[Asterisk-code-review] res rtp asterisk: Enable Forward Secrecy (PFS) for DTLS. (asterisk[13])
Alexander Traud
asteriskteam at digium.com
Wed Jun 22 07:32:33 CDT 2016
Alexander Traud has uploaded a new change for review.
https://gerrit.asterisk.org/3067
Change subject: res_rtp_asterisk: Enable Forward Secrecy (PFS) for DTLS.
......................................................................
res_rtp_asterisk: Enable Forward Secrecy (PFS) for DTLS.
Since July 2014, TLS based protocols (SIP over TLS, Secure WebSockets, HTTPS)
support PFS thanks to ASTERISK-23905. In July 2015, the same feature was added
for DTLS. The source code from main/tcptls.c should have been re-used to ease
security audits. Therefore, this change rolls back the change from July 2015 and
re-uses the code from July 2014. This has the additional benefits to work under
CentOS 7 and enabling not just ECDHE but DHE based cipher suites as well.
ASTERISK-23905 #comment enabled PFS for DTLS as well
ASTERISK-25265 #comment enabled DHE based cipher suites as well
ASTERISK-25659 #close
Reported by: StefanEng86, urbaniak, pay123
Tested by: sarumjanuch, traud
patches:
res_rtp_asterisk.patch submitted by sarumjanuch
dtls_centos_step_1.patch submitted by traud
dtls_centos_step_2.patch submitted by traud
Change-Id: I537cadf4421f092a613146b230f2c0ee1be28d5c
---
M configure
M configure.ac
M include/asterisk/autoconfig.h.in
M res/res_rtp_asterisk.c
4 files changed, 39 insertions(+), 88 deletions(-)
git pull ssh://gerrit.asterisk.org:29418/asterisk refs/changes/67/3067/1
diff --git a/configure b/configure
index cb2862e..05db1e1 100755
--- a/configure
+++ b/configure
@@ -1116,10 +1116,6 @@
DAHDI_DIR
DAHDI_INCLUDE
DAHDI_LIB
-PBX_OPENSSL_ECDH_AUTO
-OPENSSL_ECDH_AUTO_DIR
-OPENSSL_ECDH_AUTO_INCLUDE
-OPENSSL_ECDH_AUTO_LIB
PBX_OPENSSL_EC
OPENSSL_EC_DIR
OPENSSL_EC_INCLUDE
@@ -8778,18 +8774,6 @@
-OPENSSL_ECDH_AUTO_DESCRIP="OpenSSL Auto ECDH Support"
-OPENSSL_ECDH_AUTO_OPTION=crypto
-OPENSSL_ECDH_AUTO_DIR=${CRYPTO_DIR}
-
-PBX_OPENSSL_ECDH_AUTO=0
-
-
-
-
-
-
-
DAHDI_DESCRIP="DAHDI"
DAHDI_OPTION="dahdi"
PBX_DAHDI=0
@@ -13628,7 +13612,7 @@
We can't simply define LARGE_OFF_T to be 9223372036854775807,
since some C++ compilers masquerading as C compilers
incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
&& LARGE_OFF_T % 2147483647 == 1)
? 1 : -1];
@@ -13674,7 +13658,7 @@
We can't simply define LARGE_OFF_T to be 9223372036854775807,
since some C++ compilers masquerading as C compilers
incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
&& LARGE_OFF_T % 2147483647 == 1)
? 1 : -1];
@@ -13698,7 +13682,7 @@
We can't simply define LARGE_OFF_T to be 9223372036854775807,
since some C++ compilers masquerading as C compilers
incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
&& LARGE_OFF_T % 2147483647 == 1)
? 1 : -1];
@@ -13743,7 +13727,7 @@
We can't simply define LARGE_OFF_T to be 9223372036854775807,
since some C++ compilers masquerading as C compilers
incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
&& LARGE_OFF_T % 2147483647 == 1)
? 1 : -1];
@@ -13767,7 +13751,7 @@
We can't simply define LARGE_OFF_T to be 9223372036854775807,
since some C++ compilers masquerading as C compilers
incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
&& LARGE_OFF_T % 2147483647 == 1)
? 1 : -1];
@@ -31259,53 +31243,6 @@
fi
fi
-
-fi
-
-if test "$PBX_OPENSSL" = "1";
-then
-
- if test "x${PBX_OPENSSL_ECDH_AUTO}" != "x1" -a "${USE_OPENSSL_ECDH_AUTO}" != "no"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for SSL_CTX_set_ecdh_auto declared in openssl/ssl.h" >&5
-$as_echo_n "checking for SSL_CTX_set_ecdh_auto declared in openssl/ssl.h... " >&6; }
- saved_cppflags="${CPPFLAGS}"
- if test "x${OPENSSL_ECDH_AUTO_DIR}" != "x"; then
- OPENSSL_ECDH_AUTO_INCLUDE="-I${OPENSSL_ECDH_AUTO_DIR}/include"
- fi
- CPPFLAGS="${CPPFLAGS} ${OPENSSL_ECDH_AUTO_INCLUDE}"
-
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
- #include <openssl/ssl.h>
-int
-main ()
-{
-#if !defined(SSL_CTX_set_ecdh_auto)
- (void) SSL_CTX_set_ecdh_auto;
- #endif
-
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
- PBX_OPENSSL_ECDH_AUTO=1
-
-$as_echo "#define HAVE_OPENSSL_ECDH_AUTO 1" >>confdefs.h
-
-
-
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-
- CPPFLAGS="${saved_cppflags}"
- fi
fi
diff --git a/configure.ac b/configure.ac
index 9f77c67..902cc50 100644
--- a/configure.ac
+++ b/configure.ac
@@ -415,7 +415,6 @@
AST_EXT_LIB_SETUP([CRYPTO], [OpenSSL Cryptography], [crypto])
AST_EXT_LIB_SETUP_OPTIONAL([OPENSSL_SRTP], [OpenSSL SRTP Extension Support], [CRYPTO], [crypto])
AST_EXT_LIB_SETUP_OPTIONAL([OPENSSL_EC], [OpenSSL Elliptic Curve Support], [CRYPTO], [crypto])
-AST_EXT_LIB_SETUP_OPTIONAL([OPENSSL_ECDH_AUTO], [OpenSSL Auto ECDH Support], [CRYPTO], [crypto])
AST_EXT_LIB_SETUP([DAHDI], [DAHDI], [dahdi])
AST_EXT_LIB_SETUP([FFMPEG], [Ffmpeg and avcodec], [avcodec])
AST_EXT_LIB_SETUP([GSM], [External GSM], [gsm], [, use 'internal' GSM otherwise])
@@ -2396,11 +2395,6 @@
if test "$PBX_OPENSSL" = "1";
then
AST_EXT_LIB_CHECK([OPENSSL_EC], [ssl], [EC_KEY_new_by_curve_name], [openssl/ec.h], [-lcrypto])
-fi
-
-if test "$PBX_OPENSSL" = "1";
-then
- AST_C_DECLARE_CHECK([OPENSSL_ECDH_AUTO], [SSL_CTX_set_ecdh_auto], [openssl/ssl.h])
fi
if test "$PBX_OPENSSL" = "1";
diff --git a/include/asterisk/autoconfig.h.in b/include/asterisk/autoconfig.h.in
index e831d6f..6d87f23 100644
--- a/include/asterisk/autoconfig.h.in
+++ b/include/asterisk/autoconfig.h.in
@@ -548,9 +548,6 @@
/* Define to 1 if CRYPTO has the OpenSSL Elliptic Curve Support feature. */
#undef HAVE_OPENSSL_EC
-/* Define if your system has SSL_CTX_set_ecdh_auto declared. */
-#undef HAVE_OPENSSL_ECDH_AUTO
-
/* Define to 1 if CRYPTO has the OpenSSL SRTP Extension Support feature. */
#undef HAVE_OPENSSL_SRTP
diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index 7665b5c..9fdbf59 100644
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -1340,9 +1340,6 @@
{
struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
int res;
-#ifndef HAVE_OPENSSL_ECDH_AUTO
- EC_KEY *ecdh;
-#endif
if (!dtls_cfg->enabled) {
return 0;
@@ -1368,15 +1365,41 @@
SSL_CTX_set_read_ahead(rtp->ssl_ctx, 1);
-#ifdef HAVE_OPENSSL_ECDH_AUTO
- SSL_CTX_set_ecdh_auto(rtp->ssl_ctx, 1);
-#else
- ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
- if (ecdh) {
- SSL_CTX_set_tmp_ecdh(rtp->ssl_ctx, ecdh);
- EC_KEY_free(ecdh);
+#ifdef HAVE_OPENSSL_EC
+
+ if (!ast_strlen_zero(dtls_cfg->pvtfile)) {
+ BIO *bio = BIO_new_file(dtls_cfg->pvtfile, "r");
+ if (bio != NULL) {
+ DH *dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
+ if (dh != NULL) {
+ if (SSL_CTX_set_tmp_dh(rtp->ssl_ctx, dh)) {
+ long options = SSL_OP_CIPHER_SERVER_PREFERENCE | SSL_OP_SINGLE_DH_USE | SSL_OP_SINGLE_ECDH_USE;
+ options = SSL_CTX_set_options(rtp->ssl_ctx, options);
+ ast_verb(2, "DTLS DH initialized, PFS cipher-suites enabled\n");
+ }
+ DH_free(dh);
+ }
+ BIO_free(bio);
+ }
}
-#endif
+ #ifndef SSL_CTRL_SET_ECDH_AUTO
+ #define SSL_CTRL_SET_ECDH_AUTO 94
+ #endif
+ /* SSL_CTX_set_ecdh_auto(rtp->ssl_ctx, on); requires OpenSSL 1.0.2 which wraps: */
+ if (SSL_CTX_ctrl(rtp->ssl_ctx, SSL_CTRL_SET_ECDH_AUTO, 1, NULL)) {
+ ast_verb(2, "DTLS ECDH initialized (automatic), faster PFS cipher-suites enabled\n");
+ } else {
+ /* enables AES-128 ciphers, to get AES-256 use NID_secp384r1 */
+ EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+ if (ecdh != NULL) {
+ if (SSL_CTX_set_tmp_ecdh(rtp->ssl_ctx, ecdh)) {
+ ast_verb(2, "DTLS ECDH initialized (secp256r1), faster PFS cipher-suites enabled\n");
+ }
+ EC_KEY_free(ecdh);
+ }
+ }
+
+#endif /* #ifdef HAVE_OPENSSL_EC */
rtp->dtls_verify = dtls_cfg->verify;
--
To view, visit https://gerrit.asterisk.org/3067
To unsubscribe, visit https://gerrit.asterisk.org/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I537cadf4421f092a613146b230f2c0ee1be28d5c
Gerrit-PatchSet: 1
Gerrit-Project: asterisk
Gerrit-Branch: 13
Gerrit-Owner: Alexander Traud <pabstraud at compuserve.com>
More information about the asterisk-code-review
mailing list