[pbs-devel] [PATCH proxmox-backup v4 0/3] close #3612: allow config of SSL cipher-suites for proxy

[pbs-devel] [PATCH proxmox-backup v4 0/3] close #3612: allow config of SSL cipher-suites for proxy

[Hannes Laimer]

Cannot be configured in the WebUI, only through proxmox-backup-manager,
api or in the config file directly(not recommended). For changes to take
effect the proxy has to be restarted.

Since the string can be rather long and I assume most of the time the
defaults are used, it is not in the WebUI.

v2:
  - allow setting for TLSv1.3 and TLS <= 1.2 individually

v3:
  - add proper regex

v4:
  - renaming variables

Hannes Laimer (3):
  config: add tls ciphers to NodeConfig
  proxy: use ciphers from config if set
  api2: make tls ciphers updatable

 pbs-api-types/src/lib.rs        | 41 +++++++++++++++++++++++++++++++++
 src/api2/node/config.rs         |  8 +++++++
 src/bin/proxmox-backup-proxy.rs | 10 ++++++++
 src/config/node.rs              | 26 ++++++++++++++++++++-
 4 files changed, 84 insertions(+), 1 deletion(-)

-- 
2.30.2

[pbs-devel] [PATCH proxmox-backup v4 1/3] config: add tls ciphers to NodeConfig

[Hannes Laimer]

for TLS 1.3 and for TLS <= 1.2

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 pbs-api-types/src/lib.rs | 41 ++++++++++++++++++++++++++++++++++++++++
 src/config/node.rs       | 26 ++++++++++++++++++++++++-
 2 files changed, 66 insertions(+), 1 deletion(-)

diff --git a/pbs-api-types/src/lib.rs b/pbs-api-types/src/lib.rs
index 0a0dd33d..4673fc3b 100644
--- a/pbs-api-types/src/lib.rs
+++ b/pbs-api-types/src/lib.rs
@@ -100,6 +100,20 @@ mod local_macros {
     macro_rules! DNS_ALIAS_NAME {
         () => (concat!(r"(?:(?:", DNS_ALIAS_LABEL!() , r"\.)*", DNS_ALIAS_LABEL!(), ")"))
     }
+    macro_rules! OPENSSL_CIPHERSUITE_RE { 
+        () => (
+            r"TLS_AES_256_GCM_SHA384|TLS_CHACHA20_POLY1305_SHA256|TLS_AES_128_GCM_SHA256|TLS_AES_128_CCM_8_SHA256|TLS_AES_128_CCM_SHA256"
+        ) 
+    }
+    macro_rules! OPENSSL_CIPHER_STRING_RE { 
+        () => (concat!(
+            r"([!\-+]?(COMPLEMENTOFDEFAULT|ALL|COMPLEMENTOFALL|HIGH|MEDIUM|LOW|[ae]?NULL|[ka]?RSA|",
+            "kDH[rdE]?|kEDH|DHE?|EDH|ADH|kEECDH|kECDHE|ECDH|ECDHE|EECDH|AECDH|a?DSS|aDH|a?ECDSA|",
+            "SSLv3|AES(128|256)?|GCM|AESGCM|AESCCM|AESCCM8|ARIA(128|256)?|CAMELLIA(128|256)?|",
+            "CHACHA20|3?DES|RC[24]|IDEA|SEED|MD5|SHA(1|256|384)?|aGOST(01)?|kGOST|GOST94|GOST89MAC|",
+            "[ak]?PSK|kECDHEPSK|kDHEPSK|kRSAPSK|SUITEB(128|128ONLY|192)?|CBC3?|POLY1305))+"
+        )) 
+    }
 }
 
 const_regex! {
@@ -124,6 +138,22 @@ const_regex! {
 
     pub FINGERPRINT_SHA256_REGEX = r"^(?:[0-9a-fA-F][0-9a-fA-F])(?::[0-9a-fA-F][0-9a-fA-F]){31}$";
 
+    pub OPENSSL_CIPHERS_TLS_1_2_REGEX = concat!(
+        r"^((",
+        OPENSSL_CIPHER_STRING_RE!(),
+        ")([: ,](",
+        OPENSSL_CIPHER_STRING_RE!(),
+        "))*)$"
+    );
+    
+    pub OPENSSL_CIPHERS_TLS_1_3_REGEX = concat!(
+        r"^((",
+        OPENSSL_CIPHERSUITE_RE!(),
+        ")(:(",
+        OPENSSL_CIPHERSUITE_RE!(),
+        "))*)$"
+    );
+
     /// Regex for safe identifiers.
     ///
     /// This
@@ -160,6 +190,9 @@ pub const BLOCKDEVICE_NAME_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&B
 pub const SUBSCRIPTION_KEY_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&SUBSCRIPTION_KEY_REGEX);
 pub const SYSTEMD_DATETIME_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&SYSTEMD_DATETIME_REGEX);
 pub const HOSTNAME_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&HOSTNAME_REGEX);
+pub const OPENSSL_CIPHERS_TLS_1_2_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&OPENSSL_CIPHERS_TLS_1_2_REGEX);
+pub const OPENSSL_CIPHERS_TLS_1_3_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&OPENSSL_CIPHERS_TLS_1_3_REGEX);
+
 
 pub const DNS_ALIAS_FORMAT: ApiStringFormat =
     ApiStringFormat::Pattern(&DNS_ALIAS_REGEX);
@@ -189,6 +222,14 @@ pub const HOSTNAME_SCHEMA: Schema = StringSchema::new("Hostname (as defined in R
     .format(&HOSTNAME_FORMAT)
     .schema();
 
+pub const OPENSSL_CIPHERS_TLS_1_2_SCHEMA: Schema = StringSchema::new("OpenSSL cipher string list used by the proxy for TLS <= 1.2")
+    .format(&OPENSSL_CIPHERS_TLS_1_2_FORMAT)
+    .schema();
+
+pub const OPENSSL_CIPHERS_TLS_1_3_SCHEMA: Schema = StringSchema::new("OpenSSL ciphersuites list used by the proxy for TLSv1.3")
+    .format(&OPENSSL_CIPHERS_TLS_1_3_FORMAT)
+    .schema();
+
 pub const DNS_NAME_FORMAT: ApiStringFormat =
     ApiStringFormat::Pattern(&DNS_NAME_REGEX);
 
diff --git a/src/config/node.rs b/src/config/node.rs
index 4f2ab029..3f7adb1a 100644
--- a/src/config/node.rs
+++ b/src/config/node.rs
@@ -1,5 +1,6 @@
 use std::collections::HashSet;
 
+use openssl::ssl::{SslAcceptor, SslMethod};
 use anyhow::{bail, Error};
 use serde::{Deserialize, Serialize};
 
@@ -7,7 +8,7 @@ use proxmox_schema::{api, ApiStringFormat, ApiType, Updater};
 
 use proxmox_http::ProxyConfig;
 
-use pbs_api_types::EMAIL_SCHEMA;
+use pbs_api_types::{EMAIL_SCHEMA, OPENSSL_CIPHERS_TLS_1_2_SCHEMA, OPENSSL_CIPHERS_TLS_1_3_SCHEMA};
 use pbs_buildcfg::configdir;
 use pbs_config::{open_backup_lockfile, BackupLockGuard};
 
@@ -91,6 +92,14 @@ pub struct AcmeConfig {
             schema: EMAIL_SCHEMA,
             optional: true,
         },
+        "ciphers-tls13": {
+            schema: OPENSSL_CIPHERS_TLS_1_3_SCHEMA,
+            optional: true,
+        },
+        "ciphers-tls12": {
+            schema: OPENSSL_CIPHERS_TLS_1_2_SCHEMA,
+            optional: true,
+        },
     },
 )]
 #[derive(Deserialize, Serialize, Updater)]
@@ -121,6 +130,14 @@ pub struct NodeConfig {
     
     #[serde(skip_serializing_if = "Option::is_none")]
     pub email_from: Option<String>,
+
+    /// List of SSL ciphers for tls 1.3 that will be used by the proxy. (Proxy has to be restarted for changes to take effect)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ciphers_tls13: Option<String>,
+    
+    /// List of SSL ciphers for tls <= 1.2 that will be used by the proxy. (Proxy has to be restarted for changes to take effect)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ciphers_tls12: Option<String>,
 }
 
 impl NodeConfig {
@@ -172,6 +189,13 @@ impl NodeConfig {
                 bail!("duplicate domain '{}' in ACME config", domain.domain);
             }
         }
+        let mut dummy_acceptor = SslAcceptor::mozilla_intermediate_v5(SslMethod::tls()).unwrap();
+        if let Some(ciphers) = self.ciphers_tls13.as_deref() {
+            dummy_acceptor.set_ciphersuites(ciphers)?;
+        }
+        if let Some(ciphers) = self.ciphers_tls12.as_deref() {
+            dummy_acceptor.set_cipher_list(ciphers)?;
+        }
 
         Ok(())
     }
-- 
2.30.2

[pbs-devel] [PATCH proxmox-backup v4 2/3] proxy: use ciphers from config if set

[Hannes Laimer]

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/bin/proxmox-backup-proxy.rs | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/bin/proxmox-backup-proxy.rs b/src/bin/proxmox-backup-proxy.rs
index 903dd9bc..909a4b41 100644
--- a/src/bin/proxmox-backup-proxy.rs
+++ b/src/bin/proxmox-backup-proxy.rs
@@ -342,7 +342,17 @@ fn make_tls_acceptor() -> Result<SslAcceptor, Error> {
     let key_path = configdir!("/proxy.key");
     let cert_path = configdir!("/proxy.pem");
 
+    let (config, _) = proxmox_backup::config::node::config()?;
+    let ciphers_tls13 = config.ciphers_tls13;
+    let ciphers_tls12 = config.ciphers_tls12;
+
     let mut acceptor = SslAcceptor::mozilla_intermediate_v5(SslMethod::tls()).unwrap();
+    if let Some(ciphers) = ciphers_tls13.as_deref() {
+        acceptor.set_ciphersuites(ciphers)?;
+    }
+    if let Some(ciphers) = ciphers_tls12.as_deref() {
+        acceptor.set_cipher_list(ciphers)?;
+    }
     acceptor.set_private_key_file(key_path, SslFiletype::PEM)
         .map_err(|err| format_err!("unable to read proxy key {} - {}", key_path, err))?;
     acceptor.set_certificate_chain_file(cert_path)
-- 
2.30.2

[pbs-devel] [PATCH proxmox-backup v4 3/3] api2: make tls ciphers updatable

[Hannes Laimer]

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/api2/node/config.rs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/api2/node/config.rs b/src/api2/node/config.rs
index 3f060981..3eb1da12 100644
--- a/src/api2/node/config.rs
+++ b/src/api2/node/config.rs
@@ -56,6 +56,10 @@ pub enum DeletableProperty {
     http_proxy,
     /// Delete the email-from property.
     email_from,
+    /// Delete the ciphers-tls13 property.
+    ciphers_tls13,
+    /// Delete the ciphers-tls12 property.
+    ciphers_tls12,
 }
 
 #[api(
@@ -113,6 +117,8 @@ pub fn update_node_config(
                 DeletableProperty::acmedomain4 => { config.acmedomain4 = None; },
                 DeletableProperty::http_proxy => { config.http_proxy = None; },
                 DeletableProperty::email_from => { config.email_from = None; },
+                DeletableProperty::ciphers_tls13 => { config.ciphers_tls13 = None; },
+                DeletableProperty::ciphers_tls12 => { config.ciphers_tls12 = None; },
             }
         }
     }
@@ -125,6 +131,8 @@ pub fn update_node_config(
     if update.acmedomain4.is_some() { config.acmedomain4 = update.acmedomain4; }
     if update.http_proxy.is_some() { config.http_proxy = update.http_proxy; }
     if update.email_from.is_some() { config.email_from = update.email_from; }
+    if update.ciphers_tls13.is_some() { config.ciphers_tls13 = update.ciphers_tls13; }
+    if update.ciphers_tls12.is_some() { config.ciphers_tls12 = update.ciphers_tls12; }
 
     crate::config::node::save_config(&config)?;
 
-- 
2.30.2

[pbs-devel] applied-series: [PATCH proxmox-backup v4 0/3] close #3612: allow config of SSL cipher-suites for proxy

[Fabian Grünbichler]

with following follow-up, and renaming tls12/tls13 to tls-1.2/tls-1.3 
(parameters/config keys) and tls_1_2/tls_1_3 (variable/field names).

commit 1d552d2dd51ed7f23b492160b4c0c3a425fdfd68
Author:     Fabian Grünbichler <f.gruenbichler@proxmox.com>
AuthorDate: Thu Jan 13 10:16:15 2022 +0100
Commit:     Fabian Grünbichler <f.gruenbichler@proxmox.com>
CommitDate: Fri Jan 14 11:02:07 2022 +0100

    ciphers: simplify API schema
    
    these need to be checked (and are) via libssl anyway before persisting,
    and newer versions might contain new ciphers/variants/... (and things
    like @STRENGTH or @SECLEVEL=n were missing).
    
    Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>

diff --git a/pbs-api-types/src/lib.rs b/pbs-api-types/src/lib.rs
index 4ef8eea1..754e7b22 100644
--- a/pbs-api-types/src/lib.rs
+++ b/pbs-api-types/src/lib.rs
@@ -99,20 +99,6 @@ mod local_macros {
     macro_rules! DNS_ALIAS_NAME {
         () => (concat!(r"(?:(?:", DNS_ALIAS_LABEL!() , r"\.)*", DNS_ALIAS_LABEL!(), ")"))
     }
-    macro_rules! OPENSSL_CIPHERSUITE_RE { 
-        () => (
-            r"TLS_AES_256_GCM_SHA384|TLS_CHACHA20_POLY1305_SHA256|TLS_AES_128_GCM_SHA256|TLS_AES_128_CCM_8_SHA256|TLS_AES_128_CCM_SHA256"
-        ) 
-    }
-    macro_rules! OPENSSL_CIPHER_STRING_RE { 
-        () => (concat!(
-            r"([!\-+]?(COMPLEMENTOFDEFAULT|ALL|COMPLEMENTOFALL|HIGH|MEDIUM|LOW|[ae]?NULL|[ka]?RSA|",
-            "kDH[rdE]?|kEDH|DHE?|EDH|ADH|kEECDH|kECDHE|ECDH|ECDHE|EECDH|AECDH|a?DSS|aDH|a?ECDSA|",
-            "SSLv3|AES(128|256)?|GCM|AESGCM|AESCCM|AESCCM8|ARIA(128|256)?|CAMELLIA(128|256)?|",
-            "CHACHA20|3?DES|RC[24]|IDEA|SEED|MD5|SHA(1|256|384)?|aGOST(01)?|kGOST|GOST94|GOST89MAC|",
-            "[ak]?PSK|kECDHEPSK|kDHEPSK|kRSAPSK|SUITEB(128|128ONLY|192)?|CBC3?|POLY1305))+"
-        )) 
-    }
 }
 
 const_regex! {
@@ -137,21 +123,8 @@ const_regex! {
 
     pub FINGERPRINT_SHA256_REGEX = r"^(?:[0-9a-fA-F][0-9a-fA-F])(?::[0-9a-fA-F][0-9a-fA-F]){31}$";
 
-    pub OPENSSL_CIPHERS_TLS_1_2_REGEX = concat!(
-        r"^((",
-        OPENSSL_CIPHER_STRING_RE!(),
-        ")([: ,](",
-        OPENSSL_CIPHER_STRING_RE!(),
-        "))*)$"
-    );
-    
-    pub OPENSSL_CIPHERS_TLS_1_3_REGEX = concat!(
-        r"^((",
-        OPENSSL_CIPHERSUITE_RE!(),
-        ")(:(",
-        OPENSSL_CIPHERSUITE_RE!(),
-        "))*)$"
-    );
+    // just a rough check - dummy acceptor is used before persisting
+    pub OPENSSL_CIPHERS_REGEX = r"^[0-9A-Za-z_:, +!\-@=.]+$";
 
     /// Regex for safe identifiers.
     ///
@@ -189,9 +162,7 @@ pub const BLOCKDEVICE_NAME_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&B
 pub const SUBSCRIPTION_KEY_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&SUBSCRIPTION_KEY_REGEX);
 pub const SYSTEMD_DATETIME_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&SYSTEMD_DATETIME_REGEX);
 pub const HOSTNAME_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&HOSTNAME_REGEX);
-pub const OPENSSL_CIPHERS_TLS_1_2_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&OPENSSL_CIPHERS_TLS_1_2_REGEX);
-pub const OPENSSL_CIPHERS_TLS_1_3_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&OPENSSL_CIPHERS_TLS_1_3_REGEX);
-
+pub const OPENSSL_CIPHERS_TLS_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&OPENSSL_CIPHERS_REGEX);
 
 pub const DNS_ALIAS_FORMAT: ApiStringFormat =
     ApiStringFormat::Pattern(&DNS_ALIAS_REGEX);
@@ -221,12 +192,12 @@ pub const HOSTNAME_SCHEMA: Schema = StringSchema::new("Hostname (as defined in R
     .format(&HOSTNAME_FORMAT)
     .schema();
 
-pub const OPENSSL_CIPHERS_TLS_1_2_SCHEMA: Schema = StringSchema::new("OpenSSL cipher string list used by the proxy for TLS <= 1.2")
-    .format(&OPENSSL_CIPHERS_TLS_1_2_FORMAT)
+pub const OPENSSL_CIPHERS_TLS_1_2_SCHEMA: Schema = StringSchema::new("OpenSSL cipher list used by the proxy for TLS <= 1.2")
+    .format(&OPENSSL_CIPHERS_TLS_FORMAT)
     .schema();
 
-pub const OPENSSL_CIPHERS_TLS_1_3_SCHEMA: Schema = StringSchema::new("OpenSSL ciphersuites list used by the proxy for TLSv1.3")
-    .format(&OPENSSL_CIPHERS_TLS_1_3_FORMAT)
+pub const OPENSSL_CIPHERS_TLS_1_3_SCHEMA: Schema = StringSchema::new("OpenSSL ciphersuites list used by the proxy for TLS 1.3")
+    .format(&OPENSSL_CIPHERS_TLS_FORMAT)
     .schema();
 
 pub const DNS_NAME_FORMAT: ApiStringFormat =

On January 11, 2022 12:39 pm, Hannes Laimer wrote:
> Cannot be configured in the WebUI, only through proxmox-backup-manager,
> api or in the config file directly(not recommended). For changes to take
> effect the proxy has to be restarted.
> 
> Since the string can be rather long and I assume most of the time the
> defaults are used, it is not in the WebUI.
> 
> v2:
>   - allow setting for TLSv1.3 and TLS <= 1.2 individually
> 
> v3:
>   - add proper regex
> 
> v4:
>   - renaming variables
> 
> Hannes Laimer (3):
>   config: add tls ciphers to NodeConfig
>   proxy: use ciphers from config if set
>   api2: make tls ciphers updatable
> 
>  pbs-api-types/src/lib.rs        | 41 +++++++++++++++++++++++++++++++++
>  src/api2/node/config.rs         |  8 +++++++
>  src/bin/proxmox-backup-proxy.rs | 10 ++++++++
>  src/config/node.rs              | 26 ++++++++++++++++++++-
>  4 files changed, 84 insertions(+), 1 deletion(-)
> 
> -- 
> 2.30.2
> 
> 
> 
> _______________________________________________
> pbs-devel mailing list
> pbs-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
> 
> 
>