fedora crypto-policies: initial support.

[philljj]

Description

Adds initial support for Fedora and Redhat system-wide crypto-policies.

The idea is at runtime, a system wide crypto-policy config file is loaded that sets minimum security limits on:

• key sizes
• tls methods
• allowed ciphers

Fixes zd#18593.

Build with --with-sys-crypto-policy, or --with-sys-crypto-policy=<path>. If no arg is given, then /etc/crypto-policies/back-ends/wolfssl.config is used as default.

Requires enable-distro.

crypto-policy API

• wolfSSL_crypto_policy_enable
• wolfSSL_crypto_policy_enable_buffer
• wolfSSL_crypto_policy_disable
• wolfSSL_crypto_policy_is_enabled
• wolfSSL_crypto_policy_get_ciphers
• wolfSSL_crypto_policy_get_level

Enable with wolfSSL_crypto_policy_enable or wolfSSL_crypto_policy_enable_buffer. Once enabled, new instantiated WOLFSSL_CTX will inherit the policy's parameters. Trying to change the minimum downgrade version, or set key sizes smaller than allowed minimum will return CRYPTO_POLICY_FORBIDDEN.

The crypto_policy API are not thread safe, and should only be used during program init.

Testing

Added new unit tests:

• test_wolfSSL_crypto_policy
• test_wolfSSL_crypto_policy_certs_and_keys
• test_wolfSSL_crypto_policy_tls_methods
• test_wolfSSL_crypto_policy_ciphers

Added Jenkins test:

• https://github.com/wolfSSL/testing/pull/826

Config

Added three example crypto-policy configs here:

• examples/crypto_policies/future/wolfssl.txt
• examples/crypto_policies/default/wolfssl.txt
• examples/crypto_policies/legacy/wolfssl.txt

Examples

The examples client and server were updated to take crypto-policy as an arg.

E.g. if you run the example with the future policy it will fail, because the future policy requires min 3072 RSA and DH key sizes (or 256 bit ecc keys):

./examples/client/client --crypto-policy examples/crypto_policies/future/wolfssl.txt 
wolfSSL Entering wolfSSL_Init
wolfSSL Entering wolfCrypt_Init
...

wolfSSL error: Error setting minimum DH key size

If you set the client to use larger keys, then it works again:

./examples/client/client --crypto-policy examples/crypto_policies/future/wolfssl.txt -Z 3072 \
 -k certs/ecc-client-key.pem \
-c certs/client-ecc-cert.pem \
-A certs/ca-ecc-cert.pem

[dgarske]

Retest this please. CRL issues

[JacobBarthelmeh]

This looks good to me. Is there feedback on use with Fedora?

[douzzer]

The current code depends on OPENSSL_EXTRA, and you should add an error in configure.ac if someone attempts to use --with-sys-crypto-policy without ENABLED_OPENSSLEXTRA.

The other notable dependency is on stdio filesystem, so build fails if -DNO_FILESYSTEM. But wolfSSL_crypto_policy_enable() could be implemented to take a const char * instead of a path, eliminating that dependency. That could prove useful in embedded and kernel apps.

[philljj]

The combo --with-sys-crypto-policy --disable-filesystem works now. wolfSSL_crypto_policy_enable_buffer() lets you pass a mem buffer, and wolfSSL_crypto_policy_enable is gated behind !NO_FILESYSTEM:

#ifndef NO_FILESYSTEM
WOLFSSL_API int    wolfSSL_crypto_policy_enable(const char * policy);
#endif /* ! NO_FILESYSTEM */
WOLFSSL_API int    wolfSSL_crypto_policy_enable_buffer(const char * buf);