mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-06 15:17:01 +02:00
Code Issues Projects Releases Wiki Activity

MEDIUM: ssl: support for ECDA+RSA certificate selection with AWS-LC

Browse Source 
AWS-LC does not support the SSL_CTX_set_client_hello_cb() function from
OpenSSL which allows to analyze ciphers and signatures algorithm of the
ClientHello. However it supports the SSL_CTX_set_select_certificate_cb()
which allows the same thing but was the implementation from the
boringSSL side.

This patch uses the SSL_CTX_set_select_certificate_cb() as well as the
SSL_early_callback_ctx_extension_get() function to get the signature
algorithms.

This was successfully tested with openssl s_client as well as
testssl.sh.

This should allow to enable more reg-tests that depend on certificate
selection.

Require at least AWS-LC 1.22.0.
This commit is contained in:
William Lallemand 2024-06-13 19:11:52 +02:00
parent 935b3bd1b7
commit 7120c77b14
5 changed files with 17 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/haproxy/openssl-compat.h
View File

@ -79,7 +79,7 @@
#define HAVE_ASN1_TIME_TO_TM #define HAVE_ASN1_TIME_TO_TM
#endif #endif
#if (defined(SSL_CLIENT_HELLO_CB) || defined(OPENSSL_IS_BORINGSSL)) #if (defined(SSL_CLIENT_HELLO_CB) || defined(OPENSSL_IS_BORINGSSL) || defined(USE_OPENSSL_AWSLC))
#define HAVE_SSL_CLIENT_HELLO_CB #define HAVE_SSL_CLIENT_HELLO_CB
#endif #endif

2
include/haproxy/ssl_sock.h
View File

@ -104,7 +104,7 @@ void ssl_unload_providers(void);
#ifdef HAVE_SSL_CLIENT_HELLO_CB #ifdef HAVE_SSL_CLIENT_HELLO_CB
int ssl_sock_switchctx_err_cbk(SSL *ssl, int *al, void *priv); int ssl_sock_switchctx_err_cbk(SSL *ssl, int *al, void *priv);
# ifdef OPENSSL_IS_BORINGSSL # if defined(OPENSSL_IS_BORINGSSL) || defined(USE_OPENSSL_AWSLC)
int ssl_sock_switchctx_cbk(const struct ssl_early_callback_ctx *ctx); int ssl_sock_switchctx_cbk(const struct ssl_early_callback_ctx *ctx);
# else /* ! OPENSSL_IS_BORINGSSL */ # else /* ! OPENSSL_IS_BORINGSSL */
int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *arg); int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *arg);

5
src/quic_ssl.c
View File

@ -459,7 +459,10 @@ int ssl_quic_initial_ctx(struct bind_conf *bind_conf)
} }
#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
# if defined(HAVE_SSL_CLIENT_HELLO_CB) # if defined(OPENSSL_IS_BORINGSSL) || defined(USE_OPENSSL_AWSLC)
SSL_CTX_set_select_certificate_cb(ctx, ssl_sock_switchctx_cbk);
SSL_CTX_set_tlsext_servername_callback(ctx, ssl_sock_switchctx_err_cbk);
# elif defined(HAVE_SSL_CLIENT_HELLO_CB)
SSL_CTX_set_client_hello_cb(ctx, ssl_sock_switchctx_cbk, NULL); SSL_CTX_set_client_hello_cb(ctx, ssl_sock_switchctx_cbk, NULL);
SSL_CTX_set_tlsext_servername_callback(ctx, ssl_sock_switchctx_err_cbk); SSL_CTX_set_tlsext_servername_callback(ctx, ssl_sock_switchctx_err_cbk);
# else /* ! HAVE_SSL_CLIENT_HELLO_CB */ # else /* ! HAVE_SSL_CLIENT_HELLO_CB */

18
src/ssl_clienthello.c
View File

@ -131,7 +131,7 @@ int ssl_sock_switchctx_err_cbk(SSL *ssl, int *al, void *priv)
return SSL_TLSEXT_ERR_NOACK; return SSL_TLSEXT_ERR_NOACK;
} }
#ifdef OPENSSL_IS_BORINGSSL #if defined(OPENSSL_IS_BORINGSSL) || defined(USE_OPENSSL_AWSLC)
int ssl_sock_switchctx_cbk(const struct ssl_early_callback_ctx *ctx) int ssl_sock_switchctx_cbk(const struct ssl_early_callback_ctx *ctx)
{ {
SSL *ssl = ctx->ssl; SSL *ssl = ctx->ssl;
@ -170,7 +170,7 @@ int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *arg)
#ifdef USE_QUIC #ifdef USE_QUIC
if (qc) { if (qc) {
/* Look for the QUIC transport parameters. */ /* Look for the QUIC transport parameters. */
#ifdef OPENSSL_IS_BORINGSSL #if defined(OPENSSL_IS_BORINGSSL) || defined(USE_OPENSSL_AWSLC)
if (!SSL_early_callback_ctx_extension_get(ctx, qc->tps_tls_ext, if (!SSL_early_callback_ctx_extension_get(ctx, qc->tps_tls_ext,
&extension_data, &extension_len)) &extension_data, &extension_len))
#else #else
@ -182,7 +182,9 @@ int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *arg)
* <*al>, this has as side effect to generate another TLS alert * <*al>, this has as side effect to generate another TLS alert
* which would be set after calling quic_set_tls_alert(). * which would be set after calling quic_set_tls_alert().
*/ */
#if !defined(OPENSSL_IS_BORINGSSL) && !defined(USE_OPENSSL_AWSLC)
*al = SSL_AD_MISSING_EXTENSION; *al = SSL_AD_MISSING_EXTENSION;
#endif
quic_set_tls_alert(qc, SSL_AD_MISSING_EXTENSION); quic_set_tls_alert(qc, SSL_AD_MISSING_EXTENSION);
return 0; return 0;
} }
@ -197,7 +199,7 @@ int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *arg)
if (s->ssl_conf.early_data) if (s->ssl_conf.early_data)
allow_early = 1; allow_early = 1;
#ifdef OPENSSL_IS_BORINGSSL #if defined(OPENSSL_IS_BORINGSSL) || defined(USE_OPENSSL_AWSLC)
if (SSL_early_callback_ctx_extension_get(ctx, TLSEXT_TYPE_server_name, if (SSL_early_callback_ctx_extension_get(ctx, TLSEXT_TYPE_server_name,
&extension_data, &extension_len)) { &extension_data, &extension_len)) {
#else #else
@ -251,7 +253,7 @@ int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *arg)
} }
/* extract/check clientHello information */ /* extract/check clientHello information */
#ifdef OPENSSL_IS_BORINGSSL #if defined(OPENSSL_IS_BORINGSSL) || defined(USE_OPENSSL_AWSLC)
if (SSL_early_callback_ctx_extension_get(ctx, TLSEXT_TYPE_signature_algorithms, &extension_data, &extension_len)) { if (SSL_early_callback_ctx_extension_get(ctx, TLSEXT_TYPE_signature_algorithms, &extension_data, &extension_len)) {
#else #else
if (SSL_client_hello_get0_ext(ssl, TLSEXT_TYPE_signature_algorithms, &extension_data, &extension_len)) { if (SSL_client_hello_get0_ext(ssl, TLSEXT_TYPE_signature_algorithms, &extension_data, &extension_len)) {
@ -296,7 +298,7 @@ int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *arg)
ha_ciphers = SSL_get_ciphers(ssl); ha_ciphers = SSL_get_ciphers(ssl);
has_ecdsa_sig = 0; has_ecdsa_sig = 0;
#ifdef OPENSSL_IS_BORINGSSL #if defined(OPENSSL_IS_BORINGSSL) || defined(USE_OPENSSL_AWSLC)
len = ctx->cipher_suites_len; len = ctx->cipher_suites_len;
cipher_suites = ctx->cipher_suites; cipher_suites = ctx->cipher_suites;
#else #else
@ -305,7 +307,7 @@ int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *arg)
if (len % 2 != 0) if (len % 2 != 0)
goto abort; goto abort;
for (; len != 0; len -= 2, cipher_suites += 2) { for (; len != 0; len -= 2, cipher_suites += 2) {
#ifdef OPENSSL_IS_BORINGSSL #if defined(OPENSSL_IS_BORINGSSL) || defined(USE_OPENSSL_AWSLC)
uint16_t cipher_suite = (cipher_suites[0] << 8) | cipher_suites[1]; uint16_t cipher_suite = (cipher_suites[0] << 8) | cipher_suites[1];
cipher = SSL_get_cipher_by_value(cipher_suite); cipher = SSL_get_cipher_by_value(cipher_suite);
#else #else
@ -392,7 +394,7 @@ int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *arg)
/* abort handshake (was SSL_TLSEXT_ERR_ALERT_FATAL) */ /* abort handshake (was SSL_TLSEXT_ERR_ALERT_FATAL) */
if (conn) if (conn)
conn->err_code = CO_ER_SSL_HANDSHAKE; conn->err_code = CO_ER_SSL_HANDSHAKE;
#ifdef OPENSSL_IS_BORINGSSL #if defined(OPENSSL_IS_BORINGSSL) || defined(USE_OPENSSL_AWSLC)
return ssl_select_cert_error; return ssl_select_cert_error;
#else #else
*al = SSL_AD_UNRECOGNIZED_NAME; *al = SSL_AD_UNRECOGNIZED_NAME;
@ -400,7 +402,7 @@ int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *arg)
#endif #endif
allow_early: allow_early:
#ifdef OPENSSL_IS_BORINGSSL #if defined(OPENSSL_IS_BORINGSSL) || defined(USE_OPENSSL_AWSLC)
if (allow_early) if (allow_early)
SSL_set_early_data_enabled(ssl, 1); SSL_set_early_data_enabled(ssl, 1);
#else #else

2
src/ssl_sock.c
View File

@ -3440,7 +3440,7 @@ ssl_sock_initial_ctx(struct bind_conf *bind_conf)
SSL_CTX_set_timeout(ctx, global_ssl.life_time); SSL_CTX_set_timeout(ctx, global_ssl.life_time);
#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
# ifdef OPENSSL_IS_BORINGSSL # if defined(OPENSSL_IS_BORINGSSL) || defined(USE_OPENSSL_AWSLC)
SSL_CTX_set_select_certificate_cb(ctx, ssl_sock_switchctx_cbk); SSL_CTX_set_select_certificate_cb(ctx, ssl_sock_switchctx_cbk);
SSL_CTX_set_tlsext_servername_callback(ctx, ssl_sock_switchctx_err_cbk); SSL_CTX_set_tlsext_servername_callback(ctx, ssl_sock_switchctx_err_cbk);
# elif defined(HAVE_SSL_CLIENT_HELLO_CB) # elif defined(HAVE_SSL_CLIENT_HELLO_CB)