From 6963470dadacd50db3ad1f6b25d5613166dc47b4 Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Mon, 14 Nov 2016 14:02:23 +0100 Subject: [PATCH] (tinc) add cipher selection --- .../OPNsense/Tinc/forms/dialogHost.xml | 10 ++++ .../OPNsense/Tinc/forms/dialogNetwork.xml | 10 ++++ .../mvc/app/models/OPNsense/Tinc/Tinc.xml | 16 ++++++ .../scripts/OPNsense/Tinc/lib/objects.py | 2 + .../scripts/OPNsense/Tinc/list_ciphers.py | 50 +++++++++++++++++++ .../templates/OPNsense/Tinc/tinc_deploy.xml | 2 + 6 files changed, 90 insertions(+) create mode 100755 net/tinc/src/opnsense/scripts/OPNsense/Tinc/list_ciphers.py diff --git a/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogHost.xml b/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogHost.xml index 91e55e420..9e991a432 100644 --- a/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogHost.xml +++ b/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogHost.xml @@ -35,6 +35,16 @@ textbox Public key for this host in the network + + host.cipher + + dropdown + The symmetric cipher algorithm used to encrypt UDP packets. + Any cipher supported by LibreSSL or OpenSSL is recognised. + Furthermore, specifying "none" will turn off packet encryption. + It is best to use only those ciphers which support CBC mode + + host.connectTo diff --git a/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogNetwork.xml b/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogNetwork.xml index 026fdb993..e43e7ffea 100644 --- a/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogNetwork.xml +++ b/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogNetwork.xml @@ -17,6 +17,16 @@ text This machines internal address to use and network mask for the whole network + + network.cipher + + dropdown + The symmetric cipher algorithm used to encrypt UDP packets. + Any cipher supported by LibreSSL or OpenSSL is recognised. + Furthermore, specifying "none" will turn off packet encryption. + It is best to use only those ciphers which support CBC mode + + network.debuglevel diff --git a/net/tinc/src/opnsense/mvc/app/models/OPNsense/Tinc/Tinc.xml b/net/tinc/src/opnsense/mvc/app/models/OPNsense/Tinc/Tinc.xml index 5cc67df01..07b09ad3c 100644 --- a/net/tinc/src/opnsense/mvc/app/models/OPNsense/Tinc/Tinc.xml +++ b/net/tinc/src/opnsense/mvc/app/models/OPNsense/Tinc/Tinc.xml @@ -42,6 +42,14 @@ Y + + Y + N + tinc list ciphers + 1 + /tmp/tinc_current_cipher_options.index + blowfish + 1 Y @@ -93,6 +101,14 @@ Y + + Y + N + tinc list ciphers + 1 + /tmp/tinc_current_cipher_options.index + blowfish + 1 Y diff --git a/net/tinc/src/opnsense/scripts/OPNsense/Tinc/lib/objects.py b/net/tinc/src/opnsense/scripts/OPNsense/Tinc/lib/objects.py index b2b8f37ef..956586c92 100644 --- a/net/tinc/src/opnsense/scripts/OPNsense/Tinc/lib/objects.py +++ b/net/tinc/src/opnsense/scripts/OPNsense/Tinc/lib/objects.py @@ -109,6 +109,7 @@ class Host(NetwConfObject): self._connectTo = "0" self._payload['subnet'] = None self._payload['pubkey'] = None + self._payload['cipher'] = None def connect_to_this_host(self): if self.is_valid() and self._connectTo == "1": @@ -123,6 +124,7 @@ class Host(NetwConfObject): result = list() result.append('Address=%(address)s'%self._payload) result.append('Subnet=%(subnet)s'%self._payload) + result.append('Cipher=%(cipher)s'%self._payload) result.append(self._payload['pubkey']) return '\n'.join(result) diff --git a/net/tinc/src/opnsense/scripts/OPNsense/Tinc/list_ciphers.py b/net/tinc/src/opnsense/scripts/OPNsense/Tinc/list_ciphers.py new file mode 100755 index 000000000..b5755afc4 --- /dev/null +++ b/net/tinc/src/opnsense/scripts/OPNsense/Tinc/list_ciphers.py @@ -0,0 +1,50 @@ +#!/usr/local/bin/python2.7 + +""" + Copyright (c) 2016 Deciso B.V. - Ad Schellevis + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + -------------------------------------------------------------------------------------- + list ciphers +""" +from subprocess import Popen, PIPE +import ujson + +response = dict() + +p = Popen(['/usr/bin/openssl','enc', '-help'],stdin=PIPE, stdout=PIPE, stderr=PIPE, bufsize=-1) +output, error = p.communicate() +cipher_section = False +for line in error.split('\n'): + if line.find('Cipher Types') == 0: + cipher_section = True + continue + if cipher_section: + for item in line.split(): + if len(item) > 1: + response[item[1:]] = item[1:] + +response["none"] = "None" +# output generated keys +print (ujson.dumps(response)) diff --git a/net/tinc/src/opnsense/service/templates/OPNsense/Tinc/tinc_deploy.xml b/net/tinc/src/opnsense/service/templates/OPNsense/Tinc/tinc_deploy.xml index f51b424d6..d2a1a1050 100644 --- a/net/tinc/src/opnsense/service/templates/OPNsense/Tinc/tinc_deploy.xml +++ b/net/tinc/src/opnsense/service/templates/OPNsense/Tinc/tinc_deploy.xml @@ -17,6 +17,7 @@
{{network.extaddress}}
{{network.subnet}} + {{network.cipher}} 0 {% for host in helpers.toList('OPNsense.Tinc.hosts.host', 'hostname') %} @@ -27,6 +28,7 @@
{{host.extaddress}}
{{host.subnet}} + {{host.cipher}} {{host.connectTo}} {% endif %}