Add cipher name translation for OpenSSL.

This keeps naming consistent. For example, instead of id-aes128-GCM use
AES-128-GCM, which is more like AES-128-CBC.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1454874438-5081-10-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/11081
Signed-off-by: Gert Doering <gert@greenie.muc.de>

diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 3e94470ee84dd8acafba46a379c0589924ca3391..e8ab27a8fbae6e1038973bf9e0d0f49b1dde1140 100644 (file)
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -792,7 +792,7 @@ init_key_ctx (struct key_ctx *ctx, struct key *key,
 
       msg (D_HANDSHAKE, "%s: Cipher '%s' initialized with %d bit key",
           prefix,
-          cipher_kt_name(kt->cipher),
+          translate_cipher_name_to_openvpn(cipher_kt_name(kt->cipher)),
           kt->cipher_length *8);
 
       dmsg (D_SHOW_KEYS, "%s: CIPHER KEY: %s", prefix,
@@ -1664,4 +1664,42 @@ get_random()
   return l;
 }
 
+static const cipher_name_pair *
+get_cipher_name_pair(const char *cipher_name) {
+  const cipher_name_pair *pair;
+  size_t i = 0;
+
+  /* Search for a cipher name translation */
+  for (; i < cipher_name_translation_table_count; i++)
+    {
+      pair = &cipher_name_translation_table[i];
+      if (0 == strcmp (cipher_name, pair->openvpn_name) ||
+         0 == strcmp (cipher_name, pair->lib_name))
+         return pair;
+    }
+
+  /* Nothing found, return null */
+  return NULL;
+}
+
+const char *
+translate_cipher_name_from_openvpn (const char *cipher_name) {
+  const cipher_name_pair *pair = get_cipher_name_pair(cipher_name);
+
+  if (NULL == pair)
+    return cipher_name;
+
+  return pair->lib_name;
+}
+
+const char *
+translate_cipher_name_to_openvpn (const char *cipher_name) {
+  const cipher_name_pair *pair = get_cipher_name_pair(cipher_name);
+
+  if (NULL == pair)
+    return cipher_name;
+
+  return pair->openvpn_name;
+}
+
 #endif /* ENABLE_CRYPTO */

diff --git a/src/openvpn/crypto_backend.h b/src/openvpn/crypto_backend.h
index c5ff3669ddc2636525d6e5f3a76dda9d0c392334..fb7c351322a09d817f46f486d2bb7faee0edaf6a 100644 (file)
--- a/src/openvpn/crypto_backend.h
+++ b/src/openvpn/crypto_backend.h
@@ -41,6 +41,16 @@
 /* TLS uses a tag of 128 bytes, let's do the same for OpenVPN */
 #define OPENVPN_AEAD_TAG_LENGTH 16
 
+/** Struct used in cipher name translation table */
+typedef struct {
+  const char *openvpn_name;    /**< Cipher name used by OpenVPN */
+  const char *lib_name;                /**< Cipher name used by crypto library */
+} cipher_name_pair;
+
+/** Cipher name translation table */
+extern const cipher_name_pair cipher_name_translation_table[];
+extern const size_t cipher_name_translation_table_count;
+
 /*
  * This routine should have additional OpenSSL crypto library initialisations
  * used by both crypto and ssl components of OpenVPN.
@@ -584,4 +594,24 @@ void hmac_ctx_update (hmac_ctx_t *ctx, const uint8_t *src, int src_len);
  */
 void hmac_ctx_final (hmac_ctx_t *ctx, uint8_t *dst);
 
+/**
+ * Translate an OpenVPN cipher name to a crypto library cipher name.
+ *
+ * @param cipher_name  An OpenVPN cipher name
+ *
+ * @return             The corresponding crypto library cipher name, or NULL
+ *                     if no matching cipher name was found.
+ */
+const char * translate_cipher_name_from_openvpn (const char *cipher_name);
+
+/**
+ * Translate a crypto library cipher name to an OpenVPN cipher name.
+ *
+ * @param cipher_name  A crypto library cipher name
+ *
+ * @return             The corresponding OpenVPN cipher name, or NULL if no
+ *                     matching cipher name was found.
+ */
+const char * translate_cipher_name_to_openvpn (const char *cipher_name);
+
 #endif /* CRYPTO_BACKEND_H_ */

diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c
index 56b662569e8abca902841d2163b689c4f124db7b..376c8befa020d00c961a23fed33bf6ca74d9dae2 100644 (file)
--- a/src/openvpn/crypto_openssl.c
+++ b/src/openvpn/crypto_openssl.c
@@ -240,17 +240,14 @@ crypto_init_dmalloc (void)
 }
 #endif /* DMALLOC */
 
-const char *
-translate_cipher_name_from_openvpn (const char *cipher_name) {
-  // OpenSSL doesn't require any translation
-  return cipher_name;
-}
+const cipher_name_pair cipher_name_translation_table[] = {
+    { "AES-128-GCM", "id-aes128-GCM" },
+    { "AES-192-GCM", "id-aes192-GCM" },
+    { "AES-256-GCM", "id-aes256-GCM" },
+};
+const size_t cipher_name_translation_table_count =
+    sizeof (cipher_name_translation_table) / sizeof (*cipher_name_translation_table);
 
-const char *
-translate_cipher_name_to_openvpn (const char *cipher_name) {
-  // OpenSSL doesn't require any translation
-  return cipher_name;
-}
 
 void
 show_available_ciphers ()
@@ -286,9 +283,9 @@ show_available_ciphers ()
              const char *ssl_only = cipher_kt_mode_cbc(cipher) ?
                  "" : " (TLS client/server mode)";
 
-             printf ("%s %d bit default key (%s)%s\n", OBJ_nid2sn (nid),
-                     EVP_CIPHER_key_length (cipher) * 8, var_key_size,
-                     ssl_only);
+             printf ("%s %d bit default key (%s)%s\n",
+                 translate_cipher_name_to_openvpn(OBJ_nid2sn (nid)),
+                 EVP_CIPHER_key_length (cipher) * 8, var_key_size, ssl_only);
            }
        }
     }

diff --git a/src/openvpn/crypto_polarssl.c b/src/openvpn/crypto_polarssl.c
index 09cb1292dc043e990fd28f46b661a9c553e3d5db..fc6f6c340216ecba0244acb944723c72159ee7c4 100644 (file)
--- a/src/openvpn/crypto_polarssl.c
+++ b/src/openvpn/crypto_polarssl.c
@@ -121,52 +121,15 @@ crypto_init_dmalloc (void)
 }
 #endif /* DMALLOC */
 
-typedef struct { const char * openvpn_name; const char * polarssl_name; } cipher_name_pair;
-cipher_name_pair cipher_name_translation_table[] = {
+const cipher_name_pair cipher_name_translation_table[] = {
     { "BF-CBC", "BLOWFISH-CBC" },
     { "BF-CFB", "BLOWFISH-CFB64" },
     { "CAMELLIA-128-CFB", "CAMELLIA-128-CFB128" },
     { "CAMELLIA-192-CFB", "CAMELLIA-192-CFB128" },
     { "CAMELLIA-256-CFB", "CAMELLIA-256-CFB128" }
 };
-
-const cipher_name_pair *
-get_cipher_name_pair(const char *cipher_name) {
-  cipher_name_pair *pair;
-  size_t i = 0;
-
-  /* Search for a cipher name translation */
-  for (; i < sizeof (cipher_name_translation_table) / sizeof (*cipher_name_translation_table); i++)
-    {
-      pair = &cipher_name_translation_table[i];
-      if (0 == strcmp (cipher_name, pair->openvpn_name) ||
-         0 == strcmp (cipher_name, pair->polarssl_name))
-         return pair;
-    }
-
-  /* Nothing found, return null */
-  return NULL;
-}
-
-const char *
-translate_cipher_name_from_openvpn (const char *cipher_name) {
-  const cipher_name_pair *pair = get_cipher_name_pair(cipher_name);
-
-  if (NULL == pair)
-    return cipher_name;
-
-  return pair->polarssl_name;
-}
-
-const char *
-translate_cipher_name_to_openvpn (const char *cipher_name) {
-  const cipher_name_pair *pair = get_cipher_name_pair(cipher_name);
-
-  if (NULL == pair)
-    return cipher_name;
-
-  return pair->openvpn_name;
-}
+const size_t cipher_name_translation_table_count =
+    sizeof (cipher_name_translation_table) / sizeof (*cipher_name_translation_table);
 
 void
 show_available_ciphers ()

diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 6d97b4f74c1ada4bf3c1cad0f49e578b6f20c27b..02def3a82718929811d7b25857b4623ddb22b746 100644 (file)
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -3039,7 +3039,8 @@ options_string (const struct options *o,
                       o->authname, o->authname_defined,
                       o->keysize, true, false);
 
-       buf_printf (&out, ",cipher %s", cipher_kt_name (kt.cipher));
+       buf_printf (&out, ",cipher %s",
+           translate_cipher_name_to_openvpn(cipher_kt_name (kt.cipher)));
        buf_printf (&out, ",auth %s", md_kt_name (kt.digest));
        buf_printf (&out, ",keysize %d", kt.cipher_length * 8);
        if (o->shared_secret_file)