Merge pull request gost-engine#482 from VladGud/tls13

Implement provider interface to support GOST TLS 1.3

Author: chipitsine

.github/before_script.sh

@@ -12,6 +12,9 @@ if [ "${APT_INSTALL-}" ]; then
 fi
 
 git clone --depth 1 -b $OPENSSL_BRANCH https://github.com/openssl/openssl.git
+if [ "${PATCH_OPENSSL}" == "1" ]; then
+    git apply patches/openssl-tls1.3.patch
+fi
 cd openssl
 git describe --always --long
 

.github/script.sh

@@ -5,9 +5,10 @@ PATH=$PREFIX/bin:$PATH
 
 mkdir build
 cd build
-cmake -DOPENSSL_ROOT_DIR=$PREFIX -DOPENSSL_ENGINES_DIR=$PREFIX/engines ${ASAN-} ..
+cmake -DTLS13_PATCHED_OPENSSL=$PATCH_OPENSSL -DOPENSSL_ROOT_DIR=$PREFIX -DOPENSSL_ENGINES_DIR=$PREFIX/engines ${ASAN-} ..
 make
 make test CTEST_OUTPUT_ON_FAILURE=1
 if [ -z "${ASAN-}" ]; then
-    make tcl_tests
+    make tcl_tests_engine
+    make tcl_tests_provider
 fi

.github/workflows/ci.yml

@@ -2,12 +2,16 @@ name: CI
 on: [push, pull_request]
 
 env:
-    OPENSSL_BRANCH: openssl-3.0
+    OPENSSL_BRANCH: openssl-3.4.2
     USE_RPATH: yes
+    PATCH_OPENSSL: 0
+    GOST_PROVIDER_ENABLE_ONLINE_TESTS: 1
 
 jobs:
     gcc-openssl-stable:
         runs-on: ubuntu-latest
+        env:
+            PATCH_OPENSSL: 1
         steps:
             - uses: actions/checkout@v2
               with:
@@ -19,6 +23,7 @@ jobs:
         runs-on: ubuntu-latest
         env:
             CC: clang
+            PATCH_OPENSSL: 1
         steps:
             - uses: actions/checkout@v2
               with:
@@ -30,6 +35,8 @@ jobs:
         runs-on: macos-latest
         env:
             USE_RPATH:
+            PATCH_OPENSSL: 1
+            GOST_PROVIDER_ENABLE_ONLINE_TESTS: 0 # macOS runner has no network access to infotecs TLS1.3 server
         steps:
             - uses: actions/checkout@v2
               with:
@@ -92,6 +99,7 @@ jobs:
             LDFLAGS: -m32
             SETARCH: "setarch i386"
             APT_INSTALL: gcc-multilib
+            PATCH_OPENSSL: 1
         steps:
             - uses: actions/checkout@v2
               with:

.github/workflows/codeql-analysis.yml

@@ -1,7 +1,7 @@
 name: "CodeQL"
 
 env:
-  OPENSSL_BRANCH: openssl-3.0
+  OPENSSL_BRANCH: openssl-3.4.2
   #RPATH: "-Wl,-rpath=${PREFIX}/lib"
   #PREFIX: ${HOME}/opt
   #PATH: ${PREFIX}/bin:${PATH}

.github/workflows/coverity.yml

@@ -10,8 +10,10 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.repository_owner == 'gost-engine' || github.event_name == 'workflow_dispatch' }}
     env:
-      OPENSSL_BRANCH: openssl-3.0
+      OPENSSL_BRANCH: openssl-3.4.2
       USE_RPATH: yes
+      PATCH_OPENSSL: 1
+      GOST_PROVIDER_ENABLE_ONLINE_TESTS: 0
 
     steps:
     - uses: actions/checkout@v2

.github/workflows/windows.yml

@@ -7,20 +7,27 @@ jobs:
         outputs:
             openssl-head: ${{ steps.openssl.outputs.head }}
         steps:
+            - uses: actions/checkout@v2
             - uses: actions/checkout@v2
               with:
                   repository: openssl/openssl
+                  path: openssl
+                  ref: openssl-3.4.2
                   fetch-depth: 0
-            - run: echo "::set-output name=head::$(git describe --always --long)"
+            - run: echo "::set-output name=head::$(git -C openssl describe --always --long)"
               id: openssl
             - uses: actions/cache@v4
               id: cache
               with:
-                  path: _dest
+                  path: openssl/_dest
                   key: ${{ runner.os }}-openssl-${{ steps.openssl.outputs.head }}
+            - name: Apply patches
+              run: |
+                  git apply patches/openssl-tls1.3.patch
             - uses: ilammy/msvc-dev-cmd@v1
             - name: Build OpenSSL
               if: steps.cache.outputs.cache-hit != 'true'
+              working-directory: openssl
               run: |
                   perl Configure no-makedepend no-tests no-asm VC-WIN64A
                   perl configdata.pm --dump
@@ -36,13 +43,13 @@ jobs:
                   submodules: true
             - uses: actions/cache@v4
               with:
-                  path: _dest
+                  path: openssl/_dest
                   key: ${{ runner.os }}-openssl-${{ needs.msvc-openssl.outputs.openssl-head }}
-            - run: cmake -DOPENSSL_ROOT_DIR="_dest\Program Files\OpenSSL" -DOPENSSL_ENGINES_DIR=bin .
+            - run: cmake -DOPENSSL_ROOT_DIR="openssl\_dest\Program Files\OpenSSL" -DOPENSSL_ENGINES_DIR=bin .
             - run: cmake --build .
             - name: Run tests
               run: |
-                  $env:PATH = "$env:PATH;$pwd\_dest\Program Files\OpenSSL\bin"
+                  $env:PATH = "$pwd\openssl\_dest\Program Files\OpenSSL\bin;$env:PATH"
                   $env:OPENSSL_ENGINES = "$pwd\bin\Debug"
                   $env:OPENSSL_MODULES = "$pwd\bin\Debug"
                   ctest -C Debug --output-on-failure

CMakeLists.txt

@@ -8,7 +8,7 @@ include(CheckCSourceRuns)
 
 enable_testing()
 
-find_package(OpenSSL 3.0 REQUIRED)
+find_package(OpenSSL 3.4 REQUIRED)
 
 if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
   message(STATUS "Setting build type to 'RelWithDebInfo' as none was specified.")
@@ -29,12 +29,12 @@ if (CMAKE_C_COMPILER_ID MATCHES "Clang")
   set(CMAKE_C_FLAGS_RELEASE -O2)
   set(CMAKE_C_FLAGS_DEBUG "-O0 -ggdb")
   set(CMAKE_C_FLAGS_RELWITHDEBINFO "-O2 -ggdb")
-  add_compile_options(-Werror -Wall -Wno-unused-parameter -Wno-unused-function -Wno-missing-braces -Qunused-arguments -Wno-deprecated-declarations)
+  add_compile_options(-Werror -Wall -Wno-unused-parameter -Wno-unused-function -Wno-missing-braces -Qunused-arguments -Wno-deprecated-declarations -Wno-error=\#warnings)
 elseif(CMAKE_C_COMPILER_ID MATCHES "GNU")
   set(CMAKE_C_FLAGS_RELEASE -O2)
   set(CMAKE_C_FLAGS_DEBUG "-O0 -ggdb")
   set(CMAKE_C_FLAGS_RELWITHDEBINFO "-O2 -ggdb")
-  add_compile_options(-Werror -Wall -Wno-unused-parameter -Wno-unused-function -Wno-missing-braces -Wno-error=unknown-pragmas -Wno-error=pragmas -Wno-deprecated-declarations)
+  add_compile_options(-Werror -Wall -Wno-unused-parameter -Wno-unused-function -Wno-missing-braces -Wno-error=unknown-pragmas -Wno-error=pragmas -Wno-deprecated-declarations -Wno-error=cpp)
 elseif(CMAKE_C_COMPILER_ID MATCHES "MSVC")
   add_definitions(-D_CRT_SECURE_NO_WARNINGS)
   add_definitions(-D_CRT_DEPRECATED_NO_WARNINGS)
@@ -204,15 +204,25 @@ set(GOST_ENGINE_SOURCE_FILES
 
 set(GOST_PROV_SOURCE_FILES
         gost_prov.c
+        gost_prov.h
         gost_prov_cipher.c
         gost_prov_digest.c
         gost_prov_mac.c
+        gost_prov_keymgmt.c
+        gost_prov_encoder.c
+        gost_prov_signature.c
+        gost_prov_decoder.c
+        gost_prov_keyexch.c
+        gost_prov_tls.c
+        gost_prov_tls.h
         )
 
 set(TEST_ENVIRONMENT_COMMON
+        TLS13_PATCHED_OPENSSL=${TLS13_PATCHED_OPENSSL}
         CMAKE_CURRENT_SOURCE_DIR=${CMAKE_CURRENT_SOURCE_DIR}
         PERL5LIB=${CMAKE_CURRENT_SOURCE_DIR}/test
         OPENSSL_PROGRAM=${OPENSSL_PROGRAM}
+        OPENSSL_MODULES=${CMAKE_RUNTIME_OUTPUT_DIRECTORY}
         OPENSSL_CRYPTO_LIBRARY=${OPENSSL_CRYPTO_LIBRARY}
         )
 
@@ -247,6 +257,13 @@ set_tests_properties(ciphers-with-provider
   PROPERTIES ENVIRONMENT "${TEST_ENVIRONMENT_PROVIDER}")
 
 # test_curves is an internals testing program, it doesn't need a test env
+
+add_executable(test_ecdhe test_ecdhe.c)
+target_link_libraries(test_ecdhe gost_core gost_err)
+add_test(NAME ecdhe COMMAND test_ecdhe)
+set_tests_properties(ecdhe
+  PROPERTIES ENVIRONMENT "${TEST_ENVIRONMENT_ENGINE}")
+
 add_executable(test_curves test_curves.c)
 target_link_libraries(test_curves gost_core gost_err)
 add_test(NAME curves COMMAND test_curves)
@@ -295,14 +312,17 @@ add_executable(test_gost89 test_gost89.c)
 target_link_libraries(test_gost89 gost_core gost_err)
 add_test(NAME gost89 COMMAND test_gost89)
 
-add_executable(test_mgm test_mgm.c)
-target_link_libraries(test_mgm OpenSSL::Crypto)
-add_test(NAME mgm-with-engine COMMAND test_mgm)
-set_tests_properties(mgm-with-engine
-  PROPERTIES ENVIRONMENT "${TEST_ENVIRONMENT_ENGINE}")
-add_test(NAME mgm-with-provider COMMAND test_mgm)
-set_tests_properties(mgm-with-provider
-  PROPERTIES ENVIRONMENT "${TEST_ENVIRONMENT_PROVIDER}")
+if(TLS13_PATCHED_OPENSSL)
+  add_executable(test_mgm test_mgm.c)
+  target_link_libraries(test_mgm OpenSSL::Crypto)
+  add_test(NAME mgm-with-engine COMMAND test_mgm)
+  set_tests_properties(mgm-with-engine
+    PROPERTIES ENVIRONMENT "${TEST_ENVIRONMENT_ENGINE}")
+  add_test(NAME mgm-with-provider COMMAND test_mgm)
+  set_tests_properties(mgm-with-provider
+    PROPERTIES ENVIRONMENT "${TEST_ENVIRONMENT_PROVIDER}")
+  set_property(TARGET test_mgm APPEND PROPERTY COMPILE_DEFINITIONS ENGINE_DIR="${OUTPUT_DIRECTORY}")
+endif()
 
 if(NOT SKIP_PERL_TESTS)
     execute_process(COMMAND perl -MTest2::V0 -e ""
@@ -330,14 +350,14 @@ set(BINARY_TESTS_TARGETS
         test_digest
         test_ciphers
         test_curves
+        test_ecdhe
         test_params
         test_derive
         test_sign
         test_context
         test_keyexpimp
         test_gost89
         test_tls
-        test_mgm
         )
 set_property(TARGET ${BINARY_TESTS_TARGETS} APPEND PROPERTY COMPILE_DEFINITIONS ENGINE_DIR="${OUTPUT_DIRECTORY}")
 
@@ -410,12 +430,23 @@ add_custom_target(tags
     COMMAND ctags -R . ${OPENSSL_ROOT_DIR}
     WORKING_DIRECTORY ${CMAKE_SOURCE_DIR})
 
-add_custom_target(tcl_tests
+add_custom_target(tcl_tests_provider
+    COMMAND OPENSSL_LIBCRYPTO=${OPENSSL_CRYPTO_LIBRARY}
+            OPENSSL_APP=${OPENSSL_PROGRAM}
+            TESTSRC=${CMAKE_SOURCE_DIR}/tcl_tests
+            TESTDIR=${CMAKE_BINARY_DIR}/tcl_tests_provider
+            OPENSSL_MODULES_DIR=${CMAKE_RUNTIME_OUTPUT_DIRECTORY}
+            OPENSSL_CONF=${CMAKE_SOURCE_DIR}/tcl_tests/openssl-gost-provider.cnf
+            sh ./runtest.sh
+    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/tcl_tests)
+
+add_custom_target(tcl_tests_engine
     COMMAND OPENSSL_LIBCRYPTO=${OPENSSL_CRYPTO_LIBRARY}
             OPENSSL_APP=${OPENSSL_PROGRAM}
             TESTSRC=${CMAKE_SOURCE_DIR}/tcl_tests
             TESTDIR=${CMAKE_BINARY_DIR}/tcl_tests
             ENGINE_DIR=${CMAKE_RUNTIME_OUTPUT_DIRECTORY}
+            OPENSSL_CONF=${CMAKE_SOURCE_DIR}/tcl_tests/openssl-gost-engine.cnf
             sh ./runtest.sh
     WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/tcl_tests)
 

README.prov.md

@@ -37,21 +37,49 @@ MACs:
 -   kuznyechik-mac
 -   kuznyechik-ctr-acpkm-omac
 
-## TODO, not requiring additional OpenSSL support
+Keymgmt:
 
--   Basic support for GOST keys, i.e. implementations of KEYMGMT
-    (including key generation), DECODER and DECODER.
+- id-GostR3410-2001 ("GOST R 34.10-2001", "1.2.643.2.2.19")
+- id-GostR3410-2001DH ("GOST R 34.10-2001 DH", "1.2.643.2.2.98")
+- gost2012_256 ("GOST R 34.10-2012 with 256 bit modulus", "1.2.643.7.1.1.1.1")
+- gost2012_512 ("GOST R 34.10-2012 with 512 bit modulus", "1.2.643.7.1.1.1.2")
 
--   Support for these operations using GOST keys:
+Encoder:
+- id-GostR3410-2001 ("GOST R 34.10-2001", "1.2.643.2.2.19") with structure format = pem/der/text
+- id-GostR3410-2001DH ("GOST R 34.10-2001 DH", "1.2.643.2.2.98") with structure format = pem/der/text
+- gost2012_256 ("GOST R 34.10-2012 with 256 bit modulus", "1.2.643.7.1.1.1.1") with structure format = pem/der/text
+- gost2012_512 ("GOST R 34.10-2012 with 512 bit modulus", "1.2.643.7.1.1.1.2") with structure format = pem/der/text
+
+PrivateKeyInfo can only be saved in pkcs8 format without encryption.
+
+Decoder:
+- id-GostR3410-2001 ("GOST R 34.10-2001", "1.2.643.2.2.19") with structure format = der
+- id-GostR3410-2001DH ("GOST R 34.10-2001 DH", "1.2.643.2.2.98") with structure format = der
+- gost2012_256 ("GOST R 34.10-2012 with 256 bit modulus", "1.2.643.7.1.1.1.1") with structure format = der
+- gost2012_512 ("GOST R 34.10-2012 with 512 bit modulus", "1.2.643.7.1.1.1.2") with structure format = der
+
+pem2der decoder already implemented by OpenSSL default provider.
+
+PrivateKeyInfo can only be loaded in pkcs8 format without decryption.
+
+Signature:
+- SN_id_GostR3410_2001, "id-GostR3411-94-with-GostR3410-2001", "GOST R 34.11-94 with GOST R 34.10-2001", "1.2.643.2.2.3"
+- SN_id_GostR3410_2012_256, "id-tc26-signwithdigest-gost3410-2012-256", "GOST R 34.10-2012 with GOST R 34.11-2012 (256 bit)", "1.2.643.7.1.1.3.2"
+- gost2012_256, "id-tc26-signwithdigest-gost3410-2012-512", "GOST R 34.10-2012 with GOST R 34.11-2012 (512 bit)", "1.2.643.7.1.1.3.3"
 
+Keyexchange:
+- ECDHE
+
+TLS1.3:
+- OpenSSL patch has been implemented that allows to connect TLS1.3 using a provider.
+
+## TODO, not requiring additional OpenSSL support
+
+-   Support for these operations using GOST keys:
     -   ASYM_CIPHER (encryption and decryption using GOST keys)
-    -   SIGNATURE (signing and verifying using GOST keys)
 
 ## TODO, which requires additional OpenSSL support
 
--   TLSTREE support.  This may require additional changes in libssl.
-    Needs investigation.
-
 -   PKCS7 and CMS support.  This requires OpenSSL PKCS7 and CMS code
     to change for better interfacing with providers.