TLS Terminator component

The TLS Terminator component supplied as part of KasperskyOS Community Edition ensures secure data transmission over the network between the client and the server using the Transport Layer Security (TLS) protocol.

The TLS Terminator component is built into the network interaction between the client and the network VFS backend. When a client uses network functions from the libc library, calls of these functions are redirected to the TLS Terminator component. The TLS Terminator component implements wrapper functions for standard calls of the network VFS backend. These wrappers ensure that TLS connections are established, outbound data is encrypted before it is sent to the network VFS backend, and inbound data is decrypted before being returned to the client. This implementation of the component ensures data protection during transmission over the network without the need to modify the client code.

How the TLS Terminator component works

Client
Calls functions from the libc library (see the table below for a complete list of supported functions) as if it were working directly with the network VFS backend.
TLS Terminator
Intercepts function calls from the client to the libc library and replaces them with wrapper functions implementing TLS. TLS connections are managed by using the Mbed TLS and OpenSSL libraries, which implement TLS protocols and cryptographic algorithms.

A subsystem of dynamic extensions (plug-ins) lets you extend the functionality of the TLS Terminator component without changing its source code by using dynamic libraries developed by the user.
Network VFS backend
Implements the network stack.
File VFS backend
Implements file systems.

API of the libc library supported by the TLS Terminator component

`accept()`	`send()`	`bind()*`	`getprotobyname()*`
`close()`	`sendto()`	`fcntl()*`	`getprotobynumber()*`
`connect()`	`sendvec()`	`freeaddrinfo()*`	`getsockname()*`
`getsockopt()`	`setsockopt()`	`freeifaddrs()*`	`ioctl()*`
`poll()`	`shutdown()`	`getaddrinfo()*`	`listen()*`
`read()`	`socket()`	`gethostbyname()*`	`pipe()*`
`readv()`	`write()`	`getifaddrs()*`	`socketpair()*`
`recv()`	`writev()`	`getnameinfo()*`	`subscribe()*`
`recvfrom()`		`getnetbyname()*`	`sysctl()*`
`recvvec()`		`getpeername()*`

Functions marked with * in the table have standard POSIX behavior. The behavior of the rest of the functions is modified by the TLS Terminator component as indicated in the table below.

Modification of the behavior of libc functions by the TLS Terminator component

libc function	POSIX behavior of the function	Behavior of the function when using TLS Terminator
`accept()`	Accepts a connection request from the pending connection queue and creates a new socket handle for interaction	Accepts a connection request from the pending connection queue. Performs a TLS handshake with the client. Creates a new socket handle for interaction over a TLS connection.
`close()`	Closes the socket	Terminates the TLS connection. Closes the socket.
`connect()`	Initiates a connection on the socket	Establishes a TCP connection with the server. Performs a TLS handshake with the server. Returns a secure socket handle.
`getsockopt()`	Gets socket options	Gets socket options. Supports parameters specific for TLS Terminator, which are presented in the table below.
`read(), readv(), recv(), recvfrom(), recvvec()`	Receives data from the server	Receives encrypted data from the server. Decrypts them via the TLS context. Returns the decrypted data to the client.
`send(), sendto(), sendvec()`	Sends data to the server	Encrypts client data via the TLS context. Sends encrypted data to the server over a TCP connection.
`setsockopt()`	Sets the parameters of a socket.	Sets the parameters of a socket. Supports parameters specific for TLS Terminator, which are presented in the table below.
`shutdown()`	Terminates data transfer over the socket	Terminates the TLS connection. Closes the TCP socket.
`socket()`	Creates a socket for network communication	Creates a socket. Prepares a TLS context for subsequent use.
`poll()`	Tracks the state of file handles.	Monitors the state of TLS sockets. Tracks the state of the TLS handshake and readiness for encryption/decryption.
`write(), writev()`	Sends data to the server	Encrypts outbound data using the TLS context. Sends encrypted data to the server.

The IPPROTO_TLS value, which is not available in POSIX, has been implemented for the level parameter for the getsockopt() and setsockopt() functions. This value is defined in the /opt/KasperskyOS-Community-Edition-<platform>-<version>/sysroot-*-kos/include/netinet/in.h file from KasperskyOS Community Edition. Syntax of functions:

int setsockopt(int socket, int level, int option_name, const void *option_value, socklen_t option_len);

int getsockopt(int socket, int level, int option_name, void *restrict option_value, socklen_t *restrict option_len);

The level parameter specifies the level at which the option_name socket parameter name is defined. If the level parameter is equal to IPPROTO_TLS when calling the getsockopt() and setsockopt() functions, the TLS Terminator component processes the option_name socket parameter names that are available for this level from the table below.

Socket parameter names and their corresponding function behavior

Socket parameter name	Behavior of the setsockopt() function	Behavior of the getsockopt() function
`TLS_REMOTE_HOSTNAME`	Sets the name of the server to which the TLS connection is being established. This name will be used in the Server Name Indication (SNI) extension when performing the TLS handshake.	Gets the name of the server to which the TLS connection is being established.
`TLS_OCSP_STAPLING_CHECK`	Enables an OCSP Stapling check (confirmation that the certificate is valid) for the specified client socket.	This parameter is not processed.
`TLS_SESSION_ID`	This parameter is not processed.	Gets the ID of the TLS session.
`TLS_VERIFY_RESULT`	This parameter is not processed.	Returns the server certificate validation result as a combination of error flags.

If the default functionality of the TLS Terminator component is insufficient, it can be extended by using a plug-in mechanism. For more details, refer to Extending TLS Terminator functionality.

Contents of the TLS Terminator component

The component consists of the following files:

Executable file /opt/KasperskyOS-Community-Edition-<platform>-<version>/sysroot-*-kos/bin/tls
Formal specification file /opt/KasperskyOS-Community-Edition-<platform>-<version>/sysroot-*-kos/include/kl/TlsEntity.edl and the header file generated from it
Solution security policy description file /opt/KasperskyOS-Community-Edition-<platform>-<version>/sysroot-*-kos/include/kl/TlsEntity.psl

Page top