Client sends a post-handshake-authentication extension if a client key and a certificate are available
This commit is contained in:
Petr Písař
parent
0d52c79ea1
commit
d0ff533e0b
@ -0,0 +1,55 @@
|
|||||||
|
From 270badae7595332807d71b946446a70137369bf0 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Joe Orton <jorton@redhat.com>
|
||||||
|
Date: Sat, 26 Jan 2019 11:16:08 +0100
|
||||||
|
Subject: [PATCH] Enable Post-Handshake-Authentication (TLSv1.3 feature)
|
||||||
|
client-side iff available.
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
||||||
|
---
|
||||||
|
lib/IO/Socket/SSL.pm | 6 ++++++
|
||||||
|
1 file changed, 6 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/lib/IO/Socket/SSL.pm b/lib/IO/Socket/SSL.pm
|
||||||
|
index f35211b..0a0eef6 100644
|
||||||
|
--- a/lib/IO/Socket/SSL.pm
|
||||||
|
+++ b/lib/IO/Socket/SSL.pm
|
||||||
|
@@ -67,6 +67,7 @@ my $can_ecdh; # do we support ECDH key exchange
|
||||||
|
my $can_ocsp; # do we support OCSP
|
||||||
|
my $can_ocsp_staple; # do we support OCSP stapling
|
||||||
|
my $can_tckt_keycb; # TLS ticket key callback
|
||||||
|
+my $can_pha; # do we support PHA
|
||||||
|
BEGIN {
|
||||||
|
$can_client_sni = Net::SSLeay::OPENSSL_VERSION_NUMBER() >= 0x01000000;
|
||||||
|
$can_server_sni = defined &Net::SSLeay::get_servername;
|
||||||
|
@@ -87,6 +88,7 @@ BEGIN {
|
||||||
|
&& defined &Net::SSLeay::set_tlsext_status_type;
|
||||||
|
$can_tckt_keycb = defined &Net::SSLeay::CTX_set_tlsext_ticket_getkey_cb
|
||||||
|
&& $Net::SSLeay::VERSION >= 1.80;
|
||||||
|
+ $can_pha = defined &Net::SSLeay::CTX_set_post_handshake_auth;
|
||||||
|
}
|
||||||
|
|
||||||
|
my $algo2digest = do {
|
||||||
|
@@ -2018,6 +2020,7 @@ sub can_ecdh { return $can_ecdh }
|
||||||
|
sub can_ipv6 { return CAN_IPV6 }
|
||||||
|
sub can_ocsp { return $can_ocsp }
|
||||||
|
sub can_ticket_keycb { return $can_tckt_keycb }
|
||||||
|
+sub can_pha { return $can_pha }
|
||||||
|
|
||||||
|
sub DESTROY {
|
||||||
|
my $self = shift or return;
|
||||||
|
@@ -2602,6 +2605,9 @@ sub new {
|
||||||
|
"Failed to load key from file (no PEM or DER)");
|
||||||
|
}
|
||||||
|
|
||||||
|
+ Net::SSLeay::CTX_set_post_handshake_auth($ctx,1)
|
||||||
|
+ if (!$is_server && $can_pha && $havecert && $havekey);
|
||||||
|
+
|
||||||
|
# replace arg_hash with created context
|
||||||
|
$ctx{$host} = $ctx;
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.17.2
|
||||||
|
|
||||||
@ -0,0 +1,127 @@
|
|||||||
|
From 921d3a471156896a0d139e82a50d07441992c811 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
|
||||||
|
Date: Fri, 8 Feb 2019 14:50:32 +0100
|
||||||
|
Subject: [PATCH] Test client performs Post-Handshake-Authentication
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
This test uses openssl tool because PHA is not yet supported by
|
||||||
|
IO::Socket::SSL's server implementation. The openssl tool uses a fixed
|
||||||
|
port. So the test can fail.
|
||||||
|
|
||||||
|
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
||||||
|
---
|
||||||
|
MANIFEST | 1 +
|
||||||
|
t/pha_client.t | 87 ++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||||
|
2 files changed, 88 insertions(+)
|
||||||
|
create mode 100755 t/pha_client.t
|
||||||
|
|
||||||
|
diff --git a/MANIFEST b/MANIFEST
|
||||||
|
index 5c2b87c..e46f919 100644
|
||||||
|
--- a/MANIFEST
|
||||||
|
+++ b/MANIFEST
|
||||||
|
@@ -52,6 +52,7 @@ t/memleak_bad_handshake.t
|
||||||
|
t/mitm.t
|
||||||
|
t/nonblock.t
|
||||||
|
t/npn.t
|
||||||
|
+t/pha_client.t
|
||||||
|
t/plain_upgrade_downgrade.t
|
||||||
|
t/protocol_version.t
|
||||||
|
t/public_suffix_lib.pl
|
||||||
|
diff --git a/t/pha_client.t b/t/pha_client.t
|
||||||
|
new file mode 100755
|
||||||
|
index 0000000..6699443
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/t/pha_client.t
|
||||||
|
@@ -0,0 +1,87 @@
|
||||||
|
+#!/usr/bin/perl
|
||||||
|
+use strict;
|
||||||
|
+use warnings;
|
||||||
|
+use Test::More;
|
||||||
|
+use IPC::Run ();
|
||||||
|
+use IO::Socket::SSL ();
|
||||||
|
+use IO::Select ();
|
||||||
|
+
|
||||||
|
+if (!system('openssl', 'version')) {
|
||||||
|
+ plan tests => 5;
|
||||||
|
+} else {
|
||||||
|
+ plan skip_all => 'openssl tool is not available';
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+my $port = 2000;
|
||||||
|
+my $ca_cert = 'certs/test-ca.pem';
|
||||||
|
+
|
||||||
|
+diag 'Starting a server';
|
||||||
|
+my ($server, $input, $stdout, $stderr);
|
||||||
|
+eval {
|
||||||
|
+ $server = IPC::Run::start(['openssl', 's_server', '-port', $port,
|
||||||
|
+ '-Verify', '1',
|
||||||
|
+ '-cert', 'certs/server-wildcard.pem',
|
||||||
|
+ '-key', 'certs/server-wildcard.pem', '-CAfile', $ca_cert],
|
||||||
|
+ \$input, \$stdout, \$stderr);
|
||||||
|
+ # subsequent \undef does not work
|
||||||
|
+ # <https://github.com/toddr/IPC-Run/issues/124>
|
||||||
|
+};
|
||||||
|
+if (!$server or $@) {
|
||||||
|
+ BAIL_OUT("Could not start a server: $@");
|
||||||
|
+}
|
||||||
|
+# openssl s_server does not return a non-zero exit code in case of bind(2) failure.
|
||||||
|
+while ($server->pumpable && $stdout !~ /\nACCEPT\n/) { $server->pump; }
|
||||||
|
+if ($stderr =~ /unable to bind socket/) {
|
||||||
|
+ $server->kill_kill;
|
||||||
|
+ BAIL_OUT("Could not start a server: $stderr");
|
||||||
|
+}
|
||||||
|
+ok($server, 'Server started');
|
||||||
|
+
|
||||||
|
+my $client = IO::Socket::SSL->new(
|
||||||
|
+ PeerHost => 'localhost',
|
||||||
|
+ PeerPort => $port,
|
||||||
|
+ SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_PEER,
|
||||||
|
+ SSL_verifycn_scheme => 'www',
|
||||||
|
+ SSL_verifycn_name => 'www.server.local',
|
||||||
|
+ SSL_ca_file => $ca_cert,
|
||||||
|
+ SSL_key_file => 'certs/client-key.pem',
|
||||||
|
+ SSL_cert_file => 'certs/client-cert.pem'
|
||||||
|
+);
|
||||||
|
+ok($client, 'Client connected');
|
||||||
|
+
|
||||||
|
+SKIP: {
|
||||||
|
+ skip "Connection failed: errno=$!, SSL errror=$IO::Socket::SSL::SSL_ERROR", 2
|
||||||
|
+ unless $client;
|
||||||
|
+ $client->blocking(0);
|
||||||
|
+
|
||||||
|
+ SKIP: {
|
||||||
|
+ # Ask openssl s_server for PHA request and wait for the result.
|
||||||
|
+ $input .= "c\n";
|
||||||
|
+ while ($server->pumpable &&
|
||||||
|
+ $stderr !~ /SSL_verify_client_post_handshake/ &&
|
||||||
|
+ $stdout !~ /SSL_do_handshake -> 1/
|
||||||
|
+ ) {
|
||||||
|
+ # Push the PHA command to the server and read outputs.
|
||||||
|
+ $server->pump;
|
||||||
|
+
|
||||||
|
+ # Client also must perform I/O to process the PHA request.
|
||||||
|
+ my $select = IO::Select->new($client);
|
||||||
|
+ while ($select->can_read(1)) { # 1 second time-out because of
|
||||||
|
+ # blocking IPC::Run
|
||||||
|
+ my $retval = $client->read(my $buf, 1);
|
||||||
|
+ if (defined $buf and $buf eq 'c') {
|
||||||
|
+ skip 'openssl tool does not support PHA command', 1;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ ok($stdout =~ /SSL_do_handshake -> 1/, 'Client performed PHA');
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ ok($client->close, 'Client disconnected');
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+eval {
|
||||||
|
+ $server->kill_kill;
|
||||||
|
+};
|
||||||
|
+ok(!$@, 'Server terminated');
|
||||||
|
+
|
||||||
|
--
|
||||||
|
2.17.2
|
||||||
|
|
||||||
@ -1,6 +1,6 @@
|
|||||||
Name: perl-IO-Socket-SSL
|
Name: perl-IO-Socket-SSL
|
||||||
Version: 2.060
|
Version: 2.060
|
||||||
Release: 3%{?dist}
|
Release: 4%{?dist}
|
||||||
Summary: Perl library for transparent SSL
|
Summary: Perl library for transparent SSL
|
||||||
License: GPL+ or Artistic
|
License: GPL+ or Artistic
|
||||||
URL: https://metacpan.org/release/IO-Socket-SSL
|
URL: https://metacpan.org/release/IO-Socket-SSL
|
||||||
@ -10,6 +10,13 @@ Patch1: IO-Socket-SSL-2.060-use-system-default-SSL-version.patch
|
|||||||
# Prevent tests from dying on SIGPIPE, CPAN RT#126899,
|
# Prevent tests from dying on SIGPIPE, CPAN RT#126899,
|
||||||
# in upstream after 2.060
|
# in upstream after 2.060
|
||||||
Patch2: IO-Socket-SSL-2.060-make-all-tests-which-use-fork-also-ignore-signal-PIP.patch
|
Patch2: IO-Socket-SSL-2.060-make-all-tests-which-use-fork-also-ignore-signal-PIP.patch
|
||||||
|
# Client sends a post-handshake-authentication extension if a client key and
|
||||||
|
# a certificate are available, bug #1632660,
|
||||||
|
# <https://github.com/noxxi/p5-io-socket-ssl/pull/80>
|
||||||
|
Patch3: IO-Socket-SSL-2.060-Enable-Post-Handshake-Authentication-TLSv1.3-feature.patch
|
||||||
|
# A test for Enable-Post-Handshake-Authentication-TLSv1.3-feature.patch,
|
||||||
|
# bug #1632660, requires openssl tool
|
||||||
|
Patch4: IO-Socket-SSL-2.060-Test-client-performs-Post-Handshake-Authentication.patch
|
||||||
BuildArch: noarch
|
BuildArch: noarch
|
||||||
# Module Build
|
# Module Build
|
||||||
BuildRequires: coreutils
|
BuildRequires: coreutils
|
||||||
@ -36,11 +43,15 @@ BuildRequires: perl(strict)
|
|||||||
BuildRequires: perl(vars)
|
BuildRequires: perl(vars)
|
||||||
BuildRequires: perl(warnings)
|
BuildRequires: perl(warnings)
|
||||||
# Test Suite
|
# Test Suite
|
||||||
|
# openssl for Test-client-performs-Post-Handshake-Authentication.patch
|
||||||
|
BuildRequires: openssl
|
||||||
BuildRequires: perl(Data::Dumper)
|
BuildRequires: perl(Data::Dumper)
|
||||||
BuildRequires: perl(File::Temp)
|
BuildRequires: perl(File::Temp)
|
||||||
BuildRequires: perl(FindBin)
|
BuildRequires: perl(FindBin)
|
||||||
BuildRequires: perl(IO::Select)
|
BuildRequires: perl(IO::Select)
|
||||||
BuildRequires: perl(IO::Socket::INET)
|
BuildRequires: perl(IO::Socket::INET)
|
||||||
|
# IPC::Run for Test-client-performs-Post-Handshake-Authentication.patch
|
||||||
|
BuildRequires: perl(IPC::Run)
|
||||||
BuildRequires: perl(Test::More) >= 0.88
|
BuildRequires: perl(Test::More) >= 0.88
|
||||||
BuildRequires: perl(utf8)
|
BuildRequires: perl(utf8)
|
||||||
BuildRequires: procps
|
BuildRequires: procps
|
||||||
@ -92,6 +103,10 @@ mod_perl.
|
|||||||
# Prevent tests from dying on SIGPIPE (CPAN RT#126899)
|
# Prevent tests from dying on SIGPIPE (CPAN RT#126899)
|
||||||
%patch2 -p1
|
%patch2 -p1
|
||||||
|
|
||||||
|
# Enable PHA on a client side
|
||||||
|
%patch3 -p1
|
||||||
|
%patch4 -p1
|
||||||
|
|
||||||
%build
|
%build
|
||||||
NO_NETWORK_TESTING=1 perl Makefile.PL INSTALLDIRS=vendor
|
NO_NETWORK_TESTING=1 perl Makefile.PL INSTALLDIRS=vendor
|
||||||
make %{?_smp_mflags}
|
make %{?_smp_mflags}
|
||||||
@ -117,6 +132,10 @@ make test
|
|||||||
%{_mandir}/man3/IO::Socket::SSL::Utils.3*
|
%{_mandir}/man3/IO::Socket::SSL::Utils.3*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Feb 07 2019 Petr Pisar <ppisar@redhat.com> - 2.060-4
|
||||||
|
- Client sends a post-handshake-authentication extension if a client key and
|
||||||
|
a certificate are available (bug #1632660)
|
||||||
|
|
||||||
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.060-3
|
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.060-3
|
||||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user