diff --git a/CHANGELOG.md b/CHANGELOG.md index 0988b5f7..5932b360 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added - a command line parameter to change the log level threshold of the log file +- a parameter in a config file to specify the ciphers being used in the TLS protocol ### Changed @@ -24,6 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - potential NullPointerException in DescriptionModificationUptPrecondition - the test case for Glue:R0036_0 not accepting a SOAPFault as a valid answer for Subscribe messages - ReportWriter.write() could be called with ReportTypes it did not support. +- the SDCcc.TLS.EnabledProtocols parameter being ignored for the internal TLS configuration ## [8.0.1] - 2023-09-13 diff --git a/README.md b/README.md index 14ab4ad0..3c599866 100644 --- a/README.md +++ b/README.md @@ -63,6 +63,9 @@ Different combinations can be used to establish a connection: * participant_public, participant_private and ca_certificate * participant_public, participant_private and truststore +Optionally the TLS protocol versions to be enabled can be specified as well as the ciphers to be enabled for +the TLS protocol. An example can be found in configuration/config.toml, the values there are also the default values. + ### Network setup To select the network interface that should be used, the interface address can be set under ``` diff --git a/configuration/config.toml b/configuration/config.toml index 078ddaf0..b17f86b5 100644 --- a/configuration/config.toml +++ b/configuration/config.toml @@ -11,6 +11,18 @@ KeyStorePassword="whatever" TrustStorePassword="whatever" ParticipantPrivatePassword="dummypass" EnabledProtocols = ["TLSv1.2", "TLSv1.3"] +EnabledCiphers = [ + # TLS 1.2 + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", + "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", + "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", + # TLS 1.3 + "TLS_AES_128_GCM_SHA256", + "TLS_AES_256_GCM_SHA384", +] [SDCcc.Network] InterfaceAddress="127.0.0.1" diff --git a/sdccc/src/main/java/com/draeger/medical/sdccc/configuration/DefaultTestSuiteConfig.java b/sdccc/src/main/java/com/draeger/medical/sdccc/configuration/DefaultTestSuiteConfig.java index 7e0572d3..d3c4d01d 100644 --- a/sdccc/src/main/java/com/draeger/medical/sdccc/configuration/DefaultTestSuiteConfig.java +++ b/sdccc/src/main/java/com/draeger/medical/sdccc/configuration/DefaultTestSuiteConfig.java @@ -1,6 +1,6 @@ /* * This Source Code Form is subject to the terms of the MIT License. - * Copyright (c) 2023 Draegerwerk AG & Co. KGaA. + * Copyright (c) 2023, 2024 Draegerwerk AG & Co. KGaA. * * SPDX-License-Identifier: MIT */ @@ -47,6 +47,18 @@ void configureTLS() { bind(TestSuiteConfig.TRUST_STORE_PASSWORD, String.class, ""); bind(TestSuiteConfig.PARTICIPANT_PRIVATE_PASSWORD, String.class, ""); bind(TestSuiteConfig.TLS_ENABLED_PROTOCOLS, String[].class, new String[] {"TLSv1.2", "TLSv1.3"}); + bind(TestSuiteConfig.TLS_ENABLED_CIPHERS, String[].class, new String[] { + // TLS 1.2 + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", + "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", + "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", + // TLS 1.3 + "TLS_AES_128_GCM_SHA256", + "TLS_AES_256_GCM_SHA384", + }); } void configureNetwork() { diff --git a/sdccc/src/main/java/com/draeger/medical/sdccc/configuration/TestSuiteConfig.java b/sdccc/src/main/java/com/draeger/medical/sdccc/configuration/TestSuiteConfig.java index c36d42c4..3b9f6363 100644 --- a/sdccc/src/main/java/com/draeger/medical/sdccc/configuration/TestSuiteConfig.java +++ b/sdccc/src/main/java/com/draeger/medical/sdccc/configuration/TestSuiteConfig.java @@ -1,6 +1,6 @@ /* * This Source Code Form is subject to the terms of the MIT License. - * Copyright (c) 2023 Draegerwerk AG & Co. KGaA. + * Copyright (c) 2023, 2024 Draegerwerk AG & Co. KGaA. * * SPDX-License-Identifier: MIT */ @@ -35,6 +35,7 @@ public final class TestSuiteConfig { public static final String TRUST_STORE_PASSWORD = SDCCC + TLS + "TrustStorePassword"; public static final String PARTICIPANT_PRIVATE_PASSWORD = SDCCC + TLS + "ParticipantPrivatePassword"; public static final String TLS_ENABLED_PROTOCOLS = SDCCC + TLS + "EnabledProtocols"; + public static final String TLS_ENABLED_CIPHERS = SDCCC + TLS + "EnabledCiphers"; /* * Network configuration diff --git a/sdccc/src/main/java/com/draeger/medical/sdccc/sdcri/testclient/TestClientUtil.java b/sdccc/src/main/java/com/draeger/medical/sdccc/sdcri/testclient/TestClientUtil.java index ada24949..e6714766 100644 --- a/sdccc/src/main/java/com/draeger/medical/sdccc/sdcri/testclient/TestClientUtil.java +++ b/sdccc/src/main/java/com/draeger/medical/sdccc/sdcri/testclient/TestClientUtil.java @@ -59,6 +59,8 @@ public class TestClientUtil { * @param localAddressResolver resolver for getting the local address to use * @param multicastTTL TTL for multicast packets used in Discovery. * Values from 1 to 255 are valid. + * @param enabledTlsProtocols TLS protocol versions to be enabled + * @param enabledCiphers ciphers to be enabled */ @Inject public TestClientUtil( @@ -66,13 +68,17 @@ public TestClientUtil( final CommunicationLogMessageStorage communicationLogMessageStorage, final TestRunObserver testRunObserver, final LocalAddressResolver localAddressResolver, - @Named(TestSuiteConfig.NETWORK_MULTICAST_TTL) final Long multicastTTL) { + @Named(TestSuiteConfig.NETWORK_MULTICAST_TTL) final Long multicastTTL, + @Named(TestSuiteConfig.TLS_ENABLED_PROTOCOLS) final String[] enabledTlsProtocols, + @Named(TestSuiteConfig.TLS_ENABLED_CIPHERS) final String[] enabledCiphers) { injector = createClientInjector(List.of( new AbstractConfigurationModule() { @Override protected void defaultConfigure() { bind(CryptoConfig.CRYPTO_SETTINGS, CryptoSettings.class, cryptoSettings); + bind(CryptoConfig.CRYPTO_TLS_ENABLED_VERSIONS, String[].class, enabledTlsProtocols); + bind(CryptoConfig.CRYPTO_TLS_ENABLED_CIPHERS, String[].class, enabledCiphers); bind( CryptoConfig.CRYPTO_CLIENT_HOSTNAME_VERIFIER, HostnameVerifier.class, diff --git a/sdccc/src/main/java/com/draeger/medical/sdccc/sdcri/testprovider/TestProviderUtil.java b/sdccc/src/main/java/com/draeger/medical/sdccc/sdcri/testprovider/TestProviderUtil.java index b1591859..01a20f0c 100644 --- a/sdccc/src/main/java/com/draeger/medical/sdccc/sdcri/testprovider/TestProviderUtil.java +++ b/sdccc/src/main/java/com/draeger/medical/sdccc/sdcri/testprovider/TestProviderUtil.java @@ -1,12 +1,13 @@ /* * This Source Code Form is subject to the terms of the MIT License. - * Copyright (c) 2023 Draegerwerk AG & Co. KGaA. + * Copyright (c) 2023, 2024 Draegerwerk AG & Co. KGaA. * * SPDX-License-Identifier: MIT */ package com.draeger.medical.sdccc.sdcri.testprovider; +import com.draeger.medical.sdccc.configuration.TestSuiteConfig; import com.draeger.medical.sdccc.messages.MessageStorage; import com.draeger.medical.sdccc.sdcri.CommunicationLogMessageStorage; import com.google.inject.AbstractModule; @@ -15,6 +16,7 @@ import com.google.inject.Injector; import com.google.inject.assistedinject.FactoryModuleBuilder; import com.google.inject.util.Modules; +import javax.inject.Named; import javax.net.ssl.HostnameVerifier; import org.somda.sdc.biceps.guice.DefaultBicepsConfigModule; import org.somda.sdc.biceps.guice.DefaultBicepsModule; @@ -43,10 +45,15 @@ public class TestProviderUtil { * * @param cryptoSettings crypto setting * @param communicationLogMessageStorage connector to the {@linkplain MessageStorage} to write to + * @param enabledTlsProtocols TLS protocol versions to be enabled + * @param enabledCiphers ciphers to be enabled */ @Inject public TestProviderUtil( - final CryptoSettings cryptoSettings, final CommunicationLogMessageStorage communicationLogMessageStorage) { + final CryptoSettings cryptoSettings, + final CommunicationLogMessageStorage communicationLogMessageStorage, + @Named(TestSuiteConfig.TLS_ENABLED_PROTOCOLS) final String[] enabledTlsProtocols, + @Named(TestSuiteConfig.TLS_ENABLED_CIPHERS) final String[] enabledCiphers) { injector = Guice.createInjector(Modules.override( new DefaultCommonConfigModule(), new DefaultGlueModule(), @@ -60,6 +67,8 @@ public TestProviderUtil( protected void customConfigure() { super.customConfigure(); bind(CryptoConfig.CRYPTO_SETTINGS, CryptoSettings.class, cryptoSettings); + bind(CryptoConfig.CRYPTO_TLS_ENABLED_VERSIONS, String[].class, enabledTlsProtocols); + bind(CryptoConfig.CRYPTO_TLS_ENABLED_CIPHERS, String[].class, enabledCiphers); bind( CryptoConfig.CRYPTO_DEVICE_HOSTNAME_VERIFIER, HostnameVerifier.class,