diff options
| -rw-r--r-- | Makefile.am | 5 | ||||
| -rw-r--r-- | PICA_client.c | 7 | ||||
| -rw-r--r-- | PICA_node.c | 6 | ||||
| -rw-r--r-- | PICA_security.h | 30 | ||||
| -rw-r--r-- | pica-client/dialogs/registeraccountdialog.cpp | 3 | ||||
| -rw-r--r-- | pica-client/openssltool.cpp | 4 | ||||
| -rw-r--r-- | pica-client/pica-client.pro | 3 |
7 files changed, 52 insertions, 6 deletions
diff --git a/Makefile.am b/Makefile.am index faf829a..f7907af 100644 --- a/Makefile.am +++ b/Makefile.am @@ -23,7 +23,7 @@ pica_node_SOURCES = PICA_node.c PICA_msgproc.c PICA_nodeaddrlist.c \ PICA_nodewait.h PICA_nodeconfig.h PICA_log.h \ iniparser/src/dictionary.h iniparser/src/iniparser.h \ PICA_common.h PICA_proto.h PICA_id.h PICA_id.c \ - PICA_netconf.c PICA_netconf.h + PICA_netconf.c PICA_netconf.h PICA_security.h dist_man_MANS = pica-node.8 pica-node.conf.5 @@ -113,7 +113,8 @@ PICA_msgproc.c \ PICA_msgproc.h \ PICA_common.h PICA_proto.h \ PICA_id.c PICA_id.h \ -PICA_netconf.c PICA_netconf.h +PICA_netconf.c PICA_netconf.h \ +PICA_security.h nodist_pica_client_pica_client_SOURCES = \ moc_accountswindow.cpp \ diff --git a/PICA_client.c b/PICA_client.c index 3829f49..9f25e0c 100644 --- a/PICA_client.c +++ b/PICA_client.c @@ -15,6 +15,7 @@ You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>. */ +#include "PICA_security.h" #include "PICA_client.h" #include "PICA_proto.h" #include "PICA_msgproc.h" @@ -1375,6 +1376,10 @@ int PICA_open_acc(const char *cert_file, goto error_ret_1; } + /* Available since openssl 1.1.0 + SSL_CTX_set_security_level(a->ctx, PICA_OPENSSL_SECURUTY_LEVEL); + */ + dh_file = fopen(dh_param_file, "r"); if (dh_file) @@ -1430,7 +1435,7 @@ int PICA_open_acc(const char *cert_file, goto error_ret_2; } - ret = SSL_CTX_set_cipher_list(a->ctx, "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CAMELLIA256-SHA"); + ret = SSL_CTX_set_cipher_list(a->ctx, PICA_TLS_CIPHERLIST); if (ret != 1) { diff --git a/PICA_node.c b/PICA_node.c index e27364f..04a5c9c 100644 --- a/PICA_node.c +++ b/PICA_node.c @@ -23,6 +23,7 @@ #include <time.h> #include <getopt.h> +#include "PICA_security.h" #include "PICA_node.h" #include "PICA_proto.h" #include "PICA_msgproc.h" @@ -1393,6 +1394,11 @@ int PICA_node_init() PICA_fatal("unable to create SSL_CTX object"); + ret = SSL_CTX_set_cipher_list(ctx, PICA_TLS_CIPHERLIST); + + if (!ret) + PICA_fatal("failed to set cipher list " PICA_TLS_CIPHERLIST); + ret = SSL_CTX_load_verify_locations(ctx, nodecfg.CA_cert_file, 0); if (!ret) diff --git a/PICA_security.h b/PICA_security.h new file mode 100644 index 0000000..0ea3306 --- /dev/null +++ b/PICA_security.h @@ -0,0 +1,30 @@ +/* + (c) Copyright 2012 - 2018 Anton Sviridenko + https://picapica.im + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <https://www.gnu.org/licenses/>. +*/ + +#ifndef PICA_SECURITY_H +#define PICA_SECURITY_H + +/* Important security parameters grouped together */ + +#define PICA_RSA_KEYSIZE 4096 +#define PICA_TLS_CIPHERLIST "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CAMELLIA256-SHA" +#define PICA_OPENSSL_SECURUTY_LEVEL 3 +#define PICA_CERTDIGESTALGO "-sha256" +#define PICA_PRIVKEYENCALGO "-aes256" + +#endif diff --git a/pica-client/dialogs/registeraccountdialog.cpp b/pica-client/dialogs/registeraccountdialog.cpp index 3fd0f71..34254d9 100644 --- a/pica-client/dialogs/registeraccountdialog.cpp +++ b/pica-client/dialogs/registeraccountdialog.cpp @@ -17,6 +17,7 @@ */ #include "registeraccountdialog.h" #include "../globals.h" +#include "../../PICA_security.h" #include <QVBoxLayout> #include <QDir> #include <QFile> @@ -178,7 +179,7 @@ void RegisterAccountDialog::Register() nickname->setEnabled(false); btRegister->setEnabled(false); - ost.GenRSAKeySignal(4096, config_dir + QDir::separator() + "privkey.pem", cbSetPassword->isChecked(), + ost.GenRSAKeySignal(PICA_RSA_KEYSIZE, config_dir + QDir::separator() + "privkey.pem", cbSetPassword->isChecked(), password->text(), rand, this, SLOT(stageSignCert(int, QProcess::ExitStatus))); } diff --git a/pica-client/openssltool.cpp b/pica-client/openssltool.cpp index a899c74..314dbd5 100644 --- a/pica-client/openssltool.cpp +++ b/pica-client/openssltool.cpp @@ -16,6 +16,7 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */ #include "openssltool.h" +#include "../PICA_security.h" #include <QProcess> #include <QRegExp> #include <QMessageBox> @@ -119,7 +120,7 @@ bool OpenSSLTool::GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpass args << "genrsa" << "-out" << keyfile; if (setpassword) - args << "-passout" << "stdin" << "-aes256"; + args << "-passout" << "stdin" << PICA_PRIVKEYENCALGO; if (!rand.isEmpty()) args << "-rand" << rand; @@ -160,6 +161,7 @@ bool OpenSSLTool::GenCertSignal(QString cert_file, QString keyfile, QString keyp << "-days" << "3680" << "-utf8" << "-batch" + << PICA_CERTDIGESTALGO << "-passin" << "stdin"); diff --git a/pica-client/pica-client.pro b/pica-client/pica-client.pro index 205d215..b7c5fa4 100644 --- a/pica-client/pica-client.pro +++ b/pica-client/pica-client.pro @@ -72,7 +72,8 @@ HEADERS += mainwindow.h \ sound.h \ dialogs/settingsdialog.h \ settings.h \ - ../PICA_netconf.h + ../PICA_netconf.h \ + ../PICA_security.h DEFINES = PICA_MULTITHREADED |