f2f042..d631ebe7 100644 --- a/doc/openvpn.8 +++ b/doc/openvpn.8 @@ -3117,6 +3117,11 @@ IV_NCP=2 \-\- negotiable ciphers, client supports pushed by the server, a value of 2 or greater indicates client supports AES\-GCM\-128 and AES\-GCM\-256. +IV_CIPHERS= \-\- the client pushes the list of configured +ciphers with the +\.B -\-\ncp\-ciphers +option to the server. + IV_GUI_VER= \-\- the UI version of a UI if one is running, for example "de.blinkt.openvpn 0.5.47" for the Android app. @@ -4374,7 +4379,8 @@ is a colon\-separated list of ciphers, and defaults to For servers, the first cipher from .B cipher_list -will be pushed to clients that support cipher negotiation. +that is also supported by the client will be pushed to clients +that support cipher negotiation. Cipher negotiation is enabled in client\-server mode only. I.e. if .B \-\-mode @@ -4398,7 +4404,7 @@ NCP server (v2.4+) with "\-\-cipher BF\-CBC" and "\-\-ncp\-ciphers AES\-256\-GCM:AES\-256\-CBC" set can either specify "\-\-cipher BF\-CBC" or "\-\-cipher AES\-256\-CBC" and both will work. -Note, for using NCP with a OpenVPN 2.4 server this list must include +Note, for using NCP with a OpenVPN 2.4 peer this list must include the AES\-256\-GCM and AES\-128\-GCM ciphers. .\"********************************************************* .TP diff --git a/src/openvpn/init.c b/src/openvpn/init.c index d83b42b0..3488d2ea 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -2827,7 +2827,6 @@ do_init_crypto_tls(struct context *c, const unsigned int flags) to.replay_time = options->replay_time; to.tcp_mode = link_socket_proto_connection_oriented(options->ce.proto); to.config_ciphername = c->c1.ciphername; - to.config_authname = c->c1.authname; to.config_ncp_ciphers = c->c1.ncp_ciphers; to.ncp_enabled = options->ncp_enabled; to.transition_window = options->transition_window; diff --git a/src/openvpn/push.c b/src/openvpn/push.c index 368b6920..1f1e1f0d 100644 --- a/src/openvpn/push.c +++ b/src/openvpn/push.c @@ -429,7 +429,7 @@ prepare_push_reply(struct context *c, struct gc_arena *gc, prepare_auth_token_push_reply(tls_multi, gc, push_list); /* Push cipher if client supports Negotiable Crypto Parameters */ - if (tls_peer_info_ncp_ver(peer_info) >= 2 && o->ncp_enabled) + if (o->ncp_enabled) { /* if we have already created our key, we cannot *change* our own * cipher -> so log the fact and push the "what we have now" cipher @@ -445,17 +445,31 @@ prepare_push_reply(struct context *c, struct gc_arena *gc, } else { - /* Push the first cipher from --ncp-ciphers to the client. - * TODO: actual negotiation, instead of server dictatorship. */ - char *push_cipher = string_alloc(o->ncp_ciphers, &o->gc); - o->ciphername = strtok(push_cipher, ":"); + /* + * Push the first cipher from --ncp-ciphers to the client that + * the client announces to be supporting. + */ + char *push_cipher = ncp_get_best_cipher(o->ncp_ciphers, o->ciphername, + peer_info, + tls_multi->remote_ciphername, + &o->gc); + + if (push_cipher) + { + o->ciphername = push_cipher; + } + else + { + char *peer_ciphers = tls_peer_ncp_list(peer_info); + msg(M_INFO, "PUSH: No common cipher between server and client." + "Expect this connection not to work. " + "Server ncp-ciphers: '%s', client supported ciphers '%s'", + o->ncp_ciphers, peer_ciphers); + free(peer_ciphers); + } } push_option_fmt(gc, push_list, M_USAGE, "cipher %s", o->ciphername); } - else if (o->ncp_enabled) - { - tls_poor_mans_ncp(o, tls_multi->remote_ciphername); - } return true; } diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index b8351737..9476f455 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -1934,6 +1934,81 @@ tls_item_in_cipher_list(const char *item, const char *list) return token != NULL; } +char * +tls_peer_ncp_list(const char *peer_info) +{ + /* Check if the peer sends the IV_CIPHERS list */ + const char *ncp_ciphers_start; + if (peer_info && (ncp_ciphers_start = strstr(peer_info, "IV_CIPHERS="))) + { + ncp_ciphers_start += strlen("IV_CIPHERS="); + const char *ncp_ciphers_end = strstr(ncp_ciphers_start, "\n"); + if (!ncp_ciphers_end) + { + /* IV_CIPHERS is at end of the peer_info list and no '\n' + * follows */ + ncp_ciphers_end = ncp_ciphers_start + strlen(ncp_ciphers_start); + } + + char *ncp_ciphers_peer = string_alloc(ncp_ciphers_start, NULL); + /* NULL terminate the copy at the right position */ + ncp_ciphers_peer[ncp_ciphers_end - ncp_ciphers_start] = '\0'; + return ncp_ciphers_peer; + + } + else if (tls_peer_info_ncp_ver(peer_info)>=2) + { + /* If the peer announces IV_NCP=2 then it supports the AES GCM + * ciphers */ + return strdup("AES-256-GCM:AES-128-GCM"); + } + else + { + return strdup(""); + } +} + +char * +ncp_get_best_cipher(const char *server_list, const char *server_cipher, + const char *peer_info, const char *remote_cipher, + struct gc_arena *gc) +{ + char *peer_ncp_list = tls_peer_ncp_list(peer_info); + + char *tmp_ciphers = string_alloc(server_list, NULL); + char *tmp_ciphers_orig = tmp_ciphers; + + const char *token = strsep(&tmp_ciphers, ":"); + while (token) + { + if (tls_item_in_cipher_list(token, peer_ncp_list) + || streq(token, remote_cipher)) + { + break; + } + token = strsep(&tmp_ciphers, ":"); + } + /* We have not found a common cipher, as a last resort check if the + * server cipher can be used + */ + if (token == NULL + && (tls_item_in_cipher_list(server_cipher, peer_ncp_list) + || streq(server_cipher, remote_cipher))) + { + token = server_cipher; + } + + char *ret = NULL; + if (token != NULL) + { + ret = string_alloc(token, gc); + } + + free(tmp_ciphers_orig); + free(peer_ncp_list); + return ret; +} + void tls_poor_mans_ncp(struct options *o, const char *remote_ciphername) { @@ -2322,11 +2397,15 @@ push_peer_info(struct buffer *buf, struct tls_session *session) /* support for Negotiable Crypto Parameters */ if (session->opt->ncp_enabled - && (session->opt->mode == MODE_SERVER || session->opt->pull) - && tls_item_in_cipher_list("AES-128-GCM", session->opt->config_ncp_ciphers) - && tls_item_in_cipher_list("AES-256-GCM", session->opt->config_ncp_ciphers)) + && (session->opt->mode == MODE_SERVER || session->opt->pull)) { - buf_printf(&out, "IV_NCP=2\n"); + if (tls_item_in_cipher_list("AES-128-GCM", session->opt->config_ncp_ciphers) + && tls_item_in_cipher_list("AES-256-GCM", session->opt->config_ncp_ciphers)) + { + + buf_printf(&out, "IV_NCP=2\n"); + } + buf_printf(&out, "IV_CIPHERS=%s\n", session->opt->config_ncp_ciphers); } /* push compression status */ @@ -2561,6 +2640,28 @@ error: return false; } +/** + * Returns whether the client supports NCP either by + * announcing IV_NCP>=2 or the IV_CIPHERS list + */ +static bool +tls_peer_supports_ncp(const char *peer_info) +{ + if (!peer_info) + { + return false; + } + else if (tls_peer_info_ncp_ver(peer_info) >= 2 + || strstr(peer_info, "IV_CIPHERS=")) + { + return true; + } + else + { + return false; + } +} + static bool key_method_2_read(struct buffer *buf, struct tls_multi *multi, struct tls_session *session) { @@ -2633,7 +2734,7 @@ key_method_2_read(struct buffer *buf, struct tls_multi *multi, struct tls_sessio multi->remote_ciphername = options_string_extract_option(options, "cipher", NULL); - if (tls_peer_info_ncp_ver(multi->peer_info) < 2) + if (!tls_peer_supports_ncp(multi->peer_info)) { /* Peer does not support NCP, but leave NCP enabled if the local and * remote cipher do not match to attempt 'poor-man's NCP'. diff --git a/src/openvpn/ssl.h b/src/openvpn/ssl.h index a944ca3a..ad3b46d7 100644 --- a/src/openvpn/ssl.h +++ b/src/openvpn/ssl.h @@ -512,6 +512,40 @@ tls_get_peer_info(const struct tls_multi *multi) */ int tls_peer_info_ncp_ver(const char *peer_info); +/** + * Iterates through the ciphers in server_list and return the first + * cipher that is also supported by the peer according to the IV_NCP + * and IV_CIPHER values in peer_info. + * + * We also accept a cipher that is the remote cipher of the client for + * "Poor man's NCP": Use peer cipher if it is an allowed (NCP) cipher. + * Allows non-NCP peers to upgrade their cipher individually. + * + * Make sure to call tls_session_update_crypto_params() after calling this + * function. + * + * @param gc gc arena that is ONLY used to allocate the returned string + * + * @returns NULL if no common cipher is available, otherwise the best common + * cipher + */ +char * +ncp_get_best_cipher(const char *server_list, const char *server_cipher, + const char *peer_info, const char *remote_cipher, + struct gc_arena *gc); + + +/** + * Returns the support cipher list from the peer according to the IV_NCP + * and IV_CIPHER values in peer_info. + * + * @returns Either a string containing the ncp list that needs to be + * free()ed after use. If no information is available an empty string + * ("") is returned. + */ +char * +tls_peer_ncp_list(const char *peer_info); + /** * Check whether the ciphers in the supplied list are supported. * diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h index fb82f610..998ea3c4 100644 --- a/src/openvpn/ssl_common.h +++ b/src/openvpn/ssl_common.h @@ -289,7 +289,6 @@ struct tls_options bool tcp_mode; const char *config_ciphername; - const char *config_authname; const char *config_ncp_ciphers; bool ncp_enabled; From patchwork Thu Feb 13 02:51:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 995 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director10.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id wFoVB6JURV6DWQAAIUCqbw for ; Thu, 13 Feb 2020 08:52:34 -0500 Received: from proxy12.mail.ord1d.rsapps.net ([172.30.191.6]) by director10.mail.ord1d.rsapps.net with LMTP id YHLqBqJURV7pOwAApN4f7A ; Thu, 13 Feb 2020 08:52:34 -0500 Received: from smtp38.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy12.mail.ord1d.rsapps.net with LMTP id 4JGHBqJURV6/RQAA7PHxkg ; Thu, 13 Feb 2020 08:52:34 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp38.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 1485c954-4e68-11ea-b8ba-525400f6a58b-1-1 Received: from [216.105.38.7] ([216.105.38.7:56620] helo=lists.sourceforge.net) by smtp38.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id D1/1E-04176-0A4554E5; Thu, 13 Feb 2020 08:52:32 -0500 Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1j2EuA-0001jl-89; Thu, 13 Feb 2020 13:51:46 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1j2Eu9-0001jd-4y for openvpn-devel@lists.sourceforge.net; Thu, 13 Feb 2020 13:51:45 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:To: From:Sender:Reply-To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=lPDRJDbNlbnsw+cPzFh1Ofmoe5zfFMCZzRyY/cKM1ek=; b=fnwHY7cD2l+VOu3FpzvQo7yiQH 6gPWorClJIDIc8S72wrnyvjhUWWnzR689ygMFf+p8io/oWVN497XFCp6FqLABZ30uhEHhVFsd2Gxh hJLDvpNeWmkHbQ02iL3nURVEeAMcrV3CVDog9vJiJI35l7QQ+2HbYK0Tt45JXQOMFWc4=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=lPDRJDbNlbnsw+cPzFh1Ofmoe5zfFMCZzRyY/cKM1ek=; b=fHCRMFYeRmhC3RgtClZ8vDeM2A UuO7zM+g/bonNi9amNJQf8OOoQAMU7jRkCl5fRGLtdIiRzt9IDeWUSbBbODEwYW9qxTYvcbc4MY4+ MYRizL4AyMcRYB0Gy8PD1wbopiMo7tMMu3jBbpVE+pbTYhHAL3rNftymgZdPw0+cpREs=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-3.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92.2) id 1j2Eu5-0037wK-Fp for openvpn-devel@lists.sourceforge.net; Thu, 13 Feb 2020 13:51:45 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.92.3 (FreeBSD)) (envelope-from ) id 1j2Etr-00024t-4k for openvpn-devel@lists.sourceforge.net; Thu, 13 Feb 2020 14:51:27 +0100 Received: (nullmailer pid 9177 invoked by uid 10006); Thu, 13 Feb 2020 13:51:26 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Thu, 13 Feb 2020 14:51:26 +0100 Message-Id: <20200213135126.9131-1-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20191117181243.28919-3-arne@rfc2549.org> References: <20191117181243.28919-3-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: rfc2549.org] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record X-Headers-End: 1j2Eu5-0037wK-Fp Subject: [Openvpn-devel] [PATCH v2 3/5] Move NCP related function into a seperate file and add unit tests X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox This allows unit test the NCP functions. The ssl.c file has too many dependencies to make unit testing of it viable. Patch V2: Removing the include "ssl_ncp.h" from options.c for V2 of implement dynamic NCP forces a new version of this patch to add the #include in this patch. Merge VS studio file changes for ssl_ncp.[ch] into this patch Signed-off-by: Arne Schwabe --- src/openvpn/Makefile.am | 1 + src/openvpn/init.c | 1 + src/openvpn/multi.c | 1 + src/openvpn/openvpn.vcxproj | 2 + src/openvpn/options.c | 1 + src/openvpn/push.c | 1 + src/openvpn/ssl.c | 172 +------------------- src/openvpn/ssl.h | 65 -------- src/openvpn/ssl_ncp.c | 225 +++++++++++++++++++++++++++ src/openvpn/ssl_ncp.h | 101 ++++++++++++ tests/unit_tests/openvpn/Makefile.am | 18 ++- tests/unit_tests/openvpn/test_ncp.c | 182 ++++++++++++++++++++++ 12 files changed, 534 insertions(+), 236 deletions(-) create mode 100644 src/openvpn/ssl_ncp.c create mode 100644 src/openvpn/ssl_ncp.h create mode 100644 tests/unit_tests/openvpn/test_ncp.c diff --git a/src/openvpn/Makefile.am b/src/openvpn/Makefile.am index d1bb99c2..2ea47cda 100644 --- a/src/openvpn/Makefile.am +++ b/src/openvpn/Makefile.am @@ -116,6 +116,7 @@ openvpn_SOURCES = \ ssl.c ssl.h ssl_backend.h \ ssl_openssl.c ssl_openssl.h \ ssl_mbedtls.c ssl_mbedtls.h \ + ssl_ncp.c ssl_ncp.h \ ssl_common.h \ ssl_verify.c ssl_verify.h ssl_verify_backend.h \ ssl_verify_openssl.c ssl_verify_openssl.h \ diff --git a/src/openvpn/init.c b/src/openvpn/init.c index 3488d2ea..9aa050ec 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -49,6 +49,7 @@ #include "ping.h" #include "mstats.h" #include "ssl_verify.h" +#include "ssl_ncp.h" #include "tls_crypt.h" #include "forward.h" #include "auth_token.h" diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index d594dd25..b82c68c4 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -45,6 +45,7 @@ #include "gremlin.h" #include "mstats.h" #include "ssl_verify.h" +#include "ssl_ncp.h" #include "vlan.h" #include diff --git a/src/openvpn/openvpn.vcxproj b/src/openvpn/openvpn.vcxproj index 614d720a..53ac5482 100644 --- a/src/openvpn/openvpn.vcxproj +++ b/src/openvpn/openvpn.vcxproj @@ -192,6 +192,7 @@ + @@ -278,6 +279,7 @@ + diff --git a/src/openvpn/options.c b/src/openvpn/options.c index c459b260..d057975c 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -45,6 +45,7 @@ #include "shaper.h" #include "crypto.h" #include "ssl.h" +#include "ssl_ncp.h" #include "options.h" #include "misc.h" #include "socket.h" diff --git a/src/openvpn/push.c b/src/openvpn/push.c index 1f1e1f0d..38069cb5 100644 --- a/src/openvpn/push.c +++ b/src/openvpn/push.c @@ -33,6 +33,7 @@ #include "options.h" #include "ssl.h" #include "ssl_verify.h" +#include "ssl_ncp.h" #include "manage.h" #include "memdbg.h" diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 9476f455..e21279f1 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -59,6 +59,7 @@ #include "ssl.h" #include "ssl_verify.h" #include "ssl_backend.h" +#include "ssl_ncp.h" #include "auth_token.h" #include "memdbg.h" @@ -67,6 +68,7 @@ static const char ssl_default_options_string[] = "V0 UNDEF"; #endif + static inline const char * local_options_string(const struct tls_session *session) { @@ -1914,115 +1916,6 @@ key_ctx_update_implicit_iv(struct key_ctx *ctx, uint8_t *key, size_t key_len) } } -bool -tls_item_in_cipher_list(const char *item, const char *list) -{ - char *tmp_ciphers = string_alloc(list, NULL); - char *tmp_ciphers_orig = tmp_ciphers; - - const char *token = strtok(tmp_ciphers, ":"); - while (token) - { - if (0 == strcmp(token, item)) - { - break; - } - token = strtok(NULL, ":"); - } - free(tmp_ciphers_orig); - - return token != NULL; -} - -char * -tls_peer_ncp_list(const char *peer_info) -{ - /* Check if the peer sends the IV_CIPHERS list */ - const char *ncp_ciphers_start; - if (peer_info && (ncp_ciphers_start = strstr(peer_info, "IV_CIPHERS="))) - { - ncp_ciphers_start += strlen("IV_CIPHERS="); - const char *ncp_ciphers_end = strstr(ncp_ciphers_start, "\n"); - if (!ncp_ciphers_end) - { - /* IV_CIPHERS is at end of the peer_info list and no '\n' - * follows */ - ncp_ciphers_end = ncp_ciphers_start + strlen(ncp_ciphers_start); - } - - char *ncp_ciphers_peer = string_alloc(ncp_ciphers_start, NULL); - /* NULL terminate the copy at the right position */ - ncp_ciphers_peer[ncp_ciphers_end - ncp_ciphers_start] = '\0'; - return ncp_ciphers_peer; - - } - else if (tls_peer_info_ncp_ver(peer_info)>=2) - { - /* If the peer announces IV_NCP=2 then it supports the AES GCM - * ciphers */ - return strdup("AES-256-GCM:AES-128-GCM"); - } - else - { - return strdup(""); - } -} - -char * -ncp_get_best_cipher(const char *server_list, const char *server_cipher, - const char *peer_info, const char *remote_cipher, - struct gc_arena *gc) -{ - char *peer_ncp_list = tls_peer_ncp_list(peer_info); - - char *tmp_ciphers = string_alloc(server_list, NULL); - char *tmp_ciphers_orig = tmp_ciphers; - - const char *token = strsep(&tmp_ciphers, ":"); - while (token) - { - if (tls_item_in_cipher_list(token, peer_ncp_list) - || streq(token, remote_cipher)) - { - break; - } - token = strsep(&tmp_ciphers, ":"); - } - /* We have not found a common cipher, as a last resort check if the - * server cipher can be used - */ - if (token == NULL - && (tls_item_in_cipher_list(server_cipher, peer_ncp_list) - || streq(server_cipher, remote_cipher))) - { - token = server_cipher; - } - - char *ret = NULL; - if (token != NULL) - { - ret = string_alloc(token, gc); - } - - free(tmp_ciphers_orig); - free(peer_ncp_list); - return ret; -} - -void -tls_poor_mans_ncp(struct options *o, const char *remote_ciphername) -{ - if (o->ncp_enabled && remote_ciphername - && 0 != strcmp(o->ciphername, remote_ciphername)) - { - if (tls_item_in_cipher_list(remote_ciphername, o->ncp_ciphers)) - { - o->ciphername = string_alloc(remote_ciphername, &o->gc); - msg(D_TLS_DEBUG_LOW, "Using peer cipher '%s'", o->ciphername); - } - } -} - /** * Generate data channel keys for the supplied TLS session. * @@ -2640,28 +2533,6 @@ error: return false; } -/** - * Returns whether the client supports NCP either by - * announcing IV_NCP>=2 or the IV_CIPHERS list - */ -static bool -tls_peer_supports_ncp(const char *peer_info) -{ - if (!peer_info) - { - return false; - } - else if (tls_peer_info_ncp_ver(peer_info) >= 2 - || strstr(peer_info, "IV_CIPHERS=")) - { - return true; - } - else - { - return false; - } -} - static bool key_method_2_read(struct buffer *buf, struct tls_multi *multi, struct tls_session *session) { @@ -4251,45 +4122,6 @@ tls_update_remote_addr(struct tls_multi *multi, const struct link_socket_actual gc_free(&gc); } -int -tls_peer_info_ncp_ver(const char *peer_info) -{ - const char *ncpstr = peer_info ? strstr(peer_info, "IV_NCP=") : NULL; - if (ncpstr) - { - int ncp = 0; - int r = sscanf(ncpstr, "IV_NCP=%d", &ncp); - if (r == 1) - { - return ncp; - } - } - return 0; -} - -bool -tls_check_ncp_cipher_list(const char *list) -{ - bool unsupported_cipher_found = false; - - ASSERT(list); - - char *const tmp_ciphers = string_alloc(list, NULL); - const char *token = strtok(tmp_ciphers, ":"); - while (token) - { - if (!cipher_kt_get(translate_cipher_name_from_openvpn(token))) - { - msg(M_WARN, "Unsupported cipher in --ncp-ciphers: %s", token); - unsupported_cipher_found = true; - } - token = strtok(NULL, ":"); - } - free(tmp_ciphers); - - return 0 < strlen(list) && !unsupported_cipher_found; -} - void show_available_tls_ciphers(const char *cipher_list, const char *cipher_list_tls13, diff --git a/src/openvpn/ssl.h b/src/openvpn/ssl.h index ad3b46d7..3449d91e 100644 --- a/src/openvpn/ssl.h +++ b/src/openvpn/ssl.h @@ -489,15 +489,6 @@ bool tls_session_update_crypto_params(struct tls_session *session, struct frame *frame, struct frame *frame_fragment); -/** - * "Poor man's NCP": Use peer cipher if it is an allowed (NCP) cipher. - * Allows non-NCP peers to upgrade their cipher individually. - * - * Make sure to call tls_session_update_crypto_params() after calling this - * function. - */ -void tls_poor_mans_ncp(struct options *o, const char *remote_ciphername); - #ifdef MANAGEMENT_DEF_AUTH static inline char * tls_get_peer_info(const struct tls_multi *multi) @@ -506,62 +497,6 @@ tls_get_peer_info(const struct tls_multi *multi) } #endif -/** - * Return the Negotiable Crypto Parameters version advertised in the peer info - * string, or 0 if none specified. - */ -int tls_peer_info_ncp_ver(const char *peer_info); - -/** - * Iterates through the ciphers in server_list and return the first - * cipher that is also supported by the peer according to the IV_NCP - * and IV_CIPHER values in peer_info. - * - * We also accept a cipher that is the remote cipher of the client for - * "Poor man's NCP": Use peer cipher if it is an allowed (NCP) cipher. - * Allows non-NCP peers to upgrade their cipher individually. - * - * Make sure to call tls_session_update_crypto_params() after calling this - * function. - * - * @param gc gc arena that is ONLY used to allocate the returned string - * - * @returns NULL if no common cipher is available, otherwise the best common - * cipher - */ -char * -ncp_get_best_cipher(const char *server_list, const char *server_cipher, - const char *peer_info, const char *remote_cipher, - struct gc_arena *gc); - - -/** - * Returns the support cipher list from the peer according to the IV_NCP - * and IV_CIPHER values in peer_info. - * - * @returns Either a string containing the ncp list that needs to be - * free()ed after use. If no information is available an empty string - * ("") is returned. - */ -char * -tls_peer_ncp_list(const char *peer_info); - -/** - * Check whether the ciphers in the supplied list are supported. - * - * @param list Colon-separated list of ciphers - * - * @returns true iff all ciphers in list are supported. - */ -bool tls_check_ncp_cipher_list(const char *list); - -/** - * Return true iff item is present in the colon-separated zero-terminated - * cipher list. - */ -bool tls_item_in_cipher_list(const char *item, const char *list); - - /* * inline functions */ diff --git a/src/openvpn/ssl_ncp.c b/src/openvpn/ssl_ncp.c new file mode 100644 index 00000000..029ac1d5 --- /dev/null +++ b/src/openvpn/ssl_ncp.c @@ -0,0 +1,225 @@ +/* + * OpenVPN -- An application to securely tunnel IP networks + * over a single TCP/UDP port, with support for SSL/TLS-based + * session authentication and key exchange, + * packet encryption, packet authentication, and + * packet compression. + * + * Copyright (C) 2002-2018 OpenVPN Inc + * Copyright (C) 2010-2018 Fox Crypto B.V. + * Copyright (C) 2008-2013 David Sommerseth + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 + * as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +/** + * @file Control Channel SSL/Data dynamic negotion Module + * This file is split from ssl.c to be able to unit test it. + */ + +/* + * The routines in this file deal with dynamically negotiating + * the data channel HMAC and cipher keys through a TLS session. + * + * Both the TLS session and the data channel are multiplexed + * over the same TCP/UDP port. + */ +#ifdef HAVE_CONFIG_H +#include "config.h" +#elif defined(_MSC_VER) +#include "config-msvc.h" +#endif + +#include "syshead.h" +#include "win32.h" + +#include "error.h" +#include "common.h" + +#include "ssl_ncp.h" + +/** + * Return the Negotiable Crypto Parameters version advertised in the peer info + * string, or 0 if none specified. + */ +static int +tls_peer_info_ncp_ver(const char *peer_info) +{ + const char *ncpstr = peer_info ? strstr(peer_info, "IV_NCP=") : NULL; + if (ncpstr) + { + int ncp = 0; + int r = sscanf(ncpstr, "IV_NCP=%d", &ncp); + if (r == 1) + { + return ncp; + } + } + return 0; +} + +/** + * Returns whether the client supports NCP either by + * announcing IV_NCP>=2 or the IV_CIPHERS list + */ +bool +tls_peer_supports_ncp(const char *peer_info) +{ + if (!peer_info) + { + return false; + } + else if (tls_peer_info_ncp_ver(peer_info) >= 2 + || strstr(peer_info, "IV_CIPHERS=")) + { + return true; + } + else + { + return false; + } +} + +bool +tls_check_ncp_cipher_list(const char *list) +{ + bool unsupported_cipher_found = false; + + ASSERT(list); + + char *const tmp_ciphers = string_alloc(list, NULL); + const char *token = strtok(tmp_ciphers, ":"); + while (token) + { + if (!cipher_kt_get(translate_cipher_name_from_openvpn(token))) + { + msg(M_WARN, "Unsupported cipher in --ncp-ciphers: %s", token); + unsupported_cipher_found = true; + } + token = strtok(NULL, ":"); + } + free(tmp_ciphers); + + return 0 < strlen(list) && !unsupported_cipher_found; +} + +bool +tls_item_in_cipher_list(const char *item, const char *list) +{ + char *tmp_ciphers = string_alloc(list, NULL); + char *tmp_ciphers_orig = tmp_ciphers; + + const char *token = strtok(tmp_ciphers, ":"); + while (token) + { + if (0 == strcmp(token, item)) + { + break; + } + token = strtok(NULL, ":"); + } + free(tmp_ciphers_orig); + + return token != NULL; +} + +char * +tls_peer_ncp_list(const char *peer_info) +{ + /* Check if the peer sends the IV_CIPHERS list */ + const char *ncp_ciphers_start; + if (peer_info && (ncp_ciphers_start = strstr(peer_info, "IV_CIPHERS="))) + { + ncp_ciphers_start += strlen("IV_CIPHERS="); + const char *ncp_ciphers_end = strstr(ncp_ciphers_start, "\n"); + if (!ncp_ciphers_end) + { + /* IV_CIPHERS is at end of the peer_info list and no '\n' + * follows */ + ncp_ciphers_end = ncp_ciphers_start + strlen(ncp_ciphers_start); + } + + char *ncp_ciphers_peer = string_alloc(ncp_ciphers_start, NULL); + /* NULL terminate the copy at the right position */ + ncp_ciphers_peer[ncp_ciphers_end - ncp_ciphers_start] = '\0'; + return ncp_ciphers_peer; + + } + else if (tls_peer_info_ncp_ver(peer_info)>=2) + { + /* If the peer announces IV_NCP=2 then it supports the AES GCM + * ciphers */ + return strdup("AES-256-GCM:AES-128-GCM"); + } + else + { + return strdup(""); + } +} + +char * +ncp_get_best_cipher(const char *server_list, const char *server_cipher, + const char *peer_info, const char *remote_cipher, + struct gc_arena *gc) +{ + char *peer_ncp_list = tls_peer_ncp_list(peer_info); + + char *tmp_ciphers = string_alloc(server_list, NULL); + char *tmp_ciphers_orig = tmp_ciphers; + + const char *token = strsep(&tmp_ciphers, ":"); + while (token) + { + if (tls_item_in_cipher_list(token, peer_ncp_list) + || streq(token, remote_cipher)) + { + break; + } + token = strsep(&tmp_ciphers, ":"); + } + /* We have not found a common cipher, as a last resort check if the + * server cipher can be used + */ + if (token == NULL + && (tls_item_in_cipher_list(server_cipher, peer_ncp_list) + || streq(server_cipher, remote_cipher))) + { + token = server_cipher; + } + + char *ret = NULL; + if (token != NULL) + { + ret = string_alloc(token, gc); + return ret; + } + + free(tmp_ciphers_orig); + free(peer_ncp_list); + return ret; +} + +void +tls_poor_mans_ncp(struct options *o, const char *remote_ciphername) +{ + if (o->ncp_enabled && remote_ciphername + && 0 != strcmp(o->ciphername, remote_ciphername)) + { + if (tls_item_in_cipher_list(remote_ciphername, o->ncp_ciphers)) + { + o->ciphername = string_alloc(remote_ciphername, &o->gc); + msg(D_TLS_DEBUG_LOW, "Using peer cipher '%s'", o->ciphername); + } + } +} diff --git a/src/openvpn/ssl_ncp.h b/src/openvpn/ssl_ncp.h new file mode 100644 index 00000000..82d008d8 --- /dev/null +++ b/src/openvpn/ssl_ncp.h @@ -0,0 +1,101 @@ +/* + * OpenVPN -- An application to securely tunnel IP networks + * over a single TCP/UDP port, with support for SSL/TLS-based + * session authentication and key exchange, + * packet encryption, packet authentication, and + * packet compression. + * + * Copyright (C) 2002-2018 OpenVPN Inc + * Copyright (C) 2010-2018 Fox Crypto B.V. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 + * as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +/** + * @file Control Channel SSL/Data dynamic negotion Module + * This file is split from ssl.h to be able to unit test it. + */ + +#ifndef OPENVPN_SSL_NCP_H +#define OPENVPN_SSL_NCP_H + +#include "buffer.h" +#include "options.h" + +/** + * Returns whether the client supports NCP either by + * announcing IV_NCP>=2 or the IV_CIPHERS list + */ +bool +tls_peer_supports_ncp(const char *peer_info); + +/** + * "Poor man's NCP": Use peer cipher if it is an allowed (NCP) cipher. + * Allows non-NCP peers to upgrade their cipher individually. + * + * Make sure to call tls_session_update_crypto_params() after calling this + * function. + */ +void tls_poor_mans_ncp(struct options *o, const char *remote_ciphername); + +/** + * Iterates through the ciphers in server_list and return the first + * cipher that is also supported by the peer according to the IV_NCP + * and IV_CIPHER values in peer_info. + * + * We also accept a cipher that is the remote cipher of the client for + * "Poor man's NCP": Use peer cipher if it is an allowed (NCP) cipher. + * Allows non-NCP peers to upgrade their cipher individually. + * + * Make sure to call tls_session_update_crypto_params() after calling this + * function. + * + * @param gc gc arena that is ONLY used to allocate the returned string + * + * @returns NULL if no common cipher is available, otherwise the best common + * cipher + */ +char * +ncp_get_best_cipher(const char *server_list, const char *server_cipher, + const char *peer_info, const char *remote_cipher, + struct gc_arena *gc); + + +/** + * Returns the support cipher list from the peer according to the IV_NCP + * and IV_CIPHER values in peer_info. + * + * @returns Either a string containing the ncp list that needs to be + * free()ed after use. If no information is available an empty string + * ("") is returned. + */ +char * +tls_peer_ncp_list(const char *peer_info); + +/** + * Check whether the ciphers in the supplied list are supported. + * + * @param list Colon-separated list of ciphers + * + * @returns true iff all ciphers in list are supported. + */ +bool tls_check_ncp_cipher_list(const char *list); + +/** + * Return true iff item is present in the colon-separated zero-terminated + * cipher list. + */ +bool tls_item_in_cipher_list(const char *item, const char *list); + +#endif /* ifndef OPENVPN_SSL_NCP_H */ diff --git a/tests/unit_tests/openvpn/Makefile.am b/tests/unit_tests/openvpn/Makefile.am index 60e84639..f0880a6b 100644 --- a/tests/unit_tests/openvpn/Makefile.am +++ b/tests/unit_tests/openvpn/Makefile.am @@ -6,7 +6,7 @@ if HAVE_LD_WRAP_SUPPORT test_binaries += argv_testdriver buffer_testdriver endif -test_binaries += crypto_testdriver packet_id_testdriver auth_token_testdriver +test_binaries += crypto_testdriver packet_id_testdriver auth_token_testdriver ncp_testdriver if HAVE_LD_WRAP_SUPPORT test_binaries += tls_crypt_testdriver endif @@ -110,3 +110,19 @@ auth_token_testdriver_SOURCES = test_auth_token.c mock_msg.c \ $(openvpn_srcdir)/packet_id.c \ $(openvpn_srcdir)/platform.c \ $(openvpn_srcdir)/base64.c + + +ncp_testdriver_CFLAGS = @TEST_CFLAGS@ \ + -I$(openvpn_includedir) -I$(compat_srcdir) -I$(openvpn_srcdir) \ + $(OPTIONAL_CRYPTO_CFLAGS) +ncp_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ + $(OPTIONAL_CRYPTO_LIBS) + +ncp_testdriver_SOURCES = test_ncp.c mock_msg.c \ + $(openvpn_srcdir)/buffer.c \ + $(openvpn_srcdir)/crypto.c \ + $(openvpn_srcdir)/crypto_mbedtls.c \ + $(openvpn_srcdir)/crypto_openssl.c \ + $(openvpn_srcdir)/otime.c \ + $(openvpn_srcdir)/packet_id.c \ + $(openvpn_srcdir)/platform.c diff --git a/tests/unit_tests/openvpn/test_ncp.c b/tests/unit_tests/openvpn/test_ncp.c new file mode 100644 index 00000000..ec85d6ef --- /dev/null +++ b/tests/unit_tests/openvpn/test_ncp.c @@ -0,0 +1,182 @@ +/* + * OpenVPN -- An application to securely tunnel IP networks + * over a single UDP port, with support for SSL/TLS-based + * session authentication and key exchange, + * packet encryption, packet authentication, and + * packet compression. + * + * Copyright (C) 2019 Arne Schwabe + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 + * as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifdef HAVE_CONFIG_H +#include "config.h" +#elif defined(_MSC_VER) +#include "config-msvc.h" +#endif + +#include "syshead.h" + +#include +#include +#include +#include +#include +#include +#include + +#include "ssl_ncp.c" + +/* Defines for use in the tests and the mock parse_line() */ + +const char *bf_chacha = "BF-CBC:CHACHA20-POLY1305"; +const char *aes_ciphers = "AES-256-GCM:AES-128-GCM"; + +static void +test_check_ncp_ciphers_list(void **state) +{ + assert_true(tls_check_ncp_cipher_list(aes_ciphers)); + assert_true(tls_check_ncp_cipher_list(bf_chacha)); + assert_false(tls_check_ncp_cipher_list("vollbit")); + assert_false(tls_check_ncp_cipher_list("AES-256-GCM:vollbit")); +} + +static void +test_extract_client_ciphers(void **state) +{ + const char *client_peer_info; + char *peer_list; + + client_peer_info = "foo=bar\nIV_foo=y\nIV_NCP=2"; + peer_list = tls_peer_ncp_list(client_peer_info); + assert_string_equal(aes_ciphers,peer_list); + assert_true(tls_peer_supports_ncp(client_peer_info)); + free(peer_list); + + client_peer_info = "foo=bar\nIV_foo=y\nIV_NCP=2\nIV_CIPHERS=BF-CBC"; + peer_list = tls_peer_ncp_list(client_peer_info); + assert_string_equal("BF-CBC", peer_list); + assert_true(tls_peer_supports_ncp(client_peer_info)); + free(peer_list); + + client_peer_info = "IV_NCP=2\nIV_CIPHERS=BF-CBC:FOO-BAR\nIV_BAR=7"; + peer_list = tls_peer_ncp_list(client_peer_info); + assert_string_equal("BF-CBC:FOO-BAR", peer_list); + assert_true(tls_peer_supports_ncp(client_peer_info)); + free(peer_list); + + client_peer_info = "IV_CIPHERS=BF-CBC:FOO-BAR\nIV_BAR=7"; + peer_list = tls_peer_ncp_list(client_peer_info); + assert_string_equal("BF-CBC:FOO-BAR", peer_list); + assert_true(tls_peer_supports_ncp(client_peer_info)); + free(peer_list); + + client_peer_info = "IV_YOLO=NO\nIV_BAR=7"; + peer_list = tls_peer_ncp_list(client_peer_info); + assert_string_equal("", peer_list); + assert_false(tls_peer_supports_ncp(client_peer_info)); + free(peer_list); + + peer_list = tls_peer_ncp_list(NULL); + assert_string_equal("", peer_list); + assert_false(tls_peer_supports_ncp(client_peer_info)); + free(peer_list); +} + +static void +test_poor_man(void **state) +{ + struct gc_arena gc = gc_new(); + char *best_cipher; + + const char *serverlist="CHACHA20_POLY1305:AES-128-GCM"; + + best_cipher = ncp_get_best_cipher(serverlist, "BF-CBC", + "IV_YOLO=NO\nIV_BAR=7", + "BF-CBC", &gc); + + assert_string_equal(best_cipher, "BF-CBC"); + + best_cipher = ncp_get_best_cipher(serverlist, "BF-CBC", + "IV_NCP=1\nIV_BAR=7", + "AES-128-GCM", &gc); + + assert_string_equal(best_cipher, "AES-128-GCM"); + + best_cipher = ncp_get_best_cipher(serverlist, "BF-CBC", + NULL, + "AES-128-GCM", &gc); + + assert_string_equal(best_cipher, "AES-128-GCM"); + + gc_free(&gc); +} + + +static void +test_ncp_best(void **state) +{ + struct gc_arena gc = gc_new(); + char *best_cipher; + + const char *serverlist="CHACHA20_POLY1305:AES-128-GCM:AES-256-GCM"; + + best_cipher = ncp_get_best_cipher(serverlist, "BF-CBC", + "IV_YOLO=NO\nIV_NCP=2\nIV_BAR=7", + "BF-CBC", &gc); + + assert_string_equal(best_cipher, "AES-128-GCM"); + + /* Best cipher is in --cipher of client */ + best_cipher = ncp_get_best_cipher(serverlist, "BF-CBC", + "IV_NCP=2\nIV_BAR=7", + "CHACHA20_POLY1305", &gc); + + assert_string_equal(best_cipher, "CHACHA20_POLY1305"); + + /* Best cipher is in --cipher of client */ + best_cipher = ncp_get_best_cipher(serverlist, "BF-CBC", + "IV_CIPHERS=AES-128-GCM", + "AES-256-CBC", &gc); + + + assert_string_equal(best_cipher, "AES-128-GCM"); + + /* IV_NCP=2 should be ignored if IV_CIPHERS is sent */ + best_cipher = ncp_get_best_cipher(serverlist, "BF-CBC", + "IV_FOO=7\nIV_CIPHERS=AES-256-GCM\nIV_NCP=2", + "AES-256-CBC", &gc); + + assert_string_equal(best_cipher, "AES-256-GCM"); + + + gc_free(&gc); +} + + + + +const struct CMUnitTest ncp_tests[] = { + cmocka_unit_test(test_check_ncp_ciphers_list), + cmocka_unit_test(test_extract_client_ciphers), + cmocka_unit_test(test_poor_man), + cmocka_unit_test(test_ncp_best) +}; + + +int main(void) +{ + return cmocka_run_group_tests(ncp_tests, NULL, NULL); +} From patchwork Thu Feb 13 02:52:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 996 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director11.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id 0BcUGANVRV7aUwAAIUCqbw for ; Thu, 13 Feb 2020 08:54:11 -0500 Received: from proxy5.mail.ord1d.rsapps.net ([172.30.191.6]) by director11.mail.ord1d.rsapps.net with LMTP id IJQLGANVRV6vLgAAvGGmqA ; Thu, 13 Feb 2020 08:54:11 -0500 Received: from smtp33.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy5.mail.ord1d.rsapps.net with LMTP id aCR1FwNVRV6rZgAA8Zzt7w ; Thu, 13 Feb 2020 08:54:11 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp33.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 4f227260-4e68-11ea-9e02-525400041ef2-1-1 Received: from [216.105.38.7] ([216.105.38.7:57014] helo=lists.sourceforge.net) by smtp33.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 3A/9E-08233-205554E5; Thu, 13 Feb 2020 08:54:10 -0500 Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1j2Eun-0001no-M6; Thu, 13 Feb 2020 13:52:25 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1j2Eum-0001nb-AW for openvpn-devel@lists.sourceforge.net; Thu, 13 Feb 2020 13:52:24 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:To: From:Sender:Reply-To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=6lp76JRBDyTjlsYdqZMAvQW8zvkFQu23fiBcrY585PE=; b=mV5kjVUlws8KfVH7JvBl3rViOp tIG5GE2ocv8SD2MUH4yWMY0AG0wWYaezWk+I/ZYpr8wwbNuhy+yuxvU4BZrfRvTyLU3krwxidZkNs Gi9iOQ+62MBEKadNb3Kuc1Mwa4jkpB5FhghJqwIZS1prW2eydLQKYCcudrAaFAr/TJPE=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=6lp76JRBDyTjlsYdqZMAvQW8zvkFQu23fiBcrY585PE=; b=FODluEa50Xm4LkgADIEIpzF0Kz UDahXuh868hziQA9NLbNWu9axUTPmHcKXmZhGutk9B+gqau1IZegYOP+ffHdE9b92rKRv/hF5QpoE uiLZHIM3jVB1TySsEQTZpX3LDuZ2l42CCr1ZNIdENhMxprBVGbcC1CWOGTUPqR35xw40=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-3.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92.2) id 1j2Euk-0037yI-Rb for openvpn-devel@lists.sourceforge.net; Thu, 13 Feb 2020 13:52:24 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.92.3 (FreeBSD)) (envelope-from ) id 1j2Eue-00025I-8Y for openvpn-devel@lists.sourceforge.net; Thu, 13 Feb 2020 14:52:16 +0100 Received: (nullmailer pid 9302 invoked by uid 10006); Thu, 13 Feb 2020 13:52:16 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Thu, 13 Feb 2020 14:52:16 +0100 Message-Id: <20200213135216.9257-1-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: rfc2549.org] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record X-Headers-End: 1j2Euk-0037yI-Rb Subject: [Openvpn-devel] [PATCH v2 4/5] Normalise ncp-ciphers option and restrict it to 127 bytes X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox In scenarios of mbed TLS vs OpenSSL we already normalise the ciphers that are send via the wire protocol via OCC to not have a mismatch warning between server and client. This is done by translate_cipher_name_from_openvpn. The same applies also to the ncp-ciphers list. Specifying non normalised names in ncp-ciphers will cause negotation not to succeed if ciphers are not in the same form. Therefore we will normalise the ciphers in options_postmutate. The alternative and a lot less user friendly alternative would be to bail if on of the ciphers in ncp-ciphers is not in its normalised form. Also restrict the ncp-ciphers list to 127. This is somewhat arbitrary but should prevent too large IV_CIPHER messages and problems sending those. The server will accept also large IV_CIPHER values from clients. Patch V2: Correct comment about normalising ciphers Signed-off-by: Arne Schwabe --- doc/openvpn.8 | 3 ++ src/openvpn/options.c | 14 ++++--- src/openvpn/ssl_ncp.c | 57 +++++++++++++++++++++++++---- src/openvpn/ssl_ncp.h | 19 +++++++++- tests/unit_tests/openvpn/test_ncp.c | 43 ++++++++++++++++++---- 5 files changed, 114 insertions(+), 22 deletions(-) diff --git a/doc/openvpn.8 b/doc/openvpn.8 index d631ebe7..c0ec80f9 100644 --- a/doc/openvpn.8 +++ b/doc/openvpn.8 @@ -4406,6 +4406,9 @@ AES\-256\-GCM:AES\-256\-CBC" set can either specify "\-\-cipher BF\-CBC" or Note, for using NCP with a OpenVPN 2.4 peer this list must include the AES\-256\-GCM and AES\-128\-GCM ciphers. + +This list is restricted to be 127 chars long after conversion to OpenVPN +ciphers. .\"********************************************************* .TP .B \-\-ncp\-disable diff --git a/src/openvpn/options.c b/src/openvpn/options.c index d057975c..06291970 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -2511,11 +2511,6 @@ options_postprocess_verify_ce(const struct options *options, const struct connec } #endif /* P2MP_SERVER */ - if (options->ncp_enabled && !tls_check_ncp_cipher_list(options->ncp_ciphers)) - { - msg(M_USAGE, "NCP cipher list contains unsupported ciphers."); - } - if (options->keysize) { msg(M_WARN, "WARNING: --keysize is DEPRECATED and will be removed in OpenVPN 2.6"); @@ -3093,6 +3088,15 @@ options_postprocess_mutate(struct options *o) options_postprocess_mutate_invariant(o); + if (o->ncp_enabled) + { + o->ncp_ciphers = mutate_ncp_cipher_list(o->ncp_ciphers, &o->gc); + if (o->ncp_ciphers == NULL) + { + msg(M_USAGE, "NCP cipher list contains unsupported ciphers or is too long."); + } + } + if (o->remote_list && !o->connection_list) { /* diff --git a/src/openvpn/ssl_ncp.c b/src/openvpn/ssl_ncp.c index 029ac1d5..9bebc1fd 100644 --- a/src/openvpn/ssl_ncp.c +++ b/src/openvpn/ssl_ncp.c @@ -91,27 +91,70 @@ tls_peer_supports_ncp(const char *peer_info) } } -bool -tls_check_ncp_cipher_list(const char *list) +char * +mutate_ncp_cipher_list(const char *list, struct gc_arena *gc) { - bool unsupported_cipher_found = false; + bool error_found = false; - ASSERT(list); + struct buffer new_list = alloc_buf(MAX_NCP_CIPHERS_LENGTH); char *const tmp_ciphers = string_alloc(list, NULL); const char *token = strtok(tmp_ciphers, ":"); while (token) { - if (!cipher_kt_get(translate_cipher_name_from_openvpn(token))) + /* + * Going through a roundtrip by using translate_cipher_name_from_openvpn + * and translate_cipher_name_to_openvpn also normalises the cipher name, + * e.g. replacing AeS-128-gCm with AES-128-GCM + */ + const char *cipher_name = translate_cipher_name_from_openvpn(token); + const cipher_kt_t *ktc = cipher_kt_get(cipher_name); + if (!ktc) { msg(M_WARN, "Unsupported cipher in --ncp-ciphers: %s", token); - unsupported_cipher_found = true; + error_found = true; + } + else + { + const char *ovpn_cipher_name = + translate_cipher_name_to_openvpn(cipher_kt_name(ktc)); + + if (buf_len(&new_list)> 0) + { + /* The next if condition ensure there is always space for + * a : + */ + buf_puts(&new_list, ":"); + } + + /* Ensure buffer has capacity for cipher name + : + \0 */ + if (!(buf_forward_capacity(&new_list) > + strlen(ovpn_cipher_name) + 2)) + { + msg(M_WARN, "Length of --ncp-ciphers is over the" + "limit of 127 chars"); + error_found = true; + } + else + { + buf_puts(&new_list, ovpn_cipher_name); + } } token = strtok(NULL, ":"); } + + + + char *ret = NULL; + if (!error_found && buf_len(&new_list) > 0) + { + buf_null_terminate(&new_list); + ret = string_alloc(buf_str(&new_list), gc); + } free(tmp_ciphers); + free_buf(&new_list); - return 0 < strlen(list) && !unsupported_cipher_found; + return ret; } bool diff --git a/src/openvpn/ssl_ncp.h b/src/openvpn/ssl_ncp.h index 82d008d8..62822e89 100644 --- a/src/openvpn/ssl_ncp.h +++ b/src/openvpn/ssl_ncp.h @@ -87,10 +87,17 @@ tls_peer_ncp_list(const char *peer_info); * Check whether the ciphers in the supplied list are supported. * * @param list Colon-separated list of ciphers + * @parms gc gc_arena to allocate the returned string * - * @returns true iff all ciphers in list are supported. + * @returns colon separated string of normalised (via + * translate_cipher_name_from_openvpn) and + * zero terminated string iff all ciphers + * in list are supported and the total length + * is short than MAX_NCP_CIPHERS_LENGTH. NULL + * otherwise. */ -bool tls_check_ncp_cipher_list(const char *list); +char * +mutate_ncp_cipher_list(const char *list, struct gc_arena *gc); /** * Return true iff item is present in the colon-separated zero-terminated @@ -98,4 +105,12 @@ bool tls_check_ncp_cipher_list(const char *list); */ bool tls_item_in_cipher_list(const char *item, const char *list); +/** + * The maximum length of a ncp-cipher string that is accepted. + * + * Since this list needs to be pushed as IV_CIPHERS, we are conservative + * about its length. + */ +#define MAX_NCP_CIPHERS_LENGTH 127 + #endif /* ifndef OPENVPN_SSL_NCP_H */ diff --git a/tests/unit_tests/openvpn/test_ncp.c b/tests/unit_tests/openvpn/test_ncp.c index ec85d6ef..a75e7f7a 100644 --- a/tests/unit_tests/openvpn/test_ncp.c +++ b/tests/unit_tests/openvpn/test_ncp.c @@ -47,10 +47,33 @@ const char *aes_ciphers = "AES-256-GCM:AES-128-GCM"; static void test_check_ncp_ciphers_list(void **state) { - assert_true(tls_check_ncp_cipher_list(aes_ciphers)); - assert_true(tls_check_ncp_cipher_list(bf_chacha)); - assert_false(tls_check_ncp_cipher_list("vollbit")); - assert_false(tls_check_ncp_cipher_list("AES-256-GCM:vollbit")); + struct gc_arena gc = gc_new(); + + assert_string_equal(mutate_ncp_cipher_list(aes_ciphers, &gc), aes_ciphers); + + assert_string_equal(mutate_ncp_cipher_list(bf_chacha, &gc), bf_chacha); + + assert_string_equal(mutate_ncp_cipher_list("BF-cbc:ChaCha20-Poly1305", &gc), + bf_chacha); + + + assert_ptr_equal(mutate_ncp_cipher_list("vollbit", &gc), NULL); + assert_ptr_equal(mutate_ncp_cipher_list("AES-256-GCM:vollbit", &gc), NULL); + assert_ptr_equal(mutate_ncp_cipher_list("", &gc), NULL); + + assert_ptr_equal(mutate_ncp_cipher_list( + "ChaCha20-Poly1305:ChaCha20-Poly1305:ChaCha20-Poly1305:" + "ChaCha20-Poly1305:ChaCha20-Poly1305:ChaCha20-Poly1305:" + "ChaCha20-Poly1305", &gc), NULL); + +#idef ENABLE_CRYPTO_OPENSSL + assert_string_equal(mutate_ncp_cipher_list("id-aes128-GCM:id-aes256-GCM", + &gc), aes_ciphers); +#else + assert_string_equal(mutate_ncp_cipher_list("BLOWFISH-CBC", + &gc), "BF-CBC"); + gc_free(&gc); + } static void @@ -101,7 +124,7 @@ test_poor_man(void **state) struct gc_arena gc = gc_new(); char *best_cipher; - const char *serverlist="CHACHA20_POLY1305:AES-128-GCM"; + const char *serverlist = "CHACHA20_POLY1305:AES-128-GCM"; best_cipher = ncp_get_best_cipher(serverlist, "BF-CBC", "IV_YOLO=NO\nIV_BAR=7", @@ -131,7 +154,7 @@ test_ncp_best(void **state) struct gc_arena gc = gc_new(); char *best_cipher; - const char *serverlist="CHACHA20_POLY1305:AES-128-GCM:AES-256-GCM"; + const char *serverlist = "CHACHA20_POLY1305:AES-128-GCM:AES-256-GCM"; best_cipher = ncp_get_best_cipher(serverlist, "BF-CBC", "IV_YOLO=NO\nIV_NCP=2\nIV_BAR=7", @@ -167,7 +190,6 @@ test_ncp_best(void **state) - const struct CMUnitTest ncp_tests[] = { cmocka_unit_test(test_check_ncp_ciphers_list), cmocka_unit_test(test_extract_client_ciphers), @@ -176,7 +198,12 @@ const struct CMUnitTest ncp_tests[] = { }; -int main(void) +int +main(void) { +#if defined(ENABLE_CRYPTO_OPENSSL) + OpenSSL_add_all_algorithms(); +#endif + return cmocka_run_group_tests(ncp_tests, NULL, NULL); }