add and set padding block size for TLS 1.3

diff --git a/src/lib/tls/base-h b/src/lib/tls/base-h
index 5aabd45b74ee9f07fdf8aaca33ea921aa84f6b50..a4d0095cce99aa2ae93e9d4dd6a7ae857ad0248c 100644 (file)
--- a/src/lib/tls/base-h
+++ b/src/lib/tls/base-h
@@ -243,6 +243,8 @@ struct fr_tls_conf_s {
        float           tls_min_version;                //!< Minimum TLS version allowed.
 
        uint32_t        fragment_size;                  //!< Maximum record fragment, or record size.
+       uint32_t        padding_block_size;             //!< for TLS 1.3, pad blocks to multiple of this size.
+
        bool            check_crl;                      //!< Check certificate revocation lists.
        bool            allow_expired_crl;              //!< Don't error out if CRL is expired.
        char const      *check_cert_cn;                 //!< Verify cert CN matches the expansion of this string.

diff --git a/src/lib/tls/conf.c b/src/lib/tls/conf.c
index fd227bb9c11f32a51dcd75368abd8a30d67c44ee..ba71d59961c2d75e0462b323c474b6aa88e0ce9f 100644 (file)
--- a/src/lib/tls/conf.c
+++ b/src/lib/tls/conf.c
@@ -141,6 +141,7 @@ CONF_PARSER fr_tls_server_config[] = {
 #endif
        { FR_CONF_OFFSET("dh_file", FR_TYPE_FILE_INPUT, fr_tls_conf_t, dh_file) },
        { FR_CONF_OFFSET("fragment_size", FR_TYPE_UINT32, fr_tls_conf_t, fragment_size), .dflt = "1024" },
+       { FR_CONF_OFFSET("padding", FR_TYPE_UINT32, fr_tls_conf_t, padding_block_size), },
 
        { FR_CONF_OFFSET("disable_single_dh_use", FR_TYPE_BOOL, fr_tls_conf_t, disable_single_dh_use) },
        { FR_CONF_OFFSET("check_crl", FR_TYPE_BOOL, fr_tls_conf_t, check_crl), .dflt = "no" },
@@ -428,6 +429,8 @@ fr_tls_conf_t *fr_tls_conf_parse_server(CONF_SECTION *cs)
         */
        if (conf->fragment_size < 100) conf->fragment_size = 100;
 
+       FR_INTEGER_BOUND_CHECK("padding", conf->padding_block_size, <=, SSL3_RT_MAX_PLAIN_LENGTH);
+
 #ifdef __APPLE__
        if (conf_cert_admin_password(conf) < 0) goto error;
 #endif

diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index cbf72e0ef79621f6df024992746433dd86a03848..f3b65b3c5bbfc6e6dd6c8d43ad8999574a963d03 100644 (file)
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -751,6 +751,18 @@ post_ca:
         *      SSL_CTX_set_msg_callback(ctx, fr_tls_session_msg_cb);
         */
 
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+       /*
+        *      Set the block size for record padding.  This is only
+        *      used in TLS 1.3.
+        */
+       if (conf->padding_block_size) {
+               SSL_CTX_set_block_padding(ctx, conf->padding_block_size);
+       }
+#endif
+
+
+
        /*
         *      Set eliptical curve crypto configuration.
         */