Тема от ettavolt

  • ettavolt
  • Посетитель
  • Неактивен

stunnel с двусторонней аутентификацией

Ubuntu 16.04 i386, OpenSSL 1.0.2h  3 May 2016, stunnel 5.30, librtpkcs11ecp.so 1.4.3.0, libpkcs11gost-engine.so от 19.04.2016.
/etc/ssl/openssl.conf:

#openssl_conf            = openssl_def
#[openssl_def]
engines = engine_section
[engine_section]
gost = gost_section
pkcs11_gost = pkcs11_section

[gost_section]
engine_id = gost
dynamic_path = /usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libgost.so
default_algorithms = ALL
init = 0

[pkcs11_section]
engine_id = pkcs11_gost
dynamic_path = /usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libpkcs11gost-engine.so
MODULE_PATH = /usr/lib/i386-linux-gnu/librtpkcs11ecp.so
init = 0

stunnel.cfg:

verify=2
checkHost=gs.service.nalog.ru
client=yes
;CA, непосредственно выпустивший сертификат сервера.
CAFile=F94CA87FC187732AEEC75C57A825444764189F44.crt.pem
sslVersion=TLSv1
DEBUG=7

engine=dynamic
engineCtrl=SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libgost.so
engineCtrl=LOAD
engineDefault=ALL

engine=dynamic
engineCtrl=SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libpkcs11gost-engine.so
engineCtrl=LOAD
engineCtrl=MODULE_PATH:/usr/lib/i386-linux-gnu/librtpkcs11ecp.so
engineDefault=ALL
  
[remote system]
engineId = pkcs11_gost
cert=client.crt.pem
key = 41:31:44:39:36:41:38:39:33:35:39:43:45:34:45:42
accept = localhost:1443
connect = gs.service.nalog.ru:443
ciphers = GOST2001-GOST89-GOST89

; for IE
TIMEOUTclose = 0

Журнал запуска stunnel stunnel.cfg (без OPENSSL_ENGINES=/some/path):

Enter Please enter PIN:
[ ] Clients allowed=500
[.] stunnel 5.30 on i686-pc-linux-gnu platform
[.] Compiled with OpenSSL 1.0.2e 3 Dec 2015
[.] Running  with OpenSSL 1.0.2g-fips  1 Mar 2016
[.] Update OpenSSL shared libraries or rebuild stunnel
[ ] Cron thread initialized
[.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP
[ ] errno: (*__errno_location ())
[.] Reading configuration from file /home/master/stunnel/fl.ssl.cfg
[.] UTF-8 byte order mark not detected
[ ] Enabling support for engine "dynamic"
[ ] Executing engine control command SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libgost.so
[ ] Executing engine control command LOAD
[ ] Engine #1 (gost) set as default for ALL
[ ] Initializing engine #1 (gost)
[ ] Engine #1 (gost) initialized
[ ] Enabling support for engine "dynamic"
[ ] Executing engine control command SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libpkcs11gost-engine.so
[ ] Executing engine control command LOAD
[ ] Executing engine control command MODULE_PATH:/usr/lib/i386-linux-gnu/librtpkcs11ecp.so
[ ] Engine #2 (pkcs11_gost) set as default for ALL
[ ] Initializing engine #2 (pkcs11_gost)
[ ] Engine #2 (pkcs11_gost) initialized
[.] FIPS mode disabled
[ ] Compression disabled
[ ] PRNG seeded successfully
[ ] Initializing service [remote system]
[!] error queue: 1412214B: error:1412214B:SSL routines:SSL_CTX_set_client_cert_engine:no client cert method
[!] error queue: 82092084: error:82092084:lib(130):func(146):unable find any token
[!] error queue: 2606C043: error:2606C043:engine routines:ENGINE_FREE_UTIL:passed a null parameter
[!] error queue: 2608E043: error:2608E043:engine routines:ENGINE_ctrl:passed a null parameter
[!] error queue: 2606A074: error:2606A074:engine routines:ENGINE_by_id:no such engine
[!] error queue: 260B6084: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found
[!] error queue: 25070067: error:25070067:DSO support routines:DSO_load:could not load the shared library
[!] SSL_CTX_set_client_cert_engine: 25066067: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library
[ ] Loading certificate from engine ID: client.crt.pem
[!] ENGINE_ctrl_cmd: Peer suddenly disconnected
[ ] Initializing private key on engine ID: 41:31:44:39:36:41:38:39:33:35:39:43:45:34:45:42
[ ] Private key initialized on engine ID: 41:31:44:39:36:41:38:39:33:35:39:43:45:34:45:42
[ ] Loading certificate from file: client.crt.pem
[ ] Certificate loaded from file: client.crt.pem
[ ] Private key check succeeded
[!] SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match
[!] Service [remote system]: Failed to initialize SSL context

Внёс изменения из http://dev.rutoken.ru/pages/viewpage.ac … d=18055210 (всегда unsafe и OpenSSL_add_all_algorithms()). Убрал секцию инициализации gost engine из stunnel.cfg.

Журнал:

Enter Please enter PIN:
[ ] Clients allowed=500
[ ] Cron thread initialized
[.] stunnel 5.30 on i686-pc-linux-gnu platform
[.] Compiled/running with OpenSSL 1.0.2h  3 May 2016
[.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP
[ ] errno: (*__errno_location ())
[.] Reading configuration from file /home/master/stunnel/fl.ssl.cfg
[.] UTF-8 byte order mark not detected
[ ] Enabling support for engine "dynamic"
[ ] Executing engine control command SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libpkcs11gost-engine.so
[ ] Executing engine control command LOAD
[ ] Executing engine control command MODULE_PATH:/usr/lib/i386-linux-gnu/librtpkcs11ecp.so
[ ] Engine #1 (pkcs11_gost) set as default for ALL
[ ] Initializing engine #1 (pkcs11_gost)
[ ] Engine #1 (pkcs11_gost) initialized
[.] FIPS mode disabled
[ ] Compression disabled
[ ] PRNG seeded successfully
[ ] Initializing service [remote system]
[!] error queue: 1412214B: error:1412214B:SSL routines:SSL_CTX_set_client_cert_engine:no client cert method
[!] error queue: 81092084: error:81092084:lib(129):func(146):unable find any token
[!] error queue: 2606C043: error:2606C043:engine routines:ENGINE_FREE_UTIL:passed a null parameter
[!] error queue: 2608E043: error:2608E043:engine routines:ENGINE_ctrl:passed a null parameter
[!] error queue: 2606A074: error:2606A074:engine routines:ENGINE_by_id:no such engine
[!] error queue: 260B6084: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found
[!] error queue: 25070067: error:25070067:DSO support routines:DSO_load:could not load the shared library
[!] SSL_CTX_set_client_cert_engine: 25066067: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library
[ ] Loading certificate from engine ID: client.crt.pem
[!] ENGINE_ctrl_cmd: Peer suddenly disconnected
[ ] Initializing private key on engine ID: 41:31:44:39:36:41:38:39:33:35:39:43:45:34:45:42
[ ] Private key initialized on engine ID: 41:31:44:39:36:41:38:39:33:35:39:43:45:34:45:42
[ ] Loading certificate from file: client.crt.pem
[ ] Certificate loaded from file: client.crt.pem
[ ] Private key check succeeded
[!] SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match
[!] Service [remote system]: Failed to initialize SSL context

Как исправить?

Ответ от shatle

  • shatle
  • Посетитель
  • Неактивен

Re: stunnel с двусторонней аутентификацией

Попробуйте убрать загрузку модуля pkcs11 из stunnel.cfg
Модуль у Вас openssl загружает, насколько я могу судить по конфигу.

Ответ от _S

  • _S
  • Посетитель
  • Неактивен

Re: stunnel с двусторонней аутентификацией

ettavolt пишет:

stunnel.cfg:

verify=2
checkHost=gs.service.nalog.ru
client=yes
;CA, непосредственно выпустивший сертификат сервера.
CAFile=F94CA87FC187732AEEC75C57A825444764189F44.crt.pem
sslVersion=TLSv1
DEBUG=7

engine=dynamic
engineCtrl=SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libgost.so
engineCtrl=LOAD
engineDefault=ALL

engine=dynamic
engineCtrl=SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libpkcs11gost-engine.so
engineCtrl=LOAD
engineCtrl=MODULE_PATH:/usr/lib/i386-linux-gnu/librtpkcs11ecp.so
engineDefault=ALL
  
[remote system]
engineId = pkcs11_gost
cert=client.crt.pem
key = 41:31:44:39:36:41:38:39:33:35:39:43:45:34:45:42
accept = localhost:1443
connect = gs.service.nalog.ru:443
ciphers = GOST2001-GOST89-GOST89

; for IE
TIMEOUTclose = 0

Как исправить?

verify=2
checkHost=gs.service.nalog.ru
client=yes
;CA, непосредственно выпустивший сертификат сервера.
CAFile=F94CA87FC187732AEEC75C57A825444764189F44.crt.pem
sslVersion=TLSv1
DEBUG=7

engine=dynamic
engineCtrl=SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libgost.so
engineCtrl=ID:gost
engineCtrl=LIST_ADD:1
engineCtrl=LOAD
engineCtrl=INIT
engine=dynamic
engineCtrl=SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libpkcs11gost-engine.so
engineCtrl=ID:pkcs11_gost
engineCtrl=LIST_ADD:2
engineCtrl=LOAD
engineCtrl=MODULE_PATH:/usr/lib/i386-linux-gnu/librtpkcs11ecp.so
engineCtrl=INIT

engineDefault = ALL

[remote system]
; используем для загрузки ключа engine PKCS11_GOST
engineNum = 2

cert=client.crt.pem
key = 41:31:44:39:36:41:38:39:33:35:39:43:45:34:45:42
accept = localhost:1443
connect = gs.service.nalog.ru:443
ciphers = GOST2001-GOST89-GOST89

; for IE
TIMEOUTclose = 0

Ответ от ettavolt

  • ettavolt
  • Посетитель
  • Неактивен

Re: stunnel с двусторонней аутентификацией

shatle, установка openssl_conf = openssl_def закомментированна, так что openssl по умолчанию ничего не загружает. Да ещё и init = 0 для обоих.

_S, спасибо, есть кое-какой прогресс.
После замены секции инициализации engines на

engine=dynamic
engineCtrl=SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libgost.so
engineCtrl=ID:gost
engineCtrl=LIST_ADD:1
engineCtrl=LOAD
engineCtrl=INIT
engine=dynamic
engineCtrl=SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libpkcs11gost-engine.so
engineCtrl=ID:pkcs11_gost
engineCtrl=LIST_ADD:2
engineCtrl=LOAD
engineCtrl=MODULE_PATH:/usr/lib/i386-linux-gnu/librtpkcs11ecp.so
engineCtrl=INIT

engineDefault = ALL

журнал запуска выглядит так:

Enter Please enter PIN:
[ ] Clients allowed=500
[ ] Cron thread initialized
[.] stunnel 5.30 on i686-pc-linux-gnu platform
[.] Compiled/running with OpenSSL 1.0.2h  3 May 2016
[.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP
[ ] errno: (*__errno_location ())
[.] Reading configuration from file /home/master/stunnel/fl.ssl.cfg
[.] UTF-8 byte order mark not detected
[ ] Enabling support for engine "dynamic"
[ ] Executing engine control command SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libgost.so
[ ] Executing engine control command ID:gost
[ ] Executing engine control command LIST_ADD:1
[ ] Executing engine control command LOAD
[ ] Initializing engine #1 (gost)
[ ] Engine #1 (gost) initialized
[ ] Enabling support for engine "dynamic"
[ ] Executing engine control command SO_PATH:/usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libpkcs11gost-engine.so
[ ] Executing engine control command ID:pkcs11_gost
[ ] Executing engine control command LIST_ADD:2
[ ] Executing engine control command LOAD
[ ] Executing engine control command MODULE_PATH:/usr/lib/i386-linux-gnu/librtpkcs11ecp.so
[ ] Initializing engine #2 (pkcs11_gost)
[ ] Engine #2 (pkcs11_gost) initialized
[ ] Engine #2 (pkcs11_gost) set as default for ALL
[.] FIPS mode disabled
[ ] Compression disabled
[ ] PRNG seeded successfully
[ ] Initializing service [remote system]
[!] SSL_CTX_set_client_cert_engine: 1412214B: error:1412214B:SSL routines:SSL_CTX_set_client_cert_engine:no client cert method
[ ] Loading certificate from engine ID: client.crt.pem
[!] ENGINE_ctrl_cmd: Peer suddenly disconnected
[ ] Initializing private key on engine ID: 41:31:44:39:36:41:38:39:33:35:39:43:45:34:45:42
[ ] Private key initialized on engine ID: 41:31:44:39:36:41:38:39:33:35:39:43:45:34:45:42
[ ] Loading certificate from file: client.crt.pem
[ ] Certificate loaded from file: client.crt.pem
[ ] Private key check succeeded
[!] SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match
[!] Service [remote system]: Failed to initialize SSL context

т.е. больше нет сообщений

[!] error queue: 82092084: error:82092084:lib(130):func(146):unable find any token
[!] error queue: 2606C043: error:2606C043:engine routines:ENGINE_FREE_UTIL:passed a null parameter
[!] error queue: 2608E043: error:2608E043:engine routines:ENGINE_ctrl:passed a null parameter
[!] error queue: 2606A074: error:2606A074:engine routines:ENGINE_by_id:no such engine
[!] error queue: 260B6084: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found
[!] error queue: 25070067: error:25070067:DSO support routines:DSO_load:could not load the shared library
[!] SSL_CTX_set_client_cert_engine: 25066067: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library

(Если опустить два engine INIT, то журнал выглядит так же).

Ответ от ettavolt

  • ettavolt
  • Посетитель
  • Неактивен

Re: stunnel с двусторонней аутентификацией

Переименовал /usr/lib/i386-linux-gnu/openssl-1.0.2/engines/libpkcs11gost-engine.so в libpkcs11_gost.so, инициализацию engine в fl.ssl.cfg заменил на:

engine=pkcs11_gost
engineCtrl=MODULE_PATH:librtpkcs11ecp.so
engineDefault=ALL

(Обратите внимание на неполный путь к module!)
Журнал:

Enter Please enter PIN:
[ ] Clients allowed=500
[.] stunnel 5.30 on i686-pc-linux-gnu platform
[.] Compiled/running with OpenSSL 1.0.2h  3 May 2016
[.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP
[ ] errno: (*__errno_location ())
[ ] Cron thread initialized
[.] Reading configuration from file /home/master/stunnel/fl.ssl.cfg
[.] UTF-8 byte order mark not detected
[ ] Enabling support for engine "pkcs11_gost"
[ ] Executing engine control command MODULE_PATH:librtpkcs11ecp.so
[ ] Engine #1 (pkcs11_gost) set as default for ALL
[ ] Initializing engine #1 (pkcs11_gost)
[ ] Engine #1 (pkcs11_gost) initialized
[.] FIPS mode disabled
[ ] Compression disabled
[ ] PRNG seeded successfully
[ ] Initializing service [remote system]
[!] SSL_CTX_set_client_cert_engine: 1412214B: error:1412214B:SSL routines:SSL_CTX_set_client_cert_engine:no client cert method
[ ] Loading certificate from engine ID: client.crt.pem
[!] ENGINE_ctrl_cmd: Peer suddenly disconnected
[ ] Initializing private key on engine ID: 41:31:44:39:36:41:38:39:33:35:39:43:45:34:45:42
[ ] Private key initialized on engine ID: 41:31:44:39:36:41:38:39:33:35:39:43:45:34:45:42
[ ] Loading certificate from file: client.crt.pem
[ ] Certificate loaded from file: client.crt.pem
[ ] Private key check succeeded
[!] SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match
[!] Service [remote system]: Failed to initialize SSL context

Добавление INIT перед default=ALL не влияет на конечный результат.

Ответ от ettavolt

  • ettavolt
  • Посетитель
  • Неактивен

Re: stunnel с двусторонней аутентификацией

До подключения к серверу дело даже не доходит (проверял wireshark'ом).

Ответ от ettavolt

  • ettavolt
  • Посетитель
  • Неактивен

Re: stunnel с двусторонней аутентификацией

Есть ещё идеи?

Ответ от Евгений Мироненко

  • Евгений Мироненко
  • Техническая поддержка
  • Неактивен

Re: stunnel с двусторонней аутентификацией

ettavolt, если судить по логу, выглядит так, будто этот шаг не был выполнен:

ettavolt пишет:

Внёс изменения из http://dev.rutoken.ru/pages/viewpage.ac … d=18055210 (всегда unsafe и OpenSSL_add_all_algorithms()).

Пожалуйста, убедитесь, что шаг выполнен корректно (в diff на загрузку всех алгоритмов добавляется вызов двух функции):

diff --git a/src/ssl.c b/src/ssl.c
index 82a15e1..e651a30 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -82,6 +82,8 @@ NOEXPORT void cb_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
 }
   
 int ssl_configure(GLOBAL_OPTIONS *global) { /* configure global SSL settings */
+    OpenSSL_add_all_algorithms();
+    SSLeay_add_ssl_algorithms();
 #ifdef USE_FIPS
     if(FIPS_mode()!=global->option.fips) {
         RAND_set_rand_method(NULL); /* reset RAND methods */

Ответ от ettavolt

  • ettavolt
  • Посетитель
  • Неактивен

Re: stunnel с двусторонней аутентификацией

Чёрт, там, оказывается SSLeay_add_ssl_algorithms, а не SSLeay_add_all_algorithms. А я ещё подумал, зачем два add_all_algorithms…
Заменил ещё CAfile на самоподписанный сертификат УЦ ФНС - и работает.
Спасибо.

В догонку - можно как-нибудь попросить engine загружать сертификат из токена? Или SSL_CTX_set_client_cert_engine:no client cert method подразумевает, что engine на это неспособен?

Ответ от Евгений Мироненко

  • Евгений Мироненко
  • Техническая поддержка
  • Неактивен

Re: stunnel с двусторонней аутентификацией

ettavolt пишет:

В догонку - можно как-нибудь попросить engine загружать сертификат из токена? Или SSL_CTX_set_client_cert_engine:no client cert method подразумевает, что engine на это неспособен?

Поддерживать вызов SSL_CTX_set_client_cert_engine пока не планируется, но stunnel имеет и другой метод загрузки сертификата из engine: он делает вызов

ENGINE_ctrl_cmd(section->engine, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);

Поддержка загрузки сертификата через этот механизм планируется в ближайшем релизе.

Ответ от ettavolt

  • ettavolt
  • Посетитель
  • Неактивен

Re: stunnel с двусторонней аутентификацией

Евгений Мироненко пишет:

Поддержка загрузки сертификата через этот механизм планируется в ближайшем релизе.

Релиз stunnel или engine pkcs11_gost?

Ответ от Евгений Мироненко

  • Евгений Мироненко
  • Техническая поддержка
  • Неактивен

Re: stunnel с двусторонней аутентификацией

ettavolt пишет:

Релиз stunnel или engine pkcs11_gost?

Engine.