aboutsummaryrefslogtreecommitdiff
path: root/src/openvpn/crypto_openssl.h
AgeCommit message (Collapse)Author
2023-10-18Remove openssl engine method for loading the keyArne Schwabe
This is a contribution for loading engine key. OpenSSL engine is deprecated since OpenSSL 3.0 and James Bottomley has not agreed to the proposed license chagne. He is also okay with removing the feature from the current code base as it is obsolete with OpenSSL 3.0. The original commit ID was a0a8d801dd0d84e0ec844b9ca4c225df7 (plus subsequent fixes). Change-Id: I2d353a0cea0a62f289b8c1060244df66dd7a14cb Signed-off-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20231006111910.3541180-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27133.html Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit e7427bcbb9b16b52d81c65b01d440a8ecd1e6ea7)
2023-01-10Update copyright year to 2023Frank Lichtenheld
Manually excluded ovpn_dco_win.h because it is an imported file. ovpn_dco_linux.h is already excluded because it still says 2021. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230110160531.81010-1-frank@lichtenheld.com> URL: https://patchwork.openvpn.net/project/openvpn2/patch/20230110160531.81010-1-frank@lichtenheld.com/ Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ccf9d57249acb9bc9a450aec3e613bda631415f5)
2022-01-26update copyright year to 2022Antonio Quartulli
Update performed by means of: dev-tools/update-copyright.sh Cc: David Sommerseth <davids@openvpn.net> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20220125142456.18176-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23650.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-13Remove md_kt_t and change crypto API to use const char*Arne Schwabe
As with the removal of cipher_kt_t, this is allows better support of OpenSSL 3.0 and mbed TLS 3.0 Patch v2: rebase Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211213150654.3993358-2-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20211213150654.3993358-2-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-13Remove cipher_kt_t and change type to const char* in APIArne Schwabe
Make the external crypto consumer oblivious to the internal cipher type that both mbed TLS and OpenSSL use. This change is mainly done so the cipher type that is used can be stay a const type but instead of an SSL library type, we now use a simple string to identify a cipher. This has the disadvantages that we do a cipher lookup every time a function is called that needs to query properties of a cipher. But none of these queries are in a critical path. This patch also fixes the memory leaks introduced by the EVP_fetch_cipher commit by always freeing the EVP_CIPHER. This also changes kt->cipher to be always defined with the name of the cipher. This only affects the "none" cipher cipher which was previously represented by kt->cipher to be NULL. Patch v2: rebase on master Patch v3: fix errors with mbed TLS without having md_kt to const char * patch also applied, fix logic inversion in tls_crypt_tk Patch v4: fix issue if cipher does not get changed by NCP that null cipher is then used Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211213150654.3993358-1-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20211213150654.3993358-1-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-12-05Remove cipher_kt_var_key_size and remaining --keysize documentationArne Schwabe
Remove --keysize from the manual page and also remove mentioning variable key size in output of ciphers as there is no longer a way to change the keysize. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211201180727.2496903-4-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23275.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-11-12Allow loading of non default providersArne Schwabe
This allows OpenVPN to load non-default providers. This is mainly useful for loading the legacy provider with --providers legacy default Patch v4: use spaces to seperate providers, unload providers. Patch v5: General cleanup, rename option to --providers, add option to usage() and add an entry to Changes.rst Patch v6: allow --providers also to be used (and be ignored) with mbed TLS Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211112130231.3799480-1-arne@rfc2549.org> URL: https://www.mail-archive.com/search?l=mid&q=20211112130231.3799480-1-arne@rfc2549.org Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-10-27Use new EVP_MAC API for HMAC implementationArne Schwabe
The old API is deprecated in OpenSSL 3.0 and the new API does not yet exist in OpenSSL 1.1. Emulating the new API would be more complex than just having two implementations. So this switches to a new hmac implementation for OpenSSL 3.0. Unfortunately the new API does not have an easy to reset an HMAC, so we need to keep the key around to emulate a reset functionality. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Message-Id: <20211019183127.614175-2-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23013.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-07-02Update Fox e-mail address in copyright noticesMax Fillinger
Replace openvpn@fox-it.com with openvpn@foxcrypto.com. Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210701171458.8897-1-maximilian.fillinger@foxcrypto.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22608.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-06-15Update copyrightsDavid Sommerseth
- Update the update-copyright script to include more contributors as well as correcting a few typos - Correct a copyright address in the source code to now used address (dazo) - Update copyright year to 2021 Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210609213231.22576-1-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/search?l=mid&q=20210609213231.22576-1-openvpn@sf.lists.topphemmelig.net URL: https://sourceforge.net/p/openvpn/mailman/message/37299719/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-07-20Require AEAD support in the crypto libraryArne Schwabe
All supported crypto libraries have AEAD support and with our ncp/de facto default cipher AES-256-GCM we do not want to support the obscure corner case of a library with disabled AEAD. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Patch V2: Remove three instances of (harmless) #ifdef Steffan spotted that can be removed now too. Acked-by: Steffan Karger <steffan.karger@foxcrypto.com> Message-Id: <20200720121704.20333-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20506.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-06-26Reformat files using uncrustifyArne Schwabe
Some of the commits, especially engine have not strictly used uncrustify clean code. Rerun uncrustify to make them compliant again. Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200626125332.15385-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20142.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-06-06openssl: add engine method for loading the keyJames Bottomley
As well as doing crypto acceleration, engines can also be used to load key files. If the engine is set, and the private key loading fails for bio methods, this patch makes openvpn try to get the engine to load the key. If that succeeds, we end up using an engine based key. This can be used with the openssl tpm engines to make openvpn use a TPM wrapped key file. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20200528225920.6983-2-James.Bottomley@HansenPartnership.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19937.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-12-12uncrustify openvpn/ sourcesGert Doering
There are an amazing number of brackets that were either totally missing, or have snuck up on the "for(...){" line. Further, uncrustify wants "|" in multi-line logical expressions now at the beginning of the new line, and "PRIi64" now gets surrounding spaces. Added "sp_after_semi_for_empty=Add" to uncrustify.conf to leave a few for() statements alone that look better the way they are. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20181130135641.11533-3-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17970.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2018-10-10List ChaCha20-Poly1305 as stream cipherSteffan Karger
As Antonio pointed out, "8-bit block cipher" is a bit funny. So teach print_cipher() to print such cipher as "stream cipher". Because I didn't want to write the same code twice, I decided to merge the two print_cipher() implementations into one shared function. That should make it easier to keep both backends consistent. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20181009204315.8262-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17682.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-02-01Update copyright to include 2018 plus company name changeDavid Sommerseth
The autumn of 2017, OpenVPN Technologies, Inc changed name to just OpenVPN Inc. Otherwise, extend the copyright to cover 2018 as well. With the exception of the company name change, all changes have been performed by the dev-tools/update-copyright.sh script. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20180131140314.11103-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16418.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-16copyright: Update GPLv2 license textsDavid Sommerseth
The COPYRIGHT.GPL file was slightly out-of-sync with the last GPLv2 license from Free Software Foundation, Inc. The changes are primarily a new address, which required touching almost all the project files. Except of that, it is just minor adjustments to formatting, removal of form-feed characters and referencing "GNU Lesser General Public License" instead of "GNU Library General Public License". Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20170329093648.10156-1-davids@openvpn.net> URL: https://www.mail-archive.com/search?l=mid&q=20170329093648.10156-1-davids@openvpn.net Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-01-23Use SHA256 for the internal digest, instead of MD5Steffan Karger
Our internal options digest uses MD5 hashes to store the state, instead of storing the full options string. There's nothing wrong with that, but it would still be better to use SHA256 because: * That makes it easier to make OpenVPN "FIPS-compliant" (forbids MD5) * We don't have to explain anymore that MD5 is fine too The slightly less bytes for the digest (16 instead of 32) and operations per connection setup are not worth sticking to MD5. Note that might SHA256 not be available in de crypto lib, OpenVPN will refuse to start and shout "Message hash algorithm 'SHA256' not found". Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1485101081-9784-1-git-send-email-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13926.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-12-21Update copyrightsDavid Sommerseth
Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <1482350454-27280-2-git-send-email-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13653.html
2016-12-14The Great Reformatting - first phaseDavid Sommerseth
This is the first commit of the big reformatting task. This is performed by running the ./dev-tools/reformat-all.sh script. This is based upon the v3 reformat-all.sh/uncrustify.conf version which is now applied to git master. Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-02-15Add AEAD cipher support (GCM)Steffan Karger
Add Authenticated Encryption with Additional Data (AEAD) support for ciphers, which removes the need for a separate HMAC step. The MAC is integrated into the cipher and the MAC tag is prepended to the payload. This patch is inspired by the patch originally submitted by Kenny Root on the openvpn-devel mailinglist, but does a number things differently: * Don't support XTS (makes no sense for VPN) * Don't support CCM (needs extra code to make it actually work) * Don't force the user to specify "auth none" (that would break tls-auth) * Add support for PolarSSL (and change internal API for this) * Update openvpn frame size ('link mtu') calculation for AEAD modes * Use the HMAC key as an implicit part of the IV to save 8 bytes per data channel network packet. * Also authenticate the opcode/peer-id as AD in P_DATA_V2 packets. By using the negotiated HMAC key as an implicit part of the IV for AEAD-mode ciphers in TLS mode, we can save (at least) 8 bytes on each packet sent. This is particularly interesting for connections which transfer many small packets, such as remote desktop or voip connections. The current AEAD-mode ciphers (for now GCM) are based on CTR-mode cipher operation, which requires the IV to be unique (but does not require unpredictability). IV uniqueness is guaranteed by using a combination of at least 64-bits of the HMAC key (unique per TLS session), and a 32-bit packet counter. The last 32-bit word of the 128-bit cipher block is not part of the IV, but is used as a block counter. AEAD cipher mode is not available for static key mode, since IV uniqueness is harder the guarantee over sessions, and I believe supporting AEAD in static key mode too is not worth the extra complexity. Modern setups should simply use TLS mode. OpenSSL 1.0.1-1.0.1c will not work with AEAD mode, because those versions have an unnecessary check that fails to update the cipher if the tag was not already set. 1.0.1d, which fixes that, was released in February 2013. People should have updated, and distros should have backported the fix by now. Changes in v2: * Remove extra code that was just for making OpenSSL 1.0.1-1.0.1c work in AEAD mode. * Do not make AEAD support configurable in ./configure. * Get rid of '12' magic constant in openvpn_encrypt_aead(). * Update manpage to explain that --auth is ignored for the data channel when using an AEAD cipher. * Move setting the IV in AEAD cipher modes to the IV generation code. This is a more natural place and now we can pull iv[] into the IV generation scope. * Read packet ID directly from packet buffer instead of from iv buffer, to remove the need for an extra buffer. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <CAA1AbxL_S4umZr5Nd0VTvUvXEHjoWmji18GqM6FgmWqntOKqaA@mail.gmail.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/11162 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-12-31openssl: add crypto_msg(), to easily log openssl errorsSteffan Karger
This works towards removing OpenSSL-specific error printing code from error.c. The crypto_msg() functions provide convenience wrappers, specific to OpenSSL. Instead of passing the magical 'M_SSLERR' flag to msg(), a developer now just calls crypto_msg() to get OpenSSL errors dumped to log. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1414269324-14102-5-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9199 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2012-03-22build: standard directory layoutAlon Bar-Lev
Suitable for mature project. root - administrative stuff doc - documents src - sources tests - tests distro - distro specific files sample - samples SIDE EFFECT: many changes to rpm spec. Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Signed-off-by: David Sommerseth <davids@redhat.com>
generated by cgit v1.1 at 2024-10-06 18:22:00 +0000