Skip to content

Commit

Permalink
Merge pull request #1208 from yakara-ltd/ciphers
Browse files Browse the repository at this point in the history 
Allow the auth ciphers to be specified with the -c option
  • Loading branch information
@ddpbsd
ddpbsd authored Aug 5, 2017
2 parents 73d6eeb + 7cc360b commit c7ee2c1
Show file tree
Hide file tree
Showing 4 changed files with 29 additions and 12 deletions.
5 changes: 3 additions & 2 deletions src/os_auth/auth.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,10 +45,11 @@
extern BIO *bio_err;
#define KEYFILE "/etc/sslmanager.key"
#define CERTFILE "/etc/sslmanager.cert"
#define DEFAULT_CIPHERS "HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH"
#define DEFAULT_PORT "1515"

SSL_CTX *os_ssl_keys(int is_server, const char *os_dir, const char *cert, const char *key, const char *ca_cert);
SSL_CTX *get_ssl_context(void);
SSL_CTX *os_ssl_keys(int is_server, const char *os_dir, const char *ciphers, const char *cert, const char *key, const char *ca_cert);
SSL_CTX *get_ssl_context(const char *ciphers);
int load_cert_and_key(SSL_CTX *ctx, const char *cert, const char *key);
int load_ca_cert(SSL_CTX *ctx, const char *ca_cert);
int verify_callback(int ok, X509_STORE_CTX *store);
Expand Down
14 changes: 11 additions & 3 deletions src/os_auth/main-client.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ static void help_agent_auth(void) __attribute__((noreturn));
static void help_agent_auth()
{
print_header();
print_out(" %s: -[Vhdt] [-g group] [-D dir] [-m IP address] [-p port] [-A name] [-v path] [-x path] [-k path]", ARGV0);
print_out(" %s: -[Vhdt] [-g group] [-D dir] [-m IP address] [-p port] [-A name] [-c ciphers] [-v path] [-x path] [-k path]", ARGV0);
print_out(" -V Version and license message");
print_out(" -h This help message");
print_out(" -d Execute in debug mode. This parameter");
Expand All @@ -56,6 +56,7 @@ static void help_agent_auth()
print_out(" -m <addr> Manager IP address");
print_out(" -p <port> Manager port (default: %s)", DEFAULT_PORT);
print_out(" -A <name> Agent name (default: hostname)");
print_out(" -c SSL cipher list (default: %s)", DEFAULT_CIPHERS);
print_out(" -v <path> Full path to CA certificate used to verify the server");
print_out(" -x <path> Full path to agent certificate");
print_out(" -k <path> Full path to agent key");
Expand All @@ -75,6 +76,7 @@ int main(int argc, char **argv)

int sock = 0, portnum, ret = 0;
char *port = DEFAULT_PORT;
char *ciphers = DEFAULT_CIPHERS;
const char *dir = DEFAULTDIR;
const char *group = GROUPGLOBAL;
char *authpass = NULL;
Expand All @@ -98,7 +100,7 @@ int main(int argc, char **argv)
/* Set the name */
OS_SetName(ARGV0);

while ((c = getopt(argc, argv, "Vdhtg:m:p:A:v:x:k:D:P:")) != -1) {
while ((c = getopt(argc, argv, "Vdhtg:m:p:A:c:v:x:k:D:P:")) != -1) {
switch (c) {
case 'V':
print_version();
Expand Down Expand Up @@ -146,6 +148,12 @@ int main(int argc, char **argv)
}
port = optarg;
break;
case 'c':
if (!optarg) {
ErrorExit("%s: -%c needs an argument", ARGV0, c);
}
ciphers = optarg;
break;
case 'v':
if (!optarg) {
ErrorExit("%s: -%c needs an argument", ARGV0, c);
Expand Down Expand Up @@ -222,7 +230,7 @@ int main(int argc, char **argv)
}

/* Start SSL */
ctx = os_ssl_keys(0, dir, agent_cert, agent_key, ca_cert);
ctx = os_ssl_keys(0, dir, ciphers, agent_cert, agent_key, ca_cert);
if (!ctx) {
merror("%s: ERROR: SSL error. Exiting.", ARGV0);
exit(1);
Expand Down
14 changes: 11 additions & 3 deletions src/os_auth/main-server.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ static void clean_exit(SSL_CTX *ctx, int sock) __attribute__((noreturn));
static void help_authd()
{
print_header();
print_out(" %s: -[Vhdti] [-g group] [-D dir] [-p port] [-v path] [-x path] [-k path]", ARGV0);
print_out(" %s: -[Vhdti] [-g group] [-D dir] [-p port] [-c ciphers] [-v path] [-x path] [-k path]", ARGV0);
print_out(" -V Version and license message");
print_out(" -h This help message");
print_out(" -d Execute in debug mode. This parameter");
Expand All @@ -63,6 +63,7 @@ static void help_authd()
print_out(" -D <dir> Directory to chroot into (default: %s)", DEFAULTDIR);
print_out(" -p <port> Manager port (default: %s)", DEFAULT_PORT);
print_out(" -n Disable shared password authentication (not recommended).\n");
print_out(" -c SSL cipher list (default: %s)", DEFAULT_CIPHERS);
print_out(" -v <path> Full path to CA certificate used to verify clients");
print_out(" -x <path> Full path to server certificate");
print_out(" -k <path> Full path to server key");
Expand Down Expand Up @@ -151,6 +152,7 @@ int main(int argc, char **argv)
gid_t gid;
int client_sock = 0, sock = 0, portnum, ret = 0;
char *port = DEFAULT_PORT;
char *ciphers = DEFAULT_CIPHERS;
const char *dir = DEFAULTDIR;
const char *group = GROUPGLOBAL;
const char *server_cert = NULL;
Expand All @@ -171,7 +173,7 @@ int main(int argc, char **argv)
/* Set the name */
OS_SetName(ARGV0);

while ((c = getopt(argc, argv, "Vdhtig:D:m:p:v:x:k:n")) != -1) {
while ((c = getopt(argc, argv, "Vdhtig:D:m:p:c:v:x:k:n")) != -1) {
switch (c) {
case 'V':
print_version();
Expand Down Expand Up @@ -213,6 +215,12 @@ int main(int argc, char **argv)
}
port = optarg;
break;
case 'c':
if (!optarg) {
ErrorExit("%s: -%c needs an argument", ARGV0, c);
}
ciphers = optarg;
break;
case 'v':
if (!optarg) {
ErrorExit("%s: -%c needs an argument", ARGV0, c);
Expand Down Expand Up @@ -312,7 +320,7 @@ int main(int argc, char **argv)
fclose(fp);

/* Start SSL */
ctx = os_ssl_keys(1, dir, server_cert, server_key, ca_cert);
ctx = os_ssl_keys(1, dir, ciphers, server_cert, server_key, ca_cert);
if (!ctx) {
merror("%s: ERROR: SSL error. Exiting.", ARGV0);
exit(1);
Expand Down
8 changes: 4 additions & 4 deletions src/os_auth/ssl.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,11 +35,11 @@ BIO *bio_err;
* then load the file containing the CA chain and verify the certifcate
* sent by the peer.
*/
SSL_CTX *os_ssl_keys(int is_server, const char *os_dir, const char *cert, const char *key, const char *ca_cert)
SSL_CTX *os_ssl_keys(int is_server, const char *os_dir, const char *ciphers, const char *cert, const char *key, const char *ca_cert)
{
SSL_CTX *ctx = NULL;

if (!(ctx = get_ssl_context())) {
if (!(ctx = get_ssl_context(ciphers))) {
goto SSL_ERROR;
}

Expand Down Expand Up @@ -94,7 +94,7 @@ SSL_CTX *os_ssl_keys(int is_server, const char *os_dir, const char *cert, const
return (SSL_CTX *)NULL;
}

SSL_CTX *get_ssl_context()
SSL_CTX *get_ssl_context(const char *ciphers)
{
const SSL_METHOD *sslmeth = NULL;
SSL_CTX *ctx = NULL;
Expand All @@ -111,7 +111,7 @@ SSL_CTX *get_ssl_context()

/* Explicitly set options and cipher list */
SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
if (!(SSL_CTX_set_cipher_list(ctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"))) {
if (!(SSL_CTX_set_cipher_list(ctx, ciphers))) {
goto CONTEXT_ERR;
}

Expand Down

0 comments on commit c7ee2c1

Please sign in to comment.