Skip to content

Commit

Permalink
Add more TLS Security Policies with TLS 1.3 support (#3023)
Browse files Browse the repository at this point in the history
  • Loading branch information
@alexw91
alexw91 authored Sep 3, 2021
1 parent 8bbb57f commit c4bda74
Show file tree
Hide file tree
Showing 3 changed files with 149 additions and 2 deletions.
105 changes: 105 additions & 0 deletions tls/s2n_cipher_preferences.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -345,6 +345,76 @@ const struct s2n_cipher_preferences cipher_preferences_20190214_gcm = {
.suites = cipher_suites_20190214_gcm,
};

/* Same as cipher_suites_20190214, but with TLS 1.3 Ciphers */
struct s2n_cipher_suite *cipher_suites_20210825[] = {
S2N_TLS13_CLOUDFRONT_CIPHER_SUITES_20200716,
&s2n_ecdhe_ecdsa_with_aes_128_cbc_sha,
&s2n_ecdhe_rsa_with_aes_128_cbc_sha,
&s2n_ecdhe_ecdsa_with_aes_128_gcm_sha256,
&s2n_ecdhe_rsa_with_aes_128_gcm_sha256,
&s2n_ecdhe_ecdsa_with_aes_256_gcm_sha384,
&s2n_ecdhe_rsa_with_aes_256_gcm_sha384,
&s2n_ecdhe_ecdsa_with_aes_128_cbc_sha256,
&s2n_ecdhe_rsa_with_aes_128_cbc_sha256,
&s2n_ecdhe_ecdsa_with_aes_256_cbc_sha,
&s2n_ecdhe_rsa_with_aes_256_cbc_sha,
&s2n_ecdhe_ecdsa_with_aes_256_cbc_sha384,
&s2n_ecdhe_rsa_with_aes_256_cbc_sha384,
&s2n_rsa_with_aes_128_cbc_sha,
&s2n_rsa_with_aes_128_gcm_sha256,
&s2n_rsa_with_aes_256_gcm_sha384,
&s2n_rsa_with_aes_128_cbc_sha256,
&s2n_rsa_with_aes_256_cbc_sha,
&s2n_rsa_with_aes_256_cbc_sha256,
&s2n_rsa_with_3des_ede_cbc_sha,
&s2n_dhe_rsa_with_aes_128_cbc_sha,
&s2n_dhe_rsa_with_aes_128_gcm_sha256,
&s2n_dhe_rsa_with_aes_256_gcm_sha384,
&s2n_dhe_rsa_with_aes_128_cbc_sha256,
&s2n_dhe_rsa_with_aes_256_cbc_sha,
&s2n_dhe_rsa_with_aes_256_cbc_sha256,
};

const struct s2n_cipher_preferences cipher_preferences_20210825 = {
.count = s2n_array_len(cipher_suites_20210825),
.suites = cipher_suites_20210825,
};

/* Same as cipher_suites_20190214_gcm, but with TLS 1.3 Ciphers */
struct s2n_cipher_suite *cipher_suites_20210825_gcm[] = {
S2N_TLS13_CLOUDFRONT_CIPHER_SUITES_20200716,
&s2n_ecdhe_ecdsa_with_aes_128_gcm_sha256,
&s2n_ecdhe_rsa_with_aes_128_gcm_sha256,
&s2n_ecdhe_ecdsa_with_aes_256_gcm_sha384,
&s2n_ecdhe_rsa_with_aes_256_gcm_sha384,
&s2n_ecdhe_ecdsa_with_aes_128_cbc_sha,
&s2n_ecdhe_rsa_with_aes_128_cbc_sha,
&s2n_ecdhe_ecdsa_with_aes_128_cbc_sha256,
&s2n_ecdhe_rsa_with_aes_128_cbc_sha256,
&s2n_ecdhe_ecdsa_with_aes_256_cbc_sha,
&s2n_ecdhe_rsa_with_aes_256_cbc_sha,
&s2n_ecdhe_ecdsa_with_aes_256_cbc_sha384,
&s2n_ecdhe_rsa_with_aes_256_cbc_sha384,
&s2n_rsa_with_aes_128_gcm_sha256,
&s2n_rsa_with_aes_256_gcm_sha384,
&s2n_rsa_with_aes_128_cbc_sha,
&s2n_rsa_with_aes_128_cbc_sha256,
&s2n_rsa_with_aes_256_cbc_sha,
&s2n_rsa_with_aes_256_cbc_sha256,
&s2n_rsa_with_3des_ede_cbc_sha,
&s2n_dhe_rsa_with_aes_128_gcm_sha256,
&s2n_dhe_rsa_with_aes_256_gcm_sha384,
&s2n_dhe_rsa_with_aes_128_cbc_sha,
&s2n_dhe_rsa_with_aes_128_cbc_sha256,
&s2n_dhe_rsa_with_aes_256_cbc_sha,
&s2n_dhe_rsa_with_aes_256_cbc_sha256,
};

const struct s2n_cipher_preferences cipher_preferences_20210825_gcm = {
.count = s2n_array_len(cipher_suites_20210825_gcm),
.suites = cipher_suites_20210825_gcm,
};

struct s2n_cipher_suite *cipher_suites_null[] = {
&s2n_null_cipher_suite
};
Expand Down Expand Up @@ -1198,6 +1268,26 @@ const struct s2n_cipher_preferences cipher_preferences_kms_tls_1_0_2018_10 = {
.suites = cipher_suites_kms_tls_1_0_2018_10,
};


struct s2n_cipher_suite *cipher_suites_kms_tls_1_0_2021_08[] = {
S2N_TLS13_CLOUDFRONT_CIPHER_SUITES_20200716,
&s2n_ecdhe_rsa_with_aes_256_gcm_sha384,
&s2n_ecdhe_rsa_with_aes_128_gcm_sha256,
&s2n_ecdhe_rsa_with_aes_256_cbc_sha384,
&s2n_ecdhe_rsa_with_aes_256_cbc_sha,
&s2n_ecdhe_rsa_with_aes_128_cbc_sha256,
&s2n_ecdhe_rsa_with_3des_ede_cbc_sha,
&s2n_dhe_rsa_with_aes_256_cbc_sha256,
&s2n_dhe_rsa_with_aes_128_cbc_sha256,
&s2n_dhe_rsa_with_aes_256_cbc_sha,
&s2n_dhe_rsa_with_aes_128_cbc_sha,
};

const struct s2n_cipher_preferences cipher_preferences_kms_tls_1_0_2021_08 = {
.count = s2n_array_len(cipher_suites_kms_tls_1_0_2021_08),
.suites = cipher_suites_kms_tls_1_0_2021_08,
};

struct s2n_cipher_suite *cipher_suites_kms_pq_tls_1_0_2019_06[] = {
&s2n_ecdhe_bike_rsa_with_aes_256_gcm_sha384,
&s2n_ecdhe_sike_rsa_with_aes_256_gcm_sha384,
Expand Down Expand Up @@ -1611,6 +1701,21 @@ const struct s2n_cipher_preferences cipher_preferences_kms_fips_tls_1_2_2018_10
.suites = cipher_suites_kms_fips_tls_1_2_2018_10,
};

struct s2n_cipher_suite *cipher_suites_kms_fips_tls_1_2_2021_08[] = {
S2N_TLS13_CLOUDFRONT_CIPHER_SUITES_20200716,
&s2n_ecdhe_rsa_with_aes_256_gcm_sha384,
&s2n_ecdhe_rsa_with_aes_128_gcm_sha256,
&s2n_ecdhe_rsa_with_aes_256_cbc_sha384,
&s2n_ecdhe_rsa_with_aes_128_cbc_sha256,
&s2n_dhe_rsa_with_aes_256_cbc_sha256,
&s2n_dhe_rsa_with_aes_128_cbc_sha256,
};

const struct s2n_cipher_preferences cipher_preferences_kms_fips_tls_1_2_2021_08 = {
.count = s2n_array_len(cipher_suites_kms_fips_tls_1_2_2021_08),
.suites = cipher_suites_kms_fips_tls_1_2_2021_08,
};

struct s2n_cipher_suite *cipher_suites_20210816[] = {
&s2n_ecdhe_ecdsa_with_aes_256_cbc_sha384,
&s2n_ecdhe_rsa_with_aes_256_cbc_sha384,
Expand Down
7 changes: 6 additions & 1 deletion tls/s2n_cipher_preferences.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,9 @@ extern const struct s2n_cipher_preferences cipher_preferences_20190121;
extern const struct s2n_cipher_preferences cipher_preferences_20190122;
extern const struct s2n_cipher_preferences cipher_preferences_20210816;
extern const struct s2n_cipher_preferences cipher_preferences_20210816_gcm;
extern const struct s2n_cipher_preferences cipher_preferences_20210825;
extern const struct s2n_cipher_preferences cipher_preferences_20210825_gcm;

extern const struct s2n_cipher_preferences cipher_preferences_test_all;

extern const struct s2n_cipher_preferences cipher_preferences_test_all_tls12;
Expand Down Expand Up @@ -99,6 +102,9 @@ extern const struct s2n_cipher_preferences cipher_preferences_aws_crt_sdk_tls_13

/* AWS KMS Cipher Preferences */
extern const struct s2n_cipher_preferences cipher_preferences_kms_tls_1_0_2018_10;
extern const struct s2n_cipher_preferences cipher_preferences_kms_tls_1_0_2021_08;
extern const struct s2n_cipher_preferences cipher_preferences_kms_fips_tls_1_2_2018_10;
extern const struct s2n_cipher_preferences cipher_preferences_kms_fips_tls_1_2_2021_08;
extern const struct s2n_cipher_preferences cipher_preferences_kms_pq_tls_1_0_2019_06;
extern const struct s2n_cipher_preferences cipher_preferences_kms_pq_tls_1_0_2020_02;
extern const struct s2n_cipher_preferences cipher_preferences_kms_pq_tls_1_0_2020_07;
Expand All @@ -115,6 +121,5 @@ extern const struct s2n_cipher_preferences cipher_preferences_pq_tls_1_0_2021_05
extern const struct s2n_cipher_preferences cipher_preferences_pq_tls_1_0_2021_05_25;
extern const struct s2n_cipher_preferences cipher_preferences_pq_tls_1_0_2021_05_26;

extern const struct s2n_cipher_preferences cipher_preferences_kms_fips_tls_1_2_2018_10;
extern const struct s2n_cipher_preferences cipher_preferences_null;

39 changes: 38 additions & 1 deletion tls/s2n_security_policies.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -337,6 +337,14 @@ const struct s2n_security_policy security_policy_kms_tls_1_0_2018_10 = {
.ecc_preferences = &s2n_ecc_preferences_20140601,
};

const struct s2n_security_policy security_policy_kms_tls_1_0_2021_08 = {
.minimum_protocol_version = S2N_TLS10,
.cipher_preferences = &cipher_preferences_kms_tls_1_0_2021_08,
.kem_preferences = &kem_preferences_null,
.signature_preferences = &s2n_signature_preferences_20200207,
.ecc_preferences = &s2n_ecc_preferences_20200310,
};

const struct s2n_security_policy security_policy_kms_pq_tls_1_0_2019_06 = {
.minimum_protocol_version = S2N_TLS10,
.cipher_preferences = &cipher_preferences_kms_pq_tls_1_0_2019_06,
Expand Down Expand Up @@ -475,6 +483,14 @@ const struct s2n_security_policy security_policy_kms_fips_tls_1_2_2018_10 = {
.ecc_preferences = &s2n_ecc_preferences_20140601,
};

const struct s2n_security_policy security_policy_kms_fips_tls_1_2_2021_08 = {
.minimum_protocol_version = S2N_TLS12,
.cipher_preferences = &cipher_preferences_kms_fips_tls_1_2_2021_08,
.kem_preferences = &kem_preferences_null,
.signature_preferences = &s2n_signature_preferences_20200207,
.ecc_preferences = &s2n_ecc_preferences_20140601,
};

const struct s2n_security_policy security_policy_20140601 = {
.minimum_protocol_version = S2N_SSLv3,
.cipher_preferences = &cipher_preferences_20140601,
Expand Down Expand Up @@ -579,6 +595,22 @@ const struct s2n_security_policy security_policy_20190214_gcm = {
.ecc_preferences = &s2n_ecc_preferences_20140601,
};

const struct s2n_security_policy security_policy_20210825 = {
.minimum_protocol_version = S2N_TLS10,
.cipher_preferences = &cipher_preferences_20210825,
.kem_preferences = &kem_preferences_null,
.signature_preferences = &s2n_signature_preferences_20200207,
.ecc_preferences = &s2n_ecc_preferences_20200310,
};

const struct s2n_security_policy security_policy_20210825_gcm = {
.minimum_protocol_version = S2N_TLS10,
.cipher_preferences = &cipher_preferences_20210825_gcm,
.kem_preferences = &kem_preferences_null,
.signature_preferences = &s2n_signature_preferences_20200207,
.ecc_preferences = &s2n_ecc_preferences_20200310,
};

const struct s2n_security_policy security_policy_20170328 = {
.minimum_protocol_version = S2N_TLS10,
.cipher_preferences = &cipher_preferences_20170328,
Expand Down Expand Up @@ -738,7 +770,11 @@ struct s2n_security_policy_selection security_policy_selection[] = {
{ .version="AWS-CRT-SDK-TLSv1.1", .security_policy=&security_policy_aws_crt_sdk_tls_11, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="AWS-CRT-SDK-TLSv1.2", .security_policy=&security_policy_aws_crt_sdk_tls_12, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="AWS-CRT-SDK-TLSv1.3", .security_policy=&security_policy_aws_crt_sdk_tls_13, .ecc_extension_required=0, .pq_kem_extension_required=0 },
/* KMS TLS Policies*/
{ .version="KMS-TLS-1-0-2018-10", .security_policy=&security_policy_kms_tls_1_0_2018_10, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="KMS-TLS-1-0-2021-08", .security_policy=&security_policy_kms_tls_1_0_2021_08, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="KMS-FIPS-TLS-1-2-2018-10", .security_policy=&security_policy_kms_fips_tls_1_2_2018_10, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="KMS-FIPS-TLS-1-2-2021-08", .security_policy=&security_policy_kms_fips_tls_1_2_2021_08, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="KMS-PQ-TLS-1-0-2019-06", .security_policy=&security_policy_kms_pq_tls_1_0_2019_06, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="KMS-PQ-TLS-1-0-2020-02", .security_policy=&security_policy_kms_pq_tls_1_0_2020_02, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="KMS-PQ-TLS-1-0-2020-07", .security_policy=&security_policy_kms_pq_tls_1_0_2020_07, .ecc_extension_required=0, .pq_kem_extension_required=0 },
Expand All @@ -755,7 +791,6 @@ struct s2n_security_policy_selection security_policy_selection[] = {
{ .version="PQ-TLS-1-0-2021-05-24", .security_policy=&security_policy_pq_tls_1_0_2021_05_24, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="PQ-TLS-1-0-2021-05-25", .security_policy=&security_policy_pq_tls_1_0_2021_05_25, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="PQ-TLS-1-0-2021-05-26", .security_policy=&security_policy_pq_tls_1_0_2021_05_26, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="KMS-FIPS-TLS-1-2-2018-10", .security_policy=&security_policy_kms_fips_tls_1_2_2018_10, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="20140601", .security_policy=&security_policy_20140601, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="20141001", .security_policy=&security_policy_20141001, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="20150202", .security_policy=&security_policy_20150202, .ecc_extension_required=0, .pq_kem_extension_required=0 },
Expand All @@ -769,6 +804,8 @@ struct s2n_security_policy_selection security_policy_selection[] = {
{ .version="20170328_gcm", .security_policy=&security_policy_20170328_gcm, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="20190214", .security_policy=&security_policy_20190214, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="20190214_gcm", .security_policy=&security_policy_20190214_gcm, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="20210825", .security_policy=&security_policy_20210825, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="20210825_gcm", .security_policy=&security_policy_20210825_gcm, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="20170405", .security_policy=&security_policy_20170405, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="20170405_gcm", .security_policy=&security_policy_20170405_gcm, .ecc_extension_required=0, .pq_kem_extension_required=0 },
{ .version="20170718", .security_policy=&security_policy_20170718, .ecc_extension_required=0, .pq_kem_extension_required=0 },
Expand Down

0 comments on commit c4bda74

Please sign in to comment.