[Asterisk-code-review] http: Provide greater control of TLS support and set modern ... (asterisk[1.8])
Joshua Colp
asteriskteam at digium.com
Wed Feb 3 13:55:50 CST 2016
Joshua Colp has uploaded a new change for review.
https://gerrit.asterisk.org/2158
Change subject: http: Provide greater control of TLS support and set modern defaults.
......................................................................
http: Provide greater control of TLS support and set modern defaults.
This change exposes the configuration of various aspects of the TLS
support and sets the default to the modern standards.
The TLS cipher is now set to the best values according to the
Mozilla OpSec team, different TLS versions can now be disabled, and
the cipher order can be forced to be that of the server instead of
the client.
ASTERISK-24972 #close
Change-Id: Iea838877769ac8bd02e8f698e9b71c0ff068155e
---
M configs/http.conf.sample
M include/asterisk/tcptls.h
M main/http.c
M main/tcptls.c
4 files changed, 60 insertions(+), 8 deletions(-)
git pull ssh://gerrit.asterisk.org:29418/asterisk refs/changes/58/2158/1
diff --git a/configs/http.conf.sample b/configs/http.conf.sample
index 1a7f4fd..9a06fcf 100644
--- a/configs/http.conf.sample
+++ b/configs/http.conf.sample
@@ -67,10 +67,31 @@
; If no path is given for tlscertfile or tlsprivatekey, default is to look in current
; directory. If no tlsprivatekey is given, default is to search tlscertfile for private key.
;
+;
; To produce a certificate you can e.g. use openssl. This places both the cert and
; private in same .pem file.
; openssl req -new -x509 -days 365 -nodes -out /tmp/foo.pem -keyout /tmp/foo.pem
;
+; tlscipher= ; The list of allowed ciphers
+; ; if none are specified the following cipher
+; ; list will be used instead:
+; ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:
+; ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:
+; kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:
+; ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:
+; ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:
+; DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:
+; AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:
+; AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:
+; !EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+;
+; tlsdisablev1=yes ; Disable TLSv1 support - if not set this defaults to "yes"
+; tlsdisablev11=yes ; Disable TLSv1.1 support - if not set this defaults to "no"
+; tlsdisablev12=yes ; Disable TLSv1.2 support - if not set this defaults to "no"
+;
+; tlsservercipherorder=yes ; Use the server preference order instead of the client order
+; ; Defaults to "yes"
+;
; The post_mappings section maps URLs to real paths on the filesystem. If a
; POST is done from within an authenticated manager session to one of the
; configured POST mappings, then any files in the POST will be placed in the
diff --git a/include/asterisk/tcptls.h b/include/asterisk/tcptls.h
index f3f5e1f..eb7166f 100644
--- a/include/asterisk/tcptls.h
+++ b/include/asterisk/tcptls.h
@@ -79,7 +79,15 @@
/*! Use SSLv3 for outgoing client connections */
AST_SSL_SSLV3_CLIENT = (1 << 4),
/*! Use TLSv1 for outgoing client connections */
- AST_SSL_TLSV1_CLIENT = (1 << 5)
+ AST_SSL_TLSV1_CLIENT = (1 << 5),
+ /*! Use server cipher order instead of the client order */
+ AST_SSL_SERVER_CIPHER_ORDER = (1 << 6),
+ /*! Disable TLSv1 support */
+ AST_SSL_DISABLE_TLSV1 = (1 << 7),
+ /*! Disable TLSv1.1 support */
+ AST_SSL_DISABLE_TLSV11 = (1 << 8),
+ /*! Disable TLSv1.2 support */
+ AST_SSL_DISABLE_TLSV12 = (1 << 9),
};
struct ast_tls_config {
diff --git a/main/http.c b/main/http.c
index 9bebbe7..4bfa985 100644
--- a/main/http.c
+++ b/main/http.c
@@ -1118,10 +1118,13 @@
}
http_tls_cfg.pvtfile = ast_strdup("");
+ /* Apply modern intermediate settings according to the Mozilla OpSec team as of July 30th, 2015 but disable TLSv1 */
+ ast_set_flag(&http_tls_cfg.flags, AST_SSL_DISABLE_TLSV1 | AST_SSL_SERVER_CIPHER_ORDER);
+
if (http_tls_cfg.cipher) {
ast_free(http_tls_cfg.cipher);
}
- http_tls_cfg.cipher = ast_strdup("");
+ http_tls_cfg.cipher = ast_strdup("ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA");
AST_RWLIST_WRLOCK(&uri_redirects);
while ((redirect = AST_RWLIST_REMOVE_HEAD(&uri_redirects, entry))) {
@@ -1146,8 +1149,6 @@
&& strcasecmp(v->name, "tlsdontverifyserver")
&& strcasecmp(v->name, "tlsclientmethod")
&& strcasecmp(v->name, "sslclientmethod")
- && strcasecmp(v->name, "tlscipher")
- && strcasecmp(v->name, "sslcipher")
&& !ast_tls_read_conf(&http_tls_cfg, &https_desc, v->name, v->value)) {
continue;
}
diff --git a/main/tcptls.c b/main/tcptls.c
index a5a2af6..f73c2aa 100644
--- a/main/tcptls.c
+++ b/main/tcptls.c
@@ -749,6 +749,7 @@
return 0;
#else
int disable_ssl = 0;
+ long ssl_opts = 0;
if (!cfg->enabled)
return 0;
@@ -793,11 +794,24 @@
* them. SSLv23_*_method supports TLSv1+.
*/
if (disable_ssl) {
- long ssl_opts;
-
- ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
- SSL_CTX_set_options(cfg->ssl_ctx, ssl_opts);
+ ssl_opts |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
}
+
+ if (ast_test_flag(&cfg->flags, AST_SSL_SERVER_CIPHER_ORDER)) {
+ ssl_opts |= SSL_OP_CIPHER_SERVER_PREFERENCE;
+ }
+
+ if (ast_test_flag(&cfg->flags, AST_SSL_DISABLE_TLSV1)) {
+ ssl_opts |= SSL_OP_NO_TLSv1;
+ }
+ if (ast_test_flag(&cfg->flags, AST_SSL_DISABLE_TLSV11)) {
+ ssl_opts |= SSL_OP_NO_TLSv1_1;
+ }
+ if (ast_test_flag(&cfg->flags, AST_SSL_DISABLE_TLSV12)) {
+ ssl_opts |= SSL_OP_NO_TLSv1_2;
+ }
+
+ SSL_CTX_set_options(cfg->ssl_ctx, ssl_opts);
SSL_CTX_set_verify(cfg->ssl_ctx,
ast_test_flag(&cfg->flags, AST_SSL_VERIFY_CLIENT) ? SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT : SSL_VERIFY_NONE,
@@ -1109,6 +1123,14 @@
ast_clear_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);
}
+ } else if (!strcasecmp(varname, "tlsservercipherorder")) {
+ ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_SERVER_CIPHER_ORDER);
+ } else if (!strcasecmp(varname, "tlsdisablev1")) {
+ ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DISABLE_TLSV1);
+ } else if (!strcasecmp(varname, "tlsdisablev11")) {
+ ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DISABLE_TLSV11);
+ } else if (!strcasecmp(varname, "tlsdisablev12")) {
+ ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DISABLE_TLSV12);
} else {
return -1;
}
--
To view, visit https://gerrit.asterisk.org/2158
To unsubscribe, visit https://gerrit.asterisk.org/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Iea838877769ac8bd02e8f698e9b71c0ff068155e
Gerrit-PatchSet: 1
Gerrit-Project: asterisk
Gerrit-Branch: 1.8
Gerrit-Owner: Joshua Colp <jcolp at digium.com>
More information about the asterisk-code-review
mailing list