Extend TLS Support (#8505)
* tls13: This commit brings TLS 1.3 to Netdata * tls13: Update variables on slave side * tls13: Fix compilation error for old libraries * tls13: Fix compilation error for old libraries 2 * tls13 remove ciphers * tls13: TLS versions This commit brings the missing tls versions accpeted for Netdata and it also brings documentation update related to these versions * tls13: Remove dupplication This commit removes wrong dupplication of code * tls13: Documentation This commit brings fix for the documentation * tls13: Remove magic number This commit removes the magic number to allow the code to be readable * tls13: TLS version Small adjust with TLS version * tls13: Security Init This commit removes array from the function and overwrite the magic number with a string * tls13: Remove new variable name from stream * tls13: OpenSSL versions and old key name This commit removes the new key names and also update the names used to define openssl version
thiagoftsm committed
Mar 31, 2020 at 22:53 UTC
a12d4e56d7db6bcb0f84a26b930ab745ffdd427a
5 files changed
+81
-28
daemon/main.c
+3
@@ -406,6 +406,9 @@ static void security_init(){
406
snprintfz(filename, FILENAME_MAX, "%s/ssl/cert.pem",netdata_configured_user_config_dir);
407
security_cert = config_get(CONFIG_SECTION_WEB, "ssl certificate", filename);
408
409
+ tls_version = config_get(CONFIG_SECTION_WEB, "tls version", "1.3");
410
+ tls_ciphers = config_get(CONFIG_SECTION_WEB, "tls ciphers", "none");
411
+
412
security_openssl_library();
413
}
414
#endif
libnetdata/socket/security.c
+53
-25
@@ -7,6 +7,8 @@ SSL_CTX *netdata_client_ctx=NULL;
7
SSL_CTX *netdata_srv_ctx=NULL;
8
const char *security_key=NULL;
9
const char *security_cert=NULL;
10
+const char *tls_version=NULL;
11
+const char *tls_ciphers=NULL;
12
int netdata_validate_server = NETDATA_SSL_VALID_CERTIFICATE;
13
14
/**
@@ -32,14 +34,12 @@ static void security_info_callback(const SSL *ssl, int where, int ret __maybe_un
34
*/
35
void security_openssl_library()
36
{
35
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
36
-# if (SSLEAY_VERSION_NUMBER >= 0x0907000L)
37
+#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
38
+# if (SSLEAY_VERSION_NUMBER >= OPENSSL_VERSION_097)
39
OPENSSL_config(NULL);
40
# endif
41
40
-# if OPENSSL_API_COMPAT < 0x10100000L
42
SSL_load_error_strings();
42
-# endif
43
44
SSL_library_init();
45
#else
@@ -49,32 +49,60 @@ void security_openssl_library()
49
#endif
50
}
51
52
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_110
53
+/**
54
+ * TLS version
55
+ *
56
+ * Returns the TLS version depending of the user input.
57
+ *
58
+ * @param lversion is the user input.
59
+ *
60
+ * @return it returns the version number.
61
+ */
62
+int tls_select_version(const char *lversion) {
63
+ if (!strcmp(lversion, "1") || !strcmp(lversion, "1.0"))
64
+ return TLS1_VERSION;
65
+ else if (!strcmp(lversion, "1.1"))
66
+ return TLS1_1_VERSION;
67
+ else if (!strcmp(lversion, "1.2"))
68
+ return TLS1_2_VERSION;
69
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_111
70
+ else if (!strcmp(lversion, "1.3"))
71
+ return TLS1_3_VERSION;
72
+#endif
73
+
74
+ return TLS_MAX_VERSION;
75
+}
76
+#endif
77
+
78
/**
79
* OpenSSL common options
80
*
81
* Clients and SERVER have common options, this function is responsible to set them in the context.
82
*
57
- * @param ctx
83
+ * @param ctx the initialized SSL context.
84
+ * @param side 0 means server, and 1 client.
85
*/
59
-void security_openssl_common_options(SSL_CTX *ctx) {
60
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
61
- static char *ciphers = {"ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"};
86
+void security_openssl_common_options(SSL_CTX *ctx, int side) {
87
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_110
88
+ if (!side) {
89
+ int version = tls_select_version(tls_version) ;
90
#endif
63
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
64
- SSL_CTX_set_options (ctx,SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_COMPRESSION);
91
+#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
92
+ SSL_CTX_set_options (ctx,SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_COMPRESSION);
93
#else
66
- SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
67
- //We are avoiding the TLS v1.3 for while, because Google Chrome
68
- //is giving the message net::ERR_SSL_VERSION_INTERFERENCE with it.
69
- SSL_CTX_set_max_proto_version(ctx, TLS1_2_VERSION);
70
-#endif
71
- SSL_CTX_set_mode(ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
94
+ SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION);
95
+ SSL_CTX_set_max_proto_version(ctx, version);
96
73
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
74
- if (!SSL_CTX_set_cipher_list(ctx, ciphers)) {
75
- error("SSL error. cannot set the cipher list");
97
+ if(tls_ciphers && strcmp(tls_ciphers, "none") != 0) {
98
+ if (!SSL_CTX_set_cipher_list(ctx, tls_ciphers)) {
99
+ error("SSL error. cannot set the cipher list");
100
+ }
101
+ }
102
}
103
#endif
104
+
105
+ SSL_CTX_set_mode(ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
106
}
107
108
/**
@@ -86,13 +114,13 @@ void security_openssl_common_options(SSL_CTX *ctx) {
114
*/
115
SSL_CTX * security_initialize_openssl_client() {
116
SSL_CTX *ctx;
89
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
117
+#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
118
ctx = SSL_CTX_new(SSLv23_client_method());
119
#else
120
ctx = SSL_CTX_new(TLS_client_method());
121
#endif
122
if(ctx) {
95
- security_openssl_common_options(ctx);
123
+ security_openssl_common_options(ctx, 1);
124
}
125
126
return ctx;
@@ -111,7 +139,7 @@ static SSL_CTX * security_initialize_openssl_server() {
139
static int netdata_id_context = 1;
140
141
//TO DO: Confirm the necessity to check return for other OPENSSL function
114
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
142
+#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
143
ctx = SSL_CTX_new(SSLv23_server_method());
144
if (!ctx) {
145
error("Cannot create a new SSL context, netdata won't encrypt communication");
@@ -128,7 +156,7 @@ static SSL_CTX * security_initialize_openssl_server() {
156
157
SSL_CTX_use_certificate_chain_file(ctx, security_cert);
158
#endif
131
- security_openssl_common_options(ctx);
159
+ security_openssl_common_options(ctx, 0);
160
161
SSL_CTX_use_PrivateKey_file(ctx,security_key,SSL_FILETYPE_PEM);
162
@@ -142,7 +170,7 @@ static SSL_CTX * security_initialize_openssl_server() {
170
SSL_CTX_set_session_id_context(ctx,(void*)&netdata_id_context,(unsigned int)sizeof(netdata_id_context));
171
SSL_CTX_set_info_callback(ctx,security_info_callback);
172
145
-#if (OPENSSL_VERSION_NUMBER < 0x00905100L)
173
+#if (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_095)
174
SSL_CTX_set_verify_depth(ctx,1);
175
#endif
176
debug(D_WEB_CLIENT,"SSL GLOBAL CONTEXT STARTED\n");
@@ -207,7 +235,7 @@ void security_clean_openssl() {
235
SSL_CTX_free(netdata_opentsdb_ctx);
236
}
237
210
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
238
+#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
239
ERR_free_strings();
240
#endif
241
}
libnetdata/socket/security.h
+8
-1
@@ -17,9 +17,14 @@
17
18
# ifdef ENABLE_HTTPS
19
20
+#define OPENSSL_VERSION_095 0x00905100L
21
+#define OPENSSL_VERSION_097 0x0907000L
22
+#define OPENSSL_VERSION_110 0x10100000L
23
+#define OPENSSL_VERSION_111 0x10101000L
24
+
25
# include <openssl/ssl.h>
26
# include <openssl/err.h>
22
-# if (SSLEAY_VERSION_NUMBER >= 0x0907000L) && (OPENSSL_VERSION_NUMBER < 0x10100000L)
27
+# if (SSLEAY_VERSION_NUMBER >= OPENSSL_VERSION_097) && (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110)
28
# include <openssl/conf.h>
29
# endif
30
@@ -33,6 +38,8 @@ extern SSL_CTX *netdata_client_ctx;
38
extern SSL_CTX *netdata_srv_ctx;
39
extern const char *security_key;
40
extern const char *security_cert;
41
+extern const char *tls_version;
42
+extern const char *tls_ciphers;
43
extern int netdata_validate_server;
44
extern int security_location_for_context(SSL_CTX *ctx,char *file,char *path);
45
streaming/rrdpush.c
+1
@@ -109,6 +109,7 @@ int rrdpush_init() {
109
}
110
111
char *invalid_certificate = appconfig_get(&stream_config, CONFIG_SECTION_STREAM, "ssl skip certificate verification", "no");
112
+
113
if ( !strcmp(invalid_certificate,"yes")){
114
if (netdata_validate_server == NETDATA_SSL_VALID_CERTIFICATE){
115
info("Netdata is configured to accept invalid SSL certificate.");
web/server/README.md
+16
-2
@@ -67,11 +67,11 @@ The API requests are serviced as follows:
67
68
### Enabling TLS support
69
70
-Since v1.16.0, Netdata supports encrypted HTTP connections to the web server, plus encryption of streaming data between a slave and its master, via the TLS 1.2 protocol.
70
+Since v1.16.0, Netdata supports encrypted HTTP connections to the web server, plus encryption of streaming data between a slave and its master, via the TLS protocol.
71
72
Inbound unix socket connections are unaffected, regardless of the TLS settings.\
73
??? info "Differences in TLS and SSL terminology"
74
- While Netdata uses Transport Layer Security (TLS) 1.2 to encrypt communications rather than the obsolete SSL protocol, it's still common practice to refer to encrypted web connections as `SSL`. Many vendors, like Nginx and even Netdata itself, use `SSL` in configuration files, whereas documentation will always refer to encrypted communications as `TLS` or `TLS/SSL`.
74
+ While Netdata uses Transport Layer Security (TLS) to encrypt communications rather than the obsolete SSL protocol, it's still common practice to refer to encrypted web connections as `SSL`. Many vendors, like Nginx and even Netdata itself, use `SSL` in configuration files, whereas documentation will always refer to encrypted communications as `TLS` or `TLS/SSL`.
75
76
To enable TLS, provide the path to your certificate and private key in the `[web]` section of `netdata.conf`:
77
@@ -96,6 +96,20 @@ openssl req -newkey rsa:2048 -nodes -sha512 -x509 -days 365 -keyout key.pem -out
96
openssl speed rsa2048 rsa4096
97
```
98
99
+### Select TLS version
100
+
101
+Beginning with version 1.21, you can also specify the TLS version and the ciphers that you want to use:
102
+
103
+```conf
104
+[web]
105
+ tls version = 1.3
106
+ tls ciphers = TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
107
+```
108
+
109
+If you do not specify these options, Netdata will use the highest available protocol version on your system and the default cipher list for that protocol provided by your TLS implementation.
110
+
111
+While Netdata accepts all the TLS version as arguments (`1` or `1.0`, `1.1`, `1.2` and `1.3`), we recommend you use `1.3` for the most secure encryption.
112
+
113
#### TLS/SSL enforcement
114
115
When the certificates are defined and unless any other options are provided, a Netdata server will: