Plugins: net/haproxy: add support for TLS 1.3

[fraenki]

• [x] requires HAProxy 1.9+ (it added support for TLS 1.3 ciphers, #1089)
• [x] requires OpenSSL 1.1.1+ or LibreSSL with TLS 1.3 support (ETA OPNsense 20.7)
• [x] add TLS 1.3 GUI options for HAProxy plugin

[fabianfrz]

@fraenki In nginx I've enabled TLS 1.3 already but since the crypto library does not support it, it won't be usable. See libressl-portable/portable#228

[fabianfrz]

@fichtner My VPS is now running TLS 1.3 so it is probably not a big step to integrate it now.

This is how it currently looks on my Arch machine:

• extra/nginx 1.14.0-1
• core/openssl 1.1.1-1
• core/openssl-1.0 1.0.2.p-1 (was kept for legacy apps but was safe to remove from the server, on my host machine it is still required like you can see below in the packman output)

Benötigt von             : john  wpa_supplicant

My host has squid 4, nginx and lots of other stuff, the server has postfix, nginx etc.
So all major services used by OPNsense are also working with the up to date openssl version but I don't know if wpa_supplicant is also in OPNsense.

[fichtner]

we won't have this until we have 1.1.1 in openssl ports as the default. FreeBSD 12 is experimenting with last minute inclusion of 1.1.1 which doesn't go as well as it should. We'll just have to wait...

[fichtner]

PS: LibreSSL and TLS 1.3 is currently unlikely to land in the new 2.8 so that would mean 2.9 which is easily 6 months away.

[fabianfrz]

@fichtner shouldn't that be no issue because FreeBSD has its own openssl binary?

[fabianfrz]

btw. 1.1.1 is available as openssl-111

[fichtner]

1.1.1 breaks stuff, nobody really uses it (in a sane way in FreeBSD) yet

https://bugs.freebsd.org/bugzilla/showdependencytree.cgi?id=228865&hide_resolved=1
https://bugs.freebsd.org/bugzilla/showdependencytree.cgi?id=231931&hide_resolved=1

[fabianfrz]

The only two relevant are:

• 228898: net-mgmt/net-snmp: Fails to link with OpenSSL 1.1
• 226956: net/haproxy: Fix build with OpenSSL 1.1 & LibreSSL 2.7

Since HAProxy should be already fixed upstream at least (otherwise @fraenki would not have made the ticket), then there is only the SNMP server left which I cannot tell if it is already fixed.

[fichtner]

True, but I have no intention of potentially destabilising an area that currently works well. Build breaks often enough with supposedly working release software and there's 11.2 to tackle, too.

[fabianfrz]

@fichtner 19.7 roadmap then?

[fichtner]

Possibly, at least we have the leeway to do it while still being "stuck" on FreeBSD 11 through the port we're already using so FreeBSD 12 is not our blocker here. All in due time.

[irgendwr]

Any update on this? Support for TLS 1.3 would be really nice.

[mimugmail]

This needs Openssl 1.1.1 which requires FreeBSD 12.0 .. wont come before 20.1

[fichtner]

And it won‘t work with LibreSSL so far.

On 11. Aug 2019, at 21:14, Michael [e-mail] wrote:

This needs Openssl 1.1.1 which requires FreeBSD 12.0 .. wont come before 20.1

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.

[Taomyn]

Are we any closer to getting TLS 1.3 now? I believe it's possible for the admin GUI according to this thread on the forums: https://forum.opnsense.org/index.php?topic=15701.0

[fraenki]

On OPNsense 20.7 support for TLS 1.3 is available:

root@opnsense:~ # haproxy -vv|grep -i tls
OpenSSL library supports TLS extensions : yes
OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3

I'll add the required GUI options.

[fraenki]

This will be available in the upcoming os-haproxy 2.25. It seems to work as expected:

$ openssl s_client -connect opnsense-haproxy.example.com:8443 -tls1_3
...
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384

Tested on OpenSSL, not sure if this will work with LibreSSL.

[fichtner]

Note this is Client-only for LibreSSL...

On 6. Oct 2020, at 23:51, Frank Wall [e-mail] wrote:


This will be available in the upcoming os-haproxy 2.25. It seems to work as expected:

$ openssl s_client -connect opnsense.example.com:8443 -tls1_3
...
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.