bin: tool to print security policies

.gitignore

@@ -24,6 +24,7 @@ tests/fuzz/fuzz-*.log
 tests/benchmark/*_benchmark
 bin/s2nc
 bin/s2nd
+bin/policy
 util-linux-*
 Python-*
 clang-*

CMakeLists.txt

@@ -526,11 +526,14 @@ if (BUILD_TESTING)
  target_link_libraries(s2nc ${PROJECT_NAME})
  target_compile_options(s2nc PRIVATE -std=gnu99)
 
-
  add_executable(s2nd "bin/s2nd.c" "bin/echo.c" "bin/https.c" "bin/common.c")
  target_link_libraries(s2nd ${PROJECT_NAME})
  target_compile_options(s2nd PRIVATE -std=gnu99)
 
+ add_executable(policy "bin/policy.c")
+ target_link_libraries(policy ${PROJECT_NAME})
+ target_compile_options(policy PRIVATE -std=gnu99)
+
  if(S2N_LTO)
  target_compile_options(s2nc PRIVATE -flto)
  target_compile_options(s2nd PRIVATE -flto)

bin/Makefile

@@ -14,23 +14,28 @@
 #
 
 .PHONY : all
-all: s2nc s2nd
+all: s2nc s2nd policy
 include ../s2n.mk
 
 LDFLAGS += -L../lib/ -L${LIBCRYPTO_ROOT}/lib ../lib/libs2n.a ${CRYPTO_LIBS} ${LIBS}
-CRUFT += s2nc s2nd
+CRUFT += s2nc s2nd policy
 
 s2nc: s2nc.c echo.c
  ${CC} ${CFLAGS} s2nc.c echo.c common.c -o s2nc ${LDFLAGS}
 
 s2nd: s2nd.c echo.c
  ${CC} ${CFLAGS} s2nd.c echo.c https.c common.c -o s2nd ${LDFLAGS}
+
+policy: policy.c
+ ${CC} ${CFLAGS} policy.c -o policy ${LDFLAGS}
 
 $(bindir):
  @mkdir -p $(bindir)
 
-install: s2nc s2nd $(bindir)
+install: s2nc s2nd policy $(bindir)
  @cp s2n? $(bindir)
+ @cp policy $(bindir)
 
 uninstall:
  @rm -f $(bindir)/s2n?
+ @rm -f $(bindir)/policy

bin/policy.c

@@ -0,0 +1,113 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * You may not use this file except in compliance with the License.
+ * A copy of the License is located at
+ *
+ * http://aws.amazon.com/apache2.0
+ *
+ * or in the "license" file accompanying this file. This file is distributed
+ * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+
+#include <stdint.h>
+#include <stdlib.h>
+
+#include "api/s2n.h"
+#include "tls/s2n_security_policies.h"
+#include "tls/s2n_security_rules.h"
+
+#define BOOL_STR(b) ((b) ? "yes" : "no")
+
+const char *version_strs[] = {
+ [S2N_SSLv2] = "SSLv2",
+ [S2N_SSLv3] = "SSLv3",
+ [S2N_TLS10] = "TLS1.0",
+ [S2N_TLS11] = "TLS1.1",
+ [S2N_TLS12] = "TLS1.2",
+ [S2N_TLS13] = "TLS1.3",
+};
+
+static int usage()
+{
+ printf("policy <version>\n"
+ "example: policy default_tls13\n\n");
+ return 0;
+}
+
+int main(int argc, char *const *argv)
+{
+ if (argc != 2) {
+ usage();
+ exit(1);
+ }
+
+ const char *policy_name = argv[1];
+ const struct s2n_security_policy *policy = NULL;
+ if (s2n_find_security_policy_from_version(policy_name, &policy) != S2N_SUCCESS) {
+ usage();
+ exit(1);
+ }
+
+ printf("name: %s\n", policy_name);
+
+ const char *version_str = version_strs[policy->minimum_protocol_version];
+ printf("min version: %s\n", version_str ? version_str : "None");
+
+ printf("rules:\n");
+ printf("- forward secret: %s\n", BOOL_STR(policy->rules[S2N_PERFECT_FORWARD_SECRECY]));
+ printf("- supports fips: %s\n", BOOL_STR(policy->rules[S2N_FIPS_140_3]));
+
+ printf("cipher suites:\n");
+ if (policy->cipher_preferences->allow_chacha20_boosting) {
+ printf("- chacha20 boosting enabled");
+ }
+ for (size_t i = 0; i < policy->cipher_preferences->count; i++) {
+ printf("- %s\n", policy->cipher_preferences->suites[i]->iana_name);
+ }
+
+ printf("signature schemes:\n");
+ for (size_t i = 0; i < policy->signature_preferences->count; i++) {
+ printf("- %s\n", policy->signature_preferences->signature_schemes[i]->iana_name);
+ }
+
+ printf("curves:\n");
+ for (size_t i = 0; i < policy->ecc_preferences->count; i++) {
+ printf("- %s\n", policy->ecc_preferences->ecc_curves[i]->name);
+ }
+
+ if (policy->certificate_signature_preferences) {
+ if (policy->certificate_preferences_apply_locally) {
+ printf("certificate preferences apply locally\n");
+ }
+ printf("certificate signature schemes:\n");
+ for (size_t i = 0; i < policy->certificate_signature_preferences->count; i++) {
+ printf("- %s\n", policy->certificate_signature_preferences->signature_schemes[i]->iana_name);
+ }
+ }
+
+ if (policy->certificate_key_preferences) {
+ printf("certificate keys:\n");
+ for (size_t i = 0; i < policy->certificate_key_preferences->count; i++) {
+ printf("- %s\n", policy->certificate_key_preferences->certificate_keys[i]->name);
+ }
+ }
+
+ if (policy->kem_preferences && policy->kem_preferences != &kem_preferences_null) {
+ printf("pq:\n");
+ printf("- revision: %i\n", policy->kem_preferences->tls13_pq_hybrid_draft_revision);
+ printf("- kems:\n");
+ for (size_t i = 0; i < policy->kem_preferences->kem_count; i++) {
+ printf("-- %s\n", policy->kem_preferences->kems[i]->name);
+ }
+ printf("- kem groups:\n");
+ for (size_t i = 0; i < policy->kem_preferences->tls13_kem_group_count; i++) {
+ printf("-- %s\n", policy->kem_preferences->tls13_kem_groups[i]->name);
+ }
+ }
+
+ return 0;
+}

tls/s2n_certificate_keys.c

@@ -19,55 +19,66 @@
 
 const struct s2n_certificate_key s2n_rsa_rsae_1024 = {
  .public_key_libcrypto_nid = NID_rsaEncryption,
+ .name = "rsa_1024",
  .bits = 1024,
 };
 
 const struct s2n_certificate_key s2n_rsa_rsae_2048 = {
  .public_key_libcrypto_nid = NID_rsaEncryption,
+ .name = "rsa_2048",
  .bits = 2048,
 };
 
 const struct s2n_certificate_key s2n_rsa_rsae_3072 = {
  .public_key_libcrypto_nid = NID_rsaEncryption,
+ .name = "rsa_3072",
  .bits = 3072,
 };
 
 const struct s2n_certificate_key s2n_rsa_rsae_4096 = {
  .public_key_libcrypto_nid = NID_rsaEncryption,
+ .name = "rsa_4096",
  .bits = 4096,
 };
 
 const struct s2n_certificate_key s2n_rsa_pss_1024 = {
  .public_key_libcrypto_nid = NID_rsassaPss,
+ .name = "rsa_pss_1024",
  .bits = 1024,
 };
 
 const struct s2n_certificate_key s2n_rsa_pss_2048 = {
  .public_key_libcrypto_nid = NID_rsassaPss,
+ .name = "rsa_pss_2048",
  .bits = 2048,
 };
 
 const struct s2n_certificate_key s2n_rsa_pss_3072 = {
  .public_key_libcrypto_nid = NID_rsassaPss,
+ .name = "rsa_pss_3072",
  .bits = 3072,
 };
 
 const struct s2n_certificate_key s2n_rsa_pss_4096 = {
  .public_key_libcrypto_nid = NID_rsassaPss,
+ .name = "rsa_pss_4096",
  .bits = 4096,
 };
 
 const struct s2n_certificate_key s2n_ec_p256 = {
  .public_key_libcrypto_nid = NID_X9_62_prime256v1,
+ .name = "ecdsa_p256",
  .bits = 256,
 };
 
 const struct s2n_certificate_key s2n_ec_p384 = {
  .public_key_libcrypto_nid = NID_secp384r1,
+ .name = "ecdsa_p384",
  .bits = 384,
 };
 
 const struct s2n_certificate_key s2n_ec_p521 = {
  .public_key_libcrypto_nid = NID_secp521r1,
+ .name = "ecdsa_p521",
  .bits = 521,
 };

tls/s2n_certificate_keys.h

@@ -18,6 +18,7 @@
 #include <stdint.h>
 
 struct s2n_certificate_key {
+ const char *name;
  uint16_t public_key_libcrypto_nid;
 
  /* modulus for RSA key, size for EC key */