Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OpenVPN error codes, SSL_get_peer_signature_* funcs, and first patch file #1584

Merged
merged 24 commits into from
Jun 18, 2024

Conversation

smittals2
Copy link
Contributor

@smittals2 smittals2 commented May 9, 2024

Issues

CryptoAlg-2477
CryptoAlg-2478

Description of changes:

  1. Added three new aliases for AES-128-GCM, AES-192-GCM, and AES-256-GCM as required by OpenVPN
  2. Added an error and function code. Error code points to our equivalent of the OpenSSL PKCS12_R_MAC_VERIFY_FAILURE error
  3. Added SSL_get_peer_signature_nid and SSL_get_peer_signature_type_nid. No new state is stored for these in the SSL connection.
  4. Generated a patch file to use OpenVPNs internal ASSERT function instead of OpenSSL_assert, SSL_get_ciphers instead of SSL_get1_supported_ciphers, and point SSL_get_peer_tmp_key to SSL_get_server_tmp_key (which we define as a no-op)
  5. Added pkcs8.h to doc.config

Call-outs:

The patch file is temporary and will likely change with future PRs

Testing:

  1. SSL_get_peer_signature_nid and SSL_get_peer_signature_type_nid are tested in a TLS 1.2 connection (with renegotiation) and in a TLS 1.3 connection (with mTLS configured to test both the client and server side).

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

@smittals2 smittals2 requested a review from a team as a code owner May 9, 2024 01:36
@codecov-commenter
Copy link

codecov-commenter commented May 9, 2024

Codecov Report

Attention: Patch coverage is 85.18519% with 4 lines in your changes missing coverage. Please review.

Project coverage is 78.15%. Comparing base (98735a2) to head (50de7b3).

Files Patch % Lines
ssl/ssl_lib.cc 80.00% 4 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1584      +/-   ##
==========================================
- Coverage   78.16%   78.15%   -0.01%     
==========================================
  Files         562      562              
  Lines       94683    94710      +27     
  Branches    13575    13579       +4     
==========================================
+ Hits        74008    74022      +14     
- Misses      20082    20093      +11     
- Partials      593      595       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

include/openssl/pkcs8.h Outdated Show resolved Hide resolved
@smittals2 smittals2 marked this pull request as draft May 13, 2024 18:52
@smittals2 smittals2 requested a review from a team June 4, 2024 03:49
@smittals2 smittals2 changed the title WIP: OpenVPN Integration script, Patches, and Symbols OpenVPN error codes, SSL_get_peer_signature_* funcs, and first patch file Jun 4, 2024
@smittals2 smittals2 marked this pull request as ready for review June 4, 2024 04:01
@smittals2 smittals2 requested a review from andrewhop June 4, 2024 04:03
Copy link
Contributor

@geedo0 geedo0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, just some style nits to fix.

include/openssl/pkcs8.h Outdated Show resolved Hide resolved
include/openssl/rsa.h Outdated Show resolved Hide resolved
include/openssl/ssl.h Outdated Show resolved Hide resolved
ssl/ssl_lib.cc Outdated Show resolved Hide resolved
ssl/ssl_lib.cc Show resolved Hide resolved
geedo0
geedo0 previously approved these changes Jun 5, 2024
ssl/ssl_lib.cc Show resolved Hide resolved
ssl/ssl_lib.cc Show resolved Hide resolved
include/openssl/ssl.h Outdated Show resolved Hide resolved
include/openssl/ssl.h Outdated Show resolved Hide resolved
ssl/ssl_lib.cc Outdated Show resolved Hide resolved
skmcgrail
skmcgrail previously approved these changes Jun 14, 2024
@smittals2 smittals2 requested a review from andrewhop June 15, 2024 05:17
@smittals2 smittals2 merged commit 6a949d8 into aws:main Jun 18, 2024
97 of 98 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants